1167 4:55:32 PM 6/10/2017 26.7047590 Havark_C.exe A 52.25.46.214 TCP TCP:Flags=......S., SrcPort=51052, DstPort=HTTPS(443), PayloadLen=0, Seq=3675843113, Ack=0, Win=8192 ( Negotiating scale factor 0x2 ) = 8192 {TCP:3, IPv4:43} 1171 4:55:32 PM 6/10/2017 26.7547739 Havark_C.exe 52.25.46.214 A TCP TCP:Flags=...A..S., SrcPort=HTTPS(443), DstPort=51052, PayloadLen=0, Seq=743377168, Ack=3675843114, Win=26883 ( Scale factor not supported ) = 26883 {TCP:3, IPv4:43} 1172 4:55:32 PM 6/10/2017 26.7548577 Havark_C.exe A 52.25.46.214 TCP TCP:Flags=...A...., SrcPort=51052, DstPort=HTTPS(443), PayloadLen=0, Seq=3675843114, Ack=743377169, Win=64240 (scale factor 0x0) = 64240 {TCP:3, IPv4:43} 1208 4:55:33 PM 6/10/2017 27.7751839 Havark_C.exe A 52.25.46.214 TLS TLS:TLS Rec Layer-1 HandShake: Client Hello. {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 1209 4:55:33 PM 6/10/2017 27.8159017 Havark_C.exe 52.25.46.214 A TCP TCP:Flags=...A...., SrcPort=HTTPS(443), DstPort=51052, PayloadLen=0, Seq=743377169, Ack=3675843631, Win=30016 (scale factor 0x0) = 30016 {TCP:3, IPv4:43} 1210 4:55:33 PM 6/10/2017 27.8159944 Havark_C.exe 52.25.46.214 A TLS TLS:TLS Rec Layer-1 HandShake: Server Hello.; TLS Rec Layer-2 HandShake: Certificate. {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 1211 4:55:33 PM 6/10/2017 27.8160003 Havark_C.exe 52.25.46.214 A TCP TCP:[Continuation to #1210]Flags=...A...., SrcPort=HTTPS(443), DstPort=51052, PayloadLen=1460, Seq=743378629 - 743380089, Ack=3675843631, Win=30016 (scale factor 0x0) = 30016 {TCP:3, IPv4:43} 1212 4:55:33 PM 6/10/2017 27.8160208 Havark_C.exe A 52.25.46.214 TCP TCP:Flags=...A...., SrcPort=51052, DstPort=HTTPS(443), PayloadLen=0, Seq=3675843631, Ack=743380089, Win=64240 (scale factor 0x0) = 64240 {TCP:3, IPv4:43} 1213 4:55:33 PM 6/10/2017 27.8163654 Havark_C.exe 52.25.46.214 A TCP TCP:[Continuation to #1210]Flags=...AP..., SrcPort=HTTPS(443), DstPort=51052, PayloadLen=1176, Seq=743380089 - 743381265, Ack=3675843631, Win=30016 (scale factor 0x0) = 30016 {TCP:3, IPv4:43} 1214 4:55:33 PM 6/10/2017 27.8170281 Havark_C.exe 52.25.46.214 A TLS TLS:Continued Data: 901 Bytes {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 1215 4:55:33 PM 6/10/2017 27.8170698 Havark_C.exe A 52.25.46.214 TCP TCP:Flags=...A...., SrcPort=51052, DstPort=HTTPS(443), PayloadLen=0, Seq=3675843631, Ack=743382166, Win=64240 (scale factor 0x0) = 64240 {TCP:3, IPv4:43} 1216 4:55:33 PM 6/10/2017 27.8196088 Havark_C.exe A 52.25.46.214 TLS TLS:TLS Rec Layer-1 HandShake: Client Key Exchange.; TLS Rec Layer-2 Cipher Change Spec; TLS Rec Layer-3 HandShake: Encrypted Handshake Message. {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 1220 4:55:33 PM 6/10/2017 27.8617673 Havark_C.exe 52.25.46.214 A TLS TLS:TLS Rec Layer-1 Cipher Change Spec; TLS Rec Layer-2 HandShake: Encrypted Handshake Message. {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 1221 4:55:33 PM 6/10/2017 27.8631408 Havark_C.exe A 52.25.46.214 TLS TLS:TLS Rec Layer-1 SSL Application Data {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 1222 4:55:33 PM 6/10/2017 27.9443135 Havark_C.exe 52.25.46.214 A TCP TCP:Flags=...A...., SrcPort=HTTPS(443), DstPort=51052, PayloadLen=0, Seq=743382217, Ack=3675844165, Win=31088 (scale factor 0x0) = 31088 {TCP:3, IPv4:43} 1226 4:55:34 PM 6/10/2017 27.9661488 Havark_C.exe 52.25.46.214 A TLS TLS:TLS Rec Layer-1 SSL Application Data {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 1235 4:55:34 PM 6/10/2017 28.1720354 Havark_C.exe A 52.25.46.214 TCP TCP:Flags=...A...., SrcPort=51052, DstPort=HTTPS(443), PayloadLen=0, Seq=3675844165, Ack=743382993, Win=63413 (scale factor 0x0) = 63413 {TCP:3, IPv4:43} 1240 4:55:34 PM 6/10/2017 28.2080559 Havark_C.exe 52.25.46.214 A TCP TCP:[ReTransmit #1226]Flags=...AP..., SrcPort=HTTPS(443), DstPort=51052, PayloadLen=776, Seq=743382217 - 743382993, Ack=3675844165, Win=31088 (scale factor 0x0) = 31088 {TCP:3, IPv4:43} 1241 4:55:34 PM 6/10/2017 28.2081083 Havark_C.exe A 52.25.46.214 TCP TCP:[Dup Ack #1235]Flags=...A...., SrcPort=51052, DstPort=HTTPS(443), PayloadLen=0, Seq=3675844165, Ack=743382993, Win=63413 (scale factor 0x0) = 63413 {TCP:3, IPv4:43} 1258 4:55:34 PM 6/10/2017 28.6600942 Havark_C.exe A 52.25.46.214 TLS TLS:TLS Rec Layer-1 SSL Application Data {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 1262 4:55:34 PM 6/10/2017 28.7019560 Havark_C.exe 52.25.46.214 A TCP TCP:Flags=...A...., SrcPort=HTTPS(443), DstPort=51052, PayloadLen=0, Seq=743382993, Ack=3675844773, Win=32224 (scale factor 0x0) = 32224 {TCP:3, IPv4:43} 1284 4:55:35 PM 6/10/2017 29.3262745 Havark_C.exe 52.25.46.214 A TLS TLS:TLS Rec Layer-1 SSL Application Data {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 1291 4:55:35 PM 6/10/2017 29.5330234 Havark_C.exe A 52.25.46.214 TCP TCP:Flags=...A...., SrcPort=51052, DstPort=HTTPS(443), PayloadLen=0, Seq=3675844773, Ack=743383783, Win=64240 (scale factor 0x0) = 64240 {TCP:3, IPv4:43} 7494 4:56:22 PM 6/10/2017 76.9300998 Havark_C.exe A 107.21.20.6 TCP TCP:Flags=......S., SrcPort=51066, DstPort=HTTPS(443), PayloadLen=0, Seq=3760728617, Ack=0, Win=8192 ( Negotiating scale factor 0x2 ) = 8192 {TCP:87, IPv4:91} 7506 4:56:23 PM 6/10/2017 77.0134020 Havark_C.exe 107.21.20.6 A TCP TCP:Flags=...A..S., SrcPort=HTTPS(443), DstPort=51066, PayloadLen=0, Seq=252743743, Ack=3760728618, Win=26883 ( Negotiated scale factor 0x8 ) = 6882048 {TCP:87, IPv4:91} 7507 4:56:23 PM 6/10/2017 77.0134533 Havark_C.exe A 107.21.20.6 TCP TCP:Flags=...A...., SrcPort=51066, DstPort=HTTPS(443), PayloadLen=0, Seq=3760728618, Ack=252743744, Win=16425 (scale factor 0x2) = 65700 {TCP:87, IPv4:91} 7508 4:56:23 PM 6/10/2017 77.0140611 Havark_C.exe A 107.21.20.6 TLS TLS:TLS Rec Layer-1 HandShake: Client Hello. {TLS:89, SSLVersionSelector:88, TCP:87, IPv4:91} 7520 4:56:23 PM 6/10/2017 77.1026938 Havark_C.exe 107.21.20.6 A TCP TCP:Flags=...A...., SrcPort=HTTPS(443), DstPort=51066, PayloadLen=0, Seq=252743744, Ack=3760729135, Win=110 (scale factor 0x8) = 28160 {TCP:87, IPv4:91} 7521 4:56:23 PM 6/10/2017 77.1027032 Havark_C.exe 107.21.20.6 A TCP TCP:[Dup Ack #7520]Flags=...A...., SrcPort=HTTPS(443), DstPort=51066, PayloadLen=0, Seq=252743744, Ack=3760729135, Win=110 (scale factor 0x8) = 28160 {TCP:87, IPv4:91} 7522 4:56:23 PM 6/10/2017 77.1036260 Havark_C.exe 107.21.20.6 A TLS TLS:TLS Rec Layer-1 HandShake: Server Hello.; TLS Rec Layer-2 HandShake: Certificate. {TLS:89, SSLVersionSelector:88, TCP:87, IPv4:91} 7523 4:56:23 PM 6/10/2017 77.1036383 Havark_C.exe 107.21.20.6 A TCP TCP:[Continuation to #7522]Flags=...A...., SrcPort=HTTPS(443), DstPort=51066, PayloadLen=1460, Seq=252745204 - 252746664, Ack=3760729135, Win=110 (scale factor 0x8) = 28160 {TCP:87, IPv4:91} 7524 4:56:23 PM 6/10/2017 77.1036411 Havark_C.exe 107.21.20.6 A TCP TCP:[Continuation to #7522]Flags=...AP..., SrcPort=HTTPS(443), DstPort=51066, PayloadLen=1176, Seq=252746664 - 252747840, Ack=3760729135, Win=110 (scale factor 0x8) = 28160 {TCP:87, IPv4:91} 7525 4:56:23 PM 6/10/2017 77.1036715 Havark_C.exe A 107.21.20.6 TCP TCP:Flags=...A...., SrcPort=51066, DstPort=HTTPS(443), PayloadLen=0, Seq=3760729135, Ack=252747840, Win=16425 (scale factor 0x2) = 65700 {TCP:87, IPv4:91} 7526 4:56:23 PM 6/10/2017 77.1050938 Havark_C.exe 107.21.20.6 A TLS TLS:Continued Data: 905 Bytes {TLS:89, SSLVersionSelector:88, TCP:87, IPv4:91} 7527 4:56:23 PM 6/10/2017 77.1065572 Havark_C.exe A 107.21.20.6 TLS TLS:TLS Rec Layer-1 HandShake: Client Key Exchange.; TLS Rec Layer-2 Cipher Change Spec; TLS Rec Layer-3 HandShake: Encrypted Handshake Message. {TLS:89, SSLVersionSelector:88, TCP:87, IPv4:91} 7537 4:56:23 PM 6/10/2017 77.1928356 Havark_C.exe 107.21.20.6 A TLS TLS:TLS Rec Layer-1 Cipher Change Spec; TLS Rec Layer-2 HandShake: Encrypted Handshake Message. {TLS:89, SSLVersionSelector:88, TCP:87, IPv4:91} 7538 4:56:23 PM 6/10/2017 77.1942872 Havark_C.exe A 107.21.20.6 TLS TLS:TLS Rec Layer-1 SSL Application Data {TLS:89, SSLVersionSelector:88, TCP:87, IPv4:91} 7550 4:56:23 PM 6/10/2017 77.2784701 Havark_C.exe 107.21.20.6 A TLS TLS:TLS Rec Layer-1 SSL Application Data {TLS:89, SSLVersionSelector:88, TCP:87, IPv4:91} 7576 4:56:23 PM 6/10/2017 77.4831102 Havark_C.exe A 107.21.20.6 TCP TCP:Flags=...A...., SrcPort=51066, DstPort=HTTPS(443), PayloadLen=0, Seq=3760730113, Ack=252749006, Win=16133 (scale factor 0x2) = 64532 {TCP:87, IPv4:91} 9215 4:56:35 PM 6/10/2017 89.8381650 Havark_C.exe 52.25.46.214 A TLS TLS:TLS Rec Layer-1 Encrypted Alert {TLS:5, SSLVersionSelector:4, TCP:3, IPv4:43} 9248 4:56:36 PM 6/10/2017 90.0388655 Havark_C.exe A 52.25.46.214 TCP TCP:Flags=...A...., SrcPort=51052, DstPort=HTTPS(443), PayloadLen=0, Seq=3675844773, Ack=743383814, Win=64209 (scale factor 0x0) = 64209 {TCP:3, IPv4:43} 9876 4:56:40 PM 6/10/2017 94.8500443 Havark_C.exe 52.25.46.214 A TCP TCP:Flags=...A...F, SrcPort=HTTPS(443), DstPort=51052, PayloadLen=0, Seq=743383814, Ack=3675844773, Win=32224 (scale factor 0x0) = 32224 {TCP:3, IPv4:43} 9877 4:56:40 PM 6/10/2017 94.8500880 Havark_C.exe A 52.25.46.214 TCP TCP:Flags=...A...., SrcPort=51052, DstPort=HTTPS(443), PayloadLen=0, Seq=3675844773, Ack=743383815, Win=64209 (scale factor 0x0) = 64209 {TCP:3, IPv4:43} 15240 4:57:23 PM 6/10/2017 137.3390938 Havark_C.exe 107.21.20.6 A TLS TLS:TLS Rec Layer-1 Encrypted Alert {TLS:89, SSLVersionSelector:88, TCP:87, IPv4:91} 15266 4:57:23 PM 6/10/2017 137.5387601 Havark_C.exe A 107.21.20.6 TCP TCP:Flags=...A...., SrcPort=51066, DstPort=HTTPS(443), PayloadLen=0, Seq=3760730113, Ack=252749037, Win=16125 (scale factor 0x2) = 64500 {TCP:87, IPv4:91} 15927 4:57:28 PM 6/10/2017 142.3331499 Havark_C.exe 107.21.20.6 A TCP TCP:Flags=...A...F, SrcPort=HTTPS(443), DstPort=51066, PayloadLen=0, Seq=252749037, Ack=3760730113, Win=116 (scale factor 0x8) = 29696 {TCP:87, IPv4:91} 15928 4:57:28 PM 6/10/2017 142.3331946 Havark_C.exe A 107.21.20.6 TCP TCP:Flags=...A...., SrcPort=51066, DstPort=HTTPS(443), PayloadLen=0, Seq=3760730113, Ack=252749038, Win=16125 (scale factor 0x2) = 64500 {TCP:87, IPv4:91}