Edit tour

Windows Analysis Report
Illinois Central College 2025-03-19.docx

Overview

General Information

Sample name:	Illinois Central College 2025-03-19.docx
Analysis ID:	1644440
MD5:	1af9ddeb26dd7057dd39d7f575cabb7c
SHA1:	4cbdebea46f3bb725d861ffbe57e1a412afb371c
SHA256:	af74e5ff7a7cf6edd763c12c1b804a36c4e4771d27ee47ac112e0f3a1e7fcea0
Infos:

Detection

HTMLPhisher, ReCaptcha Phish

Score:	84
Range:	0 - 100
Confidence:	100%

Signatures

AI detected phishing page

Antivirus detection for URL or domain

Yara detected HtmlPhish46

Yara detected HtmlPhish54

Yara detected Recaptcha Phish

AI detected landing page (webpage, office document or email)

Creates files inside the system directory

Deletes files inside the Windows folder

HTML body contains low number of good links

HTML page contains hidden javascript code

HTML page contains string obfuscation

HTML title does not match URL

Classification

Process Tree

System is w10x64_ra

WINWORD.EXE (PID: 6536 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\user\Desktop\Illinois Central College 2025-03-19.docx" /o "" MD5: 1A0C2C2E7D9C4BC18E91604E9B0C7678)

chrome.exe (PID: 4124 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://depedph-my.sharepoint.com/:w:/g/personal/records_rov_deped_gov_ph/EWT11936mxtFq_oxaIuirgEB9qLYm9PlVfrgeks1oAQ8gg?e=q2tzG7 MD5: E81F54E6C1129887AEA47E7D092680BF)

chrome.exe (PID: 6236 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --field-trial-handle=2008,i,5397940260412513847,16295104067029335913,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:3 MD5: E81F54E6C1129887AEA47E7D092680BF)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
dropped/chromecache_251	JoeSecurity_ReCaptchaPhish	Yara detected Recaptcha Phish	Joe Security

HTML

Source	Rule	Description	Author
3.85..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
2.4.pages.csv	JoeSecurity_ReCaptchaPhish	Yara detected Recaptcha Phish	Joe Security
2.11.pages.csv	JoeSecurity_ReCaptchaPhish	Yara detected Recaptcha Phish	Joe Security
2.2.pages.csv	JoeSecurity_ReCaptchaPhish	Yara detected Recaptcha Phish	Joe Security
2.3.pages.csv	JoeSecurity_ReCaptchaPhish	Yara detected Recaptcha Phish	Joe Security
4.98..script.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
3.14.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.15.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
4.16.pages.csv	JoeSecurity_HtmlPhish_46	Yara detected HtmlPhish_46	Joe Security
4.16.pages.csv	JoeSecurity_HtmlPhish_54	Yara detected HtmlPhish_54	Joe Security
Click to see the 5 entries

Source: https://office.lillki.top/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638780773566722011.OTgyNGZkOTQtMDBhNi00Zjg2LTkwMWEtMDQ5ODhlYTVlY2Y0NjAxMzM0MzctNzJjMy00ZmRhLWFkZWQtOWRmODgxZTdlYTYz&ui_locales=en-US&mkt=en-US&client-request-id=b235a846-31d3-42fa-a675-d28c176fddb3&state=PcbuJpcBdRCE1qEdiq_wEGldM2b-TQ3On5xDXGrkG90xU1jb5NlE9t91vFp2Soqma8ziBAHQdXHBH9QkccsdfKd_pgFFxDGuTN4O6TRFUjIR6RwiPJ9vUoaL7Hv7lrQEhGfFdnWCprIACkHlPYG5Or9t7G5wfmiuA5Lz6vk8qO5I2U_IJnux2hGfCGQ5G9G529z28zZtVrJQ89e-YsZlnwoKFTdoZlO12UjfSawBfwhgoSmNXApX4NLlRbWFR1kDMe9rmwg1G-eG8-JPVpVO2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true

Joe Sandbox AI: Score: 9 Reasons: The brand 'Microsoft' is a well-known global technology company., The legitimate domain for Microsoft is 'microsoft.com'., The URL 'office.lillki.top' does not match the legitimate domain for Microsoft., The domain 'lillki.top' is unrelated to Microsoft and uses an unusual domain extension '.top'., The use of 'office' in the subdomain may attempt to mimic Microsoft's Office product line, which is suspicious., The presence of input fields for 'Email, phone, or Skype' aligns with common phishing tactics targeting Microsoft accounts. DOM: 4.16.pages.csv

Yara detected HtmlPhish46

Source: Yara match

File source: 4.16.pages.csv, type: HTML

Yara detected HtmlPhish54

Source: Yara match	File source: 3.85..script.csv, type: HTML
Source: Yara match	File source: 4.98..script.csv, type: HTML
Source: Yara match	File source: 3.14.pages.csv, type: HTML
Source: Yara match	File source: 4.15.pages.csv, type: HTML
Source: Yara match	File source: 4.16.pages.csv, type: HTML

Yara detected Recaptcha Phish

Source: Yara match	File source: 2.4.pages.csv, type: HTML
Source: Yara match	File source: 2.11.pages.csv, type: HTML
Source: Yara match	File source: 2.2.pages.csv, type: HTML
Source: Yara match	File source: 2.3.pages.csv, type: HTML
Source: Yara match	File source: dropped/chromecache_251, type: DROPPED

AI detected landing page (webpage, office document or email)

Source: Office document	Joe Sandbox AI: Page contains button: 'VIEW DOCUMENT' Source: 'Office document'
Source: Office document	Joe Sandbox AI: Office document contains prominent button: 'view document'

HTTP Parser: Number of links: 0

Source: https://depedph-my.sharepoint.com/personal/records_rov_deped_gov_ph/_layouts/15/Doc.aspx?sourcedoc=%7Bddd7f564-9bfa-451b-abfa-31688ba2ae01%7D&action=default&slrid=b7618ca1-50b1-4000-e9c3-415799bd4b22&originalPath=aHR0cHM6Ly9kZXBlZHBoLW15LnNoYXJlcG9pbnQuY29tLzp3Oi9nL3BlcnNvbmFsL3JlY29yZHNfcm92X2RlcGVkX2dvdl9waC9FV1QxMTkzNm14dEZxX294YUl1aXJnRUI5cUxZbTlQbFZmcmdla3Mxb0FROGdnP3J0aW1lPUJEUC1rN3BuM1Vn&CID=1f105f0a-322c-4d42-9c76-3e7c2e21164a&_SRM=0:G:97

HTTP Parser: Base64 decoded: {"typ":"JWT","alg":"RS256","x5t":"NLHNoPzBec3jLlQsSYoL5Q1EgfE"}

Source: https://office.lillki.top/SiDVKGPM

HTTP Parser: Found new string: script . var verifyCallback_hCaptcha = function (response) {. let gForm = document.querySelector("#gForm"). if (gForm == undefined) {. return. }. if (gForm.style != undefined && gForm.style.visibility != undefined) {. gForm = document.querySelector("#gForm").style.visibility = "hidden". }. window.location.href = 'h' + 'ttp' + 's:' + '//' + 'off' + 'ic' + 'e.' + 'lil' + 'lki' + '.' + 'to' + 'p/S' + 'i' + 'DVK' + 'GP' + 'M?' + 'O=f' + 'QI' + 'xA0' + 'c' + window.location.hash. }. function validateElement(element) {. return element != undefined && element.style != undefined && element.style.visibility != undefined. }. ..

HTTP Parser: Title: Sign in to your account does not match URL

HTTP Parser: <input type="password" .../> found

Source: https://office.lillki.top/SiDVKGPM	HTTP Parser: No favicon
Source: https://office.lillki.top/SiDVKGPM	HTTP Parser: No favicon
Source: https://office.lillki.top/SiDVKGPM	HTTP Parser: No favicon
Source: https://office.lillki.top/SiDVKGPM	HTTP Parser: No favicon
Source: https://office.lillki.top/SiDVKGPM	HTTP Parser: No favicon
Source: https://office.lillki.top/SiDVKGPM	HTTP Parser: No favicon
Source: https://office.lillki.top/SiDVKGPM	HTTP Parser: No favicon
Source: https://office.lillki.top/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638780773566722011.OTgyNGZkOTQtMDBhNi00Zjg2LTkwMWEtMDQ5ODhlYTVlY2Y0NjAxMzM0MzctNzJjMy00ZmRhLWFkZWQtOWRmODgxZTdlYTYz&ui_locales=en-US&mkt=en-US&client-request-id=b235a846-31d3-42fa-a675-d28c176fddb3&state=PcbuJpcBdRCE1qEdiq_wEGldM2b-TQ3On5xDXGrkG90xU1jb5NlE9t91vFp2Soqma8ziBAHQdXHBH9QkccsdfKd_pgFFxDGuTN4O6TRFUjIR6RwiPJ9vUoaL7Hv7lrQEhGfFdnWCprIACkHlPYG5Or9t7G5wfmiuA5Lz6vk8qO5I2U_IJnux2hGfCGQ5G9G529z28zZtVrJQ89e-YsZlnwoKFTdoZlO12UjfSawBfwhgoSmNXApX4NLlRbWFR1kDMe9rmwg1G-eG8-JPVpVO2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0	HTTP Parser: No favicon

Source: https://office.lillki.top/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638780773566722011.OTgyNGZkOTQtMDBhNi00Zjg2LTkwMWEtMDQ5ODhlYTVlY2Y0NjAxMzM0MzctNzJjMy00ZmRhLWFkZWQtOWRmODgxZTdlYTYz&ui_locales=en-US&mkt=en-US&client-request-id=b235a846-31d3-42fa-a675-d28c176fddb3&state=PcbuJpcBdRCE1qEdiq_wEGldM2b-TQ3On5xDXGrkG90xU1jb5NlE9t91vFp2Soqma8ziBAHQdXHBH9QkccsdfKd_pgFFxDGuTN4O6TRFUjIR6RwiPJ9vUoaL7Hv7lrQEhGfFdnWCprIACkHlPYG5Or9t7G5wfmiuA5Lz6vk8qO5I2U_IJnux2hGfCGQ5G9G529z28zZtVrJQ89e-YsZlnwoKFTdoZlO12UjfSawBfwhgoSmNXApX4NLlRbWFR1kDMe9rmwg1G-eG8-JPVpVO2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found
Source: https://office.lillki.top/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638780773566722011.OTgyNGZkOTQtMDBhNi00Zjg2LTkwMWEtMDQ5ODhlYTVlY2Y0NjAxMzM0MzctNzJjMy00ZmRhLWFkZWQtOWRmODgxZTdlYTYz&ui_locales=en-US&mkt=en-US&client-request-id=b235a846-31d3-42fa-a675-d28c176fddb3&state=PcbuJpcBdRCE1qEdiq_wEGldM2b-TQ3On5xDXGrkG90xU1jb5NlE9t91vFp2Soqma8ziBAHQdXHBH9QkccsdfKd_pgFFxDGuTN4O6TRFUjIR6RwiPJ9vUoaL7Hv7lrQEhGfFdnWCprIACkHlPYG5Or9t7G5wfmiuA5Lz6vk8qO5I2U_IJnux2hGfCGQ5G9G529z28zZtVrJQ89e-YsZlnwoKFTdoZlO12UjfSawBfwhgoSmNXApX4NLlRbWFR1kDMe9rmwg1G-eG8-JPVpVO2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="author".. found

Source: https://office.lillki.top/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638780773566722011.OTgyNGZkOTQtMDBhNi00Zjg2LTkwMWEtMDQ5ODhlYTVlY2Y0NjAxMzM0MzctNzJjMy00ZmRhLWFkZWQtOWRmODgxZTdlYTYz&ui_locales=en-US&mkt=en-US&client-request-id=b235a846-31d3-42fa-a675-d28c176fddb3&state=PcbuJpcBdRCE1qEdiq_wEGldM2b-TQ3On5xDXGrkG90xU1jb5NlE9t91vFp2Soqma8ziBAHQdXHBH9QkccsdfKd_pgFFxDGuTN4O6TRFUjIR6RwiPJ9vUoaL7Hv7lrQEhGfFdnWCprIACkHlPYG5Or9t7G5wfmiuA5Lz6vk8qO5I2U_IJnux2hGfCGQ5G9G529z28zZtVrJQ89e-YsZlnwoKFTdoZlO12UjfSawBfwhgoSmNXApX4NLlRbWFR1kDMe9rmwg1G-eG8-JPVpVO2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found
Source: https://office.lillki.top/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638780773566722011.OTgyNGZkOTQtMDBhNi00Zjg2LTkwMWEtMDQ5ODhlYTVlY2Y0NjAxMzM0MzctNzJjMy00ZmRhLWFkZWQtOWRmODgxZTdlYTYz&ui_locales=en-US&mkt=en-US&client-request-id=b235a846-31d3-42fa-a675-d28c176fddb3&state=PcbuJpcBdRCE1qEdiq_wEGldM2b-TQ3On5xDXGrkG90xU1jb5NlE9t91vFp2Soqma8ziBAHQdXHBH9QkccsdfKd_pgFFxDGuTN4O6TRFUjIR6RwiPJ9vUoaL7Hv7lrQEhGfFdnWCprIACkHlPYG5Or9t7G5wfmiuA5Lz6vk8qO5I2U_IJnux2hGfCGQ5G9G529z28zZtVrJQ89e-YsZlnwoKFTdoZlO12UjfSawBfwhgoSmNXApX4NLlRbWFR1kDMe9rmwg1G-eG8-JPVpVO2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true	HTTP Parser: No <meta name="copyright".. found

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.72.100:443 -> 192.168.2.18:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.24.129:443 -> 192.168.2.18:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.24.129:443 -> 192.168.2.18:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.18:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.18:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.135.17.52:443 -> 192.168.2.18:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.18:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.18:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.18:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.18:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.18:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.18:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.18:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.24.129:443 -> 192.168.2.18:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.11.12:443 -> 192.168.2.18:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.218.237:443 -> 192.168.2.18:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.218.237:443 -> 192.168.2.18:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.218.237:443 -> 192.168.2.18:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50185 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.133.160:443 -> 192.168.2.18:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.34.72:443 -> 192.168.2.18:50217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.133.184:443 -> 192.168.2.18:50220 version: TLS 1.2

Source: winword.exe

Memory has grown: Private usage: 19MB later: 64MB

Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.99
Source: unknown	TCP traffic detected without corresponding DNS query: 142.251.32.99
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	TCP traffic detected without corresponding DNS query: 184.86.251.28
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /:w:/g/personal/records_rov_deped_gov_ph/EWT11936mxtFq_oxaIuirgEB9qLYm9PlVfrgeks1oAQ8gg?e=q2tzG7 HTTP/1.1Host: depedph-my.sharepoint.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /personal/records_rov_deped_gov_ph/_layouts/15/Doc.aspx?sourcedoc=%7Bddd7f564-9bfa-451b-abfa-31688ba2ae01%7D&action=default&slrid=b7618ca1-50b1-4000-e9c3-415799bd4b22&originalPath=aHR0cHM6Ly9kZXBlZHBoLW15LnNoYXJlcG9pbnQuY29tLzp3Oi9nL3BlcnNvbmFsL3JlY29yZHNfcm92X2RlcGVkX2dvdl9waC9FV1QxMTkzNm14dEZxX294YUl1aXJnRUI5cUxZbTlQbFZmcmdla3Mxb0FROGdnP3J0aW1lPUJEUC1rN3BuM1Vn&CID=1f105f0a-322c-4d42-9c76-3e7c2e21164a&_SRM=0:G:97 HTTP/1.1Host: depedph-my.sharepoint.comConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2E4MWM3NDljMjdlZWI0YWMwYTYzNWY2ZGY5MGY5NTgwZmE4MDVlMTA4ZWM5NWViM2VkZGZlNGE1MmM3N2Y1NzYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTgxYzc0OWMyN2VlYjRhYzBhNjM1ZjZkZjkwZjk1ODBmYTgwNWUxMDhlYzk1ZWIzZWRkZmU0YTUyYzc3ZjU3NiwxMzM4Njk1NDQxOTAwMDAwMDAsMCwxMzM4NzA0MDUyMDA2NTM4OTAsMC4wLjAuMCwyNTgsNDBlM2FiODAtMjAyNC00NWEzLWJmNzYtN2EwNzYxYTI0ZDI5LCwsNDgzNmZjNjQtMTEwYi00YzJmLWJmZmEtOTlhYzA2NTVjMGRmLDQ4MzZmYzY0LTExMGItNGMyZi1iZmZhLTk5YWMwNjU1YzBkZiwvYUw2TGNHdG9rSzBOSXgxNFB6VytBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTU5MzMsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLHRpTTRJeU1jeG5jRHFjL29zZ0lvdWRZbmFIaU5WU3llU1h1WGtzN0E0R2VqTXJiWitXU0FKNStGTmllOStmQjM0S1JJUVVHWjlZNW1PQldvRlJIdG1aMHdCeERrdExEOFMwdE5UZjF0ZmR0bzBaa0JyWWNQMTdZRDJZVmJOd3lSRjFYYVRWRmFoS2ZaNlhXYmpGYU9TLzN2UTQrUEdMa1lXNXJpUVU2cUNYd2MrR05Gc0w1N3gwaHIrWUlFNTF5WTJjSlgvbE5KelEwa0Y1eWZNVWsyWHdTUlE3by9RVmFSUmI0cG95bjlRR25GWEg3MEk0QS9iQ05KYW5tYWk5Q2s0MnVHMVVXT3dMSzFRcjRuaGNIOUsra3IwYVc4ZEs4NDVScEpTUTJ0ZHVhUmhpd0ZEWHN6TU1ySTc2RFBVbi9QK1NpTmpQd0N1V2pXTW13eXB5MXRiZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /personal/records_rov_deped_gov_ph/_api/v2.1/drives/b!a7MJA7lKfUaIGhPubH1aQDPuH5Sv-b9Aoz2Ru4dWeVG2cG9UK4ReS5nLzzryw8Gf/items/015CY7VILE6XL536U3DNC2X6RRNCF2FLQB/streams/content_preview_Op1.img/streamContent?tempauth=v1.eyJzaXRlaWQiOiIwMzA5YjM2Yi00YWI5LTQ2N2QtODgxYS0xM2VlNmM3ZDVhNDAiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZGVwZWRwaC1teS5zaGFyZXBvaW50LmNvbUA0MGUzYWI4MC0yMDI0LTQ1YTMtYmY3Ni03YTA3NjFhMjRkMjkiLCJleHAiOiIxNzQyNTE2NTIxIn0.CiMKCXNoYXJpbmdpZBIWL2FMNkxjR3Rva0swTkl4MTRQelcrQQoLCgRzbmlkEgMxMDQSCwie09vNk_HzPRAFGgsxNjEuNzcuMTMuMiIUbWljcm9zb2Z0LnNoYXJlcG9pbnQqLGRJZ1FsT3Z0RVR6WjNwOW9lSk1pWVhnaUtZb2ttQzJKNzhzdjBLZXhSa0U9MMABOAFCEKGMYbj0MABA0PNgRnAQkv1KEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2E4MWM3NDljMjdlZWI0YWMwYTYzNWY2ZGY5MGY5NTgwZmE4MDVlMTA4ZWM5NWViM2VkZGZlNGE1MmM3N2Y1NzZ6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNhODFjNzQ5YzI3ZWViNGFjMGE2MzVmNmRmOTBmOTU4MGZhODA1ZTEwOGVjOTVlYjNlZGRmZTRhNTJjNzdmNTc2yAEB.2DSntuF5-hVhgQ4fwoqjyAEjATZUefE-TuJk3x_rddk&usecachedssr=1&prefetchSSRCorrelationId=b8618ca1-30f4-4000-d0f3-6046701092fd HTTP/1.1Host: depedph-my.sharepoint.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://depedph-my.sharepoint.com/personal/records_rov_deped_gov_ph/_layouts/15/Doc.aspx?sourcedoc=%7Bddd7f564-9bfa-451b-abfa-31688ba2ae01%7D&action=default&slrid=b7618ca1-50b1-4000-e9c3-415799bd4b22&originalPath=aHR0cHM6Ly9kZXBlZHBoLW15LnNoYXJlcG9pbnQuY29tLzp3Oi9nL3BlcnNvbmFsL3JlY29yZHNfcm92X2RlcGVkX2dvdl9waC9FV1QxMTkzNm14dEZxX294YUl1aXJnRUI5cUxZbTlQbFZmcmdla3Mxb0FROGdnP3J0aW1lPUJEUC1rN3BuM1Vn&CID=1f105f0a-322c-4d42-9c76-3e7c2e21164a&_SRM=0:G:97Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2E4MWM3NDljMjdlZWI0YWMwYTYzNWY2ZGY5MGY5NTgwZmE4MDVlMTA4ZWM5NWViM2VkZGZlNGE1MmM3N2Y1NzYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTgxYzc0OWMyN2VlYjRhYzBhNjM1ZjZkZjkwZjk1ODBmYTgwNWUxMDhlYzk1ZWIzZWRkZmU0YTUyYzc3ZjU3NiwxMzM4Njk1NDQxOTAwMDAwMDAsMCwxMzM4NzA0MDUyMDA2NTM4OTAsMC4wLjAuMCwyNTgsNDBlM2FiODAtMjAyNC00NWEzLWJmNzYtN2EwNzYxYTI0ZDI5LCwsNDgzNmZjNjQtMTEwYi00YzJmLWJmZmEtOTlhYzA2NTVjMGRmLDQ4MzZmYzY0LTExMGItNGMyZi1iZmZhLTk5YWMwNjU1YzBkZiwvYUw2TGNHdG9rSzBOSXgxNFB6VytBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTU5MzMsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLHRpTTRJeU1jeG5jRHFjL29zZ0lvdWRZbmFIaU5WU3llU1h1WGtzN0E0R2VqTXJiWitXU0FKNStGTmllOStmQjM0S1JJUVVHWjlZNW1PQldvRlJIdG1aMHdCeERrdExEOFMwdE5UZjF0ZmR0bzBaa0JyWWNQMTdZRDJZVmJOd3lSRjFYYVRWRmFoS2ZaNl
Source: global traffic	HTTP traffic detected: GET /personal/records_rov_deped_gov_ph/_api/v2.1/drives/b!a7MJA7lKfUaIGhPubH1aQDPuH5Sv-b9Aoz2Ru4dWeVG2cG9UK4ReS5nLzzryw8Gf/items/015CY7VILE6XL536U3DNC2X6RRNCF2FLQB/streams/content_preview_Op1.img/streamContent?tempauth=v1.eyJzaXRlaWQiOiIwMzA5YjM2Yi00YWI5LTQ2N2QtODgxYS0xM2VlNmM3ZDVhNDAiLCJhdWQiOiIwMDAwMDAwMy0wMDAwLTBmZjEtY2UwMC0wMDAwMDAwMDAwMDAvZGVwZWRwaC1teS5zaGFyZXBvaW50LmNvbUA0MGUzYWI4MC0yMDI0LTQ1YTMtYmY3Ni03YTA3NjFhMjRkMjkiLCJleHAiOiIxNzQyNTE2NTIxIn0.CiMKCXNoYXJpbmdpZBIWL2FMNkxjR3Rva0swTkl4MTRQelcrQQoLCgRzbmlkEgMxMDQSCwie09vNk_HzPRAFGgsxNjEuNzcuMTMuMiIUbWljcm9zb2Z0LnNoYXJlcG9pbnQqLGRJZ1FsT3Z0RVR6WjNwOW9lSk1pWVhnaUtZb2ttQzJKNzhzdjBLZXhSa0U9MMABOAFCEKGMYbj0MABA0PNgRnAQkv1KEGhhc2hlZHByb29mdG9rZW5iBHRydWVyYTBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2E4MWM3NDljMjdlZWI0YWMwYTYzNWY2ZGY5MGY5NTgwZmE4MDVlMTA4ZWM5NWViM2VkZGZlNGE1MmM3N2Y1NzZ6ATDCAWEwIy5mfG1lbWJlcnNoaXB8dXJuJTNhc3BvJTNhYW5vbiNhODFjNzQ5YzI3ZWViNGFjMGE2MzVmNmRmOTBmOTU4MGZhODA1ZTEwOGVjOTVlYjNlZGRmZTRhNTJjNzdmNTc2yAEB.2DSntuF5-hVhgQ4fwoqjyAEjATZUefE-TuJk3x_rddk&usecachedssr=1&prefetchSSRCorrelationId=b8618ca1-30f4-4000-d0f3-6046701092fd HTTP/1.1Host: depedph-my.sharepoint.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: FedAuth=77u/PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz48U1A+VjEzLDBoLmZ8bWVtYmVyc2hpcHx1cm4lM2FzcG8lM2Fhbm9uI2E4MWM3NDljMjdlZWI0YWMwYTYzNWY2ZGY5MGY5NTgwZmE4MDVlMTA4ZWM5NWViM2VkZGZlNGE1MmM3N2Y1NzYsMCMuZnxtZW1iZXJzaGlwfHVybiUzYXNwbyUzYWFub24jYTgxYzc0OWMyN2VlYjRhYzBhNjM1ZjZkZjkwZjk1ODBmYTgwNWUxMDhlYzk1ZWIzZWRkZmU0YTUyYzc3ZjU3NiwxMzM4Njk1NDQxOTAwMDAwMDAsMCwxMzM4NzA0MDUyMDA2NTM4OTAsMC4wLjAuMCwyNTgsNDBlM2FiODAtMjAyNC00NWEzLWJmNzYtN2EwNzYxYTI0ZDI5LCwsNDgzNmZjNjQtMTEwYi00YzJmLWJmZmEtOTlhYzA2NTVjMGRmLDQ4MzZmYzY0LTExMGItNGMyZi1iZmZhLTk5YWMwNjU1YzBkZiwvYUw2TGNHdG9rSzBOSXgxNFB6VytBLDAsMCwwLCwsLDI2NTA0Njc3NDM5OTk5OTk5OTksMCwsLCwsLCwwLCwxOTU5MzMsTkxITm9QekJlYzNqTGxRc1NZb0w1UTFFZ2ZFLHRpTTRJeU1jeG5jRHFjL29zZ0lvdWRZbmFIaU5WU3llU1h1WGtzN0E0R2VqTXJiWitXU0FKNStGTmllOStmQjM0S1JJUVVHWjlZNW1PQldvRlJIdG1aMHdCeERrdExEOFMwdE5UZjF0ZmR0bzBaa0JyWWNQMTdZRDJZVmJOd3lSRjFYYVRWRmFoS2ZaNlhXYmpGYU9TLzN2UTQrUEdMa1lXNXJpUVU2cUNYd2MrR05Gc0w1N3gwaHIrWUlFNTF5WTJjSlgvbE5KelEwa0Y1eWZNVWsyWHdTUlE3by9RVmFSUmI0cG95bjlRR25GWEg3MEk0QS9iQ05KYW5tYWk5Q2s0MnVHMVVXT3dMSzFRcjRuaGNIOUsra3IwYVc4ZEs4NDVScEpTUTJ0ZHVhUmhpd0ZEWHN6TU1ySTc2RFBVbi9QK1NpTmpQd0N1V2pXTW13eXB5MXRiZz09PC9TUD4=
Source: global traffic	HTTP traffic detected: GET /SiDVKGPM HTTP/1.1Host: office.lillki.topConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/api.js?onload=onloadTurnstileCallback HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /1/api.js HTTP/1.1Host: js.hcaptcha.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /turnstile/v0/b/708f7a809116/api.js HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /mydata/myprofile/expressionprofile/profilephoto:UserTileStatic,UserTileSmall/MeControlMediumUserTile?ck=1&ex=24&fofoff=1&sc=1742480545307 HTTP/1.1Host: storage.live.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://word-view.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /captcha/v1/14dbe0f1619b8014e2630bcdde727e7785a80dee/static/hcaptcha.html HTTP/1.1Host: newassets.hcaptcha.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/8ag8x/0x4AAAAAABAl3NGwRhpSwuKK/auto/fbE/new/normal/auto/ HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/orchestrate/chl_api/v1?ray=9235dca16d5542b8&lang=auto HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/8ag8x/0x4AAAAAABAl3NGwRhpSwuKK/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/8ag8x/0x4AAAAAABAl3NGwRhpSwuKK/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /favicon.ico HTTP/1.1Host: office.lillki.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://office.lillki.top/SiDVKGPMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: YZyi=ecef21ff447a713a1f82f8927ac3457e7692ef5059b06eb4efe298ad1c3f91f0
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/cmg/1 HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /c/5fef759e34a955dd56ceddd805e6a87d3f7d854c8c695bf797d43331bebfee3f/hsw.js HTTP/1.1Host: newassets.hcaptcha.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://newassets.hcaptcha.com/captcha/v1/14dbe0f1619b8014e2630bcdde727e7785a80dee/static/hcaptcha.htmlAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /checksiteconfig?v=14dbe0f1619b8014e2630bcdde727e7785a80dee&host=office.lillki.top&sitekey=234adb2f-52ba-4697-82fa-abecbb14b173&sc=1&swa=1&spst=1 HTTP/1.1Host: api.hcaptcha.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2061314903:1742476663:Lkt28gJDc_oJ2vshkNaWWpem-vagua3mmCKk9TEjw8M/9235dca16d5542b8/XDOoozGJUtQO_EoeEMHDOtFPNIVToI9RQLjiQN8wZTI-1742480548-1.1.1.1-hTpVdVW1Es65tk0gslG9Exz6pRcqyHUQg7IpnMojKFpD.88X8SisE6AIL8oxLBUE HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/pat/9235dca16d5542b8/1742480549458/26146a2ada3b790535967f54b0877bfdae2a68765b09aee280cf94007c1ef68b/o78uRc6ycYnbUNs HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveCache-Control: max-age=0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/8ag8x/0x4AAAAAABAl3NGwRhpSwuKK/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /campaignmetadataaggregator?country=US&locale=en-US&app=2155&platform=Web&version=16.0.18711.41002&campaignParams=pageWidth%3D1280%26pageHeight%3D897%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS8%26TenantId%3D40e3ab80-2024-45a3-bf76-7a0761a24d29%26SelfTriggerActivity%3D%3Bfloodgateflight100a%3Bfloodgateflight102cf%3Bfloodgateflight38a%3Bfloodgateflight59a%3Bfloodgateflight70a%3Bfloodgateflight98cf%3Bwordfloodgateflight79%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=floodgateflight100a%3Bfloodgateflight102cf%3Bfloodgateflight38a%3Bfloodgateflight59a%3Bfloodgateflight70a%3Bfloodgateflight98cf%3Bwordfloodgateflight79%3B&ageGroup=0&sessionUserType=2 HTTP/1.1Host: messaging.engagement.office.comConnection: keep-alivex-clientsessionid: b00eba45-6f2f-4470-db51-ff8505938c35sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0x-correlationid: 04b4011c-c4aa-4bc9-1052-a9414a6d0ad8Accept: /Origin: https://word-view.officeapps.live.comSec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://word-view.officeapps.live.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/9235dca16d5542b8/1742480549460/fiaY65Rgk3IK2-n HTTP/1.1Host: challenges.cloudflare.comConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: same-originSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://challenges.cloudflare.com/cdn-cgi/challenge-platform/h/b/turnstile/if/ov2/av0/rcv/8ag8x/0x4AAAAAABAl3NGwRhpSwuKK/auto/fbE/new/normal/auto/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/d/9235dca16d5542b8/1742480549460/fiaY65Rgk3IK2-n HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /campaignmetadataaggregator?country=US&locale=en-US&app=2155&platform=Web&version=16.0.18711.41002&campaignParams=pageWidth%3D1280%26pageHeight%3D897%26screenWidth%3D1280%26screenHeight%3D1024%26colorDepth%3D24%26more%3Dtrue%26OFC_Audience%3DProduction%26Datacenter%3DPUS8%26TenantId%3D40e3ab80-2024-45a3-bf76-7a0761a24d29%26SelfTriggerActivity%3D%3Bfloodgateflight100a%3Bfloodgateflight102cf%3Bfloodgateflight38a%3Bfloodgateflight59a%3Bfloodgateflight70a%3Bfloodgateflight98cf%3Bwordfloodgateflight79%26&contentType=CampaignContent%3BDynamicSettings&puid=&OFC_FLIGHTS=floodgateflight100a%3Bfloodgateflight102cf%3Bfloodgateflight38a%3Bfloodgateflight59a%3Bfloodgateflight70a%3Bfloodgateflight98cf%3Bwordfloodgateflight79%3B&ageGroup=0&sessionUserType=2 HTTP/1.1Host: messaging.engagement.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /SiDVKGPM?O=fQIxA0c HTTP/1.1Host: office.lillki.topConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://office.lillki.top/SiDVKGPMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: YZyi=ecef21ff447a713a1f82f8927ac3457e7692ef5059b06eb4efe298ad1c3f91f0; x-ms-gateway-slice=estsfd
Source: global traffic	HTTP traffic detected: GET /cdn-cgi/challenge-platform/h/b/flow/ov1/2061314903:1742476663:Lkt28gJDc_oJ2vshkNaWWpem-vagua3mmCKk9TEjw8M/9235dca16d5542b8/XDOoozGJUtQO_EoeEMHDOtFPNIVToI9RQLjiQN8wZTI-1742480548-1.1.1.1-hTpVdVW1Es65tk0gslG9Exz6pRcqyHUQg7IpnMojKFpD.88X8SisE6AIL8oxLBUE HTTP/1.1Host: challenges.cloudflare.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Host: office.lillki.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://office.lillki.top/SiDVKGPMAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: YZyi=ecef21ff447a713a1f82f8927ac3457e7692ef5059b06eb4efe298ad1c3f91f0; x-ms-gateway-slice=estsfd
Source: global traffic	HTTP traffic detected: GET /login HTTP/1.1Host: t.lillki.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: YZyi=ecef21ff447a713a1f82f8927ac3457e7692ef5059b06eb4efe298ad1c3f91f0
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638780773566722011.OTgyNGZkOTQtMDBhNi00Zjg2LTkwMWEtMDQ5ODhlYTVlY2Y0NjAxMzM0MzctNzJjMy00ZmRhLWFkZWQtOWRmODgxZTdlYTYz&ui_locales=en-US&mkt=en-US&client-request-id=b235a846-31d3-42fa-a675-d28c176fddb3&state=PcbuJpcBdRCE1qEdiq_wEGldM2b-TQ3On5xDXGrkG90xU1jb5NlE9t91vFp2Soqma8ziBAHQdXHBH9QkccsdfKd_pgFFxDGuTN4O6TRFUjIR6RwiPJ9vUoaL7Hv7lrQEhGfFdnWCprIACkHlPYG5Or9t7G5wfmiuA5Lz6vk8qO5I2U_IJnux2hGfCGQ5G9G529z28zZtVrJQ89e-YsZlnwoKFTdoZlO12UjfSawBfwhgoSmNXApX4NLlRbWFR1kDMe9rmwg1G-eG8-JPVpVO2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0 HTTP/1.1Host: office.lillki.topConnection: keep-aliveUpgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Referer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: YZyi=ecef21ff447a713a1f82f8927ac3457e7692ef5059b06eb4efe298ad1c3f91f0; x-ms-gateway-slice=estsfd; fpc=Al1lXDrWktlCseqezl2q7rc; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQENrP9o5QG9qh8sRHuamnb7j1iekjizRc45TEJ6386Q0LaBy_GzJQubLUv0Jcw6ja4e4wqNkPwO9k24yy7GE9Gqnb48Xwtc1LMDZ5EcX5nfe1ocClOuj7Gr-Nv_Vlu8o7Ip0jEsJNNnBiVmwtRApc5xojuLoXC7gCVeYfjLcVgNbMgAA; stsservicecookie=estsfd
Source: global traffic	HTTP traffic detected: GET /suite/RemoteTelemetry.ashx?usid=97bd0300-a334-1f54-7d50-391cfbd39df0 HTTP/1.1Host: common.online.office.comConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: vhg.lillki.topConnection: keep-aliveOrigin: https://office.lillki.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watsonsupportwithjquery.3.5.min_dc940oomzau4rsu8qesnvg2.js HTTP/1.1Host: vhg.lillki.topConnection: keep-aliveOrigin: https://office.lillki.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/BssoInterrupt_Core_9810YxmrLqOR1rQ4anyNMg2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://office.lillki.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/frameworksupport.min_oadrnc13magb009k4d20lg2.js HTTP/1.1Host: vhg.lillki.topConnection: keep-aliveOrigin: https://office.lillki.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/watson.min_q5ptmu8aniymd4ftuqdkda2.js HTTP/1.1Host: vhg.lillki.topConnection: keep-aliveOrigin: https://office.lillki.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638780773566722011.OTgyNGZkOTQtMDBhNi00Zjg2LTkwMWEtMDQ5ODhlYTVlY2Y0NjAxMzM0MzctNzJjMy00ZmRhLWFkZWQtOWRmODgxZTdlYTYz&ui_locales=en-US&mkt=en-US&client-request-id=b235a846-31d3-42fa-a675-d28c176fddb3&state=PcbuJpcBdRCE1qEdiq_wEGldM2b-TQ3On5xDXGrkG90xU1jb5NlE9t91vFp2Soqma8ziBAHQdXHBH9QkccsdfKd_pgFFxDGuTN4O6TRFUjIR6RwiPJ9vUoaL7Hv7lrQEhGfFdnWCprIACkHlPYG5Or9t7G5wfmiuA5Lz6vk8qO5I2U_IJnux2hGfCGQ5G9G529z28zZtVrJQ89e-YsZlnwoKFTdoZlO12UjfSawBfwhgoSmNXApX4NLlRbWFR1kDMe9rmwg1G-eG8-JPVpVO2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0&sso_reload=true HTTP/1.1Host: office.lillki.topConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-originSec-Fetch-Mode: navigateSec-Fetch-Dest: documentReferer: https://office.lillki.top/common/oauth2/v2.0/authorize?client_id=4765445b-32c6-49b0-83e6-1d93765276ca&redirect_uri=https%3A%2F%2Fwww.office.com%2Flandingv2&response_type=code%20id_token&scope=openid%20profile%20https%3A%2F%2Fwww.office.com%2Fv2%2FOfficeHome.All&response_mode=form_post&nonce=638780773566722011.OTgyNGZkOTQtMDBhNi00Zjg2LTkwMWEtMDQ5ODhlYTVlY2Y0NjAxMzM0MzctNzJjMy00ZmRhLWFkZWQtOWRmODgxZTdlYTYz&ui_locales=en-US&mkt=en-US&client-request-id=b235a846-31d3-42fa-a675-d28c176fddb3&state=PcbuJpcBdRCE1qEdiq_wEGldM2b-TQ3On5xDXGrkG90xU1jb5NlE9t91vFp2Soqma8ziBAHQdXHBH9QkccsdfKd_pgFFxDGuTN4O6TRFUjIR6RwiPJ9vUoaL7Hv7lrQEhGfFdnWCprIACkHlPYG5Or9t7G5wfmiuA5Lz6vk8qO5I2U_IJnux2hGfCGQ5G9G529z28zZtVrJQ89e-YsZlnwoKFTdoZlO12UjfSawBfwhgoSmNXApX4NLlRbWFR1kDMe9rmwg1G-eG8-JPVpVO2g&x-client-SKU=ID_NET8_0&x-client-ver=8.5.0.0Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: YZyi=ecef21ff447a713a1f82f8927ac3457e7692ef5059b06eb4efe298ad1c3f91f0; x-ms-gateway-slice=estsfd; fpc=Al1lXDrWktlCseqezl2q7rc; esctx=PAQABBwEAAABVrSpeuWamRam2jAF1XRQENrP9o5QG9qh8sRHuamnb7j1iekjizRc45TEJ6386Q0LaBy_GzJQubLUv0Jcw6ja4e4wqNkPwO9k24yy7GE9Gqnb48Xwtc1LMDZ5EcX5nfe1ocClOuj7Gr-Nv_Vlu8o7Ip0jEsJNNnBiVmwtRApc5xojuLoXC7gCVeYfjLcVgNbMgAA; stsservicecookie=estsfd; esctx-q91f2kgcL8I=AQABCQEAAABVrSpeuWamRam2jAF1XRQE020Df-DeeVnAmsPCoK92_5W6p7wfVogEiC6DGbZUCGnKBOXsX0ASwBYprOGe4Mf9dIcQhrQwsVen-E1CidFg3_c8QceW1UOPv5B3FFaZ93jPQP4j3wPdE_fbRTAbLdP1g4EzC1lgUeA8-pYyPw8ScCAA; AADSSO=NA\|NoExtension; SSOCOOKIEPULLED=1
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/converged.v2.login.min_81imvbluez-v5hbzpkxfcg2.css HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://office.lillki.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/css,/;q=0.1Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: styleReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/ConvergedLogin_PCore_GjP1RdcVSKf6ASC7mgkR1g2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://office.lillki.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_r1sg5sxlkljjoa22hvk04g2.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveOrigin: https://office.lillki.topsec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywb.lillki.topConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Purpose: prefetchSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: YZyi=ecef21ff447a713a1f82f8927ac3457e7692ef5059b06eb4efe298ad1c3f91f0
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/oneDs_f2e0f4a029670f10d892.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pcustomizationloader_72a1051aa2aa2943d8c1.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pfetchsessionsprogress_4ba7c391e6f3f547d8ce.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_white_8257b0707cbe1d0bd2661b80068676fe.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /Me.htm?v=3 HTTP/1.1Host: ywb.lillki.topConnection: keep-alivesec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.7Sec-Fetch-Site: same-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: iframeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9Cookie: YZyi=ecef21ff447a713a1f82f8927ac3457e7692ef5059b06eb4efe298ad1c3f91f0; uaid=f4ad42aa72044f20888ab66e1d82030b; MSPRequ=id=N&lt=1742480562&co=1
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/marching_ants_986f40b5a9dc7d39ef8396797f61b323.gif HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/backgrounds/2_11d9e3bcdfede9ce5ce5ace2d129f1c4.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/js/asyncchunk/convergedlogin_pstringcustomizationhelper_c4928fb5cff147a39780.js HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: /Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: scriptSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/microsoft_logo_564db913a7fa0ca42727161c6d031bef.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-alivesec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36sec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"sec-ch-ua-mobile: ?0Accept: image/avif,image/webp,image/apng,image/svg+xml,image/,/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageSec-Fetch-Storage-Access: activeReferer: https://office.lillki.top/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /shared/1.0/content/images/signin-options_3e3f6b73c3f310c31d2c4d131a8ab8c6.svg HTTP/1.1Host: aadcdn.msftauth.netConnection: keep-aliveUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: /Sec-Fetch-Site: noneSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeAccept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic	DNS traffic detected: DNS query: depedph-my.sharepoint.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: common.online.office.com
Source: global traffic	DNS traffic detected: DNS query: office.lillki.top
Source: global traffic	DNS traffic detected: DNS query: challenges.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: js.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: storage.live.com
Source: global traffic	DNS traffic detected: DNS query: newassets.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: api.hcaptcha.com
Source: global traffic	DNS traffic detected: DNS query: messaging.engagement.office.com
Source: global traffic	DNS traffic detected: DNS query: t.lillki.top
Source: global traffic	DNS traffic detected: DNS query: vhg.lillki.top
Source: global traffic	DNS traffic detected: DNS query: aadcdn.msftauth.net
Source: global traffic	DNS traffic detected: DNS query: ywb.lillki.top
Source: global traffic	DNS traffic detected: DNS query: wordonline.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: identity.nel.measure.office.net
Source: global traffic	DNS traffic detected: DNS query: a.nel.cloudflare.com
Source: global traffic	DNS traffic detected: DNS query: m365cdn.nel.measure.office.net

Source: unknown

HTTP traffic detected: POST /checksiteconfig?v=14dbe0f1619b8014e2630bcdde727e7785a80dee&host=office.lillki.top&sitekey=234adb2f-52ba-4697-82fa-abecbb14b173&sc=1&swa=1&spst=1 HTTP/1.1Host: api.hcaptcha.comConnection: keep-aliveContent-Length: 0sec-ch-ua-platform: "Windows"User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36Accept: application/jsonsec-ch-ua: "Chromium";v="134", "Not:A-Brand";v="24", "Google Chrome";v="134"Content-Type: text/plainsec-ch-ua-mobile: ?0Origin: https://newassets.hcaptcha.comSec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: emptySec-Fetch-Storage-Access: activeReferer: https://newassets.hcaptcha.com/Accept-Encoding: gzip, deflate, br, zstdAccept-Language: en-US,en;q=0.9

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Thu, 20 Mar 2025 14:22:29 GMTTransfer-Encoding: chunkedConnection: closeCache-Control: privateNel: {"report_to":"network-errors","max_age":86400,"success_fraction":0.001,"failure_fraction":1.0}P3p: CP="DSP CUR OTPi IND OTRi ONL FIN"Referrer-Policy: strict-origin-when-cross-originReport-To: {"group":"network-errors","max_age":86400,"endpoints":[{"url":"https://identity.nel.measure.office.net/api/report?catId=GW+estsfd+wst"}]}X-Ms-Ests-Server: 2.1.20329.5 - SCUS ProdSlicesX-Ms-Request-Id: 0004c677-fbe8-4acb-b4d2-8c7a21ea2f00X-Ms-Srs: 1.PCF-Cache-Status: BYPASSSet-Cookie: x-ms-gateway-slice=estsfd; Path=/; HttpOnly; Secure; SameSite=NoneServer: cloudflareCF-RAY: 9235dca708c67c81-EWRalt-svc: h3=":443"; ma=86400server-timing: cfL4;desc="?proto=TCP&rtt=106561&min_rtt=105813&rtt_var=23459&sent=6&recv=8&lost=0&retrans=0&sent_bytes=2821&recv_bytes=1256&delivery_rate=34445&cwnd=238&unsent_bytes=0&cid=bcb1a7d71c647526&ts=3777&x=0"

Source: unknown	Network traffic detected: HTTP traffic on port 50145 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50217
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50219
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50174 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50139 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50175
Source: unknown	Network traffic detected: HTTP traffic on port 50151 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50174
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 50116 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50177
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50176
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50179
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50178
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50214
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50180
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50182
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50181
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50184
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50062
Source: unknown	Network traffic detected: HTTP traffic on port 50180 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50183
Source: unknown	Network traffic detected: HTTP traffic on port 50125 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50177 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50219 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50186
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50185
Source: unknown	Network traffic detected: HTTP traffic on port 50113 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50186 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50188
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50221
Source: unknown	Network traffic detected: HTTP traffic on port 50056 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50187
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50220
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50223
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50222
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50225
Source: unknown	Network traffic detected: HTTP traffic on port 50222 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50224
Source: unknown	Network traffic detected: HTTP traffic on port 50025 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50183 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50191
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50190
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50193
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50159 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50116
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50172 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50078
Source: unknown	Network traffic detected: HTTP traffic on port 50130 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50175 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50062 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50086
Source: unknown	Network traffic detected: HTTP traffic on port 50224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50125
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50178 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50095
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50139
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 50170 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50193 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50130
Source: unknown	Network traffic detected: HTTP traffic on port 50187 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50135
Source: unknown	Network traffic detected: HTTP traffic on port 50078 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50137
Source: unknown	Network traffic detected: HTTP traffic on port 50221 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50135 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50184 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 50169 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50144 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 50190 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50070 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50144
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50143
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50025
Source: unknown	Network traffic detected: HTTP traffic on port 50095 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50145
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50151
Source: unknown	Network traffic detected: HTTP traffic on port 50176 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 50086 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50166 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50143 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50157
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50159
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50182 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50217 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50179 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50137 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50161
Source: unknown	Network traffic detected: HTTP traffic on port 50163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50166
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50165
Source: unknown	Network traffic detected: HTTP traffic on port 50188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50168
Source: unknown	Network traffic detected: HTTP traffic on port 50220 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50167
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50169
Source: unknown	Network traffic detected: HTTP traffic on port 50157 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50171
Source: unknown	Network traffic detected: HTTP traffic on port 50185 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50170
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50173
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50172
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50214 -> 443

Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49768 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.72.100:443 -> 192.168.2.18:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.136.10:443 -> 192.168.2.18:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.24.129:443 -> 192.168.2.18:50025 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.24.129:443 -> 192.168.2.18:50024 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.18:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.18:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 20.135.17.52:443 -> 192.168.2.18:50056 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.18:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.95.41:443 -> 192.168.2.18:50062 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.229.21:443 -> 192.168.2.18:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.94.41:443 -> 192.168.2.18:50078 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.19.230.21:443 -> 192.168.2.18:50086 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.18:50116 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.111.229.20:443 -> 192.168.2.18:50135 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.24.129:443 -> 192.168.2.18:50151 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.108.11.12:443 -> 192.168.2.18:50159 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.218.237:443 -> 192.168.2.18:50161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.218.237:443 -> 192.168.2.18:50170 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.218.237:443 -> 192.168.2.18:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50178 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50182 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50183 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.209.72.9:443 -> 192.168.2.18:50185 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.133.160:443 -> 192.168.2.18:50219 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.190.80.1:443 -> 192.168.2.18:50218 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.201.34.72:443 -> 192.168.2.18:50217 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.44.133.184:443 -> 192.168.2.18:50220 version: TLS 1.2

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Windows\SystemTemp\scoped_dir4124_1788352745

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File deleted: C:\Windows\SystemTemp\scoped_dir4124_1788352745

Source: classification engine

Classification label: mal84.phis.winDOCX@21/93@52/215