Edit tour

Windows Analysis Report
https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK

Overview

General Information

Sample URL:	https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK
Analysis ID:	1428971
Infos:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish54

Phishing site detected (based on image similarity)

Phishing site detected (based on logo match)

Drops files with a non-matching file extension (content does not match file extension)

HTML body contains low number of good links

HTML title does not match URL

Phishing site detected (based on OCR NLP Model)

Stores files to the Windows start menu directory

Classification

Process Tree

System is w10x64_ra

chrome.exe (PID: 6996 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 1696 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1940,i,10852417767403210094,1487600739097658030,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Yara Signatures

HTML

Source	Rule	Description	Author
2.7.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
1.6.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.8.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Phishing

Phishing site detected (based on favicon image match)

Source: https://belovedkittenrescue.com	Matcher: Template: microsoft matched with high similarity
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish54

Source: Yara match	File source: 2.7.pages.csv, type: HTML
Source: Yara match	File source: 1.6.pages.csv, type: HTML
Source: Yara match	File source: 2.8.pages.csv, type: HTML

Phishing site detected (based on image similarity)

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true

Matcher: Found strong image similarity, brand: MICROSOFT

Phishing site detected (based on logo match)

Matcher: Template: microsoft matched

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: Number of links: 0
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: Number of links: 0

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: Title: Redirecting does not match URL
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: Title: Sign in to your account does not match URL

Source: Chrome DOM: 0.4

ML Model on OCR Text: Matched 98.0% probability on "contract.pdf Info 1/1 DOCUMENT IS PRIVATE C.I .1C.K TO UNI OCK Note: This Document was shared via Office365 and registered as private, Recipients "

HTTP Parser: <input type="password" .../> found

HTTP Parser: No favicon

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="author".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	HTTP Parser: No <meta name="copyright".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 184.31.62.93:443 -> 192.168.2.16:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 40.68.123.157:443 -> 192.168.2.16:50116 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 184.31.62.93
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.203
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 40.68.123.157
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 20.189.173.10

Source: global traffic	HTTP traffic detected: GET /:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveCache-Control: max-age=0Accept: /Service-Worker: scriptSec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /fs/windows/config.json HTTP/1.1Connection: Keep-AliveAccept: /Accept-Encoding: identityIf-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMTRange: bytes=0-2147483646User-Agent: Microsoft BITS/7.8Host: fs.microsoft.com
Source: global traffic	HTTP traffic detected: GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=P1xUBD9uvDNMGwa&MD=LEa4PNHp HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiJ5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.8Y66lcXGe2_cHFeRKyyRySxf12-D-9sDpuBarQzfz2I&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1Host: northeurope1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://estgirls-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiJ5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.8Y66lcXGe2_cHFeRKyyRySxf12-D-9sDpuBarQzfz2I&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1Host: northeurope1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=96a77dd9-6490-4fb8-b4ec-b19d1744dedb
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiJ5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.8Y66lcXGe2_cHFeRKyyRySxf12-D-9sDpuBarQzfz2I&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22 HTTP/1.1Host: northeurope1-mediap.svc.msConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Origin: https://estgirls-my.sharepoint.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://estgirls-my.sharepoint.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /transform/passthrough?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiJ5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.8Y66lcXGe2_cHFeRKyyRySxf12-D-9sDpuBarQzfz2I&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22 HTTP/1.1Host: northeurope1-mediap.svc.msConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_api/v2.0/drive/apps?select=*%2Cpromoted%2CbuiltIn&%24expand=actions HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Accept: application/jsonAccept-Language: en-USsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1Accept-Encoding: gzip, deflate, brCookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=96a77dd9-6490-4fb8-b4ec-b19d1744dedb; ai_session=MC7cg7sGb4niasRNhHeGqm\|1713563563245\|1713563563245; MSFPC=GUID=8fa88435355d419089b10819bd882493&HASH=8fa8&LV=202404&V=4&LU=1713563567776
Source: global traffic	HTTP traffic detected: GET /haqHYyzL HTTP/1.1Host: login.ms2.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SLS/%7BE7A50285-D08D-499D-9FF8-180FDC2332BC%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=P1xUBD9uvDNMGwa&MD=LEa4PNHp HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33Host: slscr.update.microsoft.com
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: www.belovedkittenrescue.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0 HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; fpc=Aofr1nfN_4pKrIPBJZ__7B0; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8pcFyjEcqiqkPAwiu684dfPaLbM6W0ioChIyo6dxKFPjNJrYhNDKJr5XQwhhy7AHKqYy7H6T4Cry0NsEBR86OQuk41EN3kEl1utzyhYsM9dfbr6Ma5LxA6Q7GWvx84NiYr5V2L6kpxnyNhksrWGH5AbWIhCEK-DgqyLbl8203kkkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=1C2B4ED456DD69360CBF5AB2574F68DB
Source: global traffic	HTTP traffic detected: GET /s/584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949.js HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; fpc=Aofr1nfN_4pKrIPBJZ__7B0; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8pcFyjEcqiqkPAwiu684dfPaLbM6W0ioChIyo6dxKFPjNJrYhNDKJr5XQwhhy7AHKqYy7H6T4Cry0NsEBR86OQuk41EN3kEl1utzyhYsM9dfbr6Ma5LxA6Q7GWvx84NiYr5V2L6kpxnyNhksrWGH5AbWIhCEK-DgqyLbl8203kkkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=1C2B4ED456DD69360CBF5AB2574F68DB; esctx-nHQZGErJRuA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8bkpp32JSNstUewKLqiHTea8LvlhnK7BvugVAnBVgC_PIFZHYKLf3CDV3nfYqEwfVoCcCTXREKVuiRn9tpjmVooRnGONZbzPxo3tSldJRB6sU0hkhAySxsd0SyGAibJcJd4nB0uJOrSNIf7uwVeHNVCAA
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.belovedkittenrescue.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; fpc=Aofr1nfN_4pKrIPBJZ__7B0; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8pcFyjEcqiqkPAwiu684dfPaLbM6W0ioChIyo6dxKFPjNJrYhNDKJr5XQwhhy7AHKqYy7H6T4Cry0NsEBR86OQuk41EN3kEl1utzyhYsM9dfbr6Ma5LxA6Q7GWvx84NiYr5V2L6kpxnyNhksrWGH5AbWIhCEK-DgqyLbl8203kkkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=1C2B4ED456DD69360CBF5AB2574F68DB; esctx-nHQZGErJRuA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8bkpp32JSNstUewKLqiHTea8LvlhnK7BvugVAnBVgC_PIFZHYKLf3CDV3nfYqEwfVoCcCTXREKVuiRn9tpjmVooRnGONZbzPxo3tSldJRB6sU0hkhAySxsd0SyGAibJcJd4nB0uJOrSNIf7uwVeHNVCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /s/584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949 HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; fpc=Aofr1nfN_4pKrIPBJZ__7B0; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8pcFyjEcqiqkPAwiu684dfPaLbM6W0ioChIyo6dxKFPjNJrYhNDKJr5XQwhhy7AHKqYy7H6T4Cry0NsEBR86OQuk41EN3kEl1utzyhYsM9dfbr6Ma5LxA6Q7GWvx84NiYr5V2L6kpxnyNhksrWGH5AbWIhCEK-DgqyLbl8203kkkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=1C2B4ED456DD69360CBF5AB2574F68DB; esctx-nHQZGErJRuA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8bkpp32JSNstUewKLqiHTea8LvlhnK7BvugVAnBVgC_PIFZHYKLf3CDV3nfYqEwfVoCcCTXREKVuiRn9tpjmVooRnGONZbzPxo3tSldJRB6sU0hkhAySxsd0SyGAibJcJd4nB0uJOrSNIf7uwVeHNVCAA
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; fpc=Aofr1nfN_4pKrIPBJZ__7B0; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8pcFyjEcqiqkPAwiu684dfPaLbM6W0ioChIyo6dxKFPjNJrYhNDKJr5XQwhhy7AHKqYy7H6T4Cry0NsEBR86OQuk41EN3kEl1utzyhYsM9dfbr6Ma5LxA6Q7GWvx84NiYr5V2L6kpxnyNhksrWGH5AbWIhCEK-DgqyLbl8203kkkgAA; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=1C2B4ED456DD69360CBF5AB2574F68DB; esctx-nHQZGErJRuA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8bkpp32JSNstUewKLqiHTea8LvlhnK7BvugVAnBVgC_PIFZHYKLf3CDV3nfYqEwfVoCcCTXREKVuiRn9tpjmVooRnGONZbzPxo3tSldJRB6sU0hkhAySxsd0SyGAibJcJd4nB0uJOrSNIf7uwVeHNVCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /s/584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949.js HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=1C2B4ED456DD69360CBF5AB2574F68DB; esctx-nHQZGErJRuA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8bkpp32JSNstUewKLqiHTea8LvlhnK7BvugVAnBVgC_PIFZHYKLf3CDV3nfYqEwfVoCcCTXREKVuiRn9tpjmVooRnGONZbzPxo3tSldJRB6sU0hkhAySxsd0SyGAibJcJd4nB0uJOrSNIf7uwVeHNVCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AS0AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8Kpntqq_4gmNBJ5pG8l-t5k3-ChVo3lmcJE9WYZ0VV53DfyXo8AyFvmujJCLNMXhLEmirPz1AAHSyLRhQ3JIPMxWqyjVi9EZhz3UPX7EPFYEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8mO3gLCwsSTEAmiclw0fpRPhViYEbIggp7UByWLZZQ4eQ_wnNambZOkV0qZKIkJd39hL04lsBlMAnIJdSNlj0PqSDX9K1YcYP30NjjQnA-hF6M05uvenMDawboGrOVO1EgZbm0WLYbGFnW8yfmk9Smg71Y70oVVHW3ZTqXg5WBOggAA; esctx-8bMw9lHib9U=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8SsJCvaRxQ0FDac5eQSN0btq7CH7dqGIjXDsEca1TCMd7w2olwYann2mLn2V8PG4HUS5ASftJWbAOQZHethxpz-065GpS1Euovc3dFldGspNYPRGzt6Dmt36UaHgkNZ014oUiDYLJrwlR1XGnXnWpGyAA; fpc=Aofr1nfN_4pKrIPBJZ__7B0
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_1ito3russhq-9gioj-zd4w2.css HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.belovedkittenrescue.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_jHSrlUosdD1xxbmcR_lMNA2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.belovedkittenrescue.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_l2bvdjfwt697xziuhxpwsg2.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://login.belovedkittenrescue.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; MUID=1C2B4ED456DD69360CBF5AB2574F68DB
Source: global traffic	HTTP traffic detected: GET /s/584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949 HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=1C2B4ED456DD69360CBF5AB2574F68DB; esctx-nHQZGErJRuA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8bkpp32JSNstUewKLqiHTea8LvlhnK7BvugVAnBVgC_PIFZHYKLf3CDV3nfYqEwfVoCcCTXREKVuiRn9tpjmVooRnGONZbzPxo3tSldJRB6sU0hkhAySxsd0SyGAibJcJd4nB0uJOrSNIf7uwVeHNVCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AS0AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8Kpntqq_4gmNBJ5pG8l-t5k3-ChVo3lmcJE9WYZ0VV53DfyXo8AyFvmujJCLNMXhLEmirPz1AAHSyLRhQ3JIPMxWqyjVi9EZhz3UPX7EPFYEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8mO3gLCwsSTEAmiclw0fpRPhViYEbIggp7UByWLZZQ4eQ_wnNambZOkV0qZKIkJd39hL04lsBlMAnIJdSNlj0PqSDX9K1YcYP30NjjQnA-hF6M05uvenMDawboGrOVO1EgZbm0WLYbGFnW8yfmk9Smg71Y70oVVHW3ZTqXg5WBOggAA; esctx-8bMw9lHib9U=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8SsJCvaRxQ0FDac5eQSN0btq7CH7dqGIjXDsEca1TCMd7w2olwYann2mLn2V8PG4HUS5ASftJWbAOQZHethxpz-065GpS1Euovc3dFldGspNYPRGzt6Dmt36UaHgkNZ014oUiDYLJrwlR1XGnXnWpGyAA; fpc=Aofr1nfN_4pKrIPBJZ__7B0
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_7f0a8c2a247460fad87f.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4d4b76a02ae121e3b20c.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: live.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; MUID=1C2B4ED456DD69360CBF5AB2574F68DB; uaid=01510e5e6eae4ce5939bb6d3230841f3; MSPRequ=id=N&lt=1713563587&co=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_eb638da25d4055fbbb57.js HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://login.belovedkittenrescue.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/s7958766_estg_moe_gov_sa/_layouts/15/AccessDenied.aspx?correlation=64a820a1%2D306e%2D8000%2D995c%2D9b6cc5c5e6ff HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; MicrosoftApplicationsTelemetryDeviceId=96a77dd9-6490-4fb8-b4ec-b19d1744dedb; ai_session=MC7cg7sGb4niasRNhHeGqm\|1713563563245\|1713563563245; MSFPC=GUID=8fa88435355d419089b10819bd882493&HASH=8fa8&LV=202404&V=4&LU=1713563567776
Source: global traffic	HTTP traffic detected: GET /s/584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949 HTTP/1.1Host: login.belovedkittenrescue.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Content-Type: application/jsonAccept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=trueAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: a405-c7b6=584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949; x-ms-gateway-slice=estsfd; stsservicecookie=estsfd; MUID=1C2B4ED456DD69360CBF5AB2574F68DB; esctx-nHQZGErJRuA=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8bkpp32JSNstUewKLqiHTea8LvlhnK7BvugVAnBVgC_PIFZHYKLf3CDV3nfYqEwfVoCcCTXREKVuiRn9tpjmVooRnGONZbzPxo3tSldJRB6sU0hkhAySxsd0SyGAibJcJd4nB0uJOrSNIf7uwVeHNVCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1; buid=0.AS0AMe_N-B6jSkuT5F9XHpElWltEZUfGMrBJg-Ydk3ZSdsoBAAA.AQABGgEAAADnfolhJpSnRYB1SVj-Hgd8Kpntqq_4gmNBJ5pG8l-t5k3-ChVo3lmcJE9WYZ0VV53DfyXo8AyFvmujJCLNMXhLEmirPz1AAHSyLRhQ3JIPMxWqyjVi9EZhz3UPX7EPFYEgAA; esctx=PAQABBwEAAADnfolhJpSnRYB1SVj-Hgd8mO3gLCwsSTEAmiclw0fpRPhViYEbIggp7UByWLZZQ4eQ_wnNambZOkV0qZKIkJd39hL04lsBlMAnIJdSNlj0PqSDX9K1YcYP30NjjQnA-hF6M05uvenMDawboGrOVO1EgZbm0WLYbGFnW8yfmk9Smg71Y70oVVHW3ZTqXg5WBOggAA; esctx-8bMw9lHib9U=AQABCQEAAADnfolhJpSnRYB1SVj-Hgd8SsJCvaRxQ0FDac5eQSN0btq7CH7dqGIjXDsEca1TCMd7w2olwYann2mLn2V8PG4HUS5ASftJWbAOQZHethxpz-065GpS1Euovc3dFldGspNYPRGzt6Dmt36UaHgkNZ014oUiDYLJrwlR1XGnXnWpGyAA; fpc=Aofr1nfN_4pKrIPBJZ__7B0; brcap=0

Source: unknown

DNS traffic detected: queries for: estgirls-my.sharepoint.com

Source: unknown

HTTP traffic detected: POST /personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql HTTP/1.1Host: estgirls-my.sharepoint.comConnection: keep-aliveContent-Length: 507sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"accept: application/json;odata=verboseContent-Type: application/json;odata=verboseX-ServiceWorker-Strategy: CacheFirstsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Origin: https://estgirls-my.sharepoint.comSec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=

Source: chromecache_694.1.dr, chromecache_884.1.dr	String found in binary or memory: http://scripts.sil.org/OFLThis
Source: chromecache_349.1.dr, chromecache_446.1.dr, chromecache_889.1.dr, chromecache_717.1.dr, chromecache_814.1.dr, chromecache_406.1.dr, chromecache_357.1.dr, chromecache_767.1.dr, chromecache_952.1.dr	String found in binary or memory: http://www.contoso.com
Source: chromecache_762.1.dr	String found in binary or memory: http://www.unicode.org/copyright.html
Source: chromecache_449.1.dr, chromecache_702.1.dr	String found in binary or memory: https://1drv.com/
Source: chromecache_733.1.dr, chromecache_978.1.dr, chromecache_483.1.dr, chromecache_745.1.dr	String found in binary or memory: https://200.hc.com/the-harpercollins-200/moby-dick/
Source: chromecache_449.1.dr, chromecache_702.1.dr	String found in binary or memory: https://centralus1-mediad.svc.ms
Source: chromecache_979.1.dr	String found in binary or memory: https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute
Source: chromecache_642.1.dr	String found in binary or memory: https://github.com/uuidjs/uuid#getrandomvalues-not-supported
Source: chromecache_449.1.dr, chromecache_702.1.dr	String found in binary or memory: https://livefilestore.com/
Source: chromecache_776.1.dr	String found in binary or memory: https://loki.delve.office.com
Source: chromecache_449.1.dr, chromecache_702.1.dr	String found in binary or memory: https://media.cloudapp.net
Source: chromecache_634.1.dr, chromecache_502.1.dr	String found in binary or memory: https://my.microsoftpersonalcontent.com
Source: chromecache_449.1.dr, chromecache_702.1.dr	String found in binary or memory: https://northcentralus1-medias.svc.ms
Source: chromecache_414.1.dr, chromecache_779.1.dr, chromecache_634.1.dr, chromecache_386.1.dr, chromecache_607.1.dr	String found in binary or memory: https://outlook.office.com/search
Source: chromecache_425.1.dr	String found in binary or memory: https://outlook.office365.com
Source: chromecache_425.1.dr	String found in binary or memory: https://outlook.office365.com/SchedulingB2/api/v1.0/me/findmeetinglocations
Source: chromecache_449.1.dr, chromecache_414.1.dr, chromecache_386.1.dr, chromecache_515.1.dr, chromecache_607.1.dr	String found in binary or memory: https://portal.office.com/
Source: chromecache_438.1.dr	String found in binary or memory: https://reactjs.org/link/react-polyfills
Source: chromecache_505.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-05.011/
Source: chromecache_505.1.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-05.011/pdfwebworkers/mspdf/index.worker.js
Source: chromecache_505.1.dr	String found in binary or memory: https://shell.cdn.office.net/api/ShellBootstrapper/business/OneShell
Source: chromecache_702.1.dr	String found in binary or memory: https://shellppe.msocdn.com
Source: chromecache_702.1.dr	String found in binary or memory: https://shellprod.msocdn.com
Source: chromecache_458.1.dr	String found in binary or memory: https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48
Source: chromecache_733.1.dr, chromecache_978.1.dr, chromecache_483.1.dr, chromecache_745.1.dr	String found in binary or memory: https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/
Source: chromecache_733.1.dr, chromecache_978.1.dr, chromecache_483.1.dr, chromecache_745.1.dr	String found in binary or memory: https://www.peachpit.com/store/dont-make-me-think-revisited-a-common-sense-approach-9780321965516
Source: chromecache_733.1.dr, chromecache_978.1.dr, chromecache_483.1.dr, chromecache_745.1.dr	String found in binary or memory: https://www.penguinrandomhouse.com/books/196330/great-tales-and-poems-of-edgar-allan-poe-by-edgar-al
Source: chromecache_978.1.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;007E
Source: chromecache_745.1.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;:tex
Source: chromecache_733.1.dr, chromecache_483.1.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~:text=The
Source: chromecache_733.1.dr, chromecache_978.1.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~007E;007E
Source: chromecache_483.1.dr, chromecache_745.1.dr	String found in binary or memory: https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~:text=The

Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 50334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50227
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50192
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50080 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 50197 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50227 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50119
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50118
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50147 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50197
Source: unknown	Network traffic detected: HTTP traffic on port 49918 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50080
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50119 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50192 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 50150 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50149 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50140
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50149
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50141
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50146
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50148
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50147
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50150
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50141 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50118 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49678 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50158
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49940 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50160
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50140 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49673 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 50160 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1940,i,10852417767403210094,1487600739097658030,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 --field-trial-handle=1940,i,10852417767403210094,1487600739097658030,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Google Drive.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: YouTube.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Sheets.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Gmail.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Slides.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe
Source: Docs.lnk.0.dr	LNK file: ..\..\..\..\..\..\..\..\..\Program Files\Google\Chrome\Application\chrome_proxy.exe

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 672
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 955	Jump to dropped file
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: Chrome Cache Entry: 672	Jump to dropped file

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk	Jump to behavior

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	1 Registry Run Keys / Startup Folder	1 Process Injection	11 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	1 Registry Run Keys / Startup Folder	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Source	Detection	Scanner	Label	Link
https://my.microsoftpersonalcontent.com	0%	URL Reputation	safe
http://www.contoso.com	0%	URL Reputation	safe

Name	IP	Active	Malicious	Reputation
www.belovedkittenrescue.com	82.180.132.218	true	false	unknown
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	unknown
login.belovedkittenrescue.com	82.180.132.218	true	false	unknown
cs1100.wpc.omegacdn.net	152.199.4.44	true	false	unknown
part-0008.t-0009.t-msedge.net	13.107.246.36	true	false	unknown
www.google.com	108.177.122.105	true	false	high
login.ms2.belovedkittenrescue.com	82.180.132.218	true	false	unknown
live.belovedkittenrescue.com	82.180.132.218	true	false	unknown
part-0042.t-0009.t-msedge.net	13.107.246.70	true	false	unknown
identity.nel.measure.office.net	unknown	unknown	false	high
northeurope1-mediap.svc.ms	unknown	unknown	false	unknown
aadcdn.msftauth.net	unknown	unknown	false	unknown
estgirls-my.sharepoint.com	unknown	unknown	false	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	high
spo.nel.measure.office.net	unknown	unknown	false	high

Name	Malicious	Reputation
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/CSPReporting.aspx	false	unknown
https://www.belovedkittenrescue.com/login	false	unknown
https://login.belovedkittenrescue.com/common/instrumentation/reportbssotelemetry?hpgid=6&hpgact=1800&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&hpgrequestid=fd61c416-393c-4498-869a-a1f49fa6fa00	false	unknown
https://estgirls-my.sharepoint.com/_layouts/15/spwebworkerproxy.ashx	false	unknown
https://estgirls-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=odbmspdfwebworker&debug=false&bypass=false	false	unknown
https://login.belovedkittenrescue.com/favicon.ico	false	unknown
https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK	false	unknown
https://estgirls-my.sharepoint.com/_layouts/15/images/odbfavicon.ico?rev=47	false	unknown
https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0	false	unknown
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1	false	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/BssoInterrupt_Core_ChpboAn7HyXj89A22M8mzg2.js	false	unknown
https://login.belovedkittenrescue.com/	false	unknown
https://estgirls-my.sharepoint.com/_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true	false	unknown
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_api/SP.OAuth.Token/Acquire()	false	unknown
https://login.belovedkittenrescue.com/s/584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949	false	unknown
https://login.belovedkittenrescue.com/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638491603836773377.YWYyN2ZmZTMtZmVkZC00MjkyLWE1MDUtMTAyMGM3ZmVkMTA5NTM0ZTVhNDEtNWVmNy00MWIwLWI4OGMtNGIxMTFhY2JmYjYw&ui_locales=en-US&mkt=en-US&client-request-id=600ecc9f-8cd6-4159-9546-3c8e804e0f30&state=gD_wYeOwKh_0M2IfdhDmNbsuzCciwOT89MBvGw2fAuLSi62L0WPMtOWaW54uSv219WlN2Vr8PeZQC-tVujsv53jwfLx2c7HjiAq-xzKdFFEN9jkogseCbwBBvyxMItpSkCr2Ktv8JTckAbOSFm3Bi3T9KNRXmVxT94fbxC9K2OQzho4BAtnJDCmBCSrVWxUPq9UHkav7236_fh3p7H3gPHcwdXq8J0eGYmPZsm-VvJOpvWj84Q9c4TdgB3Djdc4vzqAhU3uifCZAkpdA_Y0o4Q&x-client-SKU=ID_NET6_0&x-client-ver=7.3.1.0&sso_reload=true	true	unknown
https://login.belovedkittenrescue.com/s/584d307eccd81b2443ec9cedbff3f8eccebcf5e97ea6f429adf85db6c7fbf949.js	false	unknown
https://live.belovedkittenrescue.com/Me.htm?v=3	false	unknown
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/AccessDenied.aspx?correlation=64a820a1%2D306e%2D8000%2D995c%2D9b6cc5c5e6ff	false	unknown
https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql	false	unknown
https://login.ms2.belovedkittenrescue.com/haqHYyzL	false	unknown

Name	Source	Malicious	Antivirus Detection	Reputation
https://outlook.office365.com	chromecache_425.1.dr	false		high
https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~007E;007E	chromecache_733.1.dr, chromecache_978.1.dr	false		high
https://outlook.office.com/search	chromecache_414.1.dr, chromecache_779.1.dr, chromecache_634.1.dr, chromecache_386.1.dr, chromecache_607.1.dr	false		high
https://shellppe.msocdn.com	chromecache_702.1.dr	false		unknown
http://www.unicode.org/copyright.html	chromecache_762.1.dr	false		high
https://support.office.com/en-us/article/Manage-lists-and-libraries-with-many-items-b8588dae-9387-48	chromecache_458.1.dr	false		high
https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;:tex	chromecache_745.1.dr	false		high
https://www.littlebrown.com/titles/j-d-salinger/the-catcher-in-the-rye/9780316769488/	chromecache_733.1.dr, chromecache_978.1.dr, chromecache_483.1.dr, chromecache_745.1.dr	false		unknown
https://reactjs.org/link/react-polyfills	chromecache_438.1.dr	false		high
https://shellprod.msocdn.com	chromecache_702.1.dr	false		unknown
https://northcentralus1-medias.svc.ms	chromecache_449.1.dr, chromecache_702.1.dr	false		unknown
https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~:text=The	chromecache_733.1.dr, chromecache_483.1.dr	false		high
https://centralus1-mediad.svc.ms	chromecache_449.1.dr, chromecache_702.1.dr	false		unknown
https://200.hc.com/the-harpercollins-200/moby-dick/	chromecache_733.1.dr, chromecache_978.1.dr, chromecache_483.1.dr, chromecache_745.1.dr	false		unknown
https://facebook.github.io/react/docs/more-about-refs.html#the-ref-callback-attribute	chromecache_979.1.dr	false		unknown
https://my.microsoftpersonalcontent.com	chromecache_634.1.dr, chromecache_502.1.dr	false	URL Reputation: safe	unknown
https://portal.office.com/	chromecache_449.1.dr, chromecache_414.1.dr, chromecache_386.1.dr, chromecache_515.1.dr, chromecache_607.1.dr	false		high
https://www.penguinrandomhouse.com/books/196330/great-tales-and-poems-of-edgar-allan-poe-by-edgar-al	chromecache_733.1.dr, chromecache_978.1.dr, chromecache_483.1.dr, chromecache_745.1.dr	false		high
https://www.simonandschuster.com/books/The-Great-Gatsby/F-Scott-Fitzgerald/9781982146702#:~007E;007E	chromecache_978.1.dr	false		high
https://1drv.com/	chromecache_449.1.dr, chromecache_702.1.dr	false		high
https://www.simonandschuster.com/books/The-Sun-Also-Rises/Ernest-Hemingway/9781982199524#:~:text=The	chromecache_483.1.dr, chromecache_745.1.dr	false		high
https://livefilestore.com/	chromecache_449.1.dr, chromecache_702.1.dr	false		high
https://www.peachpit.com/store/dont-make-me-think-revisited-a-common-sense-approach-9780321965516	chromecache_733.1.dr, chromecache_978.1.dr, chromecache_483.1.dr, chromecache_745.1.dr	false		high
http://www.contoso.com	chromecache_349.1.dr, chromecache_446.1.dr, chromecache_889.1.dr, chromecache_717.1.dr, chromecache_814.1.dr, chromecache_406.1.dr, chromecache_357.1.dr, chromecache_767.1.dr, chromecache_952.1.dr	false	URL Reputation: safe	unknown
https://outlook.office365.com/SchedulingB2/api/v1.0/me/findmeetinglocations	chromecache_425.1.dr	false		high
http://scripts.sil.org/OFLThis	chromecache_694.1.dr, chromecache_884.1.dr	false		high
https://github.com/uuidjs/uuid#getrandomvalues-not-supported	chromecache_642.1.dr	false		high
https://loki.delve.office.com	chromecache_776.1.dr	false		high

IP	Domain	Country	ASN	ASN Name	Malicious
13.107.138.10	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
82.180.132.218	www.belovedkittenrescue.com	Denmark	29100	BROADCOMDK	false
13.107.246.36	part-0008.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
152.199.4.44	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
13.107.246.70	part-0042.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
108.177.122.105	www.google.com	United States	15169	GOOGLEUS	false

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1428971
Start date and time:	2024-04-19 23:51:40 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 49s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Sample URL:	https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@14/1268@32/10
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Apr 19 20:52:10 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
Category:	dropped
Size (bytes):	2673
Entropy (8bit):	3.991047847875779
Encrypted:	false
SSDEEP:	48:8POdITsMAHOidAKZdA1FehwiZUklqehBy+3:8PdP1uy
MD5:	F542D7AAC5425138F32EC52AB21B0603
SHA1:	B3B6E98D27F525106935B052673E401D4CD8B42D
SHA-256:	A14BE22DBEC4AEA56869A60702A86F778A93EC26812043EC0BD48AC47629CC32
SHA-512:	5E41FA040EA1CA130992FB4B8DF001472FAAF78BF83403DAC7EF09BF8DD9E21B8564C93BA92CA1F7D5EF99A6A2428FD4CB4C12579A48C7B8D2F168C310352045
Malicious:	false
Reputation:	low
Preview:	L..................F.@.. ...$+.,....Y'.....N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.X{.....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.X......L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.X......M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.X............................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.X.............................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i...........x.. .....C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 19, 2024 23:52:09.437089920 CEST	59167	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:09.437171936 CEST	62341	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:09.541393995 CEST	53	63825	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:09.602010012 CEST	53	60604	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:10.191102028 CEST	53	57264	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:11.675334930 CEST	63468	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:11.675626993 CEST	50627	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:13.762404919 CEST	54358	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:13.762521982 CEST	58387	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:14.247503996 CEST	54374	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:14.247669935 CEST	57525	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:14.351857901 CEST	53	54374	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:14.352041006 CEST	53	57525	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:27.118449926 CEST	53	60710	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:33.874394894 CEST	57816	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:33.874670029 CEST	63636	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:33.979985952 CEST	53	57816	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:34.007823944 CEST	53	63636	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:35.193033934 CEST	63902	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:35.193178892 CEST	63974	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:52:35.298340082 CEST	53	63902	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:35.298711061 CEST	53	63974	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:42.625864029 CEST	53	63560	1.1.1.1	192.168.2.16
Apr 19, 2024 23:52:46.054066896 CEST	53	60081	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:01.027261972 CEST	61784	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:01.027462959 CEST	55919	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:01.143241882 CEST	53	55919	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:01.159123898 CEST	53	61784	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:01.990093946 CEST	63539	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:01.990355968 CEST	64609	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:02.098817110 CEST	53	63539	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:02.098839045 CEST	53	64609	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:02.943571091 CEST	65035	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:02.943738937 CEST	61648	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:03.054719925 CEST	53	61648	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:03.057380915 CEST	53	65035	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:04.750896931 CEST	56922	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:04.751060963 CEST	57736	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:04.855971098 CEST	53	56922	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:04.856842041 CEST	53	57736	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:06.588965893 CEST	49661	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:06.589112043 CEST	62019	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:06.696706057 CEST	53	49661	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:06.697415113 CEST	53	62019	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:08.746567965 CEST	53	51518	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:09.543618917 CEST	53	61809	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:10.172045946 CEST	53	64301	1.1.1.1	192.168.2.16
Apr 19, 2024 23:53:13.771703959 CEST	56463	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:13.771862984 CEST	58870	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:13.772157907 CEST	62868	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:13.772277117 CEST	60172	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:13.772753000 CEST	52022	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:13.772880077 CEST	62343	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:13.773145914 CEST	59983	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:13.773268938 CEST	49580	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:14.221643925 CEST	54155	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:14.221785069 CEST	60961	53	192.168.2.16	1.1.1.1
Apr 19, 2024 23:53:18.015094995 CEST	138	138	192.168.2.16	192.168.2.255
Apr 19, 2024 23:53:38.216851950 CEST	53	60260	1.1.1.1	192.168.2.16

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Apr 19, 2024 23:52:09.647530079 CEST	1.1.1.1	192.168.2.16	0xa82d	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:09.647530079 CEST	1.1.1.1	192.168.2.16	0xa82d	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:09.647530079 CEST	1.1.1.1	192.168.2.16	0xa82d	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:09.647530079 CEST	1.1.1.1	192.168.2.16	0xa82d	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:09.681176901 CEST	1.1.1.1	192.168.2.16	0xaf58	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:09.681176901 CEST	1.1.1.1	192.168.2.16	0xaf58	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:09.681176901 CEST	1.1.1.1	192.168.2.16	0xaf58	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:09.681176901 CEST	1.1.1.1	192.168.2.16	0xaf58	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:09.681176901 CEST	1.1.1.1	192.168.2.16	0xaf58	No error (0)	188214-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:09.681176901 CEST	1.1.1.1	192.168.2.16	0xaf58	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:09.681176901 CEST	1.1.1.1	192.168.2.16	0xaf58	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:11.898740053 CEST	1.1.1.1	192.168.2.16	0x79ed	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.898740053 CEST	1.1.1.1	192.168.2.16	0x79ed	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.898740053 CEST	1.1.1.1	192.168.2.16	0x79ed	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.898740053 CEST	1.1.1.1	192.168.2.16	0x79ed	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.898740053 CEST	1.1.1.1	192.168.2.16	0x79ed	No error (0)	svc.ha-spo.office.com	svc.ms-acdc-spo.office.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.918754101 CEST	1.1.1.1	192.168.2.16	0xa0f6	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.918754101 CEST	1.1.1.1	192.168.2.16	0xa0f6	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.918754101 CEST	1.1.1.1	192.168.2.16	0xa0f6	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.918754101 CEST	1.1.1.1	192.168.2.16	0xa0f6	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.918754101 CEST	1.1.1.1	192.168.2.16	0xa0f6	No error (0)	188214-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:11.918754101 CEST	1.1.1.1	192.168.2.16	0xa0f6	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:11.918754101 CEST	1.1.1.1	192.168.2.16	0xa0f6	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:13.866718054 CEST	1.1.1.1	192.168.2.16	0xf4c0	No error (0)	m365cdn.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:13.867547989 CEST	1.1.1.1	192.168.2.16	0xaa7	No error (0)	m365cdn.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:14.351857901 CEST	1.1.1.1	192.168.2.16	0xbf6	No error (0)	www.google.com		108.177.122.105	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:14.351857901 CEST	1.1.1.1	192.168.2.16	0xbf6	No error (0)	www.google.com		108.177.122.106	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:14.351857901 CEST	1.1.1.1	192.168.2.16	0xbf6	No error (0)	www.google.com		108.177.122.103	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:14.351857901 CEST	1.1.1.1	192.168.2.16	0xbf6	No error (0)	www.google.com		108.177.122.104	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:14.351857901 CEST	1.1.1.1	192.168.2.16	0xbf6	No error (0)	www.google.com		108.177.122.147	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:14.351857901 CEST	1.1.1.1	192.168.2.16	0xbf6	No error (0)	www.google.com		108.177.122.99	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:14.352041006 CEST	1.1.1.1	192.168.2.16	0xd48c	No error (0)	www.google.com			65	IN (0x0001)	false
Apr 19, 2024 23:52:33.979985952 CEST	1.1.1.1	192.168.2.16	0xdf77	No error (0)	northeurope1-mediap.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:33.979985952 CEST	1.1.1.1	192.168.2.16	0xdf77	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:33.979985952 CEST	1.1.1.1	192.168.2.16	0xdf77	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:34.007823944 CEST	1.1.1.1	192.168.2.16	0x1c3d	No error (0)	northeurope1-mediap.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:35.298340082 CEST	1.1.1.1	192.168.2.16	0xba56	No error (0)	northeurope1-mediap.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:52:35.298340082 CEST	1.1.1.1	192.168.2.16	0xba56	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:35.298340082 CEST	1.1.1.1	192.168.2.16	0xba56	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:52:35.298711061 CEST	1.1.1.1	192.168.2.16	0x1dc5	No error (0)	northeurope1-mediap.svc.ms	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:01.159123898 CEST	1.1.1.1	192.168.2.16	0x8be8	No error (0)	login.ms2.belovedkittenrescue.com		82.180.132.218	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:02.098817110 CEST	1.1.1.1	192.168.2.16	0x2e58	No error (0)	login.belovedkittenrescue.com		82.180.132.218	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:03.057380915 CEST	1.1.1.1	192.168.2.16	0xa0a3	No error (0)	www.belovedkittenrescue.com		82.180.132.218	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:04.855971098 CEST	1.1.1.1	192.168.2.16	0x71eb	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:04.855971098 CEST	1.1.1.1	192.168.2.16	0x71eb	No error (0)	cs1100.wpc.omegacdn.net		152.199.4.44	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:04.856842041 CEST	1.1.1.1	192.168.2.16	0x41a8	No error (0)	aadcdn.msftauth.net	cs1100.wpc.omegacdn.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:06.553811073 CEST	1.1.1.1	192.168.2.16	0x230f	No error (0)	shed.dual-low.part-0042.t-0009.t-msedge.net	part-0042.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:06.553811073 CEST	1.1.1.1	192.168.2.16	0x230f	No error (0)	part-0042.t-0009.t-msedge.net		13.107.246.70	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:06.553811073 CEST	1.1.1.1	192.168.2.16	0x230f	No error (0)	part-0042.t-0009.t-msedge.net		13.107.213.70	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:06.696706057 CEST	1.1.1.1	192.168.2.16	0x13b	No error (0)	live.belovedkittenrescue.com		82.180.132.218	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:08.210515022 CEST	1.1.1.1	192.168.2.16	0x6ceb	No error (0)	shed.dual-low.part-0008.t-0009.t-msedge.net	part-0008.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:08.210515022 CEST	1.1.1.1	192.168.2.16	0x6ceb	No error (0)	part-0008.t-0009.t-msedge.net		13.107.246.36	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:08.210515022 CEST	1.1.1.1	192.168.2.16	0x6ceb	No error (0)	part-0008.t-0009.t-msedge.net		13.107.213.36	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:13.876255035 CEST	1.1.1.1	192.168.2.16	0x27c5	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:13.876573086 CEST	1.1.1.1	192.168.2.16	0xb8c4	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:13.877362013 CEST	1.1.1.1	192.168.2.16	0xc219	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:13.877374887 CEST	1.1.1.1	192.168.2.16	0xd4a6	No error (0)	identity.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:13.878824949 CEST	1.1.1.1	192.168.2.16	0x60d4	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:13.879295111 CEST	1.1.1.1	192.168.2.16	0x5aeb	No error (0)	spo.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.023643017 CEST	1.1.1.1	192.168.2.16	0x522c	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.023643017 CEST	1.1.1.1	192.168.2.16	0x522c	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.023643017 CEST	1.1.1.1	192.168.2.16	0x522c	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.023643017 CEST	1.1.1.1	192.168.2.16	0x522c	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.041168928 CEST	1.1.1.1	192.168.2.16	0x577f	No error (0)	estgirls-my.sharepoint.com	estgirls.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.041168928 CEST	1.1.1.1	192.168.2.16	0x577f	No error (0)	estgirls.sharepoint.com	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.041168928 CEST	1.1.1.1	192.168.2.16	0x577f	No error (0)	1241-ipv4v6e.clump.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.041168928 CEST	1.1.1.1	192.168.2.16	0x577f	No error (0)	188214-ipv4v6e.farm.dprodmgd104.aa-rt.sharepoint.com	188214-ipv4v6w.farm.dprodmgd104.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.041168928 CEST	1.1.1.1	192.168.2.16	0x577f	No error (0)	188214-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com.dual-spo-0005.spo-msedge.net	dual-spo-0005.spo-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.041168928 CEST	1.1.1.1	192.168.2.16	0x577f	No error (0)	dual-spo-0005.spo-msedge.net		13.107.136.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:14.041168928 CEST	1.1.1.1	192.168.2.16	0x577f	No error (0)	dual-spo-0005.spo-msedge.net		13.107.138.10	A (IP address)	IN (0x0001)	false
Apr 19, 2024 23:53:14.326658010 CEST	1.1.1.1	192.168.2.16	0x864e	No error (0)	m365cdn.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false
Apr 19, 2024 23:53:14.327862024 CEST	1.1.1.1	192.168.2.16	0x6938	No error (0)	m365cdn.nel.measure.office.net	nel.measure.office.net.edgesuite.net		CNAME (Canonical name)	IN (0x0001)	false

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:10 UTC	764	OUT	GET /:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 21:52:10 UTC	3314	IN	HTTP/1.1 302 Found Cache-Control: private Content-Length: 369 Content-Type: text/html; charset=utf-8 Location: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,274492,0,37385 X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 54a820a1-90ba-8000-9d5d-318863c8cd55 request-id: 54a820a1-90ba-8000-9d5d-318863c8cd55 MS-CV: oSCoVLqQAICdXTGIY8jNVQ.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5a&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 194 SPIisLatency: 6 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E3E0516EAA134D19AE93625E38EFB4C1 Ref B: ATL331000101009 Ref C: 2024-04-19T21:52:10Z Date: Fri, 19 Apr 2024 21:52:09 GMT Connection: close
2024-04-19 21:52:10 UTC	369	IN	Data Raw: 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0d 0a 3c 68 32 3e 4f 62 6a 65 63 74 20 6d 6f 76 65 64 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 65 73 74 67 69 72 6c 73 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 73 37 39 35 38 37 36 36 5f 65 73 74 67 5f 6d 6f 65 5f 67 6f 76 5f 73 61 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 6f 6e 65 64 72 69 76 65 2e 61 73 70 78 3f 69 64 3d 25 32 46 70 65 72 73 6f 6e 61 6c 25 32 46 73 37 39 35 38 37 36 36 25 35 46 65 73 74 67 25 35 46 6d 6f 65 25 35 46 67 6f 76 25 35 46 73 61 25 32 46 44 6f 63 75 6d 65 6e 74 73 25 32 46 63 6f 6e 74 72 61 63 74 25 32 45 70 64 Data Ascii: <html><head><title>Object moved</title></head><body><h2>Object moved to <a href="https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epd

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:11 UTC	1552	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
2024-04-19 21:52:11 UTC	3031	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,251497,0,44601 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 55a820a1-8011-8000-9d5d-3f611d7f7e57 request-id: 55a820a1-8011-8000-9d5d-3f611d7f7e57 MS-CV: oSCoVRGAAICdXT9hHX9+Vw.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: D84A218A4D8644B9B4E5316095037E02 Ref B: ATL331000107023 Ref C: 2024-04-19T21:52:11Z Date: Fri, 19 Apr 2024 21:52:10 GMT Connection: close
2024-04-19 21:52:11 UTC	706	IN	Data Raw: 32 62 62 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2bbself._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-04-19 21:52:11 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:12 UTC	1545	OUT	GET /_layouts/15/spwebworkerproxy.ashx HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
2024-04-19 21:52:12 UTC	3031	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Transfer-Encoding: chunked Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,382039,0,39757 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 55a820a1-2044-8000-995c-981efbd5c013 request-id: 55a820a1-2044-8000-995c-981efbd5c013 MS-CV: oSCoVUQgAICZXJge+9XAEw.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 3DFF5075F4244FF6B8BDCE6943270487 Ref B: ATL331000108027 Ref C: 2024-04-19T21:52:12Z Date: Fri, 19 Apr 2024 21:52:12 GMT Connection: close
2024-04-19 21:52:12 UTC	706	IN	Data Raw: 32 62 62 0d 0a 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 20 3d 20 7b 7d 3b 0a 73 65 6c 66 2e 5f 6d 61 72 6b 50 65 72 66 53 74 61 67 65 3d 66 75 6e 63 74 69 6f 6e 28 6b 65 79 29 20 7b 69 66 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 20 3d 3d 3d 20 27 66 75 6e 63 74 69 6f 6e 27 29 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 3b 7d 20 65 6c 73 65 7b 73 65 6c 66 2e 5f 70 65 72 66 4d 61 72 6b 73 5b 6b 65 79 5d 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 7d 20 69 66 20 28 73 65 6c 66 2e 70 65 72 66 6f 72 6d 61 6e 63 65 20 26 26 20 74 79 70 65 6f 66 20 73 65 6c 66 2e 70 65 72 66 6f Data Ascii: 2bbself._perfMarks = {};self._markPerfStage=function(key) {if(self.performance && typeof self.performance.now === 'function'){self._perfMarks[key]=self.performance.now();} else{self._perfMarks[key]=Date.now();} if (self.performance && typeof self.perfo
2024-04-19 21:52:12 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:12 UTC	2132	OUT	POST /personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive Content-Length: 507 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" accept: application/json;odata=verbose Content-Type: application/json;odata=verbose X-ServiceWorker-Strategy: CacheFirst sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Origin: https://estgirls-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
2024-04-19 21:52:12 UTC	507	OUT	Data Raw: 7b 22 71 75 65 72 79 22 3a 22 71 75 65 72 79 20 28 5c 6e 20 20 20 20 20 20 20 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 3a 20 53 74 72 69 6e 67 21 5c 6e 20 20 20 20 20 20 20 20 29 5c 6e 20 20 20 20 20 20 7b 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 6c 65 67 61 63 79 20 7b 5c 6e 20 20 20 20 20 20 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 28 5c 6e 20 20 20 20 20 20 71 75 65 72 79 53 74 72 69 6e 67 3a 20 24 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 51 75 65 72 79 53 74 72 69 6e 67 5c 6e 20 20 20 20 20 20 29 20 20 20 20 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 7d 5c 6e 20 20 20 20 20 20 5c 6e 20 20 20 20 20 20 5c 6e 20 20 70 65 72 66 20 7b 5c 6e 20 20 20 20 65 78 65 63 75 74 69 6f 6e 54 69 6d 65 5c 6e 20 Data Ascii: {"query":"query (\n $spoSuiteLinksQueryString: String!\n )\n {\n \n legacy {\n spoSuiteLinks(\n queryString: $spoSuiteLinksQueryString\n ) \n \n }\n \n \n perf {\n executionTime\n
2024-04-19 21:52:13 UTC	3005	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 24601 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,253,0,24208 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 55a820a1-2062-8000-9d5d-31ae74d6faae request-id: 55a820a1-2062-8000-9d5d-31ae74d6faae MS-CV: oSCoVWIgAICdXTGudNb6rg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5c&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 3237C3A88B004A78845088C3C0BCDB39 Ref B: ATL331000105011 Ref C: 2024-04-19T21:52:12Z Date: Fri, 19 Apr 2024 21:52:12 GMT Connection: close
2024-04-19 21:52:13 UTC	1165	IN	Data Raw: 7b 22 64 61 74 61 22 3a 7b 22 6c 65 67 61 63 79 22 3a 7b 22 73 70 6f 53 75 69 74 65 4c 69 6e 6b 73 22 3a 7b 0a 20 22 53 50 53 75 69 74 65 56 65 72 73 69 6f 6e 22 3a 32 2c 0a 20 22 53 50 49 73 4d 6f 62 69 6c 65 22 3a 66 61 6c 73 65 2c 0a 20 22 43 73 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 68 61 72 65 64 2e 33 38 34 61 61 63 65 35 66 39 38 61 38 36 32 32 66 34 32 31 63 66 35 39 39 33 35 37 62 36 38 64 2e 63 73 73 22 2c 0a 20 22 4a 73 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 62 6f 6f 74 73 74 72 Data Ascii: {"data":{"legacy":{"spoSuiteLinks":{ "SPSuiteVersion":2, "SPIsMobile":false, "CssUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.shared.384aace5f98a8622f421cf599357b68d.css", "JsUrl":"https://res-1.cdn.office.net/shellux/suiteux.shell.bootstr
2024-04-19 21:52:13 UTC	8192	IN	Data Raw: 73 74 49 6e 66 6c 75 78 43 6f 6e 74 72 6f 6c 5c 22 3a 35 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 54 65 6e 61 6e 74 54 6f 6b 65 6e 5c 22 3a 5c 22 63 36 63 31 39 30 61 31 62 37 33 63 34 61 36 33 62 62 61 38 39 38 33 35 64 35 34 36 63 66 32 38 2d 66 32 61 30 34 38 32 66 2d 61 30 30 64 2d 34 38 64 39 2d 38 32 32 65 2d 65 38 39 63 63 38 39 65 62 36 34 64 2d 37 36 38 38 5c 22 2c 5c 22 41 72 69 61 54 65 6c 65 6d 65 74 72 79 55 72 69 5c 22 3a 5c 22 5c 22 2c 5c 22 41 75 74 68 41 62 74 45 6e 61 62 6c 65 64 5c 22 3a 74 72 75 65 2c 5c 22 43 4c 53 49 44 5c 22 3a 5c 22 66 38 36 63 62 64 32 32 2d 64 65 36 39 2d 34 62 31 32 2d 61 39 63 34 2d 33 35 33 61 36 34 65 31 61 62 62 66 5c 22 2c 5c 22 43 50 4e 49 50 69 6e 45 6e 61 62 6c 65 64 5c 22 3a 74 72 75 65 2c 5c 22 Data Ascii: stInfluxControl\":5,\"AriaTelemetryTenantToken\":\"c6c190a1b73c4a63bba89835d546cf28-f2a0482f-a00d-48d9-822e-e89cc89eb64d-7688\",\"AriaTelemetryUri\":\"\",\"AuthAbtEnabled\":true,\"CLSID\":\"f86cbd22-de69-4b12-a9c4-353a64e1abbf\",\"CPNIPinEnabled\":true,\"
2024-04-19 21:52:13 UTC	4144	IN	Data Raw: 6c 2e 73 65 61 72 63 68 62 6f 78 2e 62 62 66 38 63 38 30 63 35 64 63 34 63 39 36 31 38 39 61 65 2e 6a 73 5c 22 2c 5c 22 73 65 61 72 63 68 75 78 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 65 61 72 63 68 75 78 2e 66 34 65 37 37 33 30 64 30 33 36 32 38 30 63 32 38 62 61 36 2e 6a 73 5c 22 2c 5c 22 73 68 65 6c 6c 72 65 61 63 74 63 6f 6e 74 72 6f 6c 5c 22 3a 5c 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 73 68 65 6c 6c 75 78 2f 73 75 69 74 65 75 78 2e 73 68 65 6c 6c 2e 73 68 65 6c 6c 72 65 61 63 74 63 6f 6e 74 72 6f 6c 2e 39 62 34 63 63 31 38 36 31 39 34 31 33 32 30 33 37 35 38 62 2e 6a 73 Data Ascii: l.searchbox.bbf8c80c5dc4c96189ae.js\",\"searchux\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.searchux.f4e7730d036280c28ba6.js\",\"shellreactcontrol\":\"https://res-1.cdn.office.net/shellux/suiteux.shell.shellreactcontrol.9b4cc18619413203758b.js
2024-04-19 21:52:13 UTC	8192	IN	Data Raw: 6c 74 75 72 65 4e 61 6d 65 22 3a 22 65 6e 2d 55 53 22 2c 22 43 75 72 72 65 6e 74 4d 61 69 6e 4c 69 6e 6b 45 6c 65 6d 65 6e 74 49 44 22 3a 22 53 68 65 6c 6c 53 68 61 72 65 70 6f 69 6e 74 22 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 48 65 6c 70 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 53 65 74 74 69 6e 67 73 4c 69 6e 6b 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 53 65 74 74 69 6e 67 73 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 43 75 72 72 65 6e 74 57 6f 72 6b 6c 6f 61 64 55 73 65 72 53 75 62 4c 69 6e 6b 73 22 3a 6e 75 6c 6c 2c 22 44 69 6d 65 6e 73 69 6f 6e 73 22 3a 7b 22 54 6f 70 22 3a 35 30 7d 2c 22 44 6f 77 6e 41 72 72 6f 77 49 6d 61 67 65 22 3a 6e 75 6c 6c 2c 22 Data Ascii: ltureName":"en-US","CurrentMainLinkElementID":"ShellSharepoint","CurrentWorkloadHelpSubLinks":null,"CurrentWorkloadSettingsLink":null,"CurrentWorkloadSettingsSubLinks":null,"CurrentWorkloadUserSubLinks":null,"Dimensions":{"Top":50},"DownArrowImage":null,"
2024-04-19 21:52:13 UTC	2908	IN	Data Raw: 70 58 56 57 4f 32 71 59 38 35 69 75 48 52 43 2f 34 79 4c 79 4f 70 61 58 52 69 73 78 50 69 30 37 46 4c 32 59 7a 5a 78 2f 6c 59 69 2b 53 6c 76 45 35 55 7a 34 64 42 4f 75 30 63 56 52 78 54 41 6a 78 4b 38 72 30 4c 75 65 42 72 6b 63 36 34 48 6b 79 68 36 33 56 44 37 5a 6d 67 44 6a 4d 4a 67 41 77 77 58 54 2b 4d 72 72 32 4f 37 72 2f 64 71 4f 73 32 4f 6d 51 70 4f 77 42 51 42 39 48 42 66 45 78 69 48 39 42 77 6f 79 77 63 7a 6c 6a 44 64 49 54 72 78 58 76 39 68 64 2b 72 4c 64 57 37 4f 63 6a 6a 58 73 57 69 75 43 33 69 6a 4c 7a 4a 79 6c 35 43 41 59 66 36 4e 67 6d 30 45 30 51 37 6d 70 48 30 59 6d 6e 47 75 6b 36 47 72 71 70 68 38 69 6a 75 34 47 6c 38 2f 6f 52 6a 39 4f 4c 6c 6b 59 46 53 52 33 2b 44 47 71 4f 55 72 76 43 68 55 4b 65 72 7a 2f 6c 2f 35 33 6f 6d 4f 4d 67 43 4b Data Ascii: pXVWO2qY85iuHRC/4yLyOpaXRisxPi07FL2YzZx/lYi+SlvE5Uz4dBOu0cVRxTAjxK8r0LueBrkc64Hkyh63VD7ZmgDjMJgAwwXT+Mrr2O7r/dqOs2OmQpOwBQB9HBfExiH9BwoywczljDdITrxXv9hd+rLdW7OcjjXsWiuC3ijLzJyl5CAYf6Ngm0E0Q7mpH0YmnGuk6Grqph8iju4Gl8/oRj9OLlkYFSR3+DGqOUrvChUKerz/l/53omOMgCK

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

HTML

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

Chrome Cache Entry: 347

Chrome Cache Entry: 348

Chrome Cache Entry: 349

Chrome Cache Entry: 350

Chrome Cache Entry: 351

Chrome Cache Entry: 352

Chrome Cache Entry: 353

Chrome Cache Entry: 354

Chrome Cache Entry: 355

Chrome Cache Entry: 356

Chrome Cache Entry: 357

Chrome Cache Entry: 358

Chrome Cache Entry: 359

Chrome Cache Entry: 360

Chrome Cache Entry: 361

Chrome Cache Entry: 362

Chrome Cache Entry: 363

Chrome Cache Entry: 364

Chrome Cache Entry: 365

Chrome Cache Entry: 366

Windows Analysis Report
https://estgirls-my.sharepoint.com/:b:/g/personal/s7958766_estg_moe_gov_sa/EeCN0MAR0F5NufUZkT2Q-mcBn4v13Ov8FQ0oi798Dgtayg?e=zTKNmK

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:13 UTC	1563	OUT	GET /personal/s7958766_estg_moe_gov_sa/_api/v2.1/graphql HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
2024-04-19 21:52:13 UTC	3005	IN	HTTP/1.1 200 OK Cache-Control: private Content-Length: 87 Content-Type: application/json P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,0,329167,0,69106 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 55a820a1-7097-8000-9d5d-36fd9b382e1c request-id: 55a820a1-7097-8000-9d5d-36fd9b382e1c MS-CV: oSCoVZdwAICdXTb9mzguHA.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=00000000-0000-0000-0000-000000000000&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 1CAF1AE14F1848189B815A744863FC3C Ref B: ATL331000107035 Ref C: 2024-04-19T21:52:13Z Date: Fri, 19 Apr 2024 21:52:13 GMT Connection: close
2024-04-19 21:52:13 UTC	87	IN	Data Raw: 7b 22 65 72 72 6f 72 73 22 3a 5b 7b 22 6d 65 73 73 61 67 65 22 3a 22 41 20 71 75 65 72 79 20 69 73 20 72 65 71 75 69 72 65 64 2e 22 2c 22 65 78 74 65 6e 73 69 6f 6e 73 22 3a 7b 22 63 6f 64 65 22 3a 22 45 58 45 43 55 54 49 4f 4e 5f 45 52 52 4f 52 22 7d 7d 5d 7d Data Ascii: {"errors":[{"message":"A query is required.","extensions":{"code":"EXECUTION_ERROR"}}]}

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:17 UTC	2660	OUT	POST /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive Content-Length: 821 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" ScenarioType: AUO sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 CollectSPPerfMetrics: SPSQLQueryCount Content-Type: application/json;odata=verbose accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0x6D8F060422BA255A134455DEFCD78271F71C0E85F8766B35AA80E7E77C03C670E6888653C21B314597A14C9DA1BE6C4C774376D1494606B200F7BE9EB7C48602,19 Apr 2024 21:52:10 -0000 sec-ch-ua-platform: "Windows" Origin: https://estgirls-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
2024-04-19 21:52:17 UTC	821	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 31 30 35 32 36 37 39 2c 22 56 69 65 77 58 6d 6c 22 3a 22 3c 56 69 65 77 20 3e 3c 51 75 65 72 79 3e 3c 2f 51 75 65 72 79 3e 3c 56 69 65 77 46 69 65 6c 64 73 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 44 6f 63 49 63 6f 6e 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4d 6f 64 69 66 69 65 64 5c 22 2f 3e 3c 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 45 64 69 74 6f 72 5c 22 2f 3e 3c 46 Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":1052679,"ViewXml":"<View ><Query></Query><ViewFields><FieldRef Name=\"DocIcon\"/><FieldRef Name=\"LinkFilename\"/><FieldRef Name=\"Modified\"/><FieldRef Name=\"Editor\"/><F
2024-04-19 21:52:18 UTC	3258	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Thu, 04 Apr 2024 21:52:17 GMT Last-Modified: Fri, 19 Apr 2024 21:52:17 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,2102272,0,856,505117,0,1185636 X-SharePointHealthScore: 0 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 50 SPRequestDuration: 51 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 56a820a1-b099-8000-9d5d-31176ec8fb4f request-id: 56a820a1-b099-8000-9d5d-31176ec8fb4f MS-CV: oSCoVpmwAICdXTEXbsj7Tw.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5d&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: E8A3588FF7804832842F2B05EAD9AE8B Ref B: ATL331000108025 Ref C: 2024-04-19T21:52:17Z Date: Fri, 19 Apr 2024 21:52:17 GMT Connection: close
2024-04-19 21:52:18 UTC	2058	IN	Data Raw: 38 30 33 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 35 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 31 30 30 33 30 30 38 30 33 31 30 30 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 30 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 43 30 44 30 38 44 45 30 2d 44 30 31 31 2d 34 44 35 45 2d 42 39 46 35 2d 31 39 39 31 33 44 39 30 46 41 36 37 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 31 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 70 Data Ascii: 803{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "15","PermMask": "0x1003008031001","FSObjType": "0","HTML_x0020_File_x0020_Type": "","UniqueId": "{C0D08DE0-D011-4D5E-B9F5-19913D90FA67}","ProgId": "","NoExecute": "1","ContentTyp
2024-04-19 21:52:18 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 72 73 65 72 76 65 72 73 69 6f 6e 3a 53 52 7c 31 36 2e 30 2e 30 2e 32 34 38 30 33 5c 72 5c 6e 76 74 69 5f 64 65 63 72 79 70 74 73 6b 69 70 72 65 61 73 6f 6e 3a 49 57 7c 31 32 5c 72 5c 6e 76 74 69 5f 70 72 65 76 69 65 77 69 6e 76 61 6c 69 64 74 69 6d 65 3a 54 58 7c 31 37 20 41 70 72 20 32 30 32 34 20 31 32 3a 34 31 3a 31 35 20 2d 30 30 30 30 5c 72 5c 6e 76 74 69 5f 61 75 74 68 6f 72 3a 53 52 7c 69 3a 30 23 2e 66 7c 6d 65 6d 62 65 72 73 68 69 70 7c 73 37 39 35 38 37 36 36 40 65 73 74 67 2e 6d 6f 65 2e 67 6f 76 2e 73 61 5c 72 5c 6e 76 74 69 5f 73 70 72 6f 63 73 73 63 68 65 6d 61 76 65 72 73 69 6f 6e 3a 53 52 7c 31 36 2e 30 2e 31 31 30 36 2e 30 5c 72 5c 6e 76 74 69 5f 64 62 73 63 68 65 6d 61 76 65 72 73 69 6f 6e 3a 53 52 7c 31 36 2e 30 2e 34 Data Ascii: 2000rserversion:SR\|16.0.0.24803\r\nvti_decryptskipreason:IW\|12\r\nvti_previewinvalidtime:TX\|17 Apr 2024 12:41:15 -0000\r\nvti_author:SR\|i:0#.f\|membership\|s7958766@estg.moe.gov.sa\r\nvti_sprocsschemaversion:SR\|16.0.1106.0\r\nvti_dbschemaversion:SR\|16.0.4
2024-04-19 21:52:18 UTC	3006	IN	Data Raw: 62 62 37 0d 0a 69 6c 65 22 2c 0a 22 52 65 71 75 69 72 65 64 22 3a 20 22 54 52 55 45 22 2c 0a 22 52 65 61 6c 46 69 65 6c 64 4e 61 6d 65 22 3a 20 22 46 69 6c 65 4c 65 61 66 52 65 66 22 2c 0a 22 44 69 73 70 6c 61 79 4e 61 6d 65 22 3a 20 22 4e 61 6d 65 22 2c 0a 22 49 44 22 3a 20 22 38 35 35 33 31 39 36 64 2d 65 63 38 64 2d 34 35 36 34 2d 39 38 36 31 2d 33 64 62 65 39 33 31 30 35 30 63 38 22 2c 0a 22 53 74 61 74 69 63 4e 61 6d 65 22 3a 20 22 46 69 6c 65 4c 65 61 66 52 65 66 22 2c 0a 22 72 6f 6c 65 22 3a 20 22 46 69 6c 65 22 2c 0a 22 61 72 69 61 4c 61 62 65 6c 22 3a 20 22 4e 61 6d 65 22 2c 0a 22 46 72 6f 6d 42 61 73 65 54 79 70 65 22 3a 20 22 54 52 55 45 22 2c 0a 22 54 79 70 65 22 3a 20 22 46 69 6c 65 22 2c 0a 22 41 6c 6c 6f 77 47 72 69 64 45 64 69 74 69 6e 67 Data Ascii: bb7ile","Required": "TRUE","RealFieldName": "FileLeafRef","DisplayName": "Name","ID": "8553196d-ec8d-4564-9861-3dbe931050c8","StaticName": "FileLeafRef","role": "File","ariaLabel": "Name","FromBaseType": "TRUE","Type": "File","AllowGridEditing
2024-04-19 21:52:18 UTC	6079	IN	Data Raw: 31 37 62 37 0d 0a 57 56 70 5a 43 49 36 49 6a 41 6a 4c 6d 5a 38 62 57 56 74 59 6d 56 79 63 32 68 70 63 48 78 31 63 6d 34 6c 4d 32 46 7a 63 47 38 6c 4d 32 46 68 62 6d 39 75 49 32 55 30 4d 7a 63 32 5a 57 4d 77 4d 6a 55 32 5a 44 55 78 4d 6d 55 79 4d 7a 63 7a 4d 6a 41 35 59 32 59 30 4d 7a 6b 35 4e 6a 6c 6b 59 54 52 6b 4f 54 51 7a 4e 6a 4d 30 5a 6d 55 35 4e 6d 4e 68 4e 54 55 32 5a 6d 59 78 59 54 64 68 4d 57 4d 78 4e 57 45 30 59 6d 55 69 4c 43 4a 75 59 6d 59 69 4f 69 49 78 4e 7a 45 7a 4e 54 59 77 4e 44 41 77 49 69 77 69 62 6d 6c 70 49 6a 6f 69 62 57 6c 6a 63 6d 39 7a 62 32 5a 30 4c 6e 4e 6f 59 58 4a 6c 63 47 39 70 62 6e 51 69 4c 43 4a 7a 61 47 46 79 61 57 35 6e 61 57 51 69 4f 69 4a 35 59 33 67 31 62 6b 52 6b 63 6a 68 56 63 56 4d 32 4e 55 68 42 55 6d 68 48 61 30 Data Ascii: 17b7WVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiJ5Y3g1bkRkcjhVcVM2NUhBUmhHa0
2024-04-19 21:52:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:17 UTC	2651	OUT	POST /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive Content-Length: 201 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" ScenarioType: AUO Accept-Language: en-US sec-ch-ua-mobile: ?0 Authorization: Bearer User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Content-Type: application/json;odata=verbose CollectSPPerfMetrics: SPSQLQueryCount accept: application/json;odata=verbose X-ClientService-ClientTag: ODB Web X-SP-REQUESTRESOURCES: listUrl=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments X-ServiceWorker-Strategy: CacheFirst x-requestdigest: 0x6D8F060422BA255A134455DEFCD78271F71C0E85F8766B35AA80E7E77C03C670E6888653C21B314597A14C9DA1BE6C4C774376D1494606B200F7BE9EB7C48602,19 Apr 2024 21:52:10 -0000 sec-ch-ua-platform: "Windows" Origin: https://estgirls-my.sharepoint.com Sec-Fetch-Site: same-origin Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
2024-04-19 21:52:17 UTC	201	OUT	Data Raw: 7b 22 70 61 72 61 6d 65 74 65 72 73 22 3a 7b 22 5f 5f 6d 65 74 61 64 61 74 61 22 3a 7b 22 74 79 70 65 22 3a 22 53 50 2e 52 65 6e 64 65 72 4c 69 73 74 44 61 74 61 50 61 72 61 6d 65 74 65 72 73 22 7d 2c 22 52 65 6e 64 65 72 4f 70 74 69 6f 6e 73 22 3a 35 34 34 35 33 38 33 2c 22 41 6c 6c 6f 77 4d 75 6c 74 69 70 6c 65 56 61 6c 75 65 46 69 6c 74 65 72 46 6f 72 54 61 78 6f 6e 6f 6d 79 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 41 64 64 52 65 71 75 69 72 65 64 46 69 65 6c 64 73 22 3a 74 72 75 65 2c 22 52 65 71 75 69 72 65 46 6f 6c 64 65 72 43 6f 6c 6f 72 69 6e 67 46 69 65 6c 64 73 22 3a 74 72 75 65 7d 7d Data Ascii: {"parameters":{"__metadata":{"type":"SP.RenderListDataParameters"},"RenderOptions":5445383,"AllowMultipleValueFilterForTaxonomyFields":true,"AddRequiredFields":true,"RequireFolderColoringFields":true}}
2024-04-19 21:52:18 UTC	3254	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/json; charset=utf-8 Expires: Thu, 04 Apr 2024 21:52:17 GMT Last-Modified: Fri, 19 Apr 2024 21:52:17 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,79,136285,0,67950 X-SharePointHealthScore: 1 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 53 SPRequestDuration: 54 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 56a820a1-00a0-8000-995c-9ab5d8c8ee4e request-id: 56a820a1-00a0-8000-995c-9ab5d8c8ee4e MS-CV: oSCoVqAAAICZXJq12MjuTg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5a&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 8BE8C55758F349AA8E7AF15CB1134D4E Ref B: ATL331000102039 Ref C: 2024-04-19T21:52:17Z Date: Fri, 19 Apr 2024 21:52:17 GMT Connection: close
2024-04-19 21:52:18 UTC	3012	IN	Data Raw: 62 62 64 0d 0a 7b 22 77 70 71 22 3a 22 22 2c 22 54 65 6d 70 6c 61 74 65 73 22 3a 7b 7d 2c 22 4c 69 73 74 44 61 74 61 22 3a 7b 20 22 52 6f 77 22 20 3a 20 0a 5b 7b 0d 0a 22 49 44 22 3a 20 22 31 35 22 2c 0d 0a 22 50 65 72 6d 4d 61 73 6b 22 3a 20 22 30 78 31 30 30 33 30 30 38 30 33 31 30 30 31 22 2c 0d 0a 22 46 53 4f 62 6a 54 79 70 65 22 3a 20 22 30 22 2c 0d 0a 22 48 54 4d 4c 5f 78 30 30 32 30 5f 46 69 6c 65 5f 78 30 30 32 30 5f 54 79 70 65 22 3a 20 22 22 2c 0d 0a 22 55 6e 69 71 75 65 49 64 22 3a 20 22 7b 43 30 44 30 38 44 45 30 2d 44 30 31 31 2d 34 44 35 45 2d 42 39 46 35 2d 31 39 39 31 33 44 39 30 46 41 36 37 7d 22 2c 0d 0a 22 50 72 6f 67 49 64 22 3a 20 22 22 2c 0d 0a 22 4e 6f 45 78 65 63 75 74 65 22 3a 20 22 31 22 2c 0d 0a 22 43 6f 6e 74 65 6e 74 54 79 70 Data Ascii: bbd{"wpq":"","Templates":{},"ListData":{ "Row" : [{"ID": "15","PermMask": "0x1003008031001","FSObjType": "0","HTML_x0020_File_x0020_Type": "","UniqueId": "{C0D08DE0-D011-4D5E-B9F5-19913D90FA67}","ProgId": "","NoExecute": "1","ContentTyp
2024-04-19 21:52:18 UTC	8200	IN	Data Raw: 32 30 30 30 0d 0a 74 69 6f 6e 44 61 74 65 2e 22 3a 20 22 22 2c 0d 0a 22 5f 61 63 74 69 76 69 74 79 22 3a 20 22 7b 5c 22 46 69 6c 65 41 63 74 69 76 69 74 79 54 79 70 65 5c 22 3a 5c 22 39 5c 22 2c 5c 22 46 69 6c 65 41 63 74 69 76 69 74 79 54 69 6d 65 53 74 61 6d 70 5c 22 3a 5c 22 32 30 32 34 2d 30 34 2d 31 37 54 31 32 3a 34 31 3a 33 36 2e 39 38 30 5a 5c 22 2c 5c 22 46 69 6c 65 41 63 74 69 76 69 74 79 55 73 65 72 73 4f 6e 50 61 67 65 5c 22 3a 5b 7b 5c 22 44 69 73 70 6c 61 79 4e 61 6d 65 5c 22 3a 5c 22 5c 75 30 36 34 33 5c 75 30 36 32 37 5c 75 30 36 32 66 5c 75 30 36 34 61 20 5c 75 30 36 32 37 5c 75 30 36 34 34 5c 75 30 36 33 39 5c 75 30 36 34 36 5c 75 30 36 33 32 5c 75 30 36 34 61 5c 22 2c 5c 22 49 64 5c 22 3a 5c 22 73 37 39 35 38 37 36 36 40 65 73 74 67 2e Data Ascii: 2000tionDate.": "","_activity": "{\"FileActivityType\":\"9\",\"FileActivityTimeStamp\":\"2024-04-17T12:41:36.980Z\",\"FileActivityUsersOnPage\":[{\"DisplayName\":\"\u0643\u0627\u062f\u064a \u0627\u0644\u0639\u0646\u0632\u064a\",\"Id\":\"s7958766@estg.
2024-04-19 21:52:18 UTC	2056	IN	Data Raw: 38 30 31 0d 0a 6f 6b 65 6e 7d 22 0d 0a 2c 22 52 65 61 64 53 65 63 75 72 69 74 79 22 20 3a 20 22 31 22 2c 22 48 61 73 46 6f 6c 64 65 72 43 6f 6c 6f 72 69 6e 67 46 69 65 64 73 22 20 3a 20 22 54 72 75 65 22 7d 2c 20 22 41 76 61 69 6c 61 62 6c 65 43 6f 6e 74 65 6e 74 54 79 70 65 73 22 3a 20 5b 7b 22 74 65 6d 70 6c 61 74 65 55 72 6c 22 3a 22 68 74 74 70 73 3a 2f 2f 65 73 74 67 69 72 6c 73 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 70 65 72 73 6f 6e 61 6c 2f 73 37 39 35 38 37 36 36 5f 65 73 74 67 5f 6d 6f 65 5f 67 6f 76 5f 73 61 2f 5f 6c 61 79 6f 75 74 73 2f 31 35 2f 43 72 65 61 74 65 4e 65 77 44 6f 63 75 6d 65 6e 74 2e 61 73 70 78 3f 69 64 3d 68 74 74 70 73 3a 2f 2f 65 73 74 67 69 72 6c 73 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f Data Ascii: 801oken}","ReadSecurity" : "1","HasFolderColoringFieds" : "True"}, "AvailableContentTypes": [{"templateUrl":"https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/CreateNewDocument.aspx?id=https://estgirls-my.sharepoint.com/
2024-04-19 21:52:18 UTC	3364	IN	Data Raw: 64 31 64 0d 0a 30 33 63 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4c 69 6e 6b 46 69 6c 65 6e 61 6d 65 5c 22 20 2f 5c 75 30 30 33 65 5c 75 30 30 33 63 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 4d 6f 64 69 66 69 65 64 5c 22 20 2f 5c 75 30 30 33 65 5c 75 30 30 33 63 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 53 68 61 72 65 64 57 69 74 68 5c 22 20 2f 5c 75 30 30 33 65 5c 75 30 30 33 63 46 69 65 6c 64 52 65 66 20 4e 61 6d 65 3d 5c 22 45 64 69 74 6f 72 5c 22 20 2f 5c 75 30 30 33 65 5c 75 30 30 33 63 2f 56 69 65 77 46 69 65 6c 64 73 5c 75 30 30 33 65 5c 75 30 30 33 63 52 6f 77 4c 69 6d 69 74 20 50 61 67 65 64 3d 5c 22 54 52 55 45 5c 22 5c 75 30 30 33 65 33 30 5c 75 30 30 33 63 2f 52 6f 77 4c 69 6d 69 74 5c 75 30 30 33 65 5c 75 30 30 33 63 4a 53 Data Ascii: d1d03cFieldRef Name=\"LinkFilename\" /\u003e\u003cFieldRef Name=\"Modified\" /\u003e\u003cFieldRef Name=\"SharedWith\" /\u003e\u003cFieldRef Name=\"Editor\" /\u003e\u003c/ViewFields\u003e\u003cRowLimit Paged=\"TRUE\"\u003e30\u003c/RowLimit\u003e\u003cJS
2024-04-19 21:52:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:17 UTC	2008	OUT	GET /_layouts/15/images/odbfavicon.ico?rev=47 HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
2024-04-19 21:52:18 UTC	1886	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Length: 7886 Content-Type: image/x-icon Last-Modified: Sat, 13 Apr 2024 02:47:19 GMT Accept-Ranges: bytes ETag: "80d5cbe64c8dda1:0" P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly SPRequestDuration: 8 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 906DE8A0FA2F4258A08D36223884512A Ref B: ATL331000104021 Ref C: 2024-04-19T21:52:17Z Date: Fri, 19 Apr 2024 21:52:17 GMT Connection: close
2024-04-19 21:52:18 UTC	2262	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @
2024-04-19 21:52:18 UTC	5624	IN	Data Raw: df 90 14 cf 00 00 00 00 d4 78 00 60 d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff cf 74 01 ff bf 69 02 ff bf 6c 06 ff d0 80 0e ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 cf df 90 14 10 00 00 00 00 00 00 00 00 d4 78 00 cf d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d4 78 00 ff d2 77 00 ff c4 6d 02 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff b8 64 03 ff ba 67 04 ff c9 77 0a ff da 8b 12 ff df 90 14 ff df 90 14 ff df 90 14 ff df 90 14 df df 90 14 80 00 00 00 Data Ascii: x`xxxxxxxxxxxxxxxxtilxxxxxxxxxxxxxxwmddddgw

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:18 UTC	1707	OUT	GET /personal/s7958766_estg_moe_gov_sa/_api/web/GetListUsingPath(DecodedUrl=@a1)/RenderListDataAsStream?@a1=%27%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%27&TryNewExperienceSingle=TRUE HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
2024-04-19 21:52:18 UTC	3268	IN	HTTP/1.1 405 Method Not Allowed Cache-Control: private, max-age=0 Transfer-Encoding: chunked Content-Type: application/xml;charset=utf-8 Expires: Thu, 04 Apr 2024 21:52:18 GMT Last-Modified: Fri, 19 Apr 2024 21:52:18 GMT Vary: Origin P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly X-NetworkStatistics: 0,525568,0,79,148459,0,52864 X-SharePointHealthScore: 2 X-SP-SERVERSTATE: ReadOnly=0 DATASERVICEVERSION: 3.0 SPClientServiceRequestDuration: 19 SPRequestDuration: 20 X-AspNet-Version: 4.0.30319 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 56a820a1-e0c3-8000-9d5d-3d56fc5e0eca request-id: 56a820a1-e0c3-8000-9d5d-3d56fc5e0eca MS-CV: oSCoVsPgAICdXT1W/F4Oyg.0 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=b6875bbb-f371-480d-aba1-2972ce042c2b&destinationEndpoint=Edge-Prod-ATL33r5c&frontEnd=AFD&RemoteIP=81.181.57.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com .office365.com .powerapps.com .yammer.com engage.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 29D3E8FBDD274E36B55F1FBB98EFE45F Ref B: ATL331000106019 Ref C: 2024-04-19T21:52:18Z Date: Fri, 19 Apr 2024 21:52:18 GMT Connection: close
2024-04-19 21:52:18 UTC	450	IN	Data Raw: 31 62 62 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 75 74 66 2d 38 22 3f 3e 3c 6d 3a 65 72 72 6f 72 20 78 6d 6c 6e 73 3a 6d 3d 22 68 74 74 70 3a 2f 2f 73 63 68 65 6d 61 73 2e 6d 69 63 72 6f 73 6f 66 74 2e 63 6f 6d 2f 61 64 6f 2f 32 30 30 37 2f 30 38 2f 64 61 74 61 73 65 72 76 69 63 65 73 2f 6d 65 74 61 64 61 74 61 22 3e 3c 6d 3a 63 6f 64 65 3e 2d 31 2c 20 4d 69 63 72 6f 73 6f 66 74 2e 53 68 61 72 65 50 6f 69 6e 74 2e 43 6c 69 65 6e 74 2e 43 6c 69 65 6e 74 53 65 72 76 69 63 65 45 78 63 65 70 74 69 6f 6e 3c 2f 6d 3a 63 6f 64 65 3e 3c 6d 3a 6d 65 73 73 61 67 65 20 78 6d 6c 3a 6c 61 6e 67 3d 22 65 6e 2d 55 53 22 3e 54 68 65 20 48 54 54 50 20 6d 65 74 68 6f 64 20 27 47 45 54 27 20 63 61 6e 6e 6f 74 20 62 65 Data Ascii: 1bb<?xml version="1.0" encoding="utf-8"?><m:error xmlns:m="http://schemas.microsoft.com/ado/2007/08/dataservices/metadata"><m:code>-1, Microsoft.SharePoint.Client.ClientServiceException</m:code><m:message xml:lang="en-US">The HTTP method 'GET' cannot be
2024-04-19 21:52:18 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:19 UTC	2531	OUT	GET /_layouts/15/odspserviceworkerproxy.aspx?swManifestName=spserviceworker&debug=false&bypass=false&applications=%5B%7B%22id%22%3A%22STS%22%2C%22swPrefetchManifestName%22%3A%22stsserviceworkerprefetch%22%7D%2C%7B%22id%22%3A%22SPHome%22%7D%2C%7B%22id%22%3A%22SitePages%22%7D%2C%7B%22id%22%3A%22Embed%22%7D%2C%7B%22id%22%3A%22CreateGroup%22%7D%2C%7B%22id%22%3A%22SingleWebPart%22%7D%2C%7B%22id%22%3A%22VivaHome%22%7D%2C%7B%22id%22%3A%22BrokerLogon%22%7D%2C%7B%22id%22%3A%22Clipchamp%22%7D%2C%7B%22id%22%3A%22MeeBridge%22%7D%5D&defaultBrotli=true&authenticateFast=true&wwData=true&prefetchFilebrowserPageInTeams=true&FUIV9Flights=[-83099649,3]&spStartApplicationWebBundle=true&enableIntegrities=true HTTP/1.1 Host: estgirls-my.sharepoint.com Connection: keep-alive Cache-Control: max-age=0 Accept: / Service-Worker: script Sec-Fetch-Site: same-origin Sec-Fetch-Mode: same-origin Sec-Fetch-Dest: serviceworker Referer: https://estgirls-my.sharepoint.com/personal/s7958766_estg_moe_gov_sa/_layouts/15/onedrive.aspx?id=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments%2Fcontract%2Epdf&parent=%2Fpersonal%2Fs7958766%5Festg%5Fmoe%5Fgov%5Fsa%2FDocuments&ga=1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=
2024-04-19 21:52:20 UTC	1905	IN	HTTP/1.1 200 OK Cache-Control: max-age=600 Content-Length: 897 Content-Type: text/javascript; charset=utf-8 P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Set-Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jZTQzNzZlYzAyNTZkNTEyZTIzNzMyMDljZjQzOTk2OWRhNGQ5NDM2MzRmZTk2Y2E1NTZmZjFhN2ExYzE1YTRiZSwxMzM1ODAzNzQzMDAwMDAwMDAsMCwxMzM1ODEyMzUzMDMyNTM3MDYsMC4wLjAuMCwyNTgsYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiLCwsNTRhODIwYTEtOTBiYS04MDAwLTlkNWQtMzE4ODYzYzhjZDU1LDU0YTgyMGExLTkwYmEtODAwMC05ZDVkLTMxODg2M2M4Y2Q1NSx5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxODgyMTQsRGFEQWZqUVFtcHlPWHgyUnJLX1c1bHZvTFo0LGhNRTI1VDIwbktQODAxRFhzZTk4U3l2eUdtRmRLUWphc3dEQlBWUXVPQUxwMERGSzM5aSsyaFozaVJJUE1FcWFyWEdFVkJIWjI2YkpvV0llTStsbUxnWHlKakc4UWdOckhpNjB6WlcvU1RjQ2l2eW15ek5ZYm1QRUpObXZveUhxbVozUXR0dm5NeFR5aENrTkVBTHh6ek43RUpOQTBNVmZHRjljYk43QTVpc3VxeGFYWGpRSlZzTjNub0ZEd1d6aytza1BPT2NLT2hPSkhHUU5adGpTdU1GTWJoV2t3N2xUY29TNGZTNzQ3NFNhenNEWjdLVDl2UnM5NWl0NG1ucy9wMHM5M053STIwNmtyUWRtcFRYdjJqLzN0c3MyWlladDF6cXZsRk1HZHZnVkpZUy81UWFJOGZ4OEQyUUQ1cHdBUENIS0dlcXowcmxFaUhodlY4MDVSUT09PC9TUD4=; path=/; SameSite=None; secure; HttpOnly Service-Worker-Allowed: / Strict-Transport-Security: max-age=31536000 X-AspNet-Version: 4.0.30319 SPRequestDuration: 19 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.24803 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: EBDE79DBFD3546A1973C7C93F151A7F3 Ref B: ATL331000105039 Ref C: 2024-04-19T21:52:19Z Date: Fri, 19 Apr 2024 21:52:19 GMT Connection: close
2024-04-19 21:52:20 UTC	815	IN	Data Raw: 0d 0a 76 61 72 20 5f 73 74 61 72 74 54 69 6d 65 3d 70 65 72 66 6f 72 6d 61 6e 63 65 2e 6e 6f 77 28 29 2c 5f 73 74 61 72 74 54 69 6d 65 54 69 63 6b 73 3d 44 61 74 65 2e 6e 6f 77 28 29 3b 0a 76 61 72 20 5f 73 68 6f 75 6c 64 42 79 70 61 73 73 3d 66 61 6c 73 65 3b 0a 76 61 72 20 5f 63 64 6e 42 61 73 65 55 72 6c 3d 27 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 34 2d 30 34 2d 31 32 2e 30 30 33 2f 27 3b 0a 76 61 72 20 5f 73 77 42 75 69 6c 64 4e 75 6d 62 65 72 3d 27 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 34 2d 30 34 2d 31 32 2e 30 30 33 27 3b 0a 76 61 72 20 5f 77 77 42 75 69 6c 64 4e 75 6d 62 65 72 3d 27 6f 64 73 70 2d 77 65 62 2d 70 72 6f Data Ascii: var _startTime=performance.now(),_startTimeTicks=Date.now();var _shouldBypass=false;var _cdnBaseUrl='https://res-1.cdn.office.net/files/odsp-web-prod_2024-04-12.003/';var _swBuildNumber='odsp-web-prod_2024-04-12.003';var _wwBuildNumber='odsp-web-pro
2024-04-19 21:52:20 UTC	82	IN	Data Raw: 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 34 2d 30 34 2d 31 32 2e 30 30 33 2f 73 70 73 65 72 76 69 63 65 77 6f 72 6b 65 72 2e 6a 73 27 29 3b 0a 0d 0a Data Ascii: //res-1.cdn.office.net/files/odsp-web-prod_2024-04-12.003/spserviceworker.js');

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:20 UTC	161	OUT	HEAD /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 21:52:20 UTC	467	IN	HTTP/1.1 200 OK Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json Content-Type: application/octet-stream ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/079C) X-CID: 11 X-Ms-ApiVersion: Distribute 1.2 X-Ms-Region: prod-eus-z1 Cache-Control: public, max-age=119461 Date: Fri, 19 Apr 2024 21:52:20 GMT Connection: close X-CID: 2

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:20 UTC	239	OUT	GET /fs/windows/config.json HTTP/1.1 Connection: Keep-Alive Accept: / Accept-Encoding: identity If-Unmodified-Since: Tue, 16 May 2017 22:58:00 GMT Range: bytes=0-2147483646 User-Agent: Microsoft BITS/7.8 Host: fs.microsoft.com
2024-04-19 21:52:20 UTC	805	IN	HTTP/1.1 200 OK ApiVersion: Distribute 1.1 Content-Disposition: attachment; filename=config.json; filename*=UTF-8''config.json ETag: "0x64667F707FF07D62B733DBCB79EFE3855E6886C9975B0C0B467D46231B3FA5E7" Last-Modified: Tue, 16 May 2017 22:58:00 GMT Server: ECAcc (chd/0778) X-CID: 11 X-CCC: US X-Azure-Ref-OriginShield: Ref A: 52EA27DBDE0C4533B819423583F6692E Ref B: CH1AA2040902052 Ref C: 2023-07-09T23:10:08Z X-MSEdge-Ref: Ref A: 528BB8D443C042AA9AEA4EC3F75C7762 Ref B: CHI30EDGE0111 Ref C: 2023-07-09T23:11:11Z Content-Type: application/octet-stream X-Azure-Ref: 01uvbYwAAAACkqWtaEMjWQL/4cpisZkorTUVNMzBFREdFMDgxMQBjZWZjMjU4My1hOWIyLTQ0YTctOTc1NS1iNzZkMTdlMDVmN2Y= Cache-Control: public, max-age=119482 Date: Fri, 19 Apr 2024 21:52:20 GMT Content-Length: 55 Connection: close X-CID: 2
2024-04-19 21:52:20 UTC	55	IN	Data Raw: 7b 22 66 6f 6e 74 53 65 74 55 72 69 22 3a 22 66 6f 6e 74 73 65 74 2d 32 30 31 37 2d 30 34 2e 6a 73 6f 6e 22 2c 22 62 61 73 65 55 72 69 22 3a 22 66 6f 6e 74 73 22 7d Data Ascii: {"fontSetUri":"fontset-2017-04.json","baseUri":"fonts"}

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:23 UTC	306	OUT	GET /SLS/%7B522D76A4-93E1-47F8-B8CE-07C937AD1A1E%7D/x64/10.0.19045.2006/0?CH=700&L=en-GB&P=&PT=0x30&WUA=10.0.19041.1949&MK=P1xUBD9uvDNMGwa&MD=LEa4PNHp HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Windows-Update-Agent/10.0.10011.16384 Client-Protocol/2.33 Host: slscr.update.microsoft.com
2024-04-19 21:52:24 UTC	560	IN	HTTP/1.1 200 OK Cache-Control: no-cache Pragma: no-cache Content-Type: application/octet-stream Expires: -1 Last-Modified: Mon, 01 Jan 0001 00:00:00 GMT ETag: "XAopazV00XDWnJCwkmEWRv6JkbjRA9QSSZ2+e/3MzEk=_2880" MS-CorrelationId: 0d16ec5c-b1f6-48fa-89e2-74a1fdc33b73 MS-RequestId: 5628e825-3e3d-402f-9fba-b16f35e92be5 MS-CV: PDuzNHpob0KIyGzf.0 X-Microsoft-SLSClientCache: 2880 Content-Disposition: attachment; filename=environment.cab X-Content-Type-Options: nosniff Date: Fri, 19 Apr 2024 21:52:23 GMT Connection: close Content-Length: 24490
2024-04-19 21:52:24 UTC	15824	IN	Data Raw: 4d 53 43 46 00 00 00 00 92 1e 00 00 00 00 00 00 44 00 00 00 00 00 00 00 03 01 01 00 01 00 04 00 23 d0 00 00 14 00 00 00 00 00 10 00 92 1e 00 00 18 41 00 00 00 00 00 00 00 00 00 00 64 00 00 00 01 00 01 00 e6 42 00 00 00 00 00 00 00 00 00 00 00 00 80 00 65 6e 76 69 72 6f 6e 6d 65 6e 74 2e 63 61 62 00 78 cf 8d 5c 26 1e e6 42 43 4b ed 5c 07 54 13 db d6 4e a3 f7 2e d5 d0 3b 4c 42 af 4a 57 10 e9 20 bd 77 21 94 80 88 08 24 2a 02 02 d2 55 10 a4 a8 88 97 22 8a 0a d2 11 04 95 ae d2 8b 20 28 0a 88 20 45 05 f4 9f 80 05 bd ed dd f7 ff 77 dd f7 bf 65 d6 4a 66 ce 99 33 67 4e d9 7b 7f fb db 7b 56 f4 4d 34 b4 21 e0 a7 03 0a d9 fc 68 6e 1d 20 70 28 14 02 85 20 20 ad 61 10 08 e3 66 0d ed 66 9b 1d 6a 90 af 1f 17 f0 4b 68 35 01 83 6c fb 44 42 5c 7d 83 3d 03 30 be 3e ae be 58 Data Ascii: MSCFD#AdBenvironment.cabx\&BCK\TN.;LBJW w!$*U" ( EweJf3gN{{VM4!hn p( affjKh5lDB\}=0>X
2024-04-19 21:52:24 UTC	8666	IN	Data Raw: 04 01 31 2f 30 2d 30 0a 02 05 00 e1 2b 8a 50 02 01 00 30 0a 02 01 00 02 02 12 fe 02 01 ff 30 07 02 01 00 02 02 11 e6 30 0a 02 05 00 e1 2c db d0 02 01 00 30 36 06 0a 2b 06 01 04 01 84 59 0a 04 02 31 28 30 26 30 0c 06 0a 2b 06 01 04 01 84 59 0a 03 02 a0 0a 30 08 02 01 00 02 03 07 a1 20 a1 0a 30 08 02 01 00 02 03 01 86 a0 30 0d 06 09 2a 86 48 86 f7 0d 01 01 05 05 00 03 81 81 00 0c d9 08 df 48 94 57 65 3e ad e7 f2 17 9c 1f ca 3d 4d 6c cd 51 e1 ed 9c 17 a5 52 35 0f fd de 4b bd 22 92 c5 69 e5 d7 9f 29 23 72 40 7a ca 55 9d 8d 11 ad d5 54 00 bb 53 b4 87 7b 72 84 da 2d f6 e3 2c 4f 7e ba 1a 58 88 6e d6 b9 6d 16 ae 85 5b b5 c2 81 a8 e0 ee 0a 9c 60 51 3a 7b e4 61 f8 c3 e4 38 bd 7d 28 17 d6 79 f0 c8 58 c6 ef 1f f7 88 65 b1 ea 0a c0 df f7 ee 5c 23 c2 27 fd 98 63 08 31 Data Ascii: 1/0-0+P000,06+Y1(0&0+Y0 00*HHWe>=MlQR5K"i)#r@zUTS{r-,O~Xnm[`Q:{a8}(yXe\#'c1

Timestamp	Bytes transferred	Direction	Data
2024-04-19 21:52:34 UTC	2071	OUT	GET /transform/thumbnail?provider=spo&inputFormat=pdf&cs=fFNQTw&docid=https%3A%2F%2Festgirls-my.sharepoint.com%3A443%2F_api%2Fv2.0%2Fdrives%2Fb!3wg9-hIsbkKjisgTkXNd6LRDPUacccZPsT38WqC54ml1Bruter-IRZ4fXQ1eVBg9%2Fitems%2F01PD5Q4JXARXIMAEOQLZG3T5IZSE6ZB6TH%3Fversion%3DPublished&access_token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZXN0Z2lybHMtbXkuc2hhcmVwb2ludC5jb21AYjY4NzViYmItZjM3MS00ODBkLWFiYTEtMjk3MmNlMDQyYzJiIiwiY2FjaGVrZXkiOiIwaC5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNlNDM3NmVjMDI1NmQ1MTJlMjM3MzIwOWNmNDM5OTY5ZGE0ZDk0MzYzNGZlOTZjYTU1NmZmMWE3YTFjMTVhNGJlIiwiZW5kcG9pbnR1cmwiOiJURjgwRTBXRUM0cWNENzhvRWQxb0gwRjNxVXl4RlF6RXdvSjlrT1VybHlNPSIsImVuZHBvaW50dXJsTGVuZ3RoIjoiMTE4IiwiZXhwIjoiMTcxMzU4MjAwMCIsImlwYWRkciI6IjgxLjE4MS41Ny41MiIsImlzbG9vcGJhY2siOiJUcnVlIiwiaXNzIjoiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwIiwiaXN1c2VyIjoidHJ1ZSIsIm5hbWVpZCI6IjAjLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2U0Mzc2ZWMwMjU2ZDUxMmUyMzczMjA5Y2Y0Mzk5NjlkYTRkOTQzNjM0ZmU5NmNhNTU2ZmYxYTdhMWMxNWE0YmUiLCJuYmYiOiIxNzEzNTYwNDAwIiwibmlpIjoibWljcm9zb2Z0LnNoYXJlcG9pbnQiLCJzaGFyaW5naWQiOiJ5Y3g1bkRkcjhVcVM2NUhBUmhHa0VBIiwic2l0ZWlkIjoiWm1FelpEQTRaR1l0TW1NeE1pMDBNalpsTFdFek9HRXRZemd4TXpreE56TTFaR1U0Iiwic25pZCI6IjYiLCJzdHAiOiJ0IiwidHQiOiIwIiwidmVyIjoiaGFzaGVkcHJvb2Z0b2tlbiJ9.8Y66lcXGe2_cHFeRKyyRySxf12-D-9sDpuBarQzfz2I&cTag=%22c%3A%7BC0D08DE0-D011-4D5E-B9F5-19913D90FA67%7D%2C1%22&encodeFailures=1&width=1280&height=859&srcWidth=&srcHeight= HTTP/1.1 Host: northeurope1-mediap.svc.ms Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://estgirls-my.sharepoint.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2024-04-19 21:52:35 UTC	938	IN	HTTP/1.1 200 OK Cache-Control: private, max-age=2592000 Content-Length: 43482 Content-Type: image/jpeg Expires: Sun, 19 May 2024 21:52:34 GMT ETag: "{C0D08DE0-D011-4D5E-B9F5-19913D90FA67},2" X-AspNetMvc-Version: 5.2 Timing-Allow-Origin: * Access-Control-Expose-Headers: x-cache, x-msedge-ref, x-azure-ref-originshield X-OneDriveMpc-Version: 1.1.9.0 X-StreamOrigin: Cached Server-Timing: Provider;dur=87,SharePoint;dur=47,StreamRead;dur=0,TotalRequest;dur=169,Sandbox;dur=68 Request-Stat: Cached;True,RemoteReads;1 X-CorrelationId: d7c5ab1a-b2b7-4214-9098-2ae2799ca79a X-OneDriveMeTA-Version: 1.480.58163.0 X-OneDriveMeTA-Build: Media_prod_31514963_040124.1_03-28-2024 X-OneDriveMeTA-Region: northeurope X-AspNet-Version: 4.0.30319 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 6135D888B04F4244AE58ECBC97CD0DC9 Ref B: ATL331000103021 Ref C: 2024-04-19T21:52:34Z Date: Fri, 19 Apr 2024 21:52:34 GMT Connection: close
2024-04-19 21:52:35 UTC	3232	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 06 04 04 05 04 04 06 05 05 05 06 06 06 07 09 0e 09 09 08 08 09 12 0d 0d 0a 0e 15 12 16 16 15 12 14 14 17 1a 21 1c 17 18 1f 19 14 14 1d 27 1d 1f 22 23 25 25 25 16 1c 29 2c 28 24 2b 21 24 25 24 ff db 00 43 01 06 06 06 09 08 09 11 09 09 11 24 18 14 18 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 24 ff c0 00 11 08 02 f0 05 00 03 01 22 00 02 11 01 03 11 01 ff c4 00 1c 00 01 00 02 03 01 01 01 00 00 00 00 00 00 00 00 00 00 03 04 01 02 05 06 07 08 ff c4 00 49 10 00 02 01 02 03 07 01 04 08 03 05 08 02 01 04 03 00 01 02 03 04 05 11 51 06 12 13 14 21 31 61 41 07 16 a2 d1 15 22 32 35 53 54 71 Data Ascii: JFIF``C!'"#%%%),($+!$%$C$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$$"IQ!1aA"25STq
2024-04-19 21:52:35 UTC	8192	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 66 00 00 00 00 00 00 00 00 00 01 98 00 33 00 00 00 00 00 00 00 00 00 00 00 00 00 00 cc 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 ab 2b d6 ed 22 c3 2b d6 ed 20 38 d7 df 65 9f 3b da 8f bc bf 86 bf 76 7d 12 fb ec b3 e7 7b 51 f7 97 f0 d7 ee c0 e4 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e8 ec ef df 16 ff 00 ac bf a5 9f 4f c3 fb 23 e6 1b 3b f7 c5 bf eb 2f e9 67 d3 f0 fe c8 0e cd 1e c4 a8 8a 8f 62 54 00 00 00 c6 66 1b c8 8e 53 c8 09 37 96 a6 37 d6 a5 69 d7 4b d4 86 57 69 7a 81 7f 88 b5 31 c4 5a 9c c7 7c 97 Data Ascii: f3+"+ 8e;v}{QO#;/gbTfS77iKWiz1Z\|
2024-04-19 21:52:35 UTC	4144	IN	Data Raw: f4 32 ad 1e 80 73 e5 16 c8 65 49 bf 43 ad ca 3d 07 25 e0 0e 47 05 e8 6c a9 3d 0e aa b2 cf d0 cf 25 e0 0e 5c 69 b5 e8 4f 4e 4e 25 c7 67 e0 c7 2a f4 03 14 ae 1a 2e 50 b9 79 f7 2a ab 66 4f 4a 8b cf b0 1d 5b 5a cd 9d 5a 12 6d 1c 8b 4a 6d 1d 6b 78 e4 80 b9 06 6e 69 05 d0 dc 00 00 0d 59 5e b7 69 16 19 5e b7 69 01 c6 be fb 2c f9 de d4 7d e5 fc 35 fb b3 e8 97 df 65 9f 3b da 8f bc bf 86 bf 76 07 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 47 67 7e f8 b7 fd 65 fd 2c fa 7e 1f d9 1f 30 d9 df be 2d ff 00 59 7f 4b 3e 9f 87 f6 40 76 68 f6 25 44 54 7b 12 a0 06 1a 32 18 11 4e 39 95 aa 51 4c b5 26 43 29 a0 2a 4a d9 3f 42 3e 55 68 5b 73 46 37 90 15 95 a2 d0 72 ab 42 ce f2 1b c8 0a bc a2 0a d1 68 5a df 89 85 Data Ascii: 2seIC=%Gl=%\iONN%g.PyfOJ[ZZmJmkxniY^i^i,}5e;v Gg~e,~0-YK>@vh%DT{2N9QL&C)*J?B>Uh[sF7rBhZ
2024-04-19 21:52:35 UTC	8192	IN	Data Raw: b2 03 e9 1c 53 3c 52 a4 64 cd b3 02 cf 14 71 4a d9 b1 9b 02 cf 14 71 4a d9 b1 9b 02 c7 1b c9 87 5f c9 56 52 21 9d 5c 80 bc ee 16 5d c8 67 70 b5 28 4a e5 af 52 19 5c 66 05 b9 d6 59 9a c6 a6 65 2e 36 66 d1 aa 07 42 33 59 11 56 9a c8 82 35 ba 77 35 9d 4c c0 ad 71 3e e7 3a ad 46 99 d1 ab 07 22 9d 4b 66 f3 e8 05 45 5e 49 96 ed ae 1e 7d c8 79 59 67 d9 93 d1 b6 69 81 d6 b5 ae f5 2e 71 7e af 73 9d 6f 4d a4 5b ea a2 06 95 e7 dc a7 29 66 c9 6b 3e fd 4a 92 97 50 27 8b 44 91 68 ab 19 92 46 a0 16 3a 0c 91 14 66 6d bc 04 9d 07 42 27 30 a6 04 eb 20 44 a6 6d bc 06 fd 0c c5 22 2d e0 a6 05 94 90 e8 44 aa 74 0e a0 12 36 91 ab 99 13 a8 6b be 04 d9 a6 63 a1 1c 66 67 78 0c b4 6b d0 d5 c8 d7 78 09 22 91 62 8a 59 95 14 8b 14 67 d4 0e 9d 04 5e a7 d8 e7 db c8 bf 4d f4 02 64 02 00 Data Ascii: S<RdqJqJ_VR!\]gp(JR\fYe.6fB3YV5w5Lq>:F"KfE^I}yYgi.q~soM[)fk>JP'DhF:fmB'0 Dm"-Dt6kcfgxkx"bYg^Md
2024-04-19 21:52:35 UTC	8192	IN	Data Raw: f4 27 db 1d 9d da 6d aa da ad 9e c7 21 81 5d 5b d0 c1 5d 57 ca 55 85 b5 5e 63 8a 92 9a 72 57 51 c9 6e c5 25 d1 e4 f3 cf 3e c7 02 5e cb 76 81 60 cb 04 8e 19 7d 53 0e b2 c5 23 8a 61 74 2e 68 da d5 56 8d 4d b7 46 7f f3 49 55 a5 93 6b 2c a2 d6 7d df 66 1e b6 c7 da 7e 01 8b 3b 3a 78 4d 1c 43 13 b8 ba b7 95 d3 b7 b5 a2 a5 52 8d 38 cd c1 b9 a7 25 97 d6 8c 96 4b 36 da 79 66 73 6c bd a9 5a d1 ad 5a 8e 21 6b 79 71 56 ae 33 53 09 b6 a7 6b 6f 18 b5 51 2c e3 4e 5b d5 32 6d a4 fe b7 6e 9e 86 96 9b 2b b5 58 5e d1 d0 da 2c 2b 00 8d 85 ef 23 f4 7d cd 0a 56 96 ca d6 ad 35 55 d4 8b 85 35 78 9c 25 9c 9e 6f 7a 49 f7 c8 f3 98 be c2 6d 7e 1f 77 86 dd db 61 b7 55 6b 54 da b5 8c cb 3b 28 4e 36 d0 e1 c9 37 25 4e e2 5b cb 39 47 fb 51 6f a8 1e b2 1e d3 ac 2f f1 7d 9f a3 63 39 d0 b6 Data Ascii: 'm!][]WU^crWQn%>^v`}S#at.hVMFIUk,}f~;:xMCR8%K6yfslZZ!kyqV3SkoQ,N[2mn+X^,+#}V5U5x%ozIm~waUkT;(N67%N[9GQo/}c9
2024-04-19 21:52:35 UTC	8192	IN	Data Raw: 35 fb b3 e8 97 df 65 9f 3b da 8f bc bf 86 bf 76 07 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 07 47 67 7e f8 b7 fd 65 fd 2c fa 7e 1f d9 1f 30 d9 df be 2d ff 00 59 7f 4b 3e 9f 87 f6 40 76 68 f6 25 44 54 7b 12 a0 04 55 17 42 52 2a 9d 80 e7 dc c7 b9 c7 b9 a6 ba 9d 8b a9 65 99 c6 ba a9 96 60 51 9d 35 99 a7 0c 4e b2 cc 8f 8c b5 02 45 04 6e a0 88 15 6f 26 f1 ac 04 d1 a6 4d 4e 29 15 a3 58 dd 56 48 0e a5 09 25 ea 74 68 56 59 77 3c fc 2e 72 f5 2d 51 bb f2 07 a2 85 54 fd 4c ca 59 a3 97 42 eb 3f 52 d4 6a e6 80 8a e5 f4 67 22 e9 f7 3a b5 de 69 9c 9b b5 dc 0e 75 49 f5 34 e2 98 af 9a 6c 83 79 81 61 d5 21 9d 57 a9 ae f3 34 97 50 1c 57 99 25 3a ac 83 74 96 9c 40 b7 4e 6c 93 79 91 53 89 be 5d 00 ce f3 0a 46 Data Ascii: 5e;v Gg~e,~0-YK>@vh%DT{UBR*e`Q5NEno&MN)XVH%thVYw<.r-QTLYB?Rjg":iuI4lya!W4PW%:t@NlyS]F
2024-04-19 21:52:35 UTC	3338	IN	Data Raw: b3 4a 6a 25 4d e3 1c 5c bd 40 ea d3 b9 49 77 27 85 d2 d4 e1 2b 96 49 4e e5 e7 dc 0f 41 4e be 64 aa 4a 48 e4 5b d6 6f d4 e8 52 93 68 0c d4 89 16 ef 52 c4 96 68 8b 20 36 a5 12 ca fb 24 14 d1 3f a0 10 56 f5 28 56 2f 55 28 56 f5 02 b4 bb b3 43 76 ba 9a e4 06 a6 3a 1b 64 63 20 08 dd 23 09 1b a4 06 0d 5b 36 68 d1 80 cc 29 1a 80 25 8c 8d b3 22 8b 37 4c 03 34 6c d9 91 30 37 52 24 8b 2b a2 68 01 32 66 73 35 4c 01 96 cd 1b 32 cd 18 18 de 0a 46 ac c0 12 ef 8c cd 11 b2 40 6c 86 41 23 64 06 b9 1a b4 48 6a d0 11 e4 65 19 c8 24 50 48 ce e9 98 a3 75 12 0d 61 12 7a 46 b1 83 d0 9a 9c 00 b1 44 b5 02 b5 35 d0 b3 04 04 a8 64 10 01 90 c8 00 19 0c 80 01 90 c8 00 19 00 00 0c 80 01 90 00 06 43 20 00 64 32 00 00 00 00 c8 00 19 0c 80 00 00 01 90 c8 00 00 00 03 20 00 64 61 a3 26 18 Data Ascii: Jj%M\@Iw'+INANdJH[oRhRh 6$?V(V/U(VCv:dc #[6h)%"7L4l07R$+h2fs5L2F@lA#dHje$PHuazFD5dC d2 da&