Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

03 July 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:21:00 WinXP 122.25.251.106 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:671 hits: 07-11 to 07-02] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:00:26:00 Win2K-f 125.225.138.73 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 217.170.244.2:443
CZ:217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
27 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

00:31:00 WinXP 216.201.28.52 (RTECEXPRESS.NET):
RIDGEVILLE TELEPHONE COMPANY,
MANSFIELD, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
US:199.93.41.126:80
US:199.93.44.124:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
a08f3b74a4
[Firefox:123 hits: 06-18 to 07-02] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:00:33:00 Win2K-f 86.136.29.38 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
LONDON, ENGLAND, UK. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset other
0 lines Argh : 0.3
profile none summary
tarball none none none none none none none

01:04:00 WinXP 86.168.80.205 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
UK. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:446 hits: 12-31 to 07-02] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:01:10:00 WinXP 117.99.40.124 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a DE:siliconfireware.ru
:www.proxy-socks.net
:wpad
US:searchportal.information.com
US:sprw.information.com
US:spi.domainsponsor.com
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
http
6 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:1094 hits: 05-01 to 07-02] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

01:16:00 WinXP 60.236.107.202 (MESH.AD.JP):
NEC CORPORATION,
JP. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

01:32:00 WinXP 217.43.120.117 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
RUNCORN, ENGLAND, UK. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:28 hits: 12-14 to 07-02] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

T:01:38:00 Win2K-f 78.159.50.16 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

T:01:38:00 WinXP 88.147.226.168 (-):
VTSARATOV,
RU. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
15 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

01:40:00 WinXP 212.46.227.27 (VSLUH.RU):
JSC COPYLAND NETWORK,
RU. (100Mbps) n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:01:41:00 Win2K-f 61.20.166.38 (-):
FAR EASTONE TELECOMMUNICATION CO. LTD,
TW. n/a 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

01:43:00 Win2K-f 122.121.242.195 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

T:01:46:00 Win2K-f 82.240.208.113 (PROXAD.NET):
PROXAD / FREE SAS,
NICE, PROVENCE-ALPES-COTE D'AZUR, FR. n/a 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

01:51:00 WinXP 85.250.100.12 (NETVISION.NET.IL):
BROADBAND-PT,
YAVNE, YERUSHALAYIM (JERUSALEM), IL. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
15 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

T:01:51:00 WinXP 91.66.5.145 (SUPERKABEL.DE):
KABEL DEUTSCHLAND BREITBAND SERVICE GMBH,
DE. n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

01:52:00 Win2K-f 89.136.90.240 (-):
ASTRAL MIERCUREA CIUC DOCSIS NETWORK,
RO. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

T:01:53:00 WinXP 91.66.73.62 (SUPERKABEL.DE):
KABEL DEUTSCHLAND BREITBAND SERVICE GMBH,
DE. 69.42.216.90:9890 :f.unicat.org 445 pcap raw alerts
ruleset ftp
irc
29 lines Yeah : 1.3
profile none summary
tarball 31 of 33 fa841b35ff
NEW none[none] none:none
none|none none none

T:01:56:00 Win2K-f 91.65.62.174 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
DE. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 1.3
profile none summary
tarball 21 of 33 52d5117a94
NEW none[none] none:none
none|none none none

T:01:57:00 WinXP 89.136.90.240 (-):
ASTRAL MIERCUREA CIUC DOCSIS NETWORK,
RO. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

02:00:00 Win2K-f 89.28.96.105 (89-28-0-10.STARNET.MD):
STARNET,
CHISINAU, CHISINAU, MD. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

02:00:00 WinXP 91.66.73.62 (SUPERKABEL.DE):
KABEL DEUTSCHLAND BREITBAND SERVICE GMBH,
DE. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 33 fa841b35ff
NEW none[none] none:none
none|none none none

T:02:02:00 WinXP 218.164.181.246 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAINAN, KAO-HSIUNG, TW. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

02:09:00 Win2K-f 218.164.181.246 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAINAN, KAO-HSIUNG, TW. 69.42.216.90:9890 :f.unicat.org
69.42.216.90:9890 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

T:02:09:00 Win2K-f 122.121.242.195 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 69.42.216.90:9890 :f.unicat.org 445 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

T:02:13:00 WinXP 84.247.47.158 (-):
GENIUS NETWORK SYSTEM SRL,
GALATI, GALATI, RO. 69.42.216.90:9890 :f.unicat.org 445 pcap raw alerts
ruleset ftp
irc
32 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

02:23:00 WinXP 218.52.172.136 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
US:download.microsoft.com
US:64.62.216.73:80
US:64.62.216.83:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 33
33 of 33 4c3df24b32
[Firefox:42 hits: 06-17 to 07-02]
53bfe15e91
[Firefox:351 hits: 06-17 to 07-02] 4c3df24b32 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

T:02:27:00 Win2K-f 78.97.48.30 (ASTRAL.RO):
ASTRAL TELECOM SA,
RO. n/a 445 pcap raw alerts
ruleset ftp
15 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:03:03:00 Win2K-f 65.86.121.85 (DSL.NET):
ABERCROMBIE SIMMONS & GILLETTE OF VIRGINIA INC,
VIRGINIA BEACH, VIRGINIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.124:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
73f1082158
[Firefox:157 hits: 06-18 to 07-02]
b5919931fe
[Firefox:49 hits: 06-20 to 07-02] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:03:13:00 Win2K-f 211.177.171.80 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:199.93.41.124:80
US:199.93.53.125:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
125 lines Yeah : 1.3
profile none summary
tarball 27 of 32
31 of 33
0 of 32 00392af02f
NEW
325971e23c
NEW
b5919931fe
[Firefox:49 hits: 06-20 to 07-02] none[none]
none [none]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
none|none
ASProtect| none
none
lines=90 none
none
trace

T:03:25:00 WinXP 62.141.126.154 (SPB.RU):
INTERFACE & ROUTED NETWORK SPB-MEN,
RU. (100Mbps) 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3130 hits: 12-31 to 07-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

03:41:00 WinXP 86.96.64.160 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3130 hits: 12-31 to 07-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

03:59:00 WinXP 81.129.182.203 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
BATH, ENGLAND, UK. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 cce9566ceb
[Firefox:15 hits: 06-12 to 07-01] none[4] none:none
PolyEnE| none trace

04:11:00 WinXP 220.136.47.244 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a 445 pcap raw alerts
ruleset shell
12 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

04:19:00 WinXP 222.235.220.252 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
:wpad
HK:210.245.211.11:65520
US:64.215.166.173:80
US:64.215.166.190:80
US:64.62.216.10:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 31 of 33
27 of 33 2c114f9f83
NEW
76595af914
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:04:34:00 Win2K-f 74.218.34.107 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LOXAHATCHEE, FLORIDA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
a08f3b74a4
[Firefox:123 hits: 06-18 to 07-02]
b5919931fe
[Firefox:49 hits: 06-20 to 07-02] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

04:50:00 Win2K-f 218.168.139.34 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:04:58:00 WinXP 88.104.117.100 (AS9105.COM):
TISCALI UK LTD,
LIVERPOOL, ENGLAND, UK. (DSL) 217.170.244.2:443
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
irc
27 lines Yeah : 1.8
profile none summary
tarball 29 of 33 2905d384e2
NEW none[none] none:none
none|none none none

05:07:00 Win2K-f 88.104.117.100 (AS9105.COM):
TISCALI UK LTD,
LIVERPOOL, ENGLAND, UK. (DSL) n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 29 of 33 2905d384e2
NEW none[none] none:none
none|none none none

05:07:00 WinXP 211.205.117.182 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:207.123.44.126:80
HK:210.245.211.11:65520
US:8.12.202.125:80 135 pcap raw alerts
ruleset other
97 lines Yeah : 1.3
profile none summary
tarball 31 of 33
30 of 32 1509c8d024
[Firefox: 5 hits: 06-17 to 07-02]
f23b040440
[Firefox: 3 hits: 06-22 to 07-02] none[4]
f23b040440[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

05:13:00 WinXP 84.237.168.74 (-):
ADDRESS POOL FOR LTC-HOME CUSTOMERS,
RIGA, RIGA, LV. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 30 of 33 fce9309509
NEW none[none] none:none
none|none none none

T:05:21:00 WinXP 4.225.24.43 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SPRINGFIELD, OHIO, US. (DIAL) 217.170.244.2:443
CZ:217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
27 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

05:22:00 WinXP 61.94.166.54 (-):
TLKM_D4_DIALUP_SLO-G,
BANDUNG, JAWA BARAT (DJAWA BARAT), ID. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 31 of 32 a99f17e623
[Firefox:24 hits: 03-28 to 07-02] 87dfec58db [0] ASM:Graph
PolyEnE| lines=69 trace

T:05:27:00 Win2K-f 70.119.119.199 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LAKELAND, FLORIDA, US. n/a 135 pcap raw alerts
ruleset other
1 line Argh : 0.3
profile none summary
tarball none none none none none none none

T:05:29:00 WinXP 121.92.93.183 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) 217.170.244.2:443 HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520
CZ:217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
28 lines Yeah : 1.8
profile none summary
tarball 30 of 33 dfcd73f7a7
NEW none[none] none:none
none|none none none

05:30:00 WinXP 217.185.98.229 (MEDIAWAYS.NET):
VARIOUS ONLINE SERVICES,
MANNHEIM, BADEN-WURTTEMBERG, DE. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:1379 hits: 12-31 to 07-02] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:05:35:00 WinXP 208.104.204.67 (COMPORIUM.NET):
ROCK HILL TELEPHONE COMPANY,
ROCK HILL, SOUTH CAROLINA, US. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520
US:64.62.216.10:80 135 pcap raw alerts
ruleset http
119 lines Yeah : 1.3
profile none summary
tarball 31 of 33
0 of 33
29 of 33 dfbaaf577c
[Firefox: 4 hits: 06-18 to 07-02]
e07c29c4ae
[Firefox:51 hits: 06-19 to 07-02]
f504b4af20
[Firefox: 4 hits: 06-18 to 07-02] none[4]
e07c29c4ae[1]
f504b4af20[1] none:none
ASM:Graph
ASM:Graph
tElock|
FSG|
Armadillo| none
lines=92
lines=82 trace
trace
trace

05:54:00 WinXP 59.116.225.125 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3130 hits: 12-31 to 07-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:05:54:00 WinXP 59.116.225.125 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3130 hits: 12-31 to 07-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

06:01:00 WinXP 4.225.24.43 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SPRINGFIELD, OHIO, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
shell
ftp
19 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:06:31:00 Win2K-f 122.53.81.136 (PLDT.NET):
IPG,
PH. n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
352 lines Yeah : 1.3
profile none summary
tarball 30 of 33 5dcd26f86a
NEW none[none] none:none
none|none none none

T:06:39:00 Win2K-f 68.147.85.164 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
111 lines Yeah : 1.3
profile none summary
tarball 28 of 33
30 of 33 0ce8fd0298
NEW
9dab37e63b
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

07:09:00 Win2K-f 211.74.128.48 (SEED.NET.TW):
DIGITAL UNITED INC,
KAOHSIUNG, KAO-HSIUNG, TW. (DSL) n/a 135 pcap raw alerts
ruleset other
328 lines Yeah : 1.3
profile none summary
tarball 30 of 33 a886d7062a
NEW none[none] none:none
none|none none none

07:09:00 WinXP 68.92.95.114 (SWBELL.NET):
PPPOX POOL - BRAS1.STLSMO,
ST. LOUIS, MISSOURI, US. (DSL) n/a DE:siliconfireware.ru
SE:kavkazcenter.com
SE:kavkazcenter.net
FI:kavkazchat.com
US:chechenpress.info
GB:chechenpress.co.uk
:shaheeds.org
:daymohk.info
:chripress.org
:marsho.dk
:wpad
DE:212.227.111.29:80
DE:217.11.54.126:80
GB:217.194.210.198:80
69.64.145.229:80
US:72.29.65.216:80
EU:78.47.200.154:80
FI:80.81.183.162:80
SE:88.80.5.157:80
SE:88.80.5.15:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 ab5e47bf8d
[Firefox:55 hits: 05-10 to 06-30] none[3] none:none
ASPack| none trace

T:07:43:00 WinXP 211.44.167.48 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
98 lines Yeah : 1.3
profile none summary
tarball 31 of 33
30 of 33 168aab35a3
[Firefox:24 hits: 06-17 to 07-02]
acd2a6266d
[Firefox: 2 hits: 06-19 to 06-21] none[4]
acd2a6266d[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

T:08:04:00 WinXP 86.155.22.112 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
SWANSEA, WALES, UK. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:671 hits: 07-11 to 07-02] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:08:25:00 WinXP 79.111.159.229 (G-M-I.NET):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:671 hits: 07-11 to 07-02] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

08:31:00 Win2K-f 4.245.114.12 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SPARKS, NEVADA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.124:80
US:205.128.79.125:80
US:4.23.60.126:80 135 pcap raw alerts
ruleset other
82 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
73f1082158
[Firefox:157 hits: 06-18 to 07-02] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

08:34:00 WinXP 12.72.153.76 (ATT.NET):
AT&T WORLDNET SERVICES,
MORRISTOWN, NEW JERSEY, US. n/a 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

08:50:00 WinXP 96.14.184.131 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
19 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

08:51:00 Win2K-f 85.180.52.23 (ALICEDSL.DE):
HANSENET-ADSL,
STUTTGART, BADEN-WURTTEMBERG, DE. (DSL) n/a 445 pcap raw alerts
ruleset shell
4 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:08:57:00 WinXP 208.84.201.230 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
60 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33
0 of 33 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
b7082104e4
[Firefox:23 hits: 06-18 to 07-02]
e07c29c4ae
[Firefox:51 hits: 06-19 to 07-02] none[4]
none [4]
e07c29c4ae[1] none:none
none:none
ASM:Graph
tElock|
tElock|
FSG| none
none
lines=92 trace
trace
trace

T:08:59:00 WinXP 116.123.1.106 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:199.93.41.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
87 lines Yeah : 1.3
profile none summary
tarball 0 of 33
0 of 33
30 of 33 4c3df24b32
[Firefox:42 hits: 06-17 to 07-02]
e07c29c4ae
[Firefox:51 hits: 06-19 to 07-02]
ff2150aa95
NEW 4c3df24b32 [1]
e07c29c4ae[1]
none [none] ASM:Graph
ASM:Graph
none:none
Armadillo|
FSG|
none|none lines=81
lines=92
none trace
trace
none

09:04:00 Win2K-f 75.63.169.204 (SBCGLOBAL.NET):
PPPOX POOL - BRAS6.STLSMO,
SOUTH FORK, MISSOURI, US. (DSL) n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:09:30:00 WinXP 125.232.148.69 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
28 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:09:36:00 WinXP 210.79.182.131 (MEDIATTI.NET):
MEDIATTI COMMUNICATIONS INC,
OKINAWA, OKINAWA, JP. n/a US:microsoft.com
US:download.microsoft.com
US:72.247.30.81:80
US:72.247.30.83:80 135 pcap raw alerts
ruleset other
85 lines Yeah : 1.3
profile none summary
tarball 3 of 33
33 of 33 3ed16ae12d
NEW
79c01ec060
[Firefox: 4 hits: 06-18 to 07-02] 3ed16ae12d [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

T:09:36:00 WinXP 122.120.98.161 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 217.170.244.2:443
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
irc
27 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:09:47:00 WinXP 71.68.33.181 (RR.COM):
ROAD RUNNER HOLDCO LLC,
SHELBY, NORTH CAROLINA, US. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 d6df3972a0
[Firefox:217 hits: 05-02 to 06-10] 39eeef52a4 [0] ASM:Graph
PolyEnE| lines=65 trace

T:10:26:00 WinXP 201.228.26.150 (TELECOM.COM.CO):
COLOMBIA TELECOMUNICACIONES S.A. ESP,
CO. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 32 of 33 8c4361f20f
NEW none[none] none:none
none|none none none

T:10:35:00 WinXP 81.41.136.84 (RIMA-TDE.NET):
TELEFONICA DE ESPANA SAU,
ES. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 31 of 32 d370fa2826
[Firefox: 4 hits: 04-24 to 05-04] d4427d3b1e [0] ASM:Graph
PolyEnE| lines=68 trace

T:10:42:00 Win2K-f 61.229.223.250 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 217.170.244.2:443
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
irc
28 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

10:42:00 WinXP 4.188.68.37 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a 135 pcap raw alerts
ruleset other
1044 lines Yeah : 1.3
profile none summary
tarball 8 of 33 e4d62d3596
NEW none[none] none:none
none|none none none

10:43:00 WinXP 98.134.70.166 (-):
. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 33 80926258e4
NEW none[none] none:none
none|none none none

T:10:59:00 WinXP 4.246.18.195 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MILPITAS, CALIFORNIA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

11:01:00 WinXP 202.88.238.238 (ASIANET.CO.IN):
ASIANET IS A ISP PROVIDING ACCESS THROUGH CABLE,
TRIVANDRUM, KERALA, IN. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:205.128.66.124:80
US:205.128.66.126:80 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 31 of 33
29 of 33 133401d618
[Firefox: 5 hits: 06-18 to 07-01]
7819d05bbf
[Firefox: 3 hits: 06-21 to 06-30] none[4]
7819d05bbf[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

11:19:00 WinXP 71.74.168.209 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ANN ARBOR, MICHIGAN, US. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:102 hits: 09-28 to 07-02] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:11:38:00 WinXP 82.50.147.65 (POOL8250.INTERBUSINESS.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
TORINO, PIEMONTE, IT. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 33 8a79fbda68
NEW none[none] none:none
none|none none none

T:11:49:00 Win2K-f 76.161.225.191 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:12:17:00 Win2K-f 24.80.165.36 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.126:80 135 pcap raw alerts
ruleset http
96 lines Yeah : 1.3
profile none summary
tarball 31 of 32
2 of 32 607b60ad51
[Firefox: 4 hits: 06-20 to 07-01]
e5c7bce70e
[Firefox: 4 hits: 06-20 to 07-01] none[4]
e5c7bce70e[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:12:43:00 WinXP 61.218.192.234 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
KAOHSIUNG, KAO-HSIUNG, TW. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
82 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
57ce4acac2
[Firefox:31 hits: 06-17 to 07-02] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

12:46:00 Win2K-f 92.40.190.188 (IKBCC.COM):
EU-ZZ,
UK. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:12:49:00 WinXP 119.17.106.179 (-):
. 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 30 of 32 3f5ec58a6b
[Firefox:31 hits: 04-24 to 06-27] 4a77430a59 [0] ASM:Graph
PolyEnE| lines=70 trace

T:12:58:00 WinXP 70.62.193.159 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MENTOR, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
73f1082158
[Firefox:157 hits: 06-18 to 07-02] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

13:11:00 WinXP 24.137.125.5 (EASTLINK.CA):
EASTLINK,
DARTMOUTH, NOVA SCOTIA, CA. n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.126:80
US:205.128.79.124:80
US:8.12.202.125:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
a08f3b74a4
[Firefox:123 hits: 06-18 to 07-02] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:13:16:00 WinXP 72.174.223.1 (BRESNAN.NET):
BRESNAN COMMUNICATIONS LLC,
CEDAR CITY, UTAH, US. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 31 of 33 ad0c5ff63e
NEW none[none] none:none
none|none none none

13:43:00 Win2K-f 92.40.4.212 (IKBCC.COM):
EU-ZZ,
UK. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

13:50:00 WinXP 92.40.87.62 (IKBCC.COM):
EU-ZZ,
UK. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 28 of 33 99ca2f9ac5
NEW none[none] none:none
none|none none none

T:13:59:00 WinXP 208.126.82.236 (NETINS.NET):
NETINS INC,
US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 31 743e51a884
NEW none[none] none:none
none|none none none

T:14:22:00 Win2K-f 66.61.159.43 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.126:80 135 pcap raw alerts
ruleset http
100 lines Yeah : 1.3
profile none summary
tarball 33 of 33
29 of 33 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
a86bdb31d3
NEW none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

T:14:23:00 WinXP 201.228.178.158 (TELECOM.COM.CO):
COLOMBIA TELECOMUNICACIONES S.A. ESP,
CO. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:102 hits: 09-28 to 07-02] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

15:09:00 Win2K-f 70.77.45.185 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
PRINCE GEORGE, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:207.123.46.125:80
HK:210.245.211.11:80 135 pcap raw alerts
ruleset other
254 lines Yeah : 1.3
profile none summary
tarball 31 of 33
29 of 33 81264c16dd
NEW
9a91743938
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

15:20:00 WinXP 24.66.50.209 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.47:80
US:208.111.173.51:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
73f1082158
[Firefox:157 hits: 06-18 to 07-02] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:15:52:00 WinXP 24.165.137.241 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
GB:welcome3.smile.co.uk
:wpad
US:sprw.information.com
RU:www.bbin.ru
RU:www.binbank.ru
GB:195.92.84.198:80 445 pcap raw alerts
ruleset http
http
http
http
33 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:1094 hits: 05-01 to 07-02] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

16:03:00 WinXP 4.188.92.184 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MARYSVILLE, OHIO, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
132 lines Yeah : 1.3
profile none summary
tarball 0 of 33 a08f3b74a4
[Firefox:123 hits: 06-18 to 07-02] a08f3b74a4 [1] ASM:Graph
Armadillo| lines=81 trace

T:16:04:00 Win2K-f 80.225.169.34 (TISCALI.COM):
TELINCO-DIALPOOL,
LEEDS, ENGLAND, UK. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:16:05:00 WinXP 24.139.112.182 (-):
. n/a 135 pcap raw alerts
ruleset other
8 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

16:45:00 Win2K-f 67.62.174.17 (CAVTEL.NET):
CAVALIER,
PHILADELPHIA, PENNSYLVANIA, US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

16:48:00 WinXP 125.0.40.249 (INFOWEB.NE.JP):
FUJITSU LIMITED,
TOKYO, TOKYO, JP. (DIAL) n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 30 of 33 dfcd73f7a7
NEW none[none] none:none
none|none none none

17:03:00 WinXP 200.225.152.157 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 30 of 32 89ed97c981
NEW none[none] none:none
none|none none none

T:17:05:00 WinXP 200.225.152.157 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 30 of 32 89ed97c981
NEW none[none] none:none
none|none none none

17:13:00 Win2K-f 4.88.44.23 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SHILOH, NORTH CAROLINA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

17:20:00 Win2K-f 68.144.135.11 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

17:25:00 WinXP 211.177.171.80 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:192.221.99.126:80
US:205.128.79.124:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
124 lines Yeah : 1.3
profile none summary
tarball 27 of 32
31 of 33 00392af02f
NEW
325971e23c
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

17:57:00 WinXP 61.231.239.62 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:18:06:00 WinXP 61.231.239.62 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

18:15:00 Win2K-f 222.236.27.47 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:198.78.220.126:80
US:207.123.44.126:80
US:207.123.47.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
97 lines Yeah : 1.3
profile none summary
tarball 31 of 33
30 of 33 168aab35a3
[Firefox:24 hits: 06-17 to 07-02]
f62373a83b
NEW none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

T:18:24:00 WinXP 12.77.6.203 (ATT.NET):
AT&T WORLDNET SERVICES,
CHESAPEAKE, VIRGINIA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:446 hits: 12-31 to 07-02] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:18:49:00 WinXP 61.228.151.91 (PRESTONAUTO.COM):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
28 lines Yeah : 1.8
profile none summary
tarball 29 of 33 b1de2f5ce5
NEW none[none] none:none
none|none none none

T:18:58:00 Win2K-f 75.17.17.121 (SBCGLOBAL.NET):
RBACK34D.IRVNCA,
HOUSTON, TEXAS, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:205.128.66.124:80 135 pcap raw alerts
ruleset http
60 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
b7082104e4
[Firefox:23 hits: 06-18 to 07-02] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

T:19:06:00 WinXP 61.221.250.18 (HINET.NET):
DATA COMMUNICATION BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TW. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
57ce4acac2
[Firefox:31 hits: 06-17 to 07-02]
e07c29c4ae
[Firefox:51 hits: 06-19 to 07-02] none[4]
57ce4acac2[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:19:09:00 WinXP 97.94.107.33 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:3130 hits: 12-31 to 07-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

19:10:00 Win2K-f 4.155.117.67 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
PITTSBURGH, PENNSYLVANIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80
US:208.111.153.215:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
73f1082158
[Firefox:157 hits: 06-18 to 07-02] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:19:14:00 WinXP 4.248.4.232 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) 217.170.244.2:443
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
irc
30 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:19:22:00 WinXP 220.138.144.36 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 217.170.244.2:443
CZ:217.170.244.2:443 445 pcap raw alerts
ruleset shell
ftp
irc
31 lines Yeah : 1.8
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

19:27:00 WinXP 96.15.50.95 (-):
. n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 30 of 33 19588cb5a9
NEW none[none] none:none
none|none none none

19:40:00 Win2K-f 4.244.57.246 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
ST. LOUIS, MISSOURI, US. (DIAL) 4.244.57.246:21 :irc.drxclusives.info
CA:activestate.com
US:acp.org.s7b1.psmtp.com
:mail.activestate.com
:smtp.activestate.com
:mx1.activestate.com
:mxs.activestate.com
:mail1.activestate.com
:relay.activestate.com
:ns.activestate.com
:gate.activestate.com
US:maillnx-us311.fmr.com
US:acp.org.s7b2.psmtp.com
DE:mf0.ffm0.de.carpe.net
US:maillnx-us312.fmr.com
US:acp.org.s7a1.psmtp.com
DE:convex.com
US:fmrco.com.s8a1.psmtp.com
US:acp.org.s7a2.psmtp.com
:mx.convex.com
:mail.convex.com
:smtp.convex.com
:mx1.convex.com
US:fmrco.com.s8a2.psmtp.com
US:mailaps.org
US:192.223.178.26:25
US:192.223.178.27:25
CA:204.244.102.3:25
CA:204.244.102.6:25
US:209.191.118.103:25
US:209.191.88.239:25
US:209.191.88.247:25
DE:212.96.133.129:25
DE:212.96.133.20:25
US:216.39.53.1:25
US:216.39.53.2:25
US:64.18.6.10:25
US:64.18.6.11:25
US:64.18.6.13:25
US:64.18.6.14:25
US:64.18.7.10:25
US:66.196.82.7:25 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.8
profile none summary
tarball 33 of 33 94d9f89ef5
NEW none[none] none:none
none|none none none

T:19:59:00 WinXP 68.146.198.116 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 210.245.211.11:65520 HK:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset http
irc
3 lines Yeah : 1.3
profile none summary
tarball 32 of 33 cfcb945fc1
NEW none[none] none:none
none|none none none

20:08:00 WinXP 59.32.112.186 (163DATA.COM.CN):
CHINANET GUANGDONG PROVINCE NETWORK,
GUANGZHOU, GUANGDONG, CN. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 33 bce12aa21f
[Firefox:19 hits: 05-12 to 06-22] none[4] none:none
PolyEnE| none trace

T:20:31:00 Win2K-f 130.13.38.36 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 69.42.216.90:9890 :f.unicat.org 445 pcap raw alerts
ruleset ftp
irc
31 lines Yeah : 1.3
profile none summary
tarball 13 of 31 e8d4d8cde1
[Firefox:293 hits: 03-31 to 06-26] fda109a6fd [0] ASM:Graph
ASProtect| lines=583
embedded dns trace

20:42:00 Win2K-f 98.134.107.238 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 8 of 33 3b2c621477
NEW none[none] none:none
none|none none none

20:52:00 Win2K-f 208.127.234.12 (DSLEXTREME.COM):
DSL EXTREME,
WINNETKA, CALIFORNIA, US. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
114 lines Yeah : 1.3
profile none summary
tarball 29 of 33
30 of 33 2ef2f78792
[Firefox: 4 hits: 06-21 to 06-26]
b7a332eb7c
[Firefox: 4 hits: 06-21 to 06-26] 2ef2f78792 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

T:21:00:00 WinXP 75.7.24.123 (SBCGLOBAL.NET):
RBACK5.PLTNCA,
SAN JOSE, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:351 hits: 06-17 to 07-02]
73f1082158
[Firefox:157 hits: 06-18 to 07-02]
e07c29c4ae
[Firefox:51 hits: 06-19 to 07-02] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

21:01:00 WinXP 96.14.80.113 (-):
. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

T:21:16:00 WinXP 172.131.73.187 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
111 lines Yeah : 1.3
profile none summary
tarball 30 of 33
29 of 33
0 of 33 3373948767
NEW
c73f738c30
NEW
e07c29c4ae
[Firefox:51 hits: 06-19 to 07-02] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

T:21:17:00 WinXP 61.229.67.62 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a 445 pcap raw alerts
ruleset shell
shell
ftp
shell
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

21:34:00 Win2K-f 4.154.231.39 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BROCKTON, MASSACHUSETTS, US. (DIAL) n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball 30 of 33 fce9eba3fb
NEW none[none] none:none
none|none none none

T:21:50:00 WinXP 4.154.231.39 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BROCKTON, MASSACHUSETTS, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

21:55:00 Win2K-f 124.241.187.119 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.47:80
US:208.111.173.51:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
86 lines Yeah : 1.3
profile none summary
tarball 0 of 33
29 of 32 4c3df24b32
[Firefox:42 hits: 06-17 to 07-02]
dbce870f48
NEW 4c3df24b32 [1]
none [none] ASM:Graph
none:none
Armadillo|
none|none lines=81
none trace
none

22:39:00 WinXP 61.224.90.29 (HINET.NET):
DATA COMMUNICATION BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a
CZ:217.170.244.2:443
CZ:82.114.64.251:443 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 25 of 28 7fdfe363d5
[Firefox:2804 hits: 12-31 to 07-02] 10862ea8b8 [0] ASM:Graph
FSG| lines=1933
embedded dns trace

22:46:00 Win2K-f 98.105.192.232 (-):
. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:205.128.79.124:80
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 135 pcap raw alerts
ruleset other
139 lines Yeah : 1.3
profile none summary
tarball 31 of 32
29 of 33 5378ab9d2d
NEW
60a6e7e23c
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

22:56:00 WinXP 4.246.18.124 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MILPITAS, CALIFORNIA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

22:57:00 Win2K-f 24.66.38.59 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 135 pcap raw alerts
ruleset other
5 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

23:47:00 WinXP 125.101.83.144 (UCOM.NE.JP):
G-KG0008N,
JP. (100Mbps) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 32 161e73cdfc
[Firefox: 3 hits: 05-13 to 06-12] none[4] none:none
none|none none trace

23:51:00 Win2K-f 118.216.47.41 (-):
. n/a US:microsoft.com
HK:proxima.ircgalaxy.pl
US:download.microsoft.com
US:208.111.148.108:80
US:208.111.148.69:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
97 lines Yeah : 1.3
profile none summary
tarball 31 of 33
30 of 33 168aab35a3
[Firefox:24 hits: 06-17 to 07-02]
d59714403a
NEW none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

T:23:54:00 Win2K-f 71.136.17.66 (-):
MILANO DESIGN,
PLANO, TEXAS, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
86 lines Yeah : 1.3
profile none summary
tarball 3 of 33
33 of 33
0 of 32 73ce2b74da
[Firefox: 3 hits: 06-18 to 07-02]
79c01ec060
[Firefox: 4 hits: 06-18 to 07-02]
b5919931fe
[Firefox:49 hits: 06-20 to 07-02] 73ce2b74da [1]
none [4]
b5919931fe[1] ASM:Graph
none:none
ASM:Graph
Armadillo|
tElock|
ASProtect| lines=81
none
lines=90 trace
trace
trace