Flow 2

Summary

Hosts
- 10.10.10.70:1036
- 10.10.10.10:4444
Start time: 1.265851 seconds
Last packet sniffed time: 87.587480 seconds
Protocol: TCP
Bytes of data: 1335961 bytes
Packet #s: 13 - 1152, 1169 - 1173, 1188 - 1197, 1202 - 1206, 1219 - 1228, 1244 - 1312, 1344 - 1502, 1561 - 1565
.pcap of this flow: packets.pcap

Packets and Data

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
13	1.265851	10.10.10.70:1036	10.10.10.10:4444	53	1923926394	0	------S-
14	1.265922	10.10.10.10:4444	10.10.10.70:1036	0	3810429404	1923926395	---A--S-
15	1.266218	10.10.10.70:1036	10.10.10.10:4444	54	1923926395	3810429405	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
16 - 715	1.526339	10.10.10.10:4444	10.10.10.70:1036	748036

View data:

Hex dump
View as text
Raw
Carved as SANS Forensic Challenge malware sample file transfer
- Contents carved to: carve0002
  - 'file' output:
```
evidence06.pcap_output/0002/carve0002: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
```
- Size: 748032
- MD5: b062cb8344cd3e296d8868fbef289c7c

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
716	1.732004	10.10.10.70:1036	10.10.10.10:4444	239	1923926395	3811177441	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
717 - 717	3.051923	10.10.10.70:1036	10.10.10.10:4444	94

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
718	3.052010	10.10.10.10:4444	10.10.10.70:1036	38211	3811177441	1923926489	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
719 - 719	3.159222	10.10.10.10:4444	10.10.10.70:1036	1324

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
720 - 720	3.199558	10.10.10.70:1036	10.10.10.10:4444	214

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
721	3.199643	10.10.10.10:4444	10.10.10.70:1036	38213	3811178765	1923926703	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
722 - 722	3.272036	10.10.10.10:4444	10.10.10.70:1036	75

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
723 - 723	3.272473	10.10.10.70:1036	10.10.10.10:4444	90

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
724	3.272574	10.10.10.10:4444	10.10.10.70:1036	38215	3811178840	1923926793	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
725 - 802	3.378938	10.10.10.10:4444	10.10.10.70:1036	81049

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
803	3.387487	10.10.10.70:1036	10.10.10.10:4444	262	1923926793	3811259889	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
804 - 806	3.485228	10.10.10.70:1036	10.10.10.10:4444	212

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
807	3.485263	10.10.10.10:4444	10.10.10.70:1036	38276	3811259889	1923927005	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
808 - 808	4.883467	10.10.10.10:4444	10.10.10.70:1036	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
809 - 811	4.893154	10.10.10.70:1036	10.10.10.10:4444	260

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
812	4.893603	10.10.10.10:4444	10.10.10.70:1036	38279	3811260006	1923927265	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
813 - 813	5.085099	10.10.10.10:4444	10.10.10.70:1036	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
814 - 816	5.096248	10.10.10.70:1036	10.10.10.10:4444	324

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
817	5.096720	10.10.10.10:4444	10.10.10.70:1036	38282	3811260123	1923927589	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
818 - 818	32.536563	10.10.10.10:4444	10.10.10.70:1036	133

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
819 - 821	32.549352	10.10.10.70:1036	10.10.10.10:4444	276

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
822	32.549828	10.10.10.10:4444	10.10.10.70:1036	38285	3811260256	1923927865	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
823 - 823	32.739165	10.10.10.10:4444	10.10.10.70:1036	229

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
824	32.893037	10.10.10.70:1036	10.10.10.10:4444	271	1923927865	3811260485	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
825 - 827	33.096240	10.10.10.70:1036	10.10.10.10:4444	228

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
828	33.096681	10.10.10.10:4444	10.10.10.70:1036	38288	3811260485	1923928093	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
829 - 1138	33.348598	10.10.10.10:4444	10.10.10.70:1036	317332

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1139 - 1141	33.408760	10.10.10.70:1036	10.10.10.10:4444	244

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1142	33.409247	10.10.10.10:4444	10.10.10.70:1036	38521	3811577817	1923928337	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1143 - 1143	33.605484	10.10.10.10:4444	10.10.10.70:1036	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1144 - 1146	33.611847	10.10.10.70:1036	10.10.10.10:4444	244

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1147	33.612321	10.10.10.10:4444	10.10.10.70:1036	38524	3811577934	1923928581	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1148 - 1148	33.810262	10.10.10.10:4444	10.10.10.70:1036	197

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1149 - 1151	33.877488	10.10.10.70:1036	10.10.10.10:4444	260

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1152	33.877937	10.10.10.10:4444	10.10.10.70:1036	38527	3811578131	1923928841	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1169 - 1169	38.610140	10.10.10.10:4444	10.10.10.70:1036	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1170 - 1172	38.611842	10.10.10.70:1036	10.10.10.10:4444	324

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1173	38.612325	10.10.10.10:4444	10.10.10.70:1036	38530	3811578248	1923929165	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1188 - 1188	42.227579	10.10.10.10:4444	10.10.10.70:1036	101

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1189 - 1191	42.236870	10.10.10.70:1036	10.10.10.10:4444	276

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1192	42.237337	10.10.10.10:4444	10.10.10.70:1036	38533	3811578349	1923929441	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1193 - 1193	44.346874	10.10.10.10:4444	10.10.10.70:1036	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1194 - 1196	44.361859	10.10.10.70:1036	10.10.10.10:4444	228

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1197	44.362303	10.10.10.10:4444	10.10.10.70:1036	38536	3811578466	1923929669	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1202 - 1202	48.240985	10.10.10.10:4444	10.10.10.70:1036	133

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1203 - 1205	48.252474	10.10.10.70:1036	10.10.10.10:4444	228

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1206	48.252926	10.10.10.10:4444	10.10.10.70:1036	38539	3811578599	1923929897	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1219 - 1219	50.426417	10.10.10.10:4444	10.10.10.70:1036	101

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1220 - 1222	50.439968	10.10.10.70:1036	10.10.10.10:4444	276

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1223	50.440416	10.10.10.10:4444	10.10.10.70:1036	38542	3811578700	1923930173	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1224 - 1224	50.628121	10.10.10.10:4444	10.10.10.70:1036	149

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1225 - 1227	50.643097	10.10.10.70:1036	10.10.10.10:4444	1284

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1228	50.643631	10.10.10.10:4444	10.10.10.70:1036	38545	3811578849	1923931457	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1244 - 1244	58.029151	10.10.10.10:4444	10.10.10.70:1036	133

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1245 - 1247	58.033733	10.10.10.70:1036	10.10.10.10:4444	276

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1248	58.034193	10.10.10.10:4444	10.10.10.70:1036	38548	3811578982	1923931733	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1249 - 1249	58.437559	10.10.10.10:4444	10.10.10.70:1036	197

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1250 - 1252	58.440057	10.10.10.70:1036	10.10.10.10:4444	228

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1253	58.440519	10.10.10.10:4444	10.10.10.70:1036	38551	3811579179	1923931961	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1254 - 1254	58.640828	10.10.10.10:4444	10.10.10.70:1036	133

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1255 - 1296	58.643181	10.10.10.70:1036	10.10.10.10:4444	30057

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1297	58.649189	10.10.10.10:4444	10.10.10.70:1036	38572	3811579312	1923962018	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1298 - 1298	58.843972	10.10.10.10:4444	10.10.10.70:1036	133

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1299 - 1301	58.846314	10.10.10.70:1036	10.10.10.10:4444	244

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1302	58.847112	10.10.10.10:4444	10.10.10.70:1036	38575	3811579445	1923962262	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1303 - 1303	59.045905	10.10.10.10:4444	10.10.10.70:1036	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1304 - 1306	59.049502	10.10.10.70:1036	10.10.10.10:4444	228

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1307	59.050137	10.10.10.10:4444	10.10.10.70:1036	38578	3811579562	1923962490	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1308 - 1308	59.248661	10.10.10.10:4444	10.10.10.70:1036	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1309 - 1311	59.252568	10.10.10.70:1036	10.10.10.10:4444	244

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1312	59.253215	10.10.10.10:4444	10.10.10.70:1036	38581	3811579679	1923962734	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1344 - 1344	67.452418	10.10.10.10:4444	10.10.10.70:1036	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1345 - 1347	67.455566	10.10.10.70:1036	10.10.10.10:4444	324

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1348	67.456042	10.10.10.10:4444	10.10.10.70:1036	38584	3811579796	1923963058	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1349 - 1438	67.776613	10.10.10.10:4444	10.10.10.70:1036	89395

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1439	67.988839	10.10.10.70:1036	10.10.10.10:4444	477	1923963058	3811668466	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1440 - 1501	68.502507	10.10.10.70:1036	10.10.10.10:4444	59475

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1502	68.512427	10.10.10.10:4444	10.10.10.70:1036	38669	3811668466	1924022533	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1561 - 1561	87.586247	10.10.10.10:4444	10.10.10.70:1036	37

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1562	87.587095	10.10.10.10:4444	10.10.10.70:1036	38671	3811668503	1924022533	---A---F
1563	87.587154	10.10.10.70:1036	10.10.10.10:4444	551	1924022533	3811668503	---A---F
1564	87.587246	10.10.10.10:4444	10.10.10.70:1036	38672	3811668504	1924022534	---A----
1565	87.587480	10.10.10.70:1036	10.10.10.10:4444	552	1924022534	3811668504	---A----