#Fields: id timestamp timestamp_end time-taken c-ip cs-username c-port r-ip r-port cs-uri cs-bytes sc-bytes cs-bodylength sc-bodylength cs-headerlength sc-headerlength cs(User-Agent) rs(Content-Type) cs-method sc-status cs(Referer) N/A N/A N/A x-risk-score rs(Location) s-action label 1 1489674726.81 1489674726.88 72 192.168.1.123 - 49158 193.70.86.51 80 http://193.70.86.51/checkupdate 1128 405 664 209 438 175 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)' text/html; charset=iso-8859-1 POST 404 http://193.70.86.51/ - - - - - - CTU.Win13.test.Malicious 2 1489674736.53 1489674736.61 80 192.168.1.123 - 49160 193.70.86.51 80 http://193.70.86.51/checkupdate 1596 405 1131 209 439 175 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)' text/html; charset=iso-8859-1 POST 404 http://193.70.86.51/ - - - - - - CTU.Win13.test.Malicious 3 1489674757.49 1489674757.57 74 192.168.1.123 - 49162 193.70.86.51 80 http://193.70.86.51/checkupdate 1128 405 664 209 438 175 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)' text/html; charset=iso-8859-1 POST 404 http://193.70.86.51/ - - - - - - CTU.Win13.test.Malicious 4 1489674767.14 1489674767.21 74 192.168.1.123 - 49164 193.70.86.51 80 http://193.70.86.51/checkupdate 1596 405 1131 209 439 175 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)' text/html; charset=iso-8859-1 POST 404 http://193.70.86.51/ - - - - - - CTU.Win13.test.Malicious 5 1489674788.1 1489674788.18 84 192.168.1.123 - 49166 193.70.86.51 80 http://193.70.86.51/checkupdate 1128 405 664 209 438 175 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)' text/html; charset=iso-8859-1 POST 404 http://193.70.86.51/ - - - - - - CTU.Win13.test.Malicious 6 1489674797.74 1489674797.81 74 192.168.1.123 - 49167 193.70.86.51 80 http://193.70.86.51/checkupdate 1596 405 1131 209 439 175 'Mozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)' text/html; charset=iso-8859-1 POST 404 http://193.70.86.51/ - - - - - - CTU.Win13.test.Malicious