To see labeled trace (links to see raw traffic is in benign trace)
Understanding of the trace:
id in BRM1 should be the identity for replying party website. For example, for bing.com, it is 264960; for msn.com, it is 1184; and for hotmail.com, it is 64855.
lc in BRM1 is a constant. It is always 1033.