CapTipper

Analysis Info

PCAP File Analysis Time CapTipper Version Traffic Time
/opt/Malware-Project/BigDataset/Scenarios/CTU-Malware-Capture-Botnet-152-1//2016-02-12-capture_win9.pcap 02/12/16 02:13:26 0.2 b10 10/04/77 10:15:09

Flow View


Client Details

IP10.0.2.109
MAC08:00:27:61:d3:d3
USER-AGENTMozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)

Conversations

secwento.in    (185.118.142.71:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
0/zgyqmc6/index.phptext/htmlindex.php200 OKTEXT50.0 B10/04/77 10:15:09

gednksfwi.in    (176.31.62.77:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
1/zgyqmc6/index.php(2)text/htmlindex.php(2)200 OK0.0 B03/26/79 03:07:57
10/zgyqmc6/index.php(11)text/htmlindex.php(11)200 OK0.0 B10/04/08 01:24:47
11/zgyqmc6/index.php(12)text/htmlindex.php(12)200 OK0.0 B11/21/27 00:49:56
16/zgyqmc6/index.php(17)text/htmlindex.php(17)200 OK0.0 B09/07/12 14:52:48
19/zgyqmc6/index.php(20)text/htmlindex.php(20)200 OK0.0 B01/23/58 03:05:12
20/zgyqmc6/index.php(21)text/htmlindex.php(21)200 OK0.0 B12/27/74 10:56:16
24/zgyqmc6/index.php(25)text/htmlindex.php(25)200 OK0.0 B06/16/06 14:05:56
25/zgyqmc6/index.php(26)text/htmlindex.php(26)200 OK0.0 B08/02/07 05:57:00
32/zgyqmc6/index.php(33)text/htmlindex.php(33)200 OK0.0 B11/16/15 16:08:00
37/zgyqmc6/index.php(38)text/htmlindex.php(38)200 OK0.0 B06/20/23 01:09:10
38/zgyqmc6/index.php(39)text/htmlindex.php(39)200 OK0.0 B03/12/25 15:54:55
40/zgyqmc6/index.php(41)text/htmlindex.php(41)200 OK0.0 B01/20/28 17:09:01
42/zgyqmc6/index.php(43)text/htmlindex.php(43)200 OK0.0 B04/07/31 21:36:27
43/zgyqmc6/index.php(44)text/htmlindex.php(44)200 OK0.0 B08/29/32 14:29:02
47/zgyqmc6/index.php(48)text/htmlindex.php(48)200 OK0.0 B03/15/38 10:50:37
58/zgyqmc6/index.php(59)text/htmlindex.php(59)200 OK0.0 B11/05/51 10:31:57
64/zgyqmc6/index.php(65)text/htmlindex.php(65)200 OK0.0 B11/18/59 09:19:08
65/zgyqmc6/index.php(66)text/htmlindex.php(66)200 OK0.0 B07/15/61 21:20:34
66/zgyqmc6/index.php(67)text/htmlindex.php(67)200 OK0.0 B11/03/62 23:29:18
67/zgyqmc6/index.php(68)text/htmlindex.php(68)200 OK0.0 B03/17/64 02:31:37
69/zgyqmc6/index.php(70)text/htmlindex.php(70)200 OK0.0 B11/17/66 20:28:10
70/zgyqmc6/index.php(71)text/htmlindex.php(71)200 OK0.0 B01/20/68 21:29:52
71/zgyqmc6/index.php(72)text/htmlindex.php(72)200 OK0.0 B03/08/69 07:46:25
73/zgyqmc6/index.php(74)text/htmlindex.php(74)200 OK0.0 B12/21/71 05:12:08
75/zgyqmc6/index.php(76)text/htmlindex.php(76)200 OK0.0 B11/18/74 18:52:11
78/zgyqmc6/index.php(79)text/htmlindex.php(79)200 OK0.0 B01/19/78 06:06:52
81/zgyqmc6/index.php(82)text/htmlindex.php(82)200 OK0.0 B10/11/82 23:28:52
91/zgyqmc6/index.php(92)text/htmlindex.php(92)200 OK0.0 B06/01/98 20:49:12
92/zgyqmc6/index.php(93)text/htmlindex.php(93)200 OK0.0 B01/26/00 18:48:10
97/zgyqmc6/index.php(98)text/htmlindex.php(98)200 OK0.0 B11/20/06 19:10:46
104/zgyqmc6/index.php(105)text/htmlindex.php(105)200 OK0.0 B10/10/15 07:13:43
121/zgyqmc6/index.php(122)text/htmlindex.php(122)200 OK0.0 B06/29/40 06:10:45

gednksfwi.in    (176.31.62.78:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
2/zgyqmc6/index.php(3)text/htmlindex.php(3)200 OK0.0 B05/17/91 08:07:08
3/zgyqmc6/index.php(4)text/htmlindex.php(4)200 OK0.0 B11/29/01 07:48:49
6/zgyqmc6/index.php(7)text/htmlindex.php(7)200 OK0.0 B03/30/44 05:17:43
7/zgyqmc6/index.php(8)text/htmlindex.php(8)200 OK0.0 B11/17/56 13:09:33
8/zgyqmc6/index.php(9)text/htmlindex.php(9)200 OK0.0 B12/16/74 22:34:28
15/zgyqmc6/index.php(16)text/htmlindex.php(16)200 OK0.0 B07/29/96 22:22:43
23/zgyqmc6/index.php(24)text/htmlindex.php(24)200 OK0.0 B08/14/04 20:54:27
29/zgyqmc6/index.php(30)text/htmlindex.php(30)200 OK0.0 B01/24/12 12:47:51
30/zgyqmc6/index.php(31)text/htmlindex.php(31)200 OK0.0 B05/20/13 04:06:34
31/zgyqmc6/index.php(32)text/htmlindex.php(32)200 OK0.0 B10/12/14 21:39:11
41/zgyqmc6/index.php(42)text/htmlindex.php(42)200 OK0.0 B09/21/29 05:33:22
45/zgyqmc6/index.php(46)text/htmlindex.php(46)200 OK0.0 B08/08/35 12:02:19
48/zgyqmc6/index.php(49)text/htmlindex.php(49)200 OK0.0 B03/13/39 05:15:59
49/zgyqmc6/index.php(50)text/htmlindex.php(50)200 OK0.0 B05/25/40 05:49:23
52/zgyqmc6/index.php(53)text/htmlindex.php(53)200 OK0.0 B05/30/43 00:29:06
55/zgyqmc6/index.php(56)text/htmlindex.php(56)200 OK0.0 B08/30/47 15:37:08
56/zgyqmc6/index.php(57)text/htmlindex.php(57)200 OK0.0 B07/21/49 18:30:42
62/zgyqmc6/index.php(63)text/htmlindex.php(63)200 OK0.0 B01/05/57 21:28:30
63/zgyqmc6/index.php(64)text/htmlindex.php(64)200 OK0.0 B10/16/58 02:20:14
68/zgyqmc6/index.php(69)text/htmlindex.php(69)200 OK0.0 B10/21/65 21:54:40
76/zgyqmc6/index.php(77)text/htmlindex.php(77)200 OK0.0 B04/29/75 22:57:40
79/zgyqmc6/index.php(80)text/htmlindex.php(80)200 OK0.0 B05/26/79 22:33:19
84/zgyqmc6/index.php(85)text/htmlindex.php(85)200 OK0.0 B06/24/87 14:16:05
89/zgyqmc6/index.php(90)text/htmlindex.php(90)200 OK0.0 B08/15/95 14:04:12
95/zgyqmc6/index.php(96)text/htmlindex.php(96)200 OK0.0 B04/19/04 12:03:06
96/zgyqmc6/index.php(97)text/htmlindex.php(97)200 OK0.0 B07/29/05 02:50:26
102/zgyqmc6/index.php(103)text/htmlindex.php(103)200 OK0.0 B06/07/12 19:07:20
110/zgyqmc6/index.php(111)text/htmlindex.php(111)200 OK0.0 B10/13/23 04:32:19
116/zgyqmc6/index.php(117)text/htmlindex.php(117)200 OK0.0 B02/23/33 08:03:38
117/zgyqmc6/index.php(118)text/htmlindex.php(118)200 OK0.0 B10/07/34 03:19:52
122/zgyqmc6/index.php(123)text/htmlindex.php(123)200 OK0.0 B07/15/41 04:29:50
123/zgyqmc6/index.php(124)text/htmlindex.php(124)200 OK0.0 B09/16/42 18:28:06
124/zgyqmc6/index.php(125)text/htmlindex.php(125)200 OK0.0 B01/11/44 05:46:54
125/zgyqmc6/index.php(126)text/htmlindex.php(126)200 OK0.0 B08/21/45 14:06:42

gednksfwi.in    (87.98.254.64:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
4/zgyqmc6/index.php(5)text/htmlindex.php(5)200 OK0.0 B07/14/16 07:16:55
5/zgyqmc6/index.php(6)text/htmlindex.php(6)200 OK0.0 B10/24/28 06:25:15
9/zgyqmc6/index.php(10)text/htmlindex.php(10)200 OK0.0 B05/24/90 14:56:12
13/zgyqmc6/index.php(14)text/htmlindex.php(14)200 OK0.0 B06/29/60 11:58:20
14/zgyqmc6/index.php(15)text/htmlindex.php(15)200 OK0.0 B12/03/76 09:31:27
22/zgyqmc6/index.php(23)text/htmlindex.php(23)200 OK0.0 B12/26/02 05:11:14
33/zgyqmc6/index.php(34)text/htmlindex.php(34)200 OK0.0 B08/13/17 20:15:12
34/zgyqmc6/index.php(35)text/htmlindex.php(35)200 OK0.0 B01/14/19 15:11:53
39/zgyqmc6/index.php(40)text/htmlindex.php(40)200 OK0.0 B06/16/26 01:23:18
44/zgyqmc6/index.php(45)text/htmlindex.php(45)200 OK0.0 B05/28/34 00:53:55
50/zgyqmc6/index.php(51)text/htmlindex.php(51)200 OK0.0 B08/15/41 19:34:12
51/zgyqmc6/index.php(52)text/htmlindex.php(52)200 OK0.0 B09/15/41 01:39:08
59/zgyqmc6/index.php(60)text/htmlindex.php(60)200 OK0.0 B02/21/53 13:49:59
60/zgyqmc6/index.php(61)text/htmlindex.php(61)200 OK0.0 B03/19/54 08:05:20
61/zgyqmc6/index.php(62)text/htmlindex.php(62)200 OK0.0 B09/26/55 23:14:46
85/zgyqmc6/index.php(86)text/htmlindex.php(86)200 OK0.0 B05/18/89 10:53:47
87/zgyqmc6/index.php(88)text/htmlindex.php(88)200 OK0.0 B09/18/92 18:35:49
90/zgyqmc6/index.php(91)text/htmlindex.php(91)200 OK0.0 B10/08/96 16:47:04
94/zgyqmc6/index.php(95)text/htmlindex.php(95)200 OK0.0 B08/08/02 01:36:58
101/zgyqmc6/index.php(102)text/htmlindex.php(102)200 OK0.0 B05/11/11 03:14:30
103/zgyqmc6/index.php(104)text/htmlindex.php(104)200 OK0.0 B05/04/14 09:57:15
105/zgyqmc6/index.php(106)text/htmlindex.php(106)200 OK0.0 B12/30/16 18:04:45
107/zgyqmc6/index.php(108)text/htmlindex.php(108)200 OK0.0 B12/29/19 15:13:49
108/zgyqmc6/index.php(109)text/htmlindex.php(109)200 OK0.0 B05/07/21 02:49:12
109/zgyqmc6/index.php(110)text/htmlindex.php(110)200 OK0.0 B06/13/22 08:25:40
111/zgyqmc6/index.php(112)text/htmlindex.php(112)200 OK0.0 B01/02/25 20:18:08
112/zgyqmc6/index.php(113)text/htmlindex.php(113)200 OK0.0 B08/27/26 10:06:48
118/zgyqmc6/index.php(119)text/htmlindex.php(119)200 OK0.0 B03/24/36 05:10:04
119/zgyqmc6/index.php(120)text/htmlindex.php(120)200 OK0.0 B09/10/37 01:44:32

gednksfwi.in    (151.80.78.61:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
12/zgyqmc6/index.php(13)text/htmlindex.php(13)200 OK0.0 B12/14/43 02:11:55
17/zgyqmc6/index.php(18)text/htmlindex.php(18)200 OK0.0 B12/21/23 23:51:32
18/zgyqmc6/index.php(19)text/htmlindex.php(19)200 OK0.0 B06/02/39 18:57:51
21/zgyqmc6/index.php(22)text/htmlindex.php(22)200 OK0.0 B10/19/01 19:50:51
26/zgyqmc6/index.php(27)text/htmlindex.php(27)200 OK0.0 B08/10/07 13:16:03
27/zgyqmc6/index.php(28)text/htmlindex.php(28)200 OK0.0 B05/07/09 06:42:05
28/zgyqmc6/index.php(29)text/htmlindex.php(29)200 OK0.0 B06/21/10 05:47:33
35/zgyqmc6/index.php(36)text/htmlindex.php(36)200 OK0.0 B09/20/20 04:52:43
36/zgyqmc6/index.php(37)text/htmlindex.php(37)200 OK0.0 B11/17/21 00:24:41
46/zgyqmc6/index.php(47)text/htmlindex.php(47)200 OK0.0 B12/03/36 17:54:40
53/zgyqmc6/index.php(54)text/htmlindex.php(54)200 OK0.0 B01/13/45 15:02:34
54/zgyqmc6/index.php(55)text/htmlindex.php(55)200 OK0.0 B03/29/46 18:29:52
57/zgyqmc6/index.php(58)text/htmlindex.php(58)200 OK0.0 B09/19/50 00:09:13
72/zgyqmc6/index.php(73)text/htmlindex.php(73)200 OK0.0 B08/01/70 08:04:20
74/zgyqmc6/index.php(75)text/htmlindex.php(75)200 OK0.0 B07/15/73 14:53:47
77/zgyqmc6/index.php(78)text/htmlindex.php(78)200 OK0.0 B05/25/76 23:06:54
80/zgyqmc6/index.php(81)text/htmlindex.php(81)200 OK0.0 B02/20/81 22:11:24
82/zgyqmc6/index.php(83)text/htmlindex.php(83)200 OK0.0 B07/29/84 03:50:23
83/zgyqmc6/index.php(84)text/htmlindex.php(84)200 OK0.0 B10/19/85 18:13:48
86/zgyqmc6/index.php(87)text/htmlindex.php(87)200 OK0.0 B12/09/90 08:21:46
88/zgyqmc6/index.php(89)text/htmlindex.php(89)200 OK0.0 B06/05/94 06:06:56
93/zgyqmc6/index.php(94)text/htmlindex.php(94)200 OK0.0 B04/16/01 10:17:43
98/zgyqmc6/index.php(99)text/htmlindex.php(99)200 OK0.0 B05/09/08 20:21:36
99/zgyqmc6/index.php(100)text/htmlindex.php(100)200 OK0.0 B07/27/09 13:18:44
100/zgyqmc6/index.php(101)text/htmlindex.php(101)200 OK0.0 B03/10/11 21:26:57
106/zgyqmc6/index.php(107)text/htmlindex.php(107)200 OK0.0 B07/29/18 03:23:06
113/zgyqmc6/index.php(114)text/htmlindex.php(114)200 OK0.0 B10/29/27 18:54:20
114/zgyqmc6/index.php(115)text/htmlindex.php(115)200 OK0.0 B09/23/29 06:04:41
115/zgyqmc6/index.php(116)text/htmlindex.php(116)200 OK0.0 B06/09/31 10:50:57
120/zgyqmc6/index.php(121)text/htmlindex.php(121)200 OK0.0 B11/25/38 19:38:45

www.msftncsi.com    (92.122.51.50:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
126/ncsi.txttext/plainncsi.txt200 OKTEXT14.0 B08/26/22 03:37:18