CapTipper

Analysis Info

PCAP File Analysis Time CapTipper Version Traffic Time
/opt/Malware-Project/Dataset/Botnet-Capture/beingAnalyzedAndPublished/CTU-Malware-Capture-Botnet-25/2014-01-25_capture_win3.pcap 06/01/15 15:14:59 0.2 b10 12/21/81 05:53:24

Flow View


Client Details

IP10.0.2.103
MAC08:00:27:3d:00:32
USER-AGENTMozilla/4.0 (compatible; MSIE 7.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)

Conversations

www.google.com    (173.194.39.148:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
0/text/html0.html302 FoundHTML255.0 B12/21/81 05:53:24

www.google.cz    (173.194.39.191:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
1/?gws_rd=cr&ei=HbfjUrW7Do_GswbNsQEtext/html1.html302 FoundHTML256.0 B12/23/81 03:46:34
13/?gws_rd=cr&ei=TNrjUriSCoTXswb3oIHwCQtext/html13.html302 FoundHTML259.0 B05/23/67 00:47:41
70/?gws_rd=cr&ei=H4HkUqW5Kobfswb_nIGAAQtext/html70.html302 FoundHTML259.0 B01/27/35 13:57:54
1416/?gws_rd=cr&ei=DtrmUv2FGo6TswasnYC4Bgtext/html1416.html302 FoundHTML259.0 B04/04/35 10:33:33
1530/?gws_rd=cr&ei=EvXmUrehBo3UsgbwpoGoCwtext/html1530.html302 FoundHTML259.0 B06/12/37 20:37:02
1649/?gws_rd=cr&ei=MzroUq-PMMeatQaIyoDICwtext/html1649.html302 FoundHTML259.0 B10/28/63 07:34:57
1681/?gws_rd=cr&ei=boDoUtyuIsOCtAbbu4DoDwtext/html1681.html302 FoundHTML259.0 B07/09/69 04:15:08
1815/?gws_rd=cr&ei=7arpUpjWNYbBtQb0l4GYDwtext/html1815.html302 FoundHTML259.0 B09/25/93 11:25:50
1831/?gws_rd=cr&ei=B87pUqPWLYTatAbv2YCIBgtext/html1831.html302 FoundHTML259.0 B07/31/96 11:59:15
1835/?gws_rd=cr&ei=z9bpUtWLK8eOtQb30oC4Dgtext/html1835.html302 FoundHTML259.0 B04/17/97 16:17:08
1839/?gws_rd=cr&ei=kd_pUsqrDdHDswbi34BQtext/html1839.html302 FoundHTML257.0 B01/02/98 02:40:31
1946/?gws_rd=cr&ei=z8zqUonCK4btswbx74CIAwtext/html1946.html302 FoundHTML259.0 B04/02/17 12:18:23
1962/?gws_rd=cr&ei=5e_qUrXcLYTUsgbV9IDoBwtext/html1962.html302 FoundHTML259.0 B02/06/20 02:13:17
1974/?gws_rd=cr&ei=SArrUoukI8eAtAaQxICYDwtext/html1974.html302 FoundHTML259.0 B03/28/22 21:29:39
1978/?gws_rd=cr&ei=DxPrUqD0LcnJtAaUuoHgDAtext/html1978.html302 FoundHTML259.0 B12/13/22 23:35:45
1982/?gws_rd=cr&ei=zRvrUrrdHKqCyAPeq4CwCwtext/html1982.html302 FoundHTML259.0 B08/29/23 23:28:42
1986/?gws_rd=cr&ei=nyTrUvCTL4nCtAbp2oC4Bwtext/html1986.html302 FoundHTML259.0 B05/17/24 08:27:29
1994/?gws_rd=cr&ei=MjbrUtbzH8rDtQa_kIGADAtext/html1994.html302 FoundHTML259.0 B10/20/25 00:53:25

xbalfukyxyusxkwgtwuxrnjjfa.info    (69.195.129.70:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
2/(2)text/plain(2)200 OK0.0 B05/20/89 09:57:57
5/(4)text/plain(4)200 OK0.0 B01/07/92 07:27:20
8/(6)text/plain(6)200 OK0.0 B08/26/44 14:15:10
12/(9)text/plain(9)200 OK0.0 B08/06/38 15:58:28
14/(10)text/plain(10)200 OK0.0 B09/10/02 08:13:47
17/(12)text/plain(12)200 OK0.0 B01/03/07 18:47:59
20/(14)text/plain(14)200 OK0.0 B02/10/15 00:23:17
24/(17)text/plain(17)200 OK0.0 B01/20/25 21:11:41
26/(18)text/plain(18)200 OK0.0 B07/16/31 01:04:47
29/(20)text/plain(20)200 OK0.0 B06/22/35 22:23:21
32/(22)text/plain(22)200 OK0.0 B07/24/44 10:56:42
35/(24)text/plain(24)200 OK0.0 B11/07/52 03:23:05
38/(26)text/plain(26)200 OK0.0 B10/06/58 00:36:16
41/(28)text/plain(28)200 OK0.0 B03/10/65 10:55:35
44/(30)text/plain(30)200 OK0.0 B09/20/71 15:30:30
47/(32)text/plain(32)200 OK0.0 B02/10/80 20:54:07
50/(34)text/plain(34)200 OK0.0 B03/14/86 19:59:28
54/(37)text/plain(37)200 OK0.0 B01/30/97 00:48:21
57/(39)text/plain(39)200 OK0.0 B08/15/03 20:58:10
60/(41)text/plain(41)200 OK0.0 B10/21/10 18:40:27
62/(42)text/plain(42)200 OK0.0 B12/15/16 20:25:19
65/(44)text/plain(44)200 OK0.0 B09/01/24 11:12:30
68/(46)text/plain(46)200 OK0.0 B04/14/30 22:57:51
71/(48)text/plain(48)200 OK0.0 B05/12/35 22:22:28
74/(50)text/plain(50)200 OK0.0 B12/05/43 21:58:45
77/(52)text/plain(52)200 OK0.0 B05/18/49 21:01:00
80/(54)text/plain(54)200 OK0.0 B10/16/59 21:53:43
83/(56)text/plain(56)200 OK0.0 B01/26/66 05:04:16
86/(58)text/plain(58)200 OK0.0 B01/04/71 21:47:08
89/(60)text/plain(60)200 OK0.0 B03/27/80 00:34:21
92/(62)text/plain(62)200 OK0.0 B10/11/86 21:17:34
95/(64)text/plain(64)200 OK0.0 B11/17/93 08:40:42
98/(66)text/plain(66)200 OK0.0 B09/07/00 09:25:56
101/(68)text/plain(68)200 OK0.0 B02/03/08 05:03:22
105/(71)text/plain(71)200 OK0.0 B07/15/17 19:56:16
107/(72)text/plain(72)200 OK0.0 B04/18/21 02:53:46
110/(74)text/plain(74)200 OK0.0 B08/31/28 14:01:25
114/(77)text/plain(77)200 OK0.0 B06/19/39 13:28:00
116/(78)text/plain(78)200 OK0.0 B01/05/43 17:35:32
119/(80)text/plain(80)200 OK0.0 B08/13/50 08:42:09
122/(82)text/plain(82)200 OK0.0 B12/11/56 08:03:27
125/(84)text/plain(84)200 OK0.0 B12/17/65 05:14:03
128/(86)text/plain(86)200 OK0.0 B12/12/73 23:24:18
131/(88)text/plain(88)200 OK0.0 B07/05/79 17:17:10
134/(90)text/plain(90)200 OK0.0 B05/25/86 13:39:28
137/(92)text/plain(92)200 OK0.0 B03/21/02 23:21:39
140/(94)text/plain(94)200 OK0.0 B01/27/03 15:09:50
144/(97)text/plain(97)200 OK0.0 B01/17/04 02:19:13
146/(98)text/plain(98)200 OK0.0 B08/30/04 11:19:01
149/(100)text/plain(100)200 OK0.0 B01/15/05 11:31:49
152/(102)text/plain(102)200 OK0.0 B01/18/06 10:49:59
155/(104)text/plain(104)200 OK0.0 B07/12/06 03:03:07
159/(107)text/plain(107)200 OK0.0 B08/25/07 11:49:54
162/(109)text/plain(109)200 OK0.0 B05/02/08 19:21:33
164/(110)text/plain(110)200 OK0.0 B08/24/08 19:37:01
167/(112)text/plain(112)200 OK0.0 B05/22/09 15:14:50
171/(115)text/plain(115)200 OK0.0 B06/20/10 01:54:50
173/(116)text/plain(116)200 OK0.0 B11/09/10 22:03:39
200/(142)text/plain(142)200 OK0.0 B12/09/11 09:26:58
229/(170)text/plain(170)200 OK0.0 B07/12/12 04:13:39
267/(207)text/plain(207)200 OK0.0 B03/24/13 12:40:39
293/(232)text/plain(232)200 OK0.0 B10/14/13 19:37:25
338/(276)text/plain(276)200 OK0.0 B08/07/14 02:58:50
381/(318)text/plain(318)200 OK0.0 B05/20/15 11:22:03
405/(341)text/plain(341)200 OK0.0 B11/24/15 18:13:05
445/(380)text/plain(380)200 OK0.0 B08/21/16 20:21:08
489/(423)text/plain(423)200 OK0.0 B06/16/17 03:18:40
521/(454)text/plain(454)200 OK0.0 B01/28/18 00:56:42
571/(503)text/plain(503)200 OK0.0 B12/26/18 04:52:44
595/(526)text/plain(526)200 OK0.0 B06/27/19 23:09:32
625/(555)text/plain(555)200 OK0.0 B02/06/20 09:33:40
686/(615)text/plain(615)200 OK0.0 B03/02/21 18:30:08
725/(653)text/plain(653)200 OK0.0 B11/28/21 02:30:03
757/(684)text/plain(684)200 OK0.0 B07/09/22 14:43:06
798/(724)text/plain(724)200 OK0.0 B04/21/23 14:26:40
836/(761)text/plain(761)200 OK0.0 B01/22/24 13:33:26
860/(784)text/plain(784)200 OK0.0 B07/21/24 02:11:43
919/(842)text/plain(842)200 OK0.0 B08/01/25 17:28:18
938/(860)text/plain(860)200 OK0.0 B01/16/26 18:10:31
975/(896)text/plain(896)200 OK0.0 B09/29/26 19:47:57
1004/(924)text/plain(924)200 OK0.0 B05/08/27 19:12:14
1071/(990)text/plain(990)200 OK0.0 B06/27/28 18:36:05
1083/(1001)text/plain(1001)200 OK0.0 B11/04/28 06:48:10
1128/(1045)text/plain(1045)200 OK0.0 B09/06/29 09:04:58
1173/(1089)text/plain(1089)200 OK0.0 B06/28/30 17:16:10
1221/(1136)text/plain(1136)200 OK0.0 B05/14/31 21:21:13
1228/(1142)text/plain(1142)200 OK0.0 B08/29/31 06:59:57
1291/(1204)text/plain(1204)200 OK0.0 B09/27/32 11:36:27
1316/(1228)text/plain(1228)200 OK0.0 B03/29/33 13:23:40
1360/(1271)text/plain(1271)200 OK0.0 B01/20/34 01:47:49
1405/(1315)text/plain(1315)200 OK0.0 B11/16/34 16:14:51
1422/(1331)text/plain(1331)200 OK0.0 B04/28/35 04:56:28
1485/(1393)text/plain(1393)200 OK0.0 B06/06/36 19:42:47
1501/(1408)text/plain(1408)200 OK0.0 B10/25/36 00:51:31

mffeswhmjvrothexwjnlzyxpza.info    (166.78.144.80:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
3/(3)text/html(3)200 OK0.0 B08/07/98 11:28:01
6/(5)text/html(5)200 OK0.0 B03/26/01 12:41:58
9/(7)text/html(7)200 OK0.0 B11/11/53 15:15:40
11/(8)text/html(8)200 OK0.0 B11/04/99 08:25:44
15/(11)text/html(11)200 OK0.0 B08/12/03 17:21:51
18/(13)text/html(13)200 OK0.0 B12/06/07 07:04:20
21/(15)text/html(15)200 OK0.0 B01/12/16 12:42:54
23/(16)text/html(16)200 OK0.0 B03/07/21 13:30:05
27/(19)text/html(19)200 OK0.0 B06/16/32 10:17:12
30/(21)text/html(21)200 OK0.0 B05/24/36 07:14:52
33/(23)text/html(23)200 OK0.0 B06/25/45 19:49:57
36/(25)text/html(25)200 OK0.0 B10/09/53 12:59:46
39/(27)text/html(27)200 OK0.0 B09/07/59 09:32:33
42/(29)text/html(29)200 OK0.0 B02/09/66 20:07:50
45/(31)text/html(31)200 OK0.0 B08/22/72 00:57:41
48/(33)text/html(33)200 OK0.0 B01/12/81 05:55:58
51/(35)text/html(35)200 OK0.0 B02/14/87 09:23:01
53/(36)text/html(36)200 OK0.0 B03/11/93 18:43:44
56/(38)text/html(38)200 OK0.0 B09/30/99 04:57:56
59/(40)text/html(40)200 OK0.0 B12/06/06 17:57:21
63/(43)text/html(43)200 OK0.0 B11/17/17 15:31:17
66/(45)text/html(45)200 OK0.0 B08/03/25 21:31:46
69/(47)text/html(47)200 OK0.0 B03/17/31 23:57:38
72/(49)text/html(49)200 OK0.0 B04/13/36 07:47:19
75/(51)text/html(51)200 OK0.0 B11/06/44 07:48:20
78/(53)text/html(53)200 OK0.0 B04/20/50 05:14:51
81/(55)text/html(55)200 OK0.0 B09/17/60 10:35:25
84/(57)text/html(57)200 OK0.0 B12/28/66 14:07:16
87/(59)text/html(59)200 OK0.0 B12/07/71 06:43:16
90/(61)text/html(61)200 OK0.0 B02/26/81 10:37:36
93/(63)text/html(63)200 OK0.0 B09/13/87 06:56:24
96/(65)text/html(65)200 OK0.0 B10/19/94 21:38:02
99/(67)text/html(67)200 OK0.0 B08/09/01 19:02:18
102/(69)text/html(69)200 OK0.0 B01/04/09 16:51:17
104/(70)text/html(70)200 OK0.0 B08/31/13 02:27:01
108/(73)text/html(73)200 OK0.0 B03/20/22 11:56:11
111/(75)text/html(75)200 OK0.0 B08/02/29 23:08:47
113/(76)text/html(76)200 OK0.0 B08/04/35 21:17:17
117/(79)text/html(79)200 OK0.0 B12/08/43 08:31:03
120/(81)text/html(81)200 OK0.0 B07/15/51 17:34:10
123/(83)text/html(83)200 OK0.0 B11/12/57 17:15:23
126/(85)text/html(85)200 OK0.0 B11/18/66 13:44:56
129/(87)text/html(87)200 OK0.0 B11/14/74 20:50:12
132/(89)text/html(89)200 OK0.0 B06/06/80 09:35:52
135/(91)text/html(91)200 OK0.0 B09/24/01 19:07:07
138/(93)text/html(93)200 OK0.0 B04/24/02 14:37:08
141/(95)text/html(95)200 OK0.0 B03/03/03 15:16:35
143/(96)text/html(96)200 OK0.0 B08/28/03 14:53:33
147/(99)text/html(99)200 OK0.0 B10/03/04 02:43:37
150/(101)text/html(101)200 OK0.0 B02/18/05 02:49:00
153/(103)text/html(103)200 OK0.0 B02/21/06 02:07:16
156/(105)text/html(105)200 OK0.0 B08/14/06 18:45:21
158/(106)text/html(106)200 OK0.0 B04/05/07 23:36:16
161/(108)text/html(108)200 OK0.0 B12/13/07 06:47:43
165/(111)text/html(111)200 OK0.0 B09/27/08 10:59:44
168/(113)text/html(113)200 OK0.0 B06/25/09 06:54:05
170/(114)text/html(114)200 OK0.0 B01/28/10 15:56:55
174/(117)text/html(117)200 OK0.0 B12/13/10 13:57:05
181/(123)text/html(123)200 OK0.0 B07/19/11 21:37:45
238/(179)text/html(179)200 OK0.0 B08/15/12 04:40:08
276/(216)text/html(216)200 OK0.0 B04/27/13 15:50:44
302/(241)text/html(241)200 OK0.0 B11/17/13 20:52:52
347/(285)text/html(285)200 OK0.0 B09/10/14 03:04:45
390/(327)text/html(327)200 OK0.0 B06/23/15 12:49:46
414/(350)text/html(350)200 OK0.0 B12/28/15 18:24:07
454/(389)text/html(389)200 OK0.0 B09/24/16 22:35:55
498/(432)text/html(432)200 OK0.0 B07/20/17 04:00:30
530/(463)text/html(463)200 OK0.0 B03/03/18 01:02:18
580/(512)text/html(512)200 OK0.0 B01/29/19 05:08:18
604/(535)text/html(535)200 OK0.0 B07/31/19 23:36:55
634/(564)text/html(564)200 OK0.0 B03/11/20 21:34:04
695/(624)text/html(624)200 OK0.0 B04/05/21 19:29:42
697/(625)text/html(625)200 OK0.0 B07/07/21 20:47:40
766/(693)text/html(693)200 OK0.0 B08/12/22 15:02:06
807/(733)text/html(733)200 OK0.0 B05/25/23 14:34:15
845/(770)text/html(770)200 OK0.0 B02/25/24 13:48:48
869/(793)text/html(793)200 OK0.0 B08/24/24 05:52:51
891/(814)text/html(814)200 OK0.0 B03/09/25 14:50:36
947/(869)text/html(869)200 OK0.0 B02/19/26 19:07:01
984/(905)text/html(905)200 OK0.0 B11/02/26 21:31:01
1013/(933)text/html(933)200 OK0.0 B06/11/27 20:03:02
1043/(962)text/html(962)200 OK0.0 B02/03/28 08:01:39
1092/(1010)text/html(1010)200 OK0.0 B12/08/28 09:12:48
1137/(1054)text/html(1054)200 OK0.0 B10/10/29 10:45:19
1182/(1098)text/html(1098)200 OK0.0 B08/01/30 21:19:32
1193/(1108)text/html(1108)200 OK0.0 B12/20/30 15:02:27
1237/(1151)text/html(1151)200 OK0.0 B10/02/31 12:33:05
1300/(1213)text/html(1213)200 OK0.0 B10/31/32 12:36:38
1325/(1237)text/html(1237)200 OK0.0 B05/02/33 15:35:28
1369/(1280)text/html(1280)200 OK0.0 B02/23/34 03:23:43
1414/(1324)text/html(1324)200 OK0.0 B12/20/34 17:11:11
1431/(1340)text/html(1340)200 OK0.0 B06/01/35 05:47:22
1457/(1365)text/html(1365)200 OK0.0 B01/10/36 01:39:29
1510/(1417)(1417)0.0 B11/28/36 02:42:58

www.google.cz    (173.194.39.152:80)
IDURIRESPONSE TYPEFILENAMERESPONSE CODEMAGICSIZETIME
4/?gws_rd=cr&ei=7r_jUubkKrPfygOAoIFYtext/html4.html302 FoundHTML257.0 B07/05/53 09:18:56
7/?gws_rd=cr&ei=t8jjUu-1AoGYyAO4poH4CQtext/html7.html302 FoundHTML259.0 B10/03/24 04:55:16
10/?gws_rd=cr&ei=gtHjUt35Da6LyQP884DABgtext/html10.html302 FoundHTML259.0 B02/03/96 14:03:03
16/?gws_rd=cr&ei=DuPjUsC2D4qXtAbOwYCYDgtext/html16.html302 FoundHTML259.0 B11/04/06 21:30:18
22/?gws_rd=cr&ei=l_TjUrPVIYiAyQP-5oG4Dwtext/html22.html302 FoundHTML259.0 B01/25/21 19:44:30
25/?gws_rd=cr&ei=Xv3jUtHbK-O7yAPKo4HIAwtext/html25.html302 FoundHTML259.0 B03/10/28 16:30:46
28/?gws_rd=cr&ei=LAbkUs-6Ooq5yQOgoIGQCwtext/html28.html302 FoundHTML259.0 B05/02/35 18:16:20
40/?gws_rd=cr&ei=SCnkUoP3FIKqtAb_joDoAwtext/html40.html302 FoundHTML259.0 B10/24/63 17:20:03
46/?gws_rd=cr&ei=2DrkUu-HDMrMswbq2ID4Bwtext/html46.html302 FoundHTML259.0 B01/22/78 05:26:56
49/?gws_rd=cr&ei=pEPkUuTnOcfKtAb-u4DICgtext/html49.html302 FoundHTML259.0 B03/13/85 13:15:56
76/?gws_rd=cr&ei=r5LkUoHDO8eFtAaKrICIBQtext/html76.html302 FoundHTML259.0 B04/27/49 13:49:35
79/?gws_rd=cr&ei=dpvkUsD4L4TQtQb94IHgDQtext/html79.html302 FoundHTML259.0 B06/10/56 00:31:10
82/?gws_rd=cr&ei=Q6TkUuakOY3KswaYpoHoCgtext/html82.html302 FoundHTML259.0 B07/31/63 19:41:52
91/?gws_rd=cr&ei=rr7kUvGhF4yFtQbdsYDwBAtext/html91.html302 FoundHTML259.0 B01/03/85 15:55:28
94/?gws_rd=cr&ei=dcfkUuUspaDJA5r5gHAtext/html94.html302 FoundHTML256.0 B02/16/92 22:06:25
109/?gws_rd=cr&ei=UfPkUsqWGeHAyQOns4DABQtext/html109.html302 FoundHTML259.0 B09/17/27 16:12:45
112/?gws_rd=cr&ei=HvzkUvXpN4b8ygPKoYC4Bgtext/html112.html302 FoundHTML259.0 B11/07/34 21:06:01
118/?gws_rd=cr&ei=sA3lUvTLHamCyQPapIGwCAtext/html118.html302 FoundHTML259.0 B02/07/49 08:45:50
124/?gws_rd=cr&ei=QB_lUq29OYPXswbfr4EItext/html124.html302 FoundHTML257.0 B05/09/63 13:05:33
127/?gws_rd=cr&ei=CSjlUtXqH8LQtQal-oCYBwtext/html127.html302 FoundHTML259.0 B06/24/70 01:09:57
130/?gws_rd=cr&ei=1zDlUvbyF8SUtQa8pYH4Cwtext/html130.html302 FoundHTML259.0 B08/14/77 16:09:53
136/?gws_rd=cr&ei=YkLlUob0CoaEtAb68YGwAgtext/html136.html302 FoundHTML259.0 B03/09/02 07:56:26
151/?gws_rd=cr&ei=W27lUqqFDIjnswaM94CYAgtext/html151.html302 FoundHTML259.0 B10/02/05 05:23:35
154/?gws_rd=cr&ei=GnflUq2RPNHFswbb0IHgAQtext/html154.html302 FoundHTML259.0 B06/18/06 10:49:15
157/?gws_rd=cr&ei=5H_lUu_DDIbfswb_nIGAAQtext/html157.html302 FoundHTML259.0 B03/05/07 18:36:24
160/?gws_rd=cr&ei=rIjlUra6KMfsswb7-IDgDQtext/html160.html302 FoundHTML259.0 B11/21/07 00:16:27
166/?gws_rd=cr&ei=QprlUvP_OsPStQa3r4HgDwtext/html166.html302 FoundHTML259.0 B04/25/09 02:35:48