Flow 11

Summary

Hosts
- 10.10.10.70:1044
- 10.10.10.10:4445
Start time: 118.746261 seconds
Last packet sniffed time: 198.441738 seconds
Protocol: TCP
Bytes of data: 844469 bytes
Packet #s: 1628 - 2554
.pcap of this flow: packets.pcap

Packets and Data

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
1628	118.746261	10.10.10.70:1044	10.10.10.10:4445	584	1978240123	0	------S-
1629	118.746339	10.10.10.10:4445	10.10.10.70:1044	0	0	1978240124	---A-R--
1630	119.080451	10.10.10.70:1044	10.10.10.10:4445	585	1978240123	0	------S-
1631	119.080508	10.10.10.10:4445	10.10.10.70:1044	0	0	1978240124	---A-R--
1632	119.627342	10.10.10.70:1044	10.10.10.10:4445	586	1978240123	0	------S-
1633	119.627381	10.10.10.10:4445	10.10.10.70:1044	0	0	1978240124	---A-R--
1634	119.627991	10.10.10.70:1044	10.10.10.10:4445	587	1978515768	0	------S-
1635	119.628049	10.10.10.10:4445	10.10.10.70:1044	0	0	1978515769	---A-R--
1636	120.174220	10.10.10.70:1044	10.10.10.10:4445	588	1978515768	0	------S-
1637	120.174267	10.10.10.10:4445	10.10.10.70:1044	0	0	1978515769	---A-R--
1638	120.721071	10.10.10.70:1044	10.10.10.10:4445	589	1978515768	0	------S-
1639	120.721138	10.10.10.10:4445	10.10.10.70:1044	0	0	1978515769	---A-R--
1640	120.721729	10.10.10.70:1044	10.10.10.10:4445	590	1978821279	0	------S-
1641	120.721785	10.10.10.10:4445	10.10.10.70:1044	0	0	1978821280	---A-R--
1642	121.267963	10.10.10.70:1044	10.10.10.10:4445	591	1978821279	0	------S-
1643	121.268035	10.10.10.10:4445	10.10.10.70:1044	0	0	1978821280	---A-R--
1644	121.705443	10.10.10.70:1044	10.10.10.10:4445	592	1978821279	0	------S-
1645	121.705513	10.10.10.10:4445	10.10.10.70:1044	0	0	1978821280	---A-R--
1646	121.706096	10.10.10.70:1044	10.10.10.10:4445	593	1979100318	0	------S-
1647	121.706157	10.10.10.10:4445	10.10.10.70:1044	0	0	1979100319	---A-R--
1648	122.252337	10.10.10.70:1044	10.10.10.10:4445	594	1979100318	0	------S-
1649	122.252405	10.10.10.10:4445	10.10.10.70:1044	0	0	1979100319	---A-R--
1650	122.689815	10.10.10.70:1044	10.10.10.10:4445	595	1979100318	0	------S-
1651	122.689900	10.10.10.10:4445	10.10.10.70:1044	0	0	1979100319	---A-R--
1652	122.690468	10.10.10.70:1044	10.10.10.10:4445	596	1979373164	0	------S-
1653	122.690531	10.10.10.10:4445	10.10.10.70:1044	0	0	1979373165	---A-R--
1654	123.236717	10.10.10.70:1044	10.10.10.10:4445	597	1979373164	0	------S-
1655	123.236781	10.10.10.10:4445	10.10.10.70:1044	0	0	1979373165	---A-R--
1656	123.674199	10.10.10.70:1044	10.10.10.10:4445	598	1979373164	0	------S-
1657	123.674296	10.10.10.10:4445	10.10.10.70:1044	0	1436350344	1979373165	---A--S-
1658	123.674586	10.10.10.70:1044	10.10.10.10:4445	599	1979373165	1436350345	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
1659 - 2344	123.905791	10.10.10.10:4445	10.10.10.70:1044	748036

View data:

Hex dump
View as text
Raw
Carved as SANS Forensic Challenge malware sample file transfer
- Contents carved to: carve0003
  - 'file' output:
```
evidence06.pcap_output/0011/carve0003: PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bit
```
- Size: 748032
- MD5: b062cb8344cd3e296d8868fbef289c7c

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2345	123.990525	10.10.10.70:1044	10.10.10.10:4445	772	1979373165	1437095597	---A----
2346	123.990835	10.10.10.70:1044	10.10.10.10:4445	773	1979373165	1437098381	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2347 - 2347	125.074850	10.10.10.70:1044	10.10.10.10:4445	94

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2348	125.074931	10.10.10.10:4445	10.10.10.70:1044	24543	1437098381	1979373259	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2349 - 2349	125.170762	10.10.10.10:4445	10.10.10.70:1044	1410

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2350 - 2350	125.250799	10.10.10.70:1044	10.10.10.10:4445	214

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2351	125.250885	10.10.10.10:4445	10.10.10.70:1044	24545	1437099791	1979373473	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2352 - 2352	125.340313	10.10.10.10:4445	10.10.10.70:1044	75

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2353 - 2353	125.340834	10.10.10.70:1044	10.10.10.10:4445	90

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2354	125.340943	10.10.10.10:4445	10.10.10.70:1044	24547	1437099866	1979373563	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2355 - 2431	125.572580	10.10.10.10:4445	10.10.10.70:1044	81049

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2432	125.580879	10.10.10.70:1044	10.10.10.10:4445	795	1979373563	1437180150	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2433 - 2435	125.596210	10.10.10.70:1044	10.10.10.10:4445	212

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2436	125.596654	10.10.10.10:4445	10.10.10.70:1044	24608	1437180915	1979373775	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2437 - 2437	125.790415	10.10.10.10:4445	10.10.10.70:1044	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2438 - 2440	125.799301	10.10.10.70:1044	10.10.10.10:4445	260

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2441	125.799748	10.10.10.10:4445	10.10.10.70:1044	24611	1437181032	1979374035	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2442 - 2442	125.992229	10.10.10.10:4445	10.10.10.70:1044	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2443 - 2445	126.002411	10.10.10.70:1044	10.10.10.10:4445	324

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2446	126.002869	10.10.10.10:4445	10.10.10.70:1044	24614	1437181149	1979374359	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2447 - 2447	132.389287	10.10.10.10:4445	10.10.10.70:1044	101

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2448 - 2450	132.393024	10.10.10.70:1044	10.10.10.10:4445	276

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2451	132.393495	10.10.10.10:4445	10.10.10.70:1044	24617	1437181250	1979374635	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2452 - 2452	133.830970	10.10.10.10:4445	10.10.10.70:1044	101

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2453 - 2455	133.846167	10.10.10.70:1044	10.10.10.10:4445	276

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2456	133.846615	10.10.10.10:4445	10.10.10.70:1044	24620	1437181351	1979374911	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2457 - 2457	134.033787	10.10.10.10:4445	10.10.10.70:1044	149

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2458 - 2460	134.049282	10.10.10.70:1044	10.10.10.10:4445	596

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2461	134.049778	10.10.10.10:4445	10.10.10.70:1044	24623	1437181500	1979375507	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2462 - 2462	135.874220	10.10.10.10:4445	10.10.10.70:1044	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2463 - 2465	135.877358	10.10.10.70:1044	10.10.10.10:4445	228

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2466	135.877833	10.10.10.10:4445	10.10.10.70:1044	24626	1437181617	1979375735	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2467 - 2467	136.865257	10.10.10.10:4445	10.10.10.70:1044	101

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2468 - 2470	136.877382	10.10.10.70:1044	10.10.10.10:4445	260

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2471	136.877837	10.10.10.10:4445	10.10.10.70:1044	24629	1437181718	1979375995	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2472 - 2472	137.067543	10.10.10.10:4445	10.10.10.70:1044	149

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2473 - 2476	137.080505	10.10.10.70:1044	10.10.10.10:4445	2308

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2477	137.081181	10.10.10.10:4445	10.10.10.70:1044	24632	1437181867	1979377529	---A----
2478	137.081185	10.10.10.10:4445	10.10.10.70:1044	24633	1437181867	1979378303	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2479 - 2479	142.149287	10.10.10.10:4445	10.10.10.70:1044	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2480 - 2482	142.158652	10.10.10.70:1044	10.10.10.10:4445	228

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2483	142.159124	10.10.10.10:4445	10.10.10.70:1044	24636	1437181984	1979378531	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2484 - 2484	143.136802	10.10.10.10:4445	10.10.10.70:1044	101

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2485 - 2487	143.143021	10.10.10.70:1044	10.10.10.10:4445	260

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2488	143.143487	10.10.10.10:4445	10.10.10.70:1044	24639	1437182085	1979378791	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2489 - 2489	143.339246	10.10.10.10:4445	10.10.10.70:1044	133

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2490 - 2492	143.346147	10.10.10.70:1044	10.10.10.10:4445	1028

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2493	143.346681	10.10.10.10:4445	10.10.10.70:1044	24642	1437182218	1979379819	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2494 - 2494	145.244566	10.10.10.10:4445	10.10.10.70:1044	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2495 - 2497	145.252395	10.10.10.70:1044	10.10.10.10:4445	228

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2498	145.253231	10.10.10.10:4445	10.10.10.70:1044	24645	1437182335	1979380047	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2499 - 2499	146.132072	10.10.10.10:4445	10.10.10.70:1044	101

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2500 - 2502	146.143013	10.10.10.70:1044	10.10.10.10:4445	228

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2503	146.143458	10.10.10.10:4445	10.10.10.70:1044	24648	1437182436	1979380275	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2504 - 2504	146.534631	10.10.10.10:4445	10.10.10.70:1044	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2505 - 2507	146.549250	10.10.10.70:1044	10.10.10.10:4445	1524

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2508	146.549858	10.10.10.10:4445	10.10.10.70:1044	24651	1437182553	1979381799	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2509 - 2509	185.484790	10.10.10.10:4445	10.10.10.70:1044	133

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2510 - 2512	185.486720	10.10.10.70:1044	10.10.10.10:4445	276

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2513	185.487207	10.10.10.10:4445	10.10.10.70:1044	24654	1437182686	1979382075	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2514 - 2514	185.687619	10.10.10.10:4445	10.10.10.70:1044	165

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2515 - 2517	185.767987	10.10.10.70:1044	10.10.10.10:4445	276

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2518	185.768432	10.10.10.10:4445	10.10.10.70:1044	24657	1437182851	1979382351	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2519 - 2519	185.898357	10.10.10.10:4445	10.10.10.70:1044	133

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2520 - 2522	185.908603	10.10.10.70:1044	10.10.10.10:4445	552

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2523	185.909193	10.10.10.10:4445	10.10.10.70:1044	24660	1437182984	1979382903	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2524 - 2524	189.713395	10.10.10.10:4445	10.10.10.70:1044	149

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2525 - 2531	189.721125	10.10.10.70:1044	10.10.10.10:4445	600

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2532	189.752794	10.10.10.10:4445	10.10.10.70:1044	24665	1437183133	1979383503	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2533 - 2533	192.839527	10.10.10.10:4445	10.10.10.70:1044	149

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2534 - 2544	192.846057	10.10.10.70:1044	10.10.10.10:4445	716

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2545	192.955885	10.10.10.10:4445	10.10.10.70:1044	24672	1437183282	1979384219	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2546 - 2546	194.384577	10.10.10.10:4445	10.10.10.70:1044	117

View data:

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2547 - 2549	194.393200	10.10.10.70:1044	10.10.10.10:4445	324

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2550	194.393435	10.10.10.10:4445	10.10.10.70:1044	24675	1437183399	1979384543	---A----

Data Segment

Packets	Start Time	Source	Destination	Data Bytes
2551 - 2551	198.439756	10.10.10.10:4445	10.10.10.70:1044	37

View data:

Non-Data Packets

Packet #	Time	Source	Destination	IP ID#	Sequence #	Ack #	TCP Flags
2552	198.440669	10.10.10.70:1044	10.10.10.10:4445	845	1979384543	1437183436	---A---F
2553	198.441346	10.10.10.10:4445	10.10.10.70:1044	24677	1437183436	1979384544	---A---F
2554	198.441738	10.10.10.70:1044	10.10.10.10:4445	846	1979384544	1437183437	---A----