Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

10 July 2008
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
T:00:10:00 Win2K-f 24.170.44.228 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CORPUS CHRISTI, TEXAS, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09]
b5919931fe
[Firefox:96 hits: 06-20 to 07-09] 		none[4]
73f1082158[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
T:00:25:00 WinXP 210.127.111.200 (KRLINE.NET):
KRNIC,
SEOUL, KYONGGI-DO, KR. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
29 of 33
0 of 33		 0537139fe7
[Firefox: 3 hits: 06-21 to 06-22]
49b6f2dd5d
[Firefox: 3 hits: 06-21 to 06-22]
e07c29c4ae
[Firefox:77 hits: 06-19 to 07-09] 		none[4]
49b6f2dd5d[1]
e07c29c4ae[1] 		none:none
ASM:Graph
ASM:Graph
 PolyEnE|
Armadillo|
FSG| 		none
lines=81
lines=92 		trace
trace
trace
T:00:39:00 WinXP 96.52.164.63 (-):
. 		n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
267 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33 40531a3d4c
NEW 		none[none] none:none
 none|none none none
00:42:00 WinXP 24.85.96.144 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.126:80
US:198.78.220.124:80
US:199.93.41.124:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
a08f3b74a4
[Firefox:173 hits: 06-18 to 07-09] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:00:44:00 WinXP 59.173.81.170 (163DATA.COM.CN):
CHINANET HUBEI PROVINCE NETWORK,
WUHAN, HUBEI, CN. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:1403 hits: 12-31 to 07-08] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:00:53:00 WinXP 71.131.139.234 (-):
VALLEY FOOD INC,
PLANO, TEXAS, US. (100Mbps) 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.126:80
US:207.123.46.126:80
US:4.23.60.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
00:58:00 WinXP 71.120.32.171 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
FT. WAYNE, INDIANA, US. (DSL) 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.43:80
US:208.111.148.54:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
29 of 33		 8fc270a8ba
NEW
b16e6b2c52
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
01:06:00 Win2K-f 122.52.23.153 (PLDT.NET):
IPG,
PH. 		n/a US:microsoft.com
US:download.microsoft.com
HK:proxim.ircgalaxy.pl
US:208.111.148.69:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
126 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 33
33 of 33		 16874933ea
[Firefox:13 hits: 06-18 to 07-08]
76ee340669
[Firefox:13 hits: 06-18 to 07-08] 		16874933ea [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
PolyEnE| 		lines=82
none 		trace
trace
T:01:08:00 WinXP 98.134.130.96 (-):
. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		http
120 lines 		Yeah : 1.3
profile 		none summary
tarball 		28 of 33
31 of 33		 6d86a1ff5a
[Firefox:10 hits: 06-25 to 07-09]
7f6e032fc0
[Firefox:10 hits: 06-25 to 07-09] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:01:40:00 WinXP 58.191.160.156 (EONET.NE.JP):
K-OPTICOM CORPORATION,
JP. 		63.173.172.98:6668  
US:63.173.172.98:6668 		139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 1.3
profile 		none summary
tarball 		19 of 33 ea5389d425
[Firefox:40 hits: 07-06 to 07-07] 		none[none] none:none
 none|none none none
01:47:00 Win2K-f 208.126.80.240 (NETINS.NET):
NETINS INC,
US. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.47:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 33
30 of 33		 2ef2f78792
[Firefox: 5 hits: 06-21 to 07-03]
b7a332eb7c
[Firefox: 5 hits: 06-21 to 07-03] 		2ef2f78792 [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
tElock| 		lines=82
none 		trace
trace
01:50:00 WinXP 172.130.245.187 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.47:80
US:208.111.173.51:80 		135 pcap raw alerts
ruleset 		other
80 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
02:02:00 Win2K-f 4.246.248.165 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
AUBURN, CALIFORNIA, US. (DIAL) 		n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:02:04:00 Win2K-f 122.2.37.61 (PLDT.NET):
JNEC7300I03_CONSUMER,
CEBU, CEBU CITY, PH. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.215:80 		135 pcap raw alerts
ruleset 		http
253 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 33
0 of 32
31 of 33		 10e9845a09
NEW
b5919931fe
[Firefox:96 hits: 06-20 to 07-09]
e0faf35825
NEW 		none[none]
b5919931fe[1]
none [none] 		none:none
ASM:Graph
none:none
 none|none
ASProtect|
none|none 		none
lines=90
none 		none
trace
none
02:05:00 WinXP 201.104.16.48 (PROD-DIAL.COM.MX):
UNINET S.A. DE C.V,
CANCUN, QUINTANA ROO, MX. (DIAL) 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:1403 hits: 12-31 to 07-08] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
02:10:00 WinXP 86.147.164.147 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
LONDON, ENGLAND, UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 cce9566ceb
[Firefox:22 hits: 06-12 to 07-09] 		none[4] none:none
 PolyEnE| none trace
T:02:25:00 WinXP 87.61.171.121 (IP.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 c05385e600
[Firefox:20 hits: 06-24 to 07-06] 		6a383b021d [0] ASM:Graph
 PolyEnE| lines=68 trace
T:02:50:00 WinXP 86.154.14.61 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
SWANSEA, WALES, UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:688 hits: 07-11 to 07-09] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
03:39:00 WinXP 193.250.196.154 (ABO.WANADOO.FR):
WANADOO FRANCE,
PARIS, ILE-DE-FRANCE, FR. 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a12cab51ef
[Firefox:1104 hits: 05-01 to 07-09] 		40f7f463c4 [0] ASM:Graph
 ASPack| lines=281
embedded dns 		trace
T:04:02:00 Win2K-f 65.86.238.166 (DSL.NET):
DSL.NET INC,
BROOKLYN, NEW YORK, US. (100Mbps) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.69:80 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
04:22:00 Win2K-f 207.5.163.103 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.115:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
04:56:00 Win2K-f 75.136.141.17 (CHARTER.COM):
CHARTER COMMUNICATIONS,
HICKORY, NORTH CAROLINA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.126:80 		135 pcap raw alerts
ruleset 		other
200 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 33
29 of 32		 0022c74e8a
NEW
f7eec61c8e
NEW 		0022c74e8a [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
tElock| 		lines=82
none 		trace
trace
T:05:21:00 WinXP 116.59.169.51 (-):
MOBILE BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 31 4d244a981f
[Firefox: 6 hits: 03-30 to 07-08] 		b66b85d85f [0] ASM:Graph
 PolyEnE| lines=129 trace
05:22:00 WinXP 79.138.157.121 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:1403 hits: 12-31 to 07-08] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
05:29:00 WinXP 122.55.147.69 (PLDT.NET):
IPG,
PH. 		n/a   135 pcap raw alerts
ruleset 		other
11 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:05:34:00 Win2K-f 24.66.48.204 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 32
31 of 32
23 of 33		 b5919931fe
[Firefox:96 hits: 06-20 to 07-09]
bca9e0fb5f
[Firefox: 9 hits: 06-18 to 07-06]
e53a9ea82e
[Firefox: 9 hits: 06-18 to 07-06] 		b5919931fe [1]
none [4]
e53a9ea82e[1] 		ASM:Graph
none:none
ASM:Graph
 ASProtect|
PolyEnE|
Armadillo| 		lines=90
none
lines=81 		trace
trace
trace
05:37:00 WinXP 86.133.49.4 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
BASINGSTOKE, ENGLAND, UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 cce9566ceb
[Firefox:22 hits: 06-12 to 07-09] 		none[4] none:none
 PolyEnE| none trace
T:06:02:00 WinXP 77.37.156.147 (NCNET.RU):
NCN-INFRA,
RU. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3170 hits: 12-31 to 07-09] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
06:14:00 Win2K-f 211.44.167.46 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:205.128.79.124:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
97 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
30 of 33		 168aab35a3
[Firefox:44 hits: 06-17 to 07-09]
acd2a6266d
[Firefox: 4 hits: 06-19 to 07-04] 		none[4]
acd2a6266d[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=82 		trace
trace
06:24:00 WinXP 62.201.94.81 (T-ONLINE.HU):
T-ONLINE CATV CLIENTS (DYNAMIC ADDRESS POOL),
HU. 		n/a   445 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:134 hits: 09-28 to 07-09] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:06:42:00 WinXP 86.156.167.11 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
SWANSEA, WALES, UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 cce9566ceb
[Firefox:22 hits: 06-12 to 07-09] 		none[4] none:none
 PolyEnE| none trace
T:07:00:00 Win2K-f 211.186.128.240 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:198.78.220.126:80
US:205.128.79.124:80
US:207.123.47.126:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 32
28 of 32		 8a75955033
[Firefox: 6 hits: 06-20 to 07-08]
9276c8b36b
[Firefox: 6 hits: 06-20 to 07-08] 		none[4]
9276c8b36b[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
07:10:00 WinXP 99.164.123.198 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:205.128.79.126:80
US:207.123.46.126:80
US:207.123.47.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
a08f3b74a4
[Firefox:173 hits: 06-18 to 07-09] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:07:20:00 WinXP 200.100.177.157 (TELESP.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:467 hits: 12-31 to 07-09] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
07:35:00 WinXP 65.79.136.210 (CAMPTV.COM):
LAMONT DIGITAL SYSTEMS INC,
BRISTOW, VIRGINIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:199.93.44.124:80
US:4.23.60.125:80 		135 pcap raw alerts
ruleset 		other
86 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
3 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
991aba5d77
NEW 		none[4]
none [none] 		none:none
none:none
 tElock|
none|none 		none
none 		trace
none
07:52:00 Win2K-f 119.95.170.21 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:204.160.126.124:80
US:207.123.46.125:80 		135 pcap raw alerts
ruleset 		other
238 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
29 of 32		 a272491856
NEW
f8a6c43c1d
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
07:57:00 WinXP 200.164.10.14 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 		n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		33 of 33 5089fbb75a
NEW 		none[none] none:none
 none|none none none
T:07:57:00 WinXP 219.97.166.96 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:134 hits: 09-28 to 07-09] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:07:59:00 Win2K-f 125.177.34.48 (-):
POWC-018,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
HK:proxima.ircgalaxy.pl
US:download.microsoft.com
US:207.123.46.126:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		http
87 lines 		Yeah : 1.3
profile 		none summary
tarball 		1 of 33
31 of 33
0 of 32		 2ec24780fe
NEW
780febebd5
NEW
b5919931fe
[Firefox:96 hits: 06-20 to 07-09] 		none[none]
none [none]
b5919931fe[1] 		none:none
none:none
ASM:Graph
 none|none
none|none
ASProtect| 		none
none
lines=90 		none
none
trace
08:17:00 Win2K-f 63.204.78.148 (PACBELL.NET):
AT&T INTERNET SERVICES,
YUBA CITY, CALIFORNIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:08:40:00 WinXP 88.234.41.146 (-):
TT ADSL-ALCATEL DINAMIK_GAY,
TR. 		n/a   445 pcap raw alerts
ruleset 		other
0 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
08:42:00 WinXP 41.214.133.128 (-):
. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 1e5df7ba74
[Firefox:27 hits: 03-24 to 07-04] 		a5331b711f [0] ASM:Graph
 PolyEnE| lines=68 trace
T:08:42:00 WinXP 41.214.133.128 (-):
. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 1e5df7ba74
[Firefox:27 hits: 03-24 to 07-04] 		a5331b711f [0] ASM:Graph
 PolyEnE| lines=68 trace
T:09:07:00 Win2K-f 122.42.94.37 (-):
POWERCOMM,
KR. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		24 of 33
0 of 32
32 of 33		 8a93930ea8
[Firefox: 2 hits: 07-06 to 07-06]
b5919931fe
[Firefox:96 hits: 06-20 to 07-09]
bc94f66052
[Firefox: 2 hits: 07-06 to 07-06] 		none[none]
b5919931fe[1]
none [none] 		none:none
ASM:Graph
none:none
 none|none
ASProtect|
none|none 		none
lines=90
none 		none
trace
none
09:09:00 Win2K-f 70.183.164.54 (COX.NET):
COX COMMUNICATIONS,
WARWICK, RHODE ISLAND, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.124:80
US:204.160.126.126:80
US:205.128.66.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
a08f3b74a4
[Firefox:173 hits: 06-18 to 07-09] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
09:15:00 Win2K-f 124.241.191.207 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.46.125:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
a08f3b74a4
[Firefox:173 hits: 06-18 to 07-09] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
09:31:00 Win2K-f 98.134.130.96 (-):
. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.219:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
116 lines 		Yeah : 1.3
profile 		none summary
tarball 		28 of 33
31 of 33		 6d86a1ff5a
[Firefox:10 hits: 06-25 to 07-09]
7f6e032fc0
[Firefox:10 hits: 06-25 to 07-09] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
09:49:00 Win2K-f 118.219.163.101 (-):
. 		n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:199.93.53.126:80
US:207.123.47.126:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
86 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
0 of 33		 168aab35a3
[Firefox:44 hits: 06-17 to 07-09]
4c3df24b32
[Firefox:71 hits: 06-17 to 07-09] 		none[4]
4c3df24b32[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:10:09:00 WinXP 66.26.89.222 (RR.COM):
ROAD RUNNER HOLDCO LLC,
RALEIGH, NORTH CAROLINA, US. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:467 hits: 12-31 to 07-09] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
10:14:00 Win2K-f 75.46.44.210 (SBCGLOBAL.NET):
PPPOX POOL RBACK13.SFLDMI,
DETROIT, MICHIGAN, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.126:80
US:199.93.44.126:80
US:205.128.66.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
a08f3b74a4
[Firefox:173 hits: 06-18 to 07-09] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
10:18:00 Win2K-f 4.176.165.178 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
ALBUQUERQUE, NEW MEXICO, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
3 lines 		Argh : 0.3
profile 		none summary
tarball 		none none none none none none none
10:36:00 WinXP 218.237.185.45 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:199.93.44.124:80
US:199.93.46.124:80
US:207.123.37.125:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
97 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 32
31 of 33		 8390780c27
[Firefox:14 hits: 06-18 to 07-08]
af88ae89f8
[Firefox: 2 hits: 06-18 to 06-20] 		none[4]
af88ae89f8[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=82 		trace
trace
T:10:42:00 WinXP 24.83.3.68 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BURNABY, BRITISH COLUMBIA, CA. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
10:55:00 WinXP 202.125.49.164 (CTT.NE.JP):
CABLE TELEVISION TOYAMA INCORPORETED,
TOKYO, TOKYO, JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:134 hits: 09-28 to 07-09] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:11:00:00 WinXP 71.14.141.149 (CHARTER.COM):
CHARTER COMMUNICATIONS,
DUNCANVILLE, TEXAS, US. 		63.173.172.98:6668  
US:63.173.172.98:6668 		139 pcap raw alerts
ruleset 		ftp
irc
22 lines 		Yeah : 1.3
profile 		none summary
tarball 		19 of 33 bf14e246e6
[Firefox: 7 hits: 07-06 to 07-09] 		none[none] none:none
 none|none none none
T:11:01:00 WinXP 63.162.64.232 (GOLDLINK.NET):
ALLSOFT/FIRST INTERNET ALLIANCE,
BONAIRE, GEORGIA, US. 		67.43.236.98:10324 HK:proxim.ircgalaxy.pl
CA:xx.nadnadzz.info
CA:nadsam0.info
US:130.107.248.93:38863
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		irc
http
568 lines 		Yeah : 1.8
profile 		none summary
tarball 		31 of 33
19 of 33
17 of 33
none
12 of 33		 4eda5de38d
NEW
6a9be6af0c
NEW
bbe0c84096
NEW
c5622bb285
[Firefox: 7 hits: 06-23 to 07-07]
dde694c47a
NEW 		none[none]
none [none]
none [none]
none [4]
none [none] 		none:none
none:none
none:none
none:none
none:none
 none|none
none|none
none|none
none|none
none|none 		none
none
none
none
none 		none
none
none
trace
none
11:43:00 WinXP 83.213.204.15 (CLIENTES.EUSKALTEL.ES):
GLOBAL TELECOMMUNICATION SERVICE PROVIDER,
ES. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3170 hits: 12-31 to 07-09] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:11:55:00 Win2K-f 210.3.135.36 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:198.78.220.124:80
US:207.123.37.126:80
US:207.123.47.126:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
98 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
27 of 32		 79a515c871
NEW
b71c74380c
NEW 		none[4]
none [4] 		none:none
none:none
 PolyEnE|
PolyEnE| 		none
none 		trace
trace
T:12:01:00 Win2K-f 74.214.47.11 (METROCAST.NET):
GMP CABLE TV,
BERWICK, PENNSYLVANIA, US. 		n/a   135 pcap raw alerts
ruleset 		other
98 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33 e30fb27bda
NEW 		none[none] none:none
 none|none none none
T:12:01:00 WinXP 97.97.191.162 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.124:80
US:207.123.37.126:80
US:207.123.47.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:12:06:00 WinXP 201.228.76.162 (TELECOM.COM.CO):
COLOMBIA TELECOMUNICACIONES S.A. ESP,
CALI, VALLE DEL CAUCA, CO. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33 1801222e74
[Firefox: 2 hits: 07-08 to 07-09] 		none[none] none:none
 none|none none none
T:12:28:00 Win2K-f 24.139.114.68 (-):
. 		n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:192.221.99.124:80
US:198.78.220.126:80
US:207.123.37.125:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
116 lines 		Yeah : 1.3
profile 		none summary
tarball 		28 of 33
30 of 32		 232b3ac368
NEW
64afe11bcc
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
12:30:00 WinXP 75.51.223.213 (SBCGLOBAL.NET):
PPPOX POOL - RBACK7.IPLTIN,
INDIANAPOLIS, INDIANA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:198.78.220.126:80
US:207.123.37.125:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
12:44:00 WinXP 67.214.238.17 (-):
. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 33 c06735945d
NEW 		none[none] none:none
 none|none none none
T:12:44:00 WinXP 216.198.175.193 (INTELLEQCOM.NET):
INTELLEQ COMMUNICATIONS CORPORATION,
US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
111 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33
28 of 32
0 of 33		 3cd7958258
[Firefox: 5 hits: 06-17 to 07-05]
41efedf70f
[Firefox: 4 hits: 06-19 to 07-05]
e07c29c4ae
[Firefox:77 hits: 06-19 to 07-09] 		none[4]
41efedf70f[1]
e07c29c4ae[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
FSG| 		none
lines=82
lines=92 		trace
trace
trace
T:12:46:00 WinXP 85.84.214.148 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
BILBAO, PAIS VASCO, ES. 		n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:65520 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 33 8178c88f5e
[Firefox: 3 hits: 07-08 to 07-09] 		none[none] none:none
 none|none none none
T:13:22:00 WinXP 66.220.226.24 (VERMONTEL.NET):
VERMONT TELEPHONE COMPANY INC,
CHESTER, VERMONT, US. 		n/a :www.google.com.au
US:www.altavista.com
:jbeegvia.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 17028f1eda
[Firefox:19 hits: 09-29 to 07-08] 		none[3] none:none
 tElock| none trace
13:23:00 WinXP 66.220.226.24 (VERMONTEL.NET):
VERMONT TELEPHONE COMPANY INC,
CHESTER, VERMONT, US. 		n/a US:www.altavista.com
US:www.yahoo.com
:jbeegvia.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 17028f1eda
[Firefox:19 hits: 09-29 to 07-08] 		none[3] none:none
 tElock| none trace
13:28:00 Win2K-f 24.87.147.209 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
NEW WESTMINSTER, BRITISH COLUMBIA, CA. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
32 of 33		 0dc39cd3c1
NEW
a120847406
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:13:38:00 WinXP 93.102.64.126 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 3be4dcb123
NEW 		none[none] none:none
 none|none none none
13:38:00 WinXP 4.184.234.53 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
LOUISA, VIRGINIA, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
74 lines 		Yeah : 1.3
profile 		none summary
tarball 		2 of 33 aeae074a62
NEW 		none[none] none:none
 none|none none none
13:47:00 WinXP 66.61.147.24 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:13:48:00 WinXP 211.213.56.206 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80
US:208.111.148.69:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
87 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
0 of 33		 168aab35a3
[Firefox:44 hits: 06-17 to 07-09]
4c3df24b32
[Firefox:71 hits: 06-17 to 07-09] 		none[4]
4c3df24b32[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:14:14:00 WinXP 71.131.5.92 (PACBELL.NET):
RBACK13.SNTC,
SAN JOSE, CALIFORNIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.149:80 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33
0 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
a08f3b74a4
[Firefox:173 hits: 06-18 to 07-09]
e07c29c4ae
[Firefox:77 hits: 06-19 to 07-09] 		none[4]
a08f3b74a4[1]
e07c29c4ae[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
FSG| 		none
lines=81
lines=92 		trace
trace
trace
14:41:00 Win2K-f 68.226.4.190 (COX.NET):
COX COMMUNICATIONS,
GAINESVILLE, FLORIDA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
14:41:00 WinXP 65.166.185.162 (RURALTEL.NET):
NEX-TECH,
HAYS, KANSAS, US. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 33
30 of 33		 ae43bb721a
[Firefox: 4 hits: 06-19 to 07-05]
b5a9a8f575
[Firefox: 4 hits: 06-19 to 07-05] 		ae43bb721a [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
StarForce| 		lines=81
none 		trace
trace
T:14:43:00 WinXP 68.226.4.190 (COX.NET):
COX COMMUNICATIONS,
GAINESVILLE, FLORIDA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:15:05:00 WinXP 66.50.89.178 (PRTC.NET):
PUERTO RICO TELEPHONE COMPANY,
SAN JUAN, PUERTO RICO, PR. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3170 hits: 12-31 to 07-09] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:15:23:00 WinXP 4.154.57.128 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
KINGSTON, TENNESSEE, US. (DIAL) 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 33 652180b07c
NEW 		none[none] none:none
 none|none none none
T:15:41:00 Win2K-f 61.34.136.82 (BORA.NET):
DACOM CORP,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.124:80
US:206.33.45.125:80
US:207.123.46.125:80 		135 pcap raw alerts
ruleset 		other
95 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33
29 of 32		 57ce4acac2
[Firefox:48 hits: 06-17 to 07-09]
83f26f5044
[Firefox: 6 hits: 06-20 to 07-07] 		57ce4acac2 [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
tElock| 		lines=81
none 		trace
trace
15:58:00 Win2K-f 211.213.56.206 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
HK:proxima.ircgalaxy.pl
US:download.microsoft.com
US:199.93.53.126:80
US:206.33.45.125:80
HK:210.245.211.11:65520
US:8.12.202.125:80 		135 pcap raw alerts
ruleset 		other
86 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
0 of 33		 168aab35a3
[Firefox:44 hits: 06-17 to 07-09]
4c3df24b32
[Firefox:71 hits: 06-17 to 07-09] 		none[4]
4c3df24b32[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
15:59:00 WinXP 12.73.238.173 (ATT.NET):
AT&T WORLDNET SERVICES,
NEW ORLEANS, LOUISIANA, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:467 hits: 12-31 to 07-09] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
16:07:00 Win2K-f 207.5.229.218 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
16:26:00 Win2K-f 12.73.52.95 (ATT.NET):
AT&T WORLDNET SERVICES,
LAFAYETTE, LOUISIANA, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:205.128.79.126:80 		135 pcap raw alerts
ruleset 		other
147 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
16:37:00 Win2K-f 216.206.136.192 (MEER.NET):
MEER NET,
BUCKHANNON, WEST VIRGINIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:199.93.46.124:80
US:8.12.202.125:80 		135 pcap raw alerts
ruleset 		other
80 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:16:44:00 Win2K-f 72.64.30.16 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
CHARLESTON, WEST VIRGINIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:205.128.79.124:80
US:4.23.60.125:80
US:8.12.202.125:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:16:45:00 WinXP 96.14.128.35 (-):
. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 3ae357d17b
[Firefox:735 hits: 05-01 to 07-09] 		462a7be171 [0] ASM:Graph
 PolyEnE| lines=73 trace
T:16:49:00 WinXP 86.136.29.204 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
LONDON, ENGLAND, UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 cce9566ceb
[Firefox:22 hits: 06-12 to 07-09] 		none[4] none:none
 PolyEnE| none trace
T:17:09:00 Win2K-f 4.226.9.57 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MIDLOTHIAN, TEXAS, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.126:80
US:204.160.126.124:80
US:207.123.37.125:80 		135 pcap raw alerts
ruleset 		other
103 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
17:17:00 WinXP 202.179.239.13 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
JP. (DSL) 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:198.78.220.124:80
US:198.78.220.126:80
US:205.128.79.125:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
30 of 33		 02cab5983b
[Firefox: 4 hits: 06-18 to 07-08]
76e6f343c5
[Firefox: 4 hits: 06-18 to 07-08] 		none[4]
76e6f343c5[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=82 		trace
trace
17:18:00 WinXP 66.68.207.108 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MCALLEN, TEXAS, US. 		n/a DE:siliconfireware.ru
:www.proxy-socks.net
:wpad
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a12cab51ef
[Firefox:1104 hits: 05-01 to 07-09] 		40f7f463c4 [0] ASM:Graph
 ASPack| lines=281
embedded dns 		trace
T:17:28:00 Win2K-f 65.68.44.155 (SWBELL.NET):
AT&T INTERNET SERVICES,
KANSAS CITY, MISSOURI, US. (DSL) 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:198.78.220.126:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 33
0 of 32
28 of 32		 3f0a5b2ebe
[Firefox: 6 hits: 06-18 to 07-02]
b5919931fe
[Firefox:96 hits: 06-20 to 07-09]
c6bfb5f0f2
[Firefox: 6 hits: 06-18 to 07-02] 		none[4]
b5919931fe[1]
c6bfb5f0f2[1] 		none:none
ASM:Graph
ASM:Graph
 PolyEnE|
ASProtect|
Armadillo| 		none
lines=90
lines=81 		trace
trace
trace
T:17:38:00 Win2K-f 122.43.61.89 (-):
POWERCOMM,
KR. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:198.78.220.124:80
US:199.93.41.124:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		24 of 33
32 of 33		 8a93930ea8
[Firefox: 2 hits: 07-06 to 07-06]
bc94f66052
[Firefox: 2 hits: 07-06 to 07-06] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:17:46:00 WinXP 4.131.72.14 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3170 hits: 12-31 to 07-09] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
18:00:00 WinXP 4.240.235.114 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
TUCSON, ARIZONA, US. (DIAL) 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 f502585714
[Firefox:92 hits: 05-03 to 07-07] 		ae590430c5 [0] ASM:Graph
 PolyEnE| lines=63 trace
T:18:00:00 WinXP 4.240.235.114 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
TUCSON, ARIZONA, US. (DIAL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 f502585714
[Firefox:92 hits: 05-03 to 07-07] 		ae590430c5 [0] ASM:Graph
 PolyEnE| lines=63 trace
T:18:11:00 WinXP 122.25.158.241 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 		n/a   445 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		33 of 33 3b2958417b
[Firefox: 2 hits: 07-09 to 07-09] 		none[none] none:none
 none|none none none
18:15:00 WinXP 4.155.18.217 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BALTIMORE, MARYLAND, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		ftp
14 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:134 hits: 09-28 to 07-09] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
18:29:00 WinXP 4.226.9.57 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MIDLOTHIAN, TEXAS, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.149:80
US:208.111.148.152:80 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:18:43:00 WinXP 76.244.176.42 (PACBELL.NET):
AT&T INTERNET SERVICES,
US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
a08f3b74a4
[Firefox:173 hits: 06-18 to 07-09] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:18:49:00 Win2K-f 122.146.224.133 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:18:51:00 Win2K-f 75.49.236.188 (SBCGLOBAL.NET):
PPPOX POOL - BRAS6.STLSMO,
SOUTH FORK, MISSOURI, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80
US:208.111.173.16:80 		135 pcap raw alerts
ruleset 		other
306 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
30 of 33		 2a4ec56dfe
NEW
37de553249
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
18:55:00 WinXP 4.155.126.26 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
PITTSBURGH, PENNSYLVANIA, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:134 hits: 09-28 to 07-09] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:19:15:00 WinXP 70.71.200.216 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3170 hits: 12-31 to 07-09] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:19:35:00 WinXP 69.108.109.222 (PACBELL.NET):
IRVNCA INTERNAL,
LOS ANGELES, CALIFORNIA, US. (DSL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 3ae357d17b
[Firefox:735 hits: 05-01 to 07-09] 		462a7be171 [0] ASM:Graph
 PolyEnE| lines=73 trace
19:39:00 WinXP 124.87.81.162 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
TOKYO, TOKYO, JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:134 hits: 09-28 to 07-09] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
19:46:00 Win2K-f 24.198.43.30 (RR.COM):
ROAD RUNNER HOLDCO LLC,
PORTLAND, MAINE, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.126:80
US:199.93.44.124:80
US:4.23.60.126:80 		135 pcap raw alerts
ruleset 		other
77 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
73f1082158
[Firefox:248 hits: 06-18 to 07-09] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:20:12:00 WinXP 82.207.12.65 (UKRTEL.NET):
UKRTELECOM IP ACCESS NETWORK IN DONECK,
UA. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
4 lines 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3170 hits: 12-31 to 07-09] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:20:21:00 WinXP 76.231.58.231 (SBCGLOBAL.NET):
PPPOX POOL - BRAS2.FRS2CA,
FRESNO, CALIFORNIA, US. 		n/a   445 pcap raw alerts
ruleset 		shell
shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:467 hits: 12-31 to 07-09] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
20:25:00 WinXP 76.231.58.231 (SBCGLOBAL.NET):
PPPOX POOL - BRAS2.FRS2CA,
FRESNO, CALIFORNIA, US. 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:467 hits: 12-31 to 07-09] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
20:29:00 Win2K-f 98.150.85.141 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:205.128.66.124:80
US:206.33.45.125:80
US:207.123.37.125:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
a08f3b74a4
[Firefox:173 hits: 06-18 to 07-09] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:20:50:00 Win2K-f 116.123.154.137 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
HK:proxima.ircgalaxy.pl
US:download.microsoft.com
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		http
144 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
24 of 33
0 of 32		 6e2eaa0359
NEW
740e3bffe0
NEW
b5919931fe
[Firefox:96 hits: 06-20 to 07-09] 		none[none]
none [none]
b5919931fe[1] 		none:none
none:none
ASM:Graph
 none|none
none|none
ASProtect| 		none
none
lines=90 		none
none
trace
T:20:58:00 Win2K-f 24.78.187.200 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:205.128.79.124:80
US:205.128.79.125:80
US:4.23.60.126:80 		135 pcap raw alerts
ruleset 		other
123 lines 		Yeah : 1.3
profile 		none summary
tarball 		28 of 33
30 of 33		 543375ad22
NEW
dc47059490
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
20:58:00 Win2K-f 121.73.84.83 (TELSTRACLEAR.NET):
TELECOMMUNICATIONS COMPANY,
NZ. 		n/a US:microsoft.com
US:download.microsoft.com
US:205.128.79.124:80
US:205.128.79.125:80
US:4.23.60.126:80 		135 pcap raw alerts
ruleset 		other
356 lines 		Yeah : 1.3
profile 		none summary
tarball 		21 of 33
31 of 33		 0f55e617b4
NEW
4c764cd519
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
21:53:00 Win2K-f 24.24.158.48 (RR.COM):
ROAD RUNNER HOLDCO LLC,
NORTHRIDGE, CALIFORNIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80 		135 pcap raw alerts
ruleset 		other
180 lines 		Yeah : 1.3
profile 		none summary
tarball 		24 of 33
31 of 33		 5f11b319ef
[Firefox: 2 hits: 07-07 to 07-09]
a3f631e410
[Firefox: 2 hits: 07-07 to 07-09] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:21:57:00 WinXP 218.167.58.144 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a   445 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:134 hits: 09-28 to 07-09] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:21:59:00 WinXP 60.179.160.46 (163DATA.COM.CN):
CHINANET-ZJ NINGBO NODE NETWORK,
NINGBO, ZHEJIANG, CN. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3170 hits: 12-31 to 07-09] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
22:00:00 WinXP 124.60.119.144 (-):
POWERCOM,
KR. 		n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:205.128.66.124:80
HK:210.245.211.11:65520
US:4.23.60.125:80
US:4.23.60.126:80 		135 pcap raw alerts
ruleset 		other
87 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33
32 of 33		 4c3df24b32
[Firefox:71 hits: 06-17 to 07-09]
58408136a4
[Firefox: 2 hits: 06-28 to 07-06] 		4c3df24b32 [1]
none [none] 		ASM:Graph
none:none
 Armadillo|
none|none 		lines=81
none 		trace
none
22:12:00 Win2K-f 4.249.60.34 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WASHINGTON, DISTRICT OF COLUMBIA, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
299 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33 f296d0848c
NEW 		none[none] none:none
 none|none none none
T:22:30:00 WinXP 216.198.160.227 (DOBSONTELECO.COM):
INTELLEQ COMMUNICATIONS CORPORATION,
NEWALLA, OKLAHOMA, US. (DSL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3170 hits: 12-31 to 07-09] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:22:36:00 WinXP 70.67.253.172 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
DUNCAN, BRITISH COLUMBIA, CA. (DSL) 		n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 33 965c2ca7e5
NEW 		none[none] none:none
 none|none none none
22:39:00 WinXP 219.97.165.141 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:134 hits: 09-28 to 07-09] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
23:11:00 Win2K-f 220.227.128.118 (PHOTONINFOTECH.COM):
RELIANCE INFOCOM LTD,
RAJKOT, GUJARAT, IN. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
US:204.160.126.124:80
US:4.23.60.125:80 		135 pcap raw alerts
ruleset 		other
99 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33
30 of 32		 6884695753
NEW
d36316d3ce
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
23:30:00 WinXP 70.61.160.34 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COLUMBUS, OHIO, US. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:204.160.126.126:80
US:207.123.46.125:80
US:207.123.47.126:80
HK:210.245.211.11:80 		135 pcap raw alerts
ruleset 		other
190 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 32
none		 2110c8100f
[Firefox: 6 hits: 06-19 to 07-02]
e818015a89
[Firefox: 5 hits: 06-23 to 07-02] 		none[4]
e818015a89[1] 		none:none
ASM:Graph
 PolyEnE|
Armadillo| 		none
lines=81 		trace
trace
T:23:31:00 WinXP 199.227.202.37 (-):
APPFORGE,
ATLANTA, GEORGIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:207.123.46.125:80
US:207.123.47.126:80 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:524 hits: 06-17 to 07-09]
a08f3b74a4
[Firefox:173 hits: 06-18 to 07-09] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
23:32:00 Win2K-f 24.85.114.145 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) 		n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:204.160.126.126:80
US:207.123.46.125:80
US:207.123.47.126:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
32 of 33		 0dc39cd3c1
NEW
a120847406
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
23:34:00 WinXP 122.26.118.195 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:688 hits: 07-11 to 07-09] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
T:23:38:00 Win2K-f 122.42.94.37 (-):
POWERCOMM,
KR. 		n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:198.78.220.124:80
HK:210.245.211.11:65520
US:4.23.60.125:80 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		24 of 33
32 of 33		 8a93930ea8
[Firefox: 2 hits: 07-06 to 07-06]
bc94f66052
[Firefox: 2 hits: 07-06 to 07-06] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
23:41:00 WinXP 87.61.171.213 (IP.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. 		n/a EU:siliconfireware.ru
:wpad
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 df17a625ee
[Firefox:481 hits: 05-04 to 07-09] 		9bbdd086c5 [0] ASM:Graph
 ASPack| lines=186
embedded dns 		trace