CapTipper Report

CapTipper

Analysis Info

PCAP File	Analysis Time	CapTipper Version	Traffic Time
/opt/Malware-Project/BigDataset/Scenarios/CTU-Malware-Capture-Botnet-335-1//2018-02-16_win8.pcap	02/16/18 20:50:21	0.3 b13	12/16/81 11:09:10

Flow View

Client Details

IP	192.168.1.118
MAC	08:00:27:c3:f9:98
USER-AGENT	Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0)

Conversations

www.revouninstaller.com (146.20.152.114:80)

ID

URI

RESPONSE TYPE

FILENAME

RESPONSE CODE

MAGIC

SIZE

TIME

0

/proinstall_thankyou.html

text/html

proinstall_thankyou.html

301 Moved Permanently

HTML

264.0 B

12/16/81 11:09:10

Download
SHA256	bab86376f04c18d5deec8954af50130372065da2b42ce87dc2fba5c7f596451f
Referer
Magic	HyperText Markup Language (HTML)
Request	GET /proinstall_thankyou.html HTTP/1.1 Accept: / Accept-Language: en-us User-Agent: Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 6.1; Trident/4.0; SLCC2; .NET CLR 2.0.50727; .NET CLR 3.5.30729; .NET CLR 3.0.30729; Media Center PC 6.0) Accept-Encoding: gzip, deflate Host: www.revouninstaller.com Connection: Keep-Alive
Response Header	HTTP/1.1 301 Moved Permanently Date: Sat, 10 Feb 2018 02:50:43 GMT Server: Apache Location: https://www.revouninstaller.com/proinstall_thankyou.html Content-Length: 264 Connection: close Content-Type: text/html; charset=iso-8859-1
Response Peek (128 B)	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Per...