Timeline

• Infected with htbot
• MD5: e515267ba19417974a63b51e4f7dd9e9

Wed Mar 4 15:12:11 CET 2015

started win9

Wed Mar 4 15:14:18 CET 2015

infected

Correctly infected

Mon Mar 9 11:40:09 CET 2015

Some days ago win9 stop sending packets, so I'm rebooting it. Strangely, the vm was stopped!!!! So I have to start it again. Weird. Now we made a new pcap file.

It is still infected.

Mon Mar 9 15:06:07 CET 2015

The server froze. A new capture was started