Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

10

b6b72cd7d9...98.exe

windows7-x64

10

b6b72cd7d9...98.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    148s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09/02/2025, 04:31 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b6b72cd7d9143f8ec845893ccf3dc74e850c0bb0e308f0ecb4c54aeb5ff86f98.exe

  • Size

    92KB

  • MD5

    9539c01fdb566eba7251c27b06225f08

  • SHA1

    b7567b406d97690cacf55ea020a214cd125d1661

  • SHA256

    b6b72cd7d9143f8ec845893ccf3dc74e850c0bb0e308f0ecb4c54aeb5ff86f98

  • SHA512

    2782ea2b51b937e40a342dd769a183f2997903d8508a9be3b1e2b209fc8e1b00da72a575f3694429281677307d1a5e757250ad0b1a5c0ae909250fec6854b747

  • SSDEEP

    1536:TJbCiJVkgMaT2itTkjoRXnM48dXFajVPYxCEtkz30rtru:9bfVk29te2jqxCEtg30Ba

Score
10/10
sakuladiscoverypersistencerattrojan

Malware Config

Extracted

Family

sakula

C2

www.savmpet.com

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Sakula family
    sakula
  • Sakula payload 1 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b6b72cd7d9143f8ec845893ccf3dc74e850c0bb0e308f0ecb4c54aeb5ff86f98.exe
    "C:\Users\Admin\AppData\Local\Temp\b6b72cd7d9143f8ec845893ccf3dc74e850c0bb0e308f0ecb4c54aeb5ff86f98.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4580
    • C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
      C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3576
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\b6b72cd7d9143f8ec845893ccf3dc74e850c0bb0e308f0ecb4c54aeb5ff86f98.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:1680
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7RkNDOTM0OTAtRjY4RS00NkQyLTlCQkUtMTE2OEFGNDFDMzBCfSIgdXNlcmlkPSJ7Q0EwMUIwMzAtODQzRC00Njg2LUExNTktQTE2RDY5N0FDNDM0fSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7NDQ3MjQzNkYtQzFCNy00NDdELTgzRDktMjlFNEJDMjhGNjRFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSIxIiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDU4NjAiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxODIxNjMwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTU2NTk2NTU3Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:4800

Network

  • flag-us
    DNS
    www.savmpet.com
    AdobeUpdate.exe
    Remote address:
    8.8.8.8:53
    Request
    www.savmpet.com
    IN A
    Response
    www.savmpet.com
    IN A
    52.34.198.229
  • flag-us
    DNS
    www.savmpet.com
    AdobeUpdate.exe
    Remote address:
    8.8.8.8:53
    Request
    www.savmpet.com
    IN A
  • flag-us
    POST
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240616078
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    POST /newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240616078 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Content-Length: 176
    Cache-Control: no-cache
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:09:22 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110162|1739110162|0|1|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: snkz=212.102.63.147; path=/; Expires=Thu, 15 Apr 2027 00:00:00 GMT
  • flag-us
    GET
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240617734
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    GET /photo/xfznpvic-1587550269.jpg?resid=240617734 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Cache-Control: no-cache
    Cookie: btst=; snkz=212.102.63.147; btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110162|1739110162|0|1|0
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:09:23 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110163|1739110162|0|2|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
  • flag-us
    DNS
    msedge.api.cdp.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    msedge.api.cdp.microsoft.com
    IN A
    Response
    msedge.api.cdp.microsoft.com
    IN CNAME
    api.cdp.microsoft.com
    api.cdp.microsoft.com
    IN CNAME
    glb.api.prod.dcat.dsp.trafficmanager.net
    glb.api.prod.dcat.dsp.trafficmanager.net
    IN A
    4.151.228.221
  • flag-us
    DNS
    msedge.api.cdp.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    msedge.api.cdp.microsoft.com
    IN A
  • flag-us
    POST
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240648234
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    POST /newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240648234 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Content-Length: 176
    Cache-Control: no-cache
    Cookie: snkz=212.102.63.147; btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110163|1739110162|0|2|0
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:09:54 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110194|1739110162|15|3|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
  • flag-us
    GET
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240649750
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    GET /photo/xfznpvic-1587550269.jpg?resid=240649750 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Cache-Control: no-cache
    Cookie: btst=; snkz=212.102.63.147; btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110194|1739110162|15|3|0
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:09:55 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110195|1739110162|8|4|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
  • flag-us
    POST
    https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates
    Remote address:
    4.151.228.221:443
    Request
    POST /api/v2/contents/Browser/namespaces/Default/names?action=batchupdates HTTP/2.0
    host: msedge.api.cdp.microsoft.com
    cache-control: no-cache
    pragma: no-cache
    content-type: application/json
    user-agent: Microsoft Edge Update/1.3.195.43;winhttp
    x-old-uid: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    ms-correlationid: {FCC93490-F68E-46D2-9BBE-1168AF41C30B}
    ms-requestid: {38435CE6-68CA-4616-A0F7-7B2264C600B2}
    ms-cv: kDTJ/I720kabvhFor0HDCw.0
    x-last-hr: 0x80072ee2
    x-last-http-status-code: 0
    x-retry-count: 0
    x-http-attempts: 2
    content-length: 2540
    Response
    HTTP/2.0 200
    content-type: text/plain; charset=utf-8
    content-type: application/json; charset=utf-8
    date: Sun, 09 Feb 2025 14:10:13 GMT
    content-length: 298
    ms-correlationid: fcc93490-f68e-46d2-9bbe-1168af41c30b
    ms-requestid: 38435ce6-68ca-4616-a0f7-7b2264c600b2
    ms-cv: {FCC93490-F68E-46D2-9BBE-1168AF41C30B}.0
  • flag-us
    POST
    https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/132.0.2957.140/files?action=GenerateDownloadInfo&foregroundPriority=false
    Remote address:
    4.151.228.221:443
    Request
    POST /api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/132.0.2957.140/files?action=GenerateDownloadInfo&foregroundPriority=false HTTP/2.0
    host: msedge.api.cdp.microsoft.com
    cache-control: no-cache
    pragma: no-cache
    content-type: application/json
    user-agent: Microsoft Edge Update/1.3.195.43;winhttp
    x-old-uid: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    ms-correlationid: {FCC93490-F68E-46D2-9BBE-1168AF41C30B}
    ms-requestid: {4964342C-A25C-40E4-B87C-D5C9151CD7D1}
    ms-cv: kDTJ/I720kabvhFor0HDCw.1
    x-last-hr: 0x0
    x-last-http-status-code: 0
    x-retry-count: 0
    x-http-attempts: 1
    content-length: 2
    Response
    HTTP/2.0 200
    content-type: text/plain; charset=utf-8
    content-type: application/json; charset=utf-8
    date: Sun, 09 Feb 2025 14:10:13 GMT
    content-length: 5351
    ms-correlationid: fcc93490-f68e-46d2-9bbe-1168af41c30b
    ms-requestid: 4964342c-a25c-40e4-b87c-d5c9151cd7d1
    ms-cv: {FCC93490-F68E-46D2-9BBE-1168AF41C30B}.0
  • flag-us
    DNS
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    IN A
    Response
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    IN CNAME
    star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com
    star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com
    IN CNAME
    cdp-f-tlu-net.trafficmanager.net
    cdp-f-tlu-net.trafficmanager.net
    IN CNAME
    wildcard.f.tlu.dl.delivery.mp.microsoft.com.edgesuite.net
    wildcard.f.tlu.dl.delivery.mp.microsoft.com.edgesuite.net
    IN CNAME
    a1847.dscd.akamai.net
    a1847.dscd.akamai.net
    IN A
    2.18.190.183
    a1847.dscd.akamai.net
    IN A
    2.18.190.162
  • flag-gb
    HEAD
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    HEAD /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 200 OK
    Cache-Control: public, max-age=17280000
    Content-Length: 177180216
    Content-Type: application/octet-stream
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    Accept-Ranges: bytes
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 57bc4fdb-5120-49b5-8001-a2329fc1e2df
    MS-RequestId: 9991e830-be9e-4e5d-a5d5-93f0bb823527
    MS-CV: CF4EFJgeEUeGqOzu.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Date: Sun, 09 Feb 2025 14:10:19 GMT
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=0-1119
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:19 GMT
    Content-Range: bytes 0-1119/177180216
    Content-Length: 1120
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=1120-3145
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:23 GMT
    Content-Range: bytes 1120-3145/177180216
    Content-Length: 2026
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=3146-5915
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:24 GMT
    Content-Range: bytes 3146-5915/177180216
    Content-Length: 2770
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=5916-8118
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:25 GMT
    Content-Range: bytes 5916-8118/177180216
    Content-Length: 2203
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=8119-14914
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:26 GMT
    Content-Range: bytes 8119-14914/177180216
    Content-Length: 6796
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=14915-54038
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:27 GMT
    Content-Range: bytes 14915-54038/177180216
    Content-Length: 39124
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=54039-117502
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:28 GMT
    Content-Range: bytes 54039-117502/177180216
    Content-Length: 63464
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=117503-134669
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:33 GMT
    Content-Range: bytes 117503-134669/177180216
    Content-Length: 17167
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=134670-236913
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:34 GMT
    Content-Range: bytes 134670-236913/177180216
    Content-Length: 102244
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=236914-264965
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:39 GMT
    Content-Range: bytes 236914-264965/177180216
    Content-Length: 28052
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=264966-285343
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:45 GMT
    Content-Range: bytes 264966-285343/177180216
    Content-Length: 20378
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=285344-326920
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:46 GMT
    Content-Range: bytes 285344-326920/177180216
    Content-Length: 41577
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=326921-457450
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:46 GMT
    Content-Range: bytes 326921-457450/177180216
    Content-Length: 130530
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=457451-693586
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:47 GMT
    Content-Range: bytes 457451-693586/177180216
    Content-Length: 236136
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=693587-1215450
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:48 GMT
    Content-Range: bytes 693587-1215450/177180216
    Content-Length: 521864
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=1215451-1576226
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:52 GMT
    Content-Range: bytes 1215451-1576226/177180216
    Content-Length: 360776
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=1576227-1833214
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:56 GMT
    Content-Range: bytes 1576227-1833214/177180216
    Content-Length: 256988
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=1833215-2370424
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:56 GMT
    Content-Range: bytes 1833215-2370424/177180216
    Content-Length: 537210
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-gb
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    Remote address:
    2.18.190.183:80
    Request
    GET /filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Thu, 30 Jan 2025 22:24:43 GMT
    Range: bytes=2370425-3486487
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {AC238266-8B6E-4810-9FF7-D53805793662}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Cache-Control: public, max-age=17280000
    Content-Type: application/octet-stream
    Accept-Ranges: bytes
    Server: Microsoft-IIS/10.0
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: 6f60f8cc-e39b-44d3-b4d4-339059ed8366
    MS-RequestId: c8e2eff3-3eeb-4f9c-9dc9-9aaf7fc8a933
    MS-CV: y9dBBsu9vkmE74iU.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Thu, 30 Jan 2025 22:24:43 GMT
    ETag: "Zn30nCFs7P9yX7o9FILxqytRM2k="
    Date: Sun, 09 Feb 2025 14:10:57 GMT
    Content-Range: bytes 2370425-3486487/177180216
    Content-Length: 1116063
    Connection: keep-alive
    X-CID: 2
    X-CCC: GB
  • flag-us
    POST
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240680250
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    POST /newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240680250 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Content-Length: 176
    Cache-Control: no-cache
    Cookie: snkz=212.102.63.147; btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110195|1739110162|8|4|0
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:10:26 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110226|1739110162|19|5|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
  • flag-us
    GET
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240681750
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    GET /photo/xfznpvic-1587550269.jpg?resid=240681750 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Cache-Control: no-cache
    Cookie: btst=; snkz=212.102.63.147; btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110226|1739110162|19|5|0
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:10:27 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110227|1739110162|10|6|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
  • flag-us
    POST
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240712218
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    POST /newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240712218 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Content-Length: 176
    Cache-Control: no-cache
    Cookie: snkz=212.102.63.147; btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110227|1739110162|10|6|0
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:11:00 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110260|1739110162|21|7|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
  • flag-us
    GET
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240715359
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    GET /photo/xfznpvic-1587550269.jpg?resid=240715359 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Cache-Control: no-cache
    Cookie: btst=; snkz=212.102.63.147; btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110260|1739110162|21|7|0
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:11:02 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110262|1739110162|11|8|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
  • flag-us
    POST
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240746859
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    POST /newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240746859 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Content-Length: 176
    Cache-Control: no-cache
    Cookie: snkz=212.102.63.147; btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110262|1739110162|11|8|0
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:11:33 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110293|1739110162|21|9|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
  • flag-us
    GET
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240748359
    AdobeUpdate.exe
    Remote address:
    52.34.198.229:80
    Request
    GET /photo/xfznpvic-1587550269.jpg?resid=240748359 HTTP/1.1
    User-Agent: iexplorer
    Host: www.savmpet.com
    Cache-Control: no-cache
    Cookie: btst=; snkz=212.102.63.147; btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110293|1739110162|21|9|0
    Response
    HTTP/1.1 200 OK
    Server: nginx
    Date: Sun, 09 Feb 2025 14:11:37 GMT
    Content-Type: text/html
    Transfer-Encoding: chunked
    Connection: close
    Set-Cookie: btst=; path=/; domain=.www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=; path=/; domain=www.savmpet.com; Max-Age=1; Expires=Thu, 01 Jan 1970 00:00:01 GMT; HttpOnly; SameSite=Lax;
    Set-Cookie: btst=cd65216ed321613503740cc58d7caf18|212.102.63.147|1739110297|1739110162|12|10|0; path=/; domain=.savmpet.com; Expires=Thu, 15 Apr 2027 00:00:00 GMT; HttpOnly; SameSite=Lax;
  • 52.34.198.229:80
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240616078
    http
    AdobeUpdate.exe
    626 B
     872 B
     6
    5

    HTTP Request

    POST http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240616078

    HTTP Response

    200
  • 52.34.198.229:80
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240617734
    http
    AdobeUpdate.exe
    574 B
     792 B
     7
    5

    HTTP Request

    GET http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240617734

    HTTP Response

    200
  • 4.151.228.221:443
    msedge.api.cdp.microsoft.com
    260 B
     5
  • 52.34.198.229:80
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240648234
    http
    AdobeUpdate.exe
    789 B
     801 B
     7
    5

    HTTP Request

    POST http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240648234

    HTTP Response

    200
  • 52.34.198.229:80
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240649750
    http
    AdobeUpdate.exe
    529 B
     792 B
     6
    5

    HTTP Request

    GET http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240649750

    HTTP Response

    200
  • 4.151.228.221:443
    https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/132.0.2957.140/files?action=GenerateDownloadInfo&foregroundPriority=false
    tls, http2
    4.8kB
     12.4kB
     23
    20

    HTTP Request

    POST https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates

    HTTP Response

    200

    HTTP Request

    POST https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/132.0.2957.140/files?action=GenerateDownloadInfo&foregroundPriority=false

    HTTP Response

    200
  • 2.18.190.183:80
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d
    http
    153.3kB
     3.8MB
     2145
    2765

    HTTP Request

    HEAD http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    200

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/0740036a-4e18-456d-96fa-d1d9c4ca4676?P1=1739715015&P2=404&P3=2&P4=jOIysSF6fMQ4tFPnXvAkAduTy2M2zJf3ta0pV3zkeCWFs1yBpSUY4u6AGoFIiTcMX1xejAynNXw2%2bDZYCaYnkg%3d%3d

    HTTP Response

    206
  • 52.34.198.229:80
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240680250
    http
    AdobeUpdate.exe
    789 B
     801 B
     7
    5

    HTTP Request

    POST http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240680250

    HTTP Response

    200
  • 52.34.198.229:80
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240681750
    http
    AdobeUpdate.exe
    529 B
     801 B
     6
    5

    HTTP Request

    GET http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240681750

    HTTP Response

    200
  • 52.34.198.229:80
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240712218
    http
    AdobeUpdate.exe
    2.4kB
     833 B
     12
    6

    HTTP Request

    POST http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240712218

    HTTP Response

    200
  • 52.34.198.229:80
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240715359
    http
    AdobeUpdate.exe
    581 B
     801 B
     7
    5

    HTTP Request

    GET http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240715359

    HTTP Response

    200
  • 52.34.198.229:80
    http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240746859
    http
    AdobeUpdate.exe
    1.0kB
     841 B
     12
    6

    HTTP Request

    POST http://www.savmpet.com/newimage.asp?imageid=xfznpvic-1587550269&type=0&resid=240746859

    HTTP Response

    200
  • 52.34.198.229:80
    http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240748359
    http
    AdobeUpdate.exe
    926 B
     802 B
     9
    5

    HTTP Request

    GET http://www.savmpet.com/photo/xfznpvic-1587550269.jpg?resid=240748359

    HTTP Response

    200
  • 8.8.8.8:53
    www.savmpet.com
    dns
    AdobeUpdate.exe
    122 B
     77 B
     2
    1

    DNS Request

    www.savmpet.com

    DNS Request

    www.savmpet.com

    DNS Response

    52.34.198.229

  • 8.8.8.8:53
    msedge.api.cdp.microsoft.com
    dns
    148 B
     158 B
     2
    1

    DNS Request

    msedge.api.cdp.microsoft.com

    DNS Request

    msedge.api.cdp.microsoft.com

    DNS Response

    4.151.228.221

  • 8.8.8.8:53
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    dns
    87 B
     328 B
     1
    1

    DNS Request

    msedge.b.tlu.dl.delivery.mp.microsoft.com

    DNS Response

    2.18.190.183
    2.18.190.162

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\AdobeUpdate.exe
    Filesize

    92KB

    MD5

    61efdc3a21d09e18f5f381064b436ad9

    SHA1

    a99f6e3894b03f26ad0cda05e8831b187cd6d638

    SHA256

    9a66e5987043aba3b8aa48edae109eb7de47f4c4eb2f136c8b2cab3fa8de7a4a

    SHA512

    779719d7244124868c7f9ce03e62ab4f3f5d4f0a6d8f8ba96b831b48616342b45941033551dc900371a7dc5a55bd311ae235c42ceae44984ff62f60c564de0ce

    Download Submit

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.