Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

10

Static

static

5

4bcd9b4b41...71.exe

windows7-x64

10

4bcd9b4b41...71.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    111s
  • max time network
    119s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250207-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250207-enlocale:en-usos:windows10-2004-x64system
  • submitted
    12/02/2025, 15:59 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4bcd9b4b41fd4fa922924b0b02a35d2dae91d4101f7ba060be11735de9fa8371.exe

  • Size

    43KB

  • MD5

    891e3132ac5e6b82209ceafcea12f41c

  • SHA1

    d849546400baa08c756a8f5d420239cc233423f6

  • SHA256

    4bcd9b4b41fd4fa922924b0b02a35d2dae91d4101f7ba060be11735de9fa8371

  • SHA512

    70123ecaa233fccb1b8c34341d4bd1772deb6ecf7b75cb8c09fe18be6b7a9e57e5ab7be2867245625e05020d822267bb8aeab4f17e9d1beed4d1679c4b9f2adb

  • SSDEEP

    768:+U9XnKJv8KrtPNxT4oreP7cIK3yQpdk6x8pf9m4P/S0hVvIZiGDZ6RO8nHE8taq9:+U9abrtX4oocIK3yQkaY9z/S0hhy6k8/

Score
10/10
sakuladiscoverypersistencerattrojanupx

Malware Config

Signatures

  • Sakula

    Sakula is a remote access trojan with various capabilities.

    trojanratsakula
  • Sakula family
    sakula
  • Sakula payload 4 IoCs
  • Downloads MZ/PE file 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • UPX packed file 7 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 3 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4bcd9b4b41fd4fa922924b0b02a35d2dae91d4101f7ba060be11735de9fa8371.exe
    "C:\Users\Admin\AppData\Local\Temp\4bcd9b4b41fd4fa922924b0b02a35d2dae91d4101f7ba060be11735de9fa8371.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1296
    • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:3652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c ping 127.0.0.1 & del /q "C:\Users\Admin\AppData\Local\Temp\4bcd9b4b41fd4fa922924b0b02a35d2dae91d4101f7ba060be11735de9fa8371.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • System Network Configuration Discovery: Internet Connection Discovery
      • Suspicious use of WriteProcessMemory
      PID:3992
      • C:\Windows\SysWOW64\PING.EXE
        ping 127.0.0.1
        3⤵
        • System Location Discovery: System Language Discovery
        • System Network Configuration Discovery: Internet Connection Discovery
        • Runs ping.exe
        PID:4592
  • C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
    "C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NDMzMDYzOTgtMkNFMC00QjFCLTkzMTItRDIzRkQ0QThERUQwfSIgdXNlcmlkPSJ7NUM2MDMyODQtRDc2MS00MTQxLTkwNzEtRTU5OUYxNDQyNENDfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7MDQ1QTJBOTYtMUNDQy00NUJELTgwODEtOUM3RDM1MDZFOUFFfSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI0IiBpbnN0YWxsZGF0ZXRpbWU9IjE3Mzg5NDY4ODkiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4MzQxOTM2NTgwOTAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI0OTIxOTE0MDI1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
    1⤵
    • System Location Discovery: System Language Discovery
    • System Network Configuration Discovery: Internet Connection Discovery
    PID:2184

Network

  • flag-us
    DNS
    citrix.vipreclod.com
    MediaCenter.exe
    Remote address:
    8.8.8.8:53
    Request
    citrix.vipreclod.com
    IN A
    Response
  • flag-us
    DNS
    msedge.api.cdp.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    msedge.api.cdp.microsoft.com
    IN A
    Response
    msedge.api.cdp.microsoft.com
    IN CNAME
    api.cdp.microsoft.com
    api.cdp.microsoft.com
    IN CNAME
    glb.api.prod.dcat.dsp.trafficmanager.net
    glb.api.prod.dcat.dsp.trafficmanager.net
    IN A
    4.151.228.221
  • flag-us
    DNS
    msedge.api.cdp.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    msedge.api.cdp.microsoft.com
    IN A
  • flag-us
    POST
    https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates
    Remote address:
    4.151.228.221:443
    Request
    POST /api/v2/contents/Browser/namespaces/Default/names?action=batchupdates HTTP/2.0
    host: msedge.api.cdp.microsoft.com
    cache-control: no-cache
    pragma: no-cache
    content-type: application/json
    user-agent: Microsoft Edge Update/1.3.195.43;winhttp
    x-old-uid: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    ms-correlationid: {43306398-2CE0-4B1B-9312-D23FD4A8DED0}
    ms-requestid: {C4E08E16-1571-47D4-9F8A-EB4860BAE379}
    ms-cv: mGMwQ+AsG0uTEtI/1Kje0A.0
    x-last-hr: 0x0
    x-last-http-status-code: 0
    x-retry-count: 0
    x-http-attempts: 1
    content-length: 2539
  • flag-us
    DNS
    citrix.vipreclod.com
    MediaCenter.exe
    Remote address:
    8.8.8.8:53
    Request
    citrix.vipreclod.com
    IN A
    Response
  • flag-us
    DNS
    citrix.vipreclod.com
    MediaCenter.exe
    Remote address:
    8.8.8.8:53
    Request
    citrix.vipreclod.com
    IN A
  • flag-us
    POST
    https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates
    Remote address:
    4.151.228.221:443
    Request
    POST /api/v2/contents/Browser/namespaces/Default/names?action=batchupdates HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Content-Type: application/json
    User-Agent: Microsoft Edge Update/1.3.195.43;winhttp
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    MS-CorrelationId: {43306398-2CE0-4B1B-9312-D23FD4A8DED0}
    MS-RequestId: {C4E08E16-1571-47D4-9F8A-EB4860BAE379}
    MS-CV: mGMwQ+AsG0uTEtI/1Kje0A.0
    X-Last-HR: 0x0
    X-Last-HTTP-Status-Code: 0
    X-Retry-Count: 0
    X-HTTP-Attempts: 1
    Content-Length: 2539
    Host: msedge.api.cdp.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 297
    Content-Type: text/plain; charset=utf-8
    Content-Type: application/json; charset=utf-8
    Date: Wed, 12 Feb 2025 16:00:07 GMT
    MS-CorrelationId: 43306398-2ce0-4b1b-9312-d23fd4a8ded0
    MS-RequestId: c4e08e16-1571-47d4-9f8a-eb4860bae379
    MS-CV: {43306398-2CE0-4B1B-9312-D23FD4A8DED0}.0
  • flag-us
    POST
    https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/133.0.3065.59/files?action=GenerateDownloadInfo&foregroundPriority=false
    Remote address:
    4.151.228.221:443
    Request
    POST /api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/133.0.3065.59/files?action=GenerateDownloadInfo&foregroundPriority=false HTTP/1.1
    Cache-Control: no-cache
    Connection: Keep-Alive
    Pragma: no-cache
    Content-Type: application/json
    User-Agent: Microsoft Edge Update/1.3.195.43;winhttp
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    MS-CorrelationId: {43306398-2CE0-4B1B-9312-D23FD4A8DED0}
    MS-RequestId: {BFC26AE9-29B9-4BE9-B2C7-2C148781FF3B}
    MS-CV: mGMwQ+AsG0uTEtI/1Kje0A.1
    X-Last-HR: 0x0
    X-Last-HTTP-Status-Code: 0
    X-Retry-Count: 0
    X-HTTP-Attempts: 1
    Content-Length: 2
    Host: msedge.api.cdp.microsoft.com
    Response
    HTTP/1.1 200 OK
    Content-Length: 5336
    Content-Type: text/plain; charset=utf-8
    Content-Type: application/json; charset=utf-8
    Date: Wed, 12 Feb 2025 16:00:09 GMT
    MS-CorrelationId: 43306398-2ce0-4b1b-9312-d23fd4a8ded0
    MS-RequestId: bfc26ae9-29b9-4be9-b2c7-2c148781ff3b
    MS-CV: {43306398-2CE0-4B1B-9312-D23FD4A8DED0}.0
  • flag-us
    DNS
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    IN A
    Response
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    IN CNAME
    star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com
    star.b.tlu.dl.delivery.mp.microsoft.com.delivery.microsoft.com
    IN CNAME
    cdp-f-tlu-net.trafficmanager.net
    cdp-f-tlu-net.trafficmanager.net
    IN CNAME
    edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com
    edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com
    IN A
    91.81.130.133
    edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com
    IN A
    91.81.129.182
    edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com
    IN A
    91.81.129.181
    edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com
    IN A
    91.80.49.85
    edge.ds-c7114-microsoft.global.dns.qwilted-cds.cqloud.com
    IN A
    91.80.49.22
  • flag-us
    DNS
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    IN A
  • flag-us
    DNS
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    Remote address:
    8.8.8.8:53
    Request
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    IN A
  • flag-us
    DNS
    citrix.vipreclod.com
    MediaCenter.exe
    Remote address:
    8.8.8.8:53
    Request
    citrix.vipreclod.com
    IN A
    Response
  • flag-it
    HEAD
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    HEAD /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 200 OK
    Date: Wed, 12 Feb 2025 16:00:44 GMT
    Content-Type: application/octet-stream
    Content-Length: 178604088
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a20258d-2845831920-1
    Ocn-Served-By: QLT
    Accept-Ranges: bytes
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=0-1119
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:45 GMT
    Content-Type: application/octet-stream
    Content-Length: 1120
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a2026f6-2845831920-2
    Ocn-Served-By: QLT
    Content-Range: bytes 0-1119/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=1120-2305
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:47 GMT
    Content-Type: application/octet-stream
    Content-Length: 1186
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a2046a6-2845831920-3
    Ocn-Served-By: QLT
    Content-Range: bytes 1120-2305/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=2306-4862
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:48 GMT
    Content-Type: application/octet-stream
    Content-Length: 2557
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a205a85-2845831920-4
    Ocn-Served-By: QLT
    Content-Range: bytes 2306-4862/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=4863-13746
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:49 GMT
    Content-Type: application/octet-stream
    Content-Length: 8884
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a206a00-2845831920-5
    Ocn-Served-By: QLT
    Content-Range: bytes 4863-13746/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=13747-35629
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:51 GMT
    Content-Type: application/octet-stream
    Content-Length: 21883
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a2082fd-2845831920-6
    Ocn-Served-By: QLT
    Content-Range: bytes 13747-35629/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=35630-51801
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:51 GMT
    Content-Type: application/octet-stream
    Content-Length: 16172
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a208a17-2845831920-7
    Ocn-Served-By: QLT
    Content-Range: bytes 35630-51801/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=51802-145095
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:52 GMT
    Content-Type: application/octet-stream
    Content-Length: 93294
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a209a74-2845831920-8
    Ocn-Served-By: QLT
    Content-Range: bytes 51802-145095/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=145096-316748
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:53 GMT
    Content-Type: application/octet-stream
    Content-Length: 171653
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a20ab1e-2845831920-9
    Ocn-Served-By: QLT
    Content-Range: bytes 145096-316748/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=316749-491174
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:54 GMT
    Content-Type: application/octet-stream
    Content-Length: 174426
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a20bafb-2845831920-10
    Ocn-Served-By: QLT
    Content-Range: bytes 316749-491174/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=491175-895937
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:56 GMT
    Content-Type: application/octet-stream
    Content-Length: 404763
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a20cb72-2845831920-11
    Ocn-Served-By: QLT
    Content-Range: bytes 491175-895937/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=895938-1437104
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:00:57 GMT
    Content-Type: application/octet-stream
    Content-Length: 541167
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a20dc4f-2845831920-12
    Ocn-Served-By: QLT
    Content-Range: bytes 895938-1437104/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=1437105-1688331
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:01:07 GMT
    Content-Type: application/octet-stream
    Content-Length: 251227
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a217d40-2845831920-13
    Ocn-Served-By: QLT
    Content-Range: bytes 1437105-1688331/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=1688332-1891707
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:01:08 GMT
    Content-Type: application/octet-stream
    Content-Length: 203376
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a219178-2845831920-14
    Ocn-Served-By: QLT
    Content-Range: bytes 1688332-1891707/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=1891708-2101043
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:01:10 GMT
    Content-Type: application/octet-stream
    Content-Length: 209336
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a21a78e-2845831920-15
    Ocn-Served-By: QLT
    Content-Range: bytes 1891708-2101043/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=2101044-2356710
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:01:10 GMT
    Content-Type: application/octet-stream
    Content-Length: 255667
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a21b327-2845831920-16
    Ocn-Served-By: QLT
    Content-Range: bytes 2101044-2356710/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=2356711-2663335
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:01:12 GMT
    Content-Type: application/octet-stream
    Content-Length: 306625
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a21ce2f-2845831920-17
    Ocn-Served-By: QLT
    Content-Range: bytes 2356711-2663335/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=2663336-3001928
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:01:13 GMT
    Content-Type: application/octet-stream
    Content-Length: 338593
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a21d682-2845831920-18
    Ocn-Served-By: QLT
    Content-Range: bytes 2663336-3001928/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=3001929-3337032
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:01:15 GMT
    Content-Type: application/octet-stream
    Content-Length: 335104
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a21fb41-2845831920-19
    Ocn-Served-By: QLT
    Content-Range: bytes 3001929-3337032/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-it
    GET
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    Remote address:
    91.81.129.182:80
    Request
    GET /filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d HTTP/1.1
    Connection: Keep-Alive
    Accept: */*
    Accept-Encoding: identity
    If-Unmodified-Since: Mon, 10 Feb 2025 02:10:08 GMT
    Range: bytes=3337033-3730876
    User-Agent: Microsoft BITS/7.8
    X-Old-UID: {47FB9468-8872-4D4A-8613-AEEF19F10815}; age=-1; cnt=2
    X-Last-HR: 0x80070422
    X-Last-HTTP-Status-Code: 500
    X-Retry-Count: 0
    X-HTTP-Attempts: 2
    Host: msedge.b.tlu.dl.delivery.mp.microsoft.com
    Response
    HTTP/1.1 206 Partial Content
    Date: Wed, 12 Feb 2025 16:01:15 GMT
    Content-Type: application/octet-stream
    Content-Length: 393844
    Connection: keep-alive
    Cache-Control: public, max-age=17280000
    X-AspNetMvc-Version: 5.3
    MS-CorrelationId: b7f68eea-eb72-49dc-8a98-06d8579ddfb8
    MS-RequestId: 38e89f31-2058-4f40-a9db-fda0a65f415a
    MS-CV: z0TyYAApQ0SnTPhTzEiNVQ.0.1.1.6.1.1.2.0
    X-AspNet-Version: 4.0.30319
    X-Powered-By: ASP.NET
    X-Powered-By: ARR/3.0
    X-Powered-By: ASP.NET
    Last-Modified: Mon, 10 Feb 2025 02:10:08 GMT
    ETag: "BajKwfS+sHh4GdiCWW5erzQdfdY="
    X-CID: 9
    X-CCC: it
    Ocn-Cache-Status: HIT
    Ocn-Requestid: 100000059a2203e1-2845831920-20
    Ocn-Served-By: QLT
    Content-Range: bytes 3337033-3730876/178604088
    Server: Qwilt
    X-OC-Service-Type: lo
  • flag-us
    DNS
    citrix.vipreclod.com
    MediaCenter.exe
    Remote address:
    8.8.8.8:53
    Request
    citrix.vipreclod.com
    IN A
    Response
  • flag-us
    DNS
    citrix.vipreclod.com
    MediaCenter.exe
    Remote address:
    8.8.8.8:53
    Request
    citrix.vipreclod.com
    IN A
  • 4.151.228.221:443
    https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates
    tls, http2
    6.5kB
     6.2kB
     21
    13

    HTTP Request

    POST https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates
  • 4.151.228.221:443
    https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/133.0.3065.59/files?action=GenerateDownloadInfo&foregroundPriority=false
    tls, http
    10.8kB
     11.9kB
     22
    16

    HTTP Request

    POST https://msedge.api.cdp.microsoft.com/api/v2/contents/Browser/namespaces/Default/names?action=batchupdates

    HTTP Response

    200

    HTTP Request

    POST https://msedge.api.cdp.microsoft.com/api/v1.1/internal/contents/Browser/namespaces/Default/names/msedge-stable-win-x64/versions/133.0.3065.59/files?action=GenerateDownloadInfo&foregroundPriority=false

    HTTP Response

    200
  • 91.81.130.133:80
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    260 B
     5
  • 91.81.129.182:80
    http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d
    http
    115.9kB
     3.7MB
     1860
    2642

    HTTP Request

    HEAD http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    200

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206

    HTTP Request

    GET http://msedge.b.tlu.dl.delivery.mp.microsoft.com/filestreamingservice/files/fed55805-2e85-41d8-b4e3-4ef6b5ebf63a?P1=1739980810&P2=404&P3=2&P4=JTSDkPq5gZOLNOkxaDHmqShTLBv1dYQ%2b4KSdr6DyenvfpuKTrDooRRn5FvYUrQjr5nIYcnlCiMIVn1d4pH45aQ%3d%3d

    HTTP Response

    206
  • 184.22.175.13:80
    MediaCenter.exe
    260 B
     5
  • 8.8.8.8:53
    citrix.vipreclod.com
    dns
    MediaCenter.exe
    66 B
     134 B
     1
    1

    DNS Request

    citrix.vipreclod.com

  • 8.8.8.8:53
    msedge.api.cdp.microsoft.com
    dns
    148 B
     158 B
     2
    1

    DNS Request

    msedge.api.cdp.microsoft.com

    DNS Request

    msedge.api.cdp.microsoft.com

    DNS Response

    4.151.228.221

  • 8.8.8.8:53
    citrix.vipreclod.com
    dns
    MediaCenter.exe
    132 B
     134 B
     2
    1

    DNS Request

    citrix.vipreclod.com

    DNS Request

    citrix.vipreclod.com

  • 8.8.8.8:53
    msedge.b.tlu.dl.delivery.mp.microsoft.com
    dns
    261 B
     344 B
     3
    1

    DNS Request

    msedge.b.tlu.dl.delivery.mp.microsoft.com

    DNS Request

    msedge.b.tlu.dl.delivery.mp.microsoft.com

    DNS Request

    msedge.b.tlu.dl.delivery.mp.microsoft.com

    DNS Response

    91.81.130.133
    91.81.129.182
    91.81.129.181
    91.80.49.85
    91.80.49.22

  • 8.8.8.8:53
    citrix.vipreclod.com
    dns
    MediaCenter.exe
    66 B
     134 B
     1
    1

    DNS Request

    citrix.vipreclod.com

  • 8.8.8.8:53
    citrix.vipreclod.com
    dns
    MediaCenter.exe
    132 B
     134 B
     2
    1

    DNS Request

    citrix.vipreclod.com

    DNS Request

    citrix.vipreclod.com

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\MicroMedia\MediaCenter.exe
    Filesize

    43KB

    MD5

    612ce837e0a4a850fe93a0914ffde92c

    SHA1

    bb39c10f43e1959ab4ced3efaae60a0b16b31df2

    SHA256

    6514a833343ed4779b38366148144021332bea53017a2c9fb254f79b46e90b58

    SHA512

    ded6cbf47522f8e1d7874e780fcffa700c99e7460956c74f2a2e586a22529af03458433f30b756261e934bfa07ba2ba93277f6d63841fd3d9c6f804377ecf934

    Download Submit

  • memory/1296-0-0x0000000000800000-0x000000000081F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1296-6-0x0000000000800000-0x000000000081F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/1296-14-0x0000000000800000-0x000000000081F000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3652-5-0x0000000000690000-0x00000000006AF000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3652-8-0x0000000000690000-0x00000000006AF000-memory.dmp

    Filesize

    124KB

    Download

  • memory/3652-19-0x0000000000690000-0x00000000006AF000-memory.dmp

    Filesize

    124KB

    Download

We care about your privacy.

This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.