Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

23 June 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:01:51:00 WinXP 121.228.211.15 (163DATA.COM.CN):
CHINANET JIANGSU PROVINCE NETWORK,
BEIJING, BEIJING, CN. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:1344 hits: 12-31 to 06-22] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:02:16:00 Win2K-f 210.219.190.225 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:64.215.166.173:80
US:64.215.166.190:80 135 pcap raw alerts
ruleset other
86 lines Yeah : 1.3
profile none summary
tarball 0 of 33
30 of 32 4c3df24b32
[Firefox:19 hits: 06-17 to 06-22]
8390780c27
[Firefox: 3 hits: 06-18 to 06-21] 4c3df24b32 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

T:03:22:00 WinXP 124.104.185.185 (PLDT.NET):
GNTC7300I02_CONSUMER,
PH. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:1344 hits: 12-31 to 06-22] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:03:26:00 Win2K-f 80.104.45.153 (BUSINESS.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A,
PISA, TOSCANA, IT. n/a 445 pcap raw alerts
ruleset shell
15 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:03:55:00 WinXP 86.147.196.4 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
BATH, ENGLAND, UK. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 1898e66cd2
[Firefox: 3 hits: 05-20 to 06-22] none[4] none:none
PolyEnE| none trace

T:04:15:00 WinXP 81.84.150.46 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
LISBON, LISBOA, PT. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3079 hits: 12-31 to 06-22] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:04:39:00 WinXP 117.99.46.175 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball none a47929d343
NEW none[4] none:none
PolyEnE| none trace

T:04:42:00 Win2K-f 70.67.167.20 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
DUNCAN, BRITISH COLUMBIA, CA. n/a 135 pcap raw alerts
ruleset other
158 lines Yeah : 1.3
profile none summary
tarball none a3708f06d0
NEW a3708f06d0 [1] ASM:Graph
Armadillo| lines=81 trace

T:05:01:00 WinXP 218.228.212.166 (EONET.NE.JP):
K-OPTICOM CORPORATION,
OSAKA, OSAKA, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:55 hits: 09-28 to 06-22] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:05:18:00 Win2K-f 122.42.21.70 (-):
POWERCOMM,
KR. 67.43.236.98:10324 :proxim.ircgalaxy.pl
US:mx1.hotmail.com
US:mailin-01.mx.aol.com
SE:ftp.icq.com
US:yutunrz.1dumb.com
US:mailin-04.mx.aol.com
US:http.icq.com.edgesuite.net
CA:xx.nadnadzz.info
CA:nadsam0.info
US:130.107.160.57:42157 135 pcap raw alerts
ruleset http
irc
745 lines Yeah : 1.8
profile none summary
tarball none
none
none
none 2a8d1f17ac
NEW
745ae23613
NEW
7d9b611c43
NEW
c5622bb285
NEW none[4]
none [4]
none [4]
none [4] none:none
none:none
none:none
none:none
none|none
PeCompact|
tElock|
none|none none
none
none
none trace
trace
trace
trace

T:05:43:00 Win2K-f 71.7.238.189 (EASTLINK.CA):
EASTLINK,
DARTMOUTH, NOVA SCOTIA, CA. 72.10.172.213:7000 67.43.236.99:10324 CA:xx.nadnadzz.info
CA:nadsam0.info
US:130.107.188.161:4665 445 pcap raw alerts
ruleset irc
http
45 lines Yeah : 0.8
profile none summary
tarball none
none
none 7d9b611c43
NEW
bb40cbf335
NEW
c5622bb285
NEW none[4]
none [4]
none [4] none:none
none:none
none:none
tElock|
none|none
none|none none
none
none trace
trace
trace

T:06:36:00 Win2K-f 24.87.36.121 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
RICHMOND, BRITISH COLUMBIA, CA. (DSL) n/a :proxim.ircgalaxy.pl 135 pcap raw alerts
ruleset other
266 lines Yeah : 1.3
profile none summary
tarball 30 of 33 7df41a77e6
NEW none[4] none:none
PolyEnE| none trace

T:07:09:00 WinXP 208.238.205.21 (OLYPEN.COM):
OLYPEN INC,
WASHINGTON, US. (DSL) n/a US:www.yahoo.com
US:www.altavista.com
:jbeegvia.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 17028f1eda
[Firefox:12 hits: 09-29 to 06-22] none[3] none:none
tElock| none trace

08:03:00 WinXP 72.183.60.105 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CORPUS CHRISTI, TEXAS, US. n/a DE:siliconfireware.ru
SE:kavkazcenter.com
SE:kavkazcenter.net
FI:kavkazchat.com
US:chechenpress.info
GB:chechenpress.co.uk
US:shaheeds.org
:daymohk.info
:chripress.org
:marsho.dk
DE:ebookfinaltrash.ru
:wpad
DE:212.227.111.29:80
DE:217.11.54.126:80
GB:217.194.210.198:80
US:63.251.92.197:80
US:72.29.65.216:80
EU:78.47.200.154:80
FI:80.81.183.162:80
SE:88.80.5.157:80
SE:88.80.5.15:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 ab5e47bf8d
[Firefox:51 hits: 05-10 to 06-22] none[3] none:none
ASPack| none trace

08:38:00 WinXP 202.88.238.21 (ASIANET.CO.IN):
ASIANET IS A ISP PROVIDING ACCESS THROUGH CABLE,
TRIVANDRUM, KERALA, IN. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:205.128.66.126:80
US:206.33.45.125:80 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 31 of 33
29 of 33 133401d618
[Firefox: 2 hits: 06-18 to 06-21]
7819d05bbf
NEW none[4]
7819d05bbf[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

T:10:13:00 Win2K-f 71.128.100.211 (PACBELL.NET):
PACFICC COAST CHEMICALS,
PLANO, TEXAS, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:140 hits: 06-17 to 06-22]
a08f3b74a4
[Firefox:46 hits: 06-18 to 06-22]
b5919931fe
[Firefox:20 hits: 06-20 to 06-22] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

10:59:00 Win2K-f 92.40.52.25 (IKBCC.COM):
EU-ZZ,
UK. n/a :proxim.ircgalaxy.pl
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none 4e0a21df9c
NEW none[4] none:none
FSG| none trace

T:11:07:00 WinXP 70.63.150.59 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
190 lines Yeah : 1.3
profile none summary
tarball 29 of 32
none 2110c8100f
NEW
e818015a89
NEW none[4]
e818015a89[1] none:none
ASM:Graph
PolyEnE|
Armadillo| none
lines=81 trace
trace

T:11:31:00 WinXP 24.224.215.148 (EASTLINK.CA):
EASTLINK,
HALIFAX, NOVA SCOTIA, CA. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:140 hits: 06-17 to 06-22]
a08f3b74a4
[Firefox:46 hits: 06-18 to 06-22]
e07c29c4ae
[Firefox:24 hits: 06-19 to 06-22] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:11:45:00 WinXP 218.86.236.21 (AGENT1.GZ.CN):
CHINANET GUIZHOU PROVINCE NETWORK,
GUIZHOU, GUIZHOU, CN. 72.10.172.218:7763 :proxima.ircgalaxy.pl
:nagoo.nagitiriheiwu.net
CA:mypal.urpal43sourpalhuh.com
US:mm.esskil99.info 135 pcap raw alerts
ruleset irc
http
308 lines Yeah : 1.8
profile none summary
tarball none
none 4f8d6c0a4d
NEW
929a9a1ac4
NEW none[4]
none [4] none:none
none:none
none|none
none|none none
none trace
trace

11:59:00 Win2K-f 4.255.207.203 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
YUKON, OKLAHOMA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

12:19:00 Win2K-f 212.106.35.203 (-):
TWELVENET LTD PROVIDES DOMAIN REGISTRATION AND,
UK. n/a 135 pcap raw alerts
ruleset ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

12:21:00 WinXP 92.40.209.234 (IKBCC.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

12:24:00 WinXP 4.161.187.55 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
IRVING, TEXAS, US. (DIAL) n/a EU:siliconfireware.ru
DE:ebookfinaltrash.ru
:wpad
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:1064 hits: 05-01 to 06-21] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

T:12:58:00 Win2K-f 24.222.51.165 (EASTLINK.CA):
EASTLINK,
TRURO, NOVA SCOTIA, CA. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:205.128.79.125:80 135 pcap raw alerts
ruleset http
111 lines Yeah : 1.3
profile none summary
tarball none
none c929e6508d
NEW
ee1d9a67bb
NEW c929e6508d [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

T:14:37:00 Win2K-f 75.49.22.98 (SBCGLOBAL.NET):
PPPOX POOL - SE1.WOTNOH,
COLUMBUS, OHIO, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:140 hits: 06-17 to 06-22]
a08f3b74a4
[Firefox:46 hits: 06-18 to 06-22] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

14:37:00 WinXP 82.2.181.182 (NTL.COM):
NTL INFRASTRUCTURE - WALTHAM PARK,
LONDON, ENGLAND, UK. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:18 hits: 12-14 to 06-21] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

T:14:55:00 Win2K-f 216.30.232.67 (AUSTINCPAAC.COM):
FIBERNET OF WEST VIRGINIA,
CHARLESTON, WEST VIRGINIA, US. (100Mbps) n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:207.123.46.125:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball none
none dc20b6fe59
NEW
f97070ef2b
NEW dc20b6fe59 [1]
none [4] ASM:Graph
none:none
Armadillo|
PolyEnE| lines=81
none trace
trace

14:55:00 WinXP 96.14.160.168 (-):
. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2691 hits: 12-31 to 06-22] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

15:00:00 WinXP 98.105.94.247 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:15:07:00 WinXP 12.74.178.16 (ATT.NET):
AT&T WORLDNET SERVICES,
BRANDON, MISSISSIPPI, US. (DIAL) 12.74.178.16:21 445 pcap raw alerts
ruleset shell
ftp
20 lines Yeah : 1.8
profile none summary
tarball none none none none none none none

T:15:19:00 WinXP 4.161.187.190 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
IRVING, TEXAS, US. (DIAL) n/a DE:siliconfireware.ru
US:searchportal.information.com
GB:new.egg.com
:wpad
US:sprw.information.com
US:spi.domainsponsor.com 445 pcap raw alerts
ruleset http
http
http
http
33 lines Yeah : 0.8
profile none summary
tarball 20 of 29 3ce8dd4359
[Firefox: 5 hits: 07-10 to 02-19] cb80a979e8 [0] ASM:Graph
ASPack| lines=2 trace

15:28:00 Win2K-f 4.244.198.170 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
PLEASANT HILL, MISSOURI, US. (DIAL) 4.244.198.170:21 :irc.drxclusives.info
CA:activestate.com
:mx.doel.org
:mail.doel.org
:mail.activestate.com
:smtp.activestate.com
:mx1.activestate.com
:mxs.activestate.com
:mail1.activestate.com
:relay.activestate.com
:ns.activestate.com
:gate.activestate.com
US:fmrco.com.s8b1.psmtp.com
DE:mf0.ffm0.de.carpe.net
GB:mail.oa5.com
US:fmrco.com.s8b2.psmtp.com
DE:convex.com
US:maillnx-us111.fmr.com
:mx.convex.com
:mail.convex.com
US:192.223.198.26:25
CA:204.244.102.3:25
CA:204.244.102.6:25
US:209.191.88.239:25
DE:212.96.133.129:25
DE:212.96.133.20:25
216.104.34.250:25
US:216.39.53.1:25
US:216.39.53.2:25
US:64.18.7.13:25
US:64.18.7.14:25
US:66.196.82.7:25
US:68.142.202.247:25
GB:89.187.70.128:25
GB:89.187.70.146:25 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.8
profile none summary
tarball none e480c6484a
NEW none[4] none:none
FSG| none trace

15:40:00 WinXP 96.15.169.231 (-):
. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2691 hits: 12-31 to 06-22] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

15:50:00 Win2K-f 68.144.71.96 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:199.93.44.126:80
US:207.123.47.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:140 hits: 06-17 to 06-22]
73f1082158
[Firefox:50 hits: 06-18 to 06-22] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

15:54:00 WinXP 41.214.168.233 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 17 of 32 ec5495e4fe
NEW none[4] none:none
PolyEnE| none trace

16:03:00 WinXP 4.252.99.198 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
INDIANA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

16:14:00 WinXP 71.113.77.184 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
LYNNWOOD, WASHINGTON, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:205.128.66.124:80
US:205.128.79.125:80
US:205.128.79.126:80 135 pcap raw alerts
ruleset other
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:140 hits: 06-17 to 06-22]
a08f3b74a4
[Firefox:46 hits: 06-18 to 06-22] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

16:15:00 WinXP 124.66.248.132 (FCH.NE.JP):
FUREAI CHANNEL INC,
HIROSHIMA, HIROSHIMA, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:55 hits: 09-28 to 06-22] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

16:24:00 Win2K-f 98.105.6.17 (-):
. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2691 hits: 12-31 to 06-22] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

16:26:00 WinXP 75.179.36.222 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AKRON, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:205.128.79.125:80
US:207.123.37.125:80 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:140 hits: 06-17 to 06-22]
b7082104e4
[Firefox: 7 hits: 06-18 to 06-20] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

16:50:00 Win2K-f 64.38.78.250 (SPEAKEASY.NET):
US. n/a 445 pcap raw alerts
ruleset shell
shell
ftp
19 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:17:04:00 Win2K-f 24.84.182.249 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. n/a 135 pcap raw alerts
ruleset other
53 lines Yeah : 1.3
profile none summary
tarball none f9bf3a1e43
NEW f9bf3a1e43 [1] ASM:Graph
Armadillo| lines=81 trace

17:08:00 WinXP 68.201.38.33 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COPPERAS COVE, TEXAS, US. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3079 hits: 12-31 to 06-22] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:17:09:00 WinXP 68.201.38.33 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COPPERAS COVE, TEXAS, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3079 hits: 12-31 to 06-22] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

17:30:00 WinXP 118.231.53.229 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

17:39:00 Win2K-f 4.242.141.138 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:17:50:00 Win2K-f 98.140.228.155 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

17:56:00 Win2K-f 98.133.190.28 (-):
ALLTEL SIP CUSTOMERS - ATLANTA,
ATLANTA, GEORGIA, US. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2691 hits: 12-31 to 06-22] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:17:58:00 Win2K-f 122.2.93.3 (PLDT.NET):
IPG,
PH. 67.43.236.98:10324 CA:xx.nadnadzz.info
CA:nadsam0.info
CA:ns.ircstyle.net
CA:uuuu.ka3ek.com
CA:ns.enterhere.biz
US:130.107.192.117:17131 135 pcap raw alerts
ruleset irc
http
293 lines Yeah : 1.8
profile none summary
tarball none
none
31 of 33
none 7d9b611c43
NEW
8d60c59e25
NEW
954a98c971
NEW
c5622bb285
NEW none[4]
none [4]
none [4]
none [4] none:none
none:none
none:none
none:none
tElock|
none|none
FSG|
none|none none
none
none
none trace
trace
trace
trace

17:58:00 WinXP 166.165.228.162 (MYVZW.COM):
SERVICE PROVIDER CORPORATION,
BEDMINSTER, NEW JERSEY, US. (DSL) n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2691 hits: 12-31 to 06-22] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

18:23:00 WinXP 24.86.136.58 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a :proxim.ircgalaxy.pl 135 pcap raw alerts
ruleset other
268 lines Yeah : 1.3
profile none summary
tarball 29 of 32 e759d2b517
NEW none[4] none:none
PolyEnE| none trace

18:42:00 WinXP 92.40.75.224 (IKBCC.COM):
EU-ZZ,
UK. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:72.247.30.144:80
US:72.247.30.211:80 135 pcap raw alerts
ruleset other
128 lines Yeah : 1.3
profile none summary
tarball 30 of 32
none 7452c8448d
NEW
fd9b49840f
NEW none[4]
fd9b49840f[1] none:none
ASM:Graph
PolyEnE|
Armadillo| none
lines=81 trace
trace

18:46:00 WinXP 207.171.222.86 (GLASTEL.COM):
ASSOCIATED NETWORKS PARTNERS INC.-GLASSFORD,
SPRINGFIELD, ILLINOIS, US. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball none
none 3dd83c631f
NEW
dda4f0bd66
NEW none[4]
dda4f0bd66[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

T:18:52:00 WinXP 219.110.166.139 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:55 hits: 09-28 to 06-22] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:19:03:00 Win2K-f 4.242.141.138 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

19:09:00 WinXP 24.92.191.75 (RR.COM):
ROAD RUNNER HOLDCO LLC,
TAMPA, FLORIDA, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.126:80
US:207.123.46.126:80
US:4.23.60.125:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:140 hits: 06-17 to 06-22]
a08f3b74a4
[Firefox:46 hits: 06-18 to 06-22] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

19:10:00 WinXP 70.247.161.199 (SWBELL.NET):
PPPOX POOL - BRAS17 RCSNTX,
FT. WORTH, TEXAS, US. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:433 hits: 12-31 to 06-21] 048df78048 [0] ASM:Graph
none|none lines=61 trace

19:15:00 WinXP 4.153.226.245 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MARIETTA, GEORGIA, US. (DIAL) n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:441 hits: 05-02 to 06-21] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

T:19:20:00 Win2K-f 66.27.176.85 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CANOGA PARK, CALIFORNIA, US. 217.170.244.2:443
CZ:217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
122 lines Yeah : 1.8
profile none summary
tarball 16 of 31 23c32fbd78
[Firefox: 3 hits: 05-03 to 06-05] none[4] none:none
PeCompact| none trace

T:19:26:00 WinXP 4.235.6.221 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
ORLANDO, FLORIDA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:55 hits: 09-28 to 06-22] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

19:42:00 WinXP 68.148.100.55 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
EDMONTON, ALBERTA, CA. (DSL) n/a :proxim.ircgalaxy.pl 135 pcap raw alerts
ruleset other
280 lines Yeah : 1.3
profile none summary
tarball none 99b828dad0
NEW none[4] none:none
PolyEnE| none trace

T:20:07:00 Win2K-f 211.177.210.196 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 0 of 33
33 of 33 4c3df24b32
[Firefox:19 hits: 06-17 to 06-22]
53bfe15e91
[Firefox:140 hits: 06-17 to 06-22] 4c3df24b32 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

20:13:00 WinXP 96.14.249.118 (-):
. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2691 hits: 12-31 to 06-22] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

20:43:00 Win2K-f 4.254.217.151 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BILLINGS, MONTANA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:205.128.66.126:80
US:206.33.45.125:80 135 pcap raw alerts
ruleset other
105 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:140 hits: 06-17 to 06-22]
73f1082158
[Firefox:50 hits: 06-18 to 06-22] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:21:07:00 WinXP 12.214.237.156 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
CHENOA, ILLINOIS, US. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball 29 of 29 32a0d7d0e0
[Firefox:44 hits: 05-04 to 06-09] d791762796 [0] ASM:Graph
tElock| lines=81
embedded dns trace

21:17:00 WinXP 68.183.65.207 (DSLEXTREME.COM):
DSL EXTREME,
SAN JOSE, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
US:204.160.126.124:80
US:207.123.46.125:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:140 hits: 06-17 to 06-22]
a08f3b74a4
[Firefox:46 hits: 06-18 to 06-22] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:21:23:00 Win2K-f 74.214.47.11 (METROCAST.NET):
GMP CABLE TV,
BERWICK, PENNSYLVANIA, US. n/a 135 pcap raw alerts
ruleset other
204 lines Yeah : 1.3
profile none summary
tarball 32 of 33 fe22b8315f
[Firefox: 2 hits: 06-19 to 06-21] none[4] none:none
StarForce| none trace

21:28:00 WinXP 4.255.46.53 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:433 hits: 12-31 to 06-21] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:21:28:00 WinXP 66.143.165.54 (SWBELL.NET):
PPPOX POOL RBACK7 AUSTTX,
AUSTIN, TEXAS, US. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:433 hits: 12-31 to 06-21] 048df78048 [0] ASM:Graph
none|none lines=61 trace

21:43:00 Win2K-f 24.222.112.180 (LIBERATED.CA):
EASTLINK,
HALIFAX, NOVA SCOTIA, CA. n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:207.123.46.126:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball none
none 05c5bca473
NEW
09c7dd2528
NEW none[4]
09c7dd2528[1] none:none
ASM:Graph
StarForce|
Armadillo| none
lines=82 trace
trace

22:22:00 WinXP 122.104.243.249 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
SYDNEY, NEW SOUTH WALES, AU. n/a 135 pcap raw alerts
ruleset other
54 lines Yeah : 1.3
profile none summary
tarball 0 of 33 a08f3b74a4
[Firefox:46 hits: 06-18 to 06-22] a08f3b74a4 [1] ASM:Graph
Armadillo| lines=81 trace

T:22:34:00 Win2K-f 122.146.227.166 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

22:46:00 Win2K-f 24.66.229.181 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SASKATOON, SASKATCHEWAN, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 31 of 32
23 of 33 bca9e0fb5f
[Firefox: 3 hits: 06-18 to 06-22]
e53a9ea82e
[Firefox: 3 hits: 06-18 to 06-22] none[4]
e53a9ea82e[1] none:none
ASM:Graph
PolyEnE|
Armadillo| none
lines=81 trace
trace

T:22:56:00 Win2K-f 208.126.40.29 (-):
WESTERN IOWA NETWORKS,
BREDA, IOWA, US. n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:72.247.30.81:80 135 pcap raw alerts
ruleset other
129 lines Yeah : 1.3
profile none summary
tarball 29 of 32
27 of 32 4dcf7f18ac
NEW
9bf5558de5
NEW none[4]
9bf5558de5[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

23:37:00 Win2K-f 80.104.43.175 (BUSINESS.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A,
PISA, TOSCANA, IT. n/a 445 pcap raw alerts
ruleset shell
14 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

23:52:00 WinXP 193.250.68.214 (ABO.WANADOO.FR):
WANADOO,
FR. n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball none none none none none none none