Network Analysis

GET /download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21134&authkey=AFTe8YO6kjuEIKY HTTP/1.1 User-Agent: zipo Host: onedrive.live.com

HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://nt5jww.sn.files.1drv.com/y4miUsf9sljhXmJzfbHSzBV5TVv6fiYklyyLJPEpgu9KzrWNc5gYDHZ5coO5NjYF8gvoNogRS-nj7GhSKMxPrxvQ3lak9G-88eu_Cq_0vpnd6O5argxr9COAVP2XuxhXOOUg41KabEabJjei_JBLFmHefbSrURxPYQ6Q64IBRowInSxDPXSGnlovCWV-5-GfE7AD0nDVKiNxNQH-lNT6nWWzQ/Uogsnykzlubtojeyocmevzvkobqbwih?download&psid=1 Set-Cookie: E=P:l1jAsppt2Yg=:gFI5tfV7zK8WLwdWEHaZVoMt58S972mzRukhjzLOl9A=:F; domain=.live.com; path=/ Set-Cookie: xid=4843d2c5-f289-4e42-ab26-bc7832ef1afb&&RDE42AAC88D3F2&289; domain=.live.com; path=/ Set-Cookie: xidseq=1; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Wed, 01-Sep-2021 21:09:04 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Wed, 08-Sep-2021 22:49:04 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: RDE42AAC88D3F2 X-ODWebServer: canadacentral0-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 0224A4DC867F4AB6A9AC30B6A92BB697 Ref B: SLAEDGE1116 Ref C: 2021-09-01T22:49:04Z Date: Wed, 01 Sep 2021 22:49:04 GMT Content-Length: 0

GET /y4miUsf9sljhXmJzfbHSzBV5TVv6fiYklyyLJPEpgu9KzrWNc5gYDHZ5coO5NjYF8gvoNogRS-nj7GhSKMxPrxvQ3lak9G-88eu_Cq_0vpnd6O5argxr9COAVP2XuxhXOOUg41KabEabJjei_JBLFmHefbSrURxPYQ6Q64IBRowInSxDPXSGnlovCWV-5-GfE7AD0nDVKiNxNQH-lNT6nWWzQ/Uogsnykzlubtojeyocmevzvkobqbwih?download&psid=1 HTTP/1.1 User-Agent: zipo Host: nt5jww.sn.files.1drv.com Connection: Keep-Alive

HTTP/1.1 200 OK Cache-Control: public Content-Length: 582656 Content-Type: application/octet-stream Content-Location: https://nt5jww.sn.files.1drv.com/y4me2Oa38y8JFsQwPZYWULxyo1qlmQlBgMXCVuldpzWcqrcexzB1UN1paKAFI1um9TnXyv9I0IhwNtblFeICXZptAibvmZfb0Q3PwpR1kH7j4aJl2scl4Xmu1raAKmkqwbi0iQwZqPcHYYqTjUD5iLtUcNV9t-bqRbm1IsD7Wo7ZcK4Hg53yNIIDC0ARDMWW8-0 Expires: Tue, 30 Nov 2021 22:49:05 GMT Last-Modified: Wed, 01 Sep 2021 14:38:00 GMT Accept-Ranges: bytes ETag: D6676A9A61E841F3!134.2 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" X-MSNSERVER: SN3PPF24D145F64 Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: Las9RVk22kikegiIH6TR9A.0 X-SqlDataOrigin: S CTag: aYzpENjY3NkE5QTYxRTg0MUYzITEzNC4yNTc X-PreAuthInfo: rv;poba; Content-Disposition: attachment; filename="Uogsnykzlubtojeyocmevzvkobqbwih" X-Content-Type-Options: nosniff X-StreamOrigin: X X-AsmVersion: UNKNOWN; 19.749.824.2003 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: BD22B99003844E92B4C339A446217DFA Ref B: SLAEDGE1120 Ref C: 2021-09-01T22:49:04Z Date: Wed, 01 Sep 2021 22:49:04 GMT

GET /download?cid=D6676A9A61E841F3&resid=D6676A9A61E841F3%21134&authkey=AFTe8YO6kjuEIKY HTTP/1.1 User-Agent: aswe Host: onedrive.live.com Cache-Control: no-cache Cookie: E=P:l1jAsppt2Yg=:gFI5tfV7zK8WLwdWEHaZVoMt58S972mzRukhjzLOl9A=:F; xid=4843d2c5-f289-4e42-ab26-bc7832ef1afb&&RDE42AAC88D3F2&289; xidseq=1; wla42=

HTTP/1.1 302 Found Cache-Control: no-cache, no-store Pragma: no-cache Content-Type: text/html Expires: -1 Location: https://nt5jww.sn.files.1drv.com/y4mIIeLspNJ3K28H6JugwGsEdpXjFzjPVJT4bPmRd4s8yB8qLpYXzcLDUWXEYrVapMd-sie624Z-x4WyElcv_PZHofwwgvlFNVGzNabdNZAV9sCzBHopy1lzLXg4cDygzCE7AGKWqmXzrN1QPk3Ut_beGliD9n9FYGgNVj_ATz8BvVbleQmMNwRjbVfSqkBTOXQZGlXkhFhKT-u5Snr_Wtezw/Uogsnykzlubtojeyocmevzvkobqbwih?download&psid=1 Set-Cookie: E=P:2Ytus5pt2Yg=:Lp1INAMBUaiTckKobrsX54Vctkzg3rr84UEGCqTfb8g=:F; domain=.live.com; path=/ Set-Cookie: xidseq=2; domain=.live.com; path=/ Set-Cookie: LD=; domain=.live.com; expires=Wed, 01-Sep-2021 21:09:05 GMT; path=/ Set-Cookie: wla42=; domain=live.com; expires=Wed, 08-Sep-2021 22:49:05 GMT; path=/ X-Content-Type-Options: nosniff Strict-Transport-Security: max-age=31536000 X-MSNServer: RDE42AAC88D3F2 X-ODWebServer: canadacentral0-odwebpl X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 1B136112CCBA43E58D6D34C13FEB346D Ref B: SLAEDGE1116 Ref C: 2021-09-01T22:49:05Z Date: Wed, 01 Sep 2021 22:49:05 GMT Content-Length: 0

GET /y4mIIeLspNJ3K28H6JugwGsEdpXjFzjPVJT4bPmRd4s8yB8qLpYXzcLDUWXEYrVapMd-sie624Z-x4WyElcv_PZHofwwgvlFNVGzNabdNZAV9sCzBHopy1lzLXg4cDygzCE7AGKWqmXzrN1QPk3Ut_beGliD9n9FYGgNVj_ATz8BvVbleQmMNwRjbVfSqkBTOXQZGlXkhFhKT-u5Snr_Wtezw/Uogsnykzlubtojeyocmevzvkobqbwih?download&psid=1 HTTP/1.1 User-Agent: aswe Host: nt5jww.sn.files.1drv.com Cache-Control: no-cache Connection: Keep-Alive

HTTP/1.1 200 OK Cache-Control: public Content-Length: 582656 Content-Type: application/octet-stream Content-Location: https://nt5jww.sn.files.1drv.com/y4me2Oa38y8JFsQwPZYWULxyo1qlmQlBgMXCVuldpzWcqrcexzB1UN1paKAFI1um9TnXyv9I0IhwNtblFeICXZptAibvmZfb0Q3PwpR1kH7j4aJl2scl4Xmu1raAKmkqwbi0iQwZqPcHYYqTjUD5iLtUcNV9t-bqRbm1IsD7Wo7ZcK4Hg53yNIIDC0ARDMWW8-0 Expires: Tue, 30 Nov 2021 22:49:05 GMT Last-Modified: Wed, 01 Sep 2021 14:38:00 GMT Accept-Ranges: bytes ETag: D6676A9A61E841F3!134.2 P3P: CP="BUS CUR CONo FIN IVDo ONL OUR PHY SAMo TELo" X-MSNSERVER: SN3PPF453EAE022 Strict-Transport-Security: max-age=31536000; includeSubDomains MS-CV: vxDMtiCLUkSQWj2yPyYgXw.0 X-SqlDataOrigin: S CTag: aYzpENjY3NkE5QTYxRTg0MUYzITEzNC4yNTc X-PreAuthInfo: rv;poba; Content-Disposition: attachment; filename="Uogsnykzlubtojeyocmevzvkobqbwih" X-Content-Type-Options: nosniff X-StreamOrigin: X X-AsmVersion: UNKNOWN; 19.742.813.2004 X-Cache: CONFIG_NOCACHE X-MSEdge-Ref: Ref A: 1C3CEBAAF1B44184A9ED8330C1534FEC Ref B: SLAEDGE1118 Ref C: 2021-09-01T22:49:05Z Date: Wed, 01 Sep 2021 22:49:05 GMT