Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

20 July 2008
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
00:27:00 Win2K-f 59.114.127.96 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
00:37:00 Win2K-f 125.233.18.9 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
00:50:00 Win2K-f 211.49.5.118 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
US:download.microsoft.com
US:4.23.60.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33
33 of 33		 4c3df24b32
[Firefox:101 hits: 06-17 to 07-19]
53bfe15e91
[Firefox:767 hits: 06-17 to 07-19] 		4c3df24b32 [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
tElock| 		lines=81
none 		trace
trace
00:52:00 Win2K-f 24.87.46.107 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
RICHMOND, BRITISH COLUMBIA, CA. (DSL) 		72.10.172.218:9928 72.10.172.218:2938 CA:teek.ihshsd8.com
CA:japan.youngpeyatech.info
CA:done.blacktiehsbdcs.com
CA:72.10.169.26:3938
CA:72.10.172.218:2938
CA:72.10.172.218:9928 		135 pcap raw alerts
ruleset 		other
616 lines 		Yeah : 1.8
profile 		none summary
tarball 		32 of 33 e3d90a3753
NEW 		none[none] none:none
 none|none none none
T:01:16:00 WinXP 202.247.116.226 (MESH.AD.JP):
C&C INTERNET SERVICE MESH (NEC CORPORATION),
HIROSHIMA, HIROSHIMA, JP. 		n/a   445 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		32 of 32 03f912899b
[Firefox:48 hits: 12-14 to 07-17] 		83893bd25d [0] ASM:Graph
 none|none lines=65 trace
T:01:17:00 Win2K-f 24.67.144.25 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COURTENAY, BRITISH COLUMBIA, CA. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.126:80
US:205.128.79.124:80
US:207.123.37.125:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:01:20:00 WinXP 207.5.161.86 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.126:80
US:205.128.79.124:80
US:207.123.37.125:80 		135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:01:20:00 WinXP 118.165.15.182 (-):
. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 33 a483ba8aa1
[Firefox: 8 hits: 07-09 to 07-19] 		none[none] none:none
 none|none none none
T:01:24:00 WinXP 61.231.32.167 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (100Mbps) 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:01:27:00 WinXP 218.43.16.1 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:717 hits: 07-11 to 07-19] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
01:48:00 Win2K-f 125.231.97.185 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a   135 pcap raw alerts
ruleset 		other
53 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33 57ce4acac2
[Firefox:63 hits: 06-17 to 07-17] 		57ce4acac2 [1] ASM:Graph
 Armadillo| lines=81 trace
01:54:00 WinXP 4.141.32.59 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BUFFALO, NEW YORK, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
19 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:01:54:00 WinXP 89.204.204.142 (O2.IE):
O2 IRELAND MOBILE PHONE OPERATOR,
IE. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:717 hits: 07-11 to 07-19] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
02:25:00 Win2K-f 218.168.76.27 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:02:32:00 WinXP 211.176.160.19 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		http
125 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33
30 of 33		 2e04b06527
[Firefox: 2 hits: 06-18 to 07-04]
5c054291de
[Firefox: 2 hits: 06-18 to 07-04] 		none[4]
5c054291de[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=82 		trace
trace
02:48:00 WinXP 210.205.62.38 (KRLINE.NET):
KRNIC,
KR. (100Mbps) 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.219:80
US:208.111.148.226:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
135 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33
29 of 33		 3c8ada1df2
NEW
b8ba472d64
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
02:52:00 Win2K-f 59.121.113.168 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
19 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:02:56:00 Win2K-f 213.94.133.130 (EIRCOM.NET):
EIRCOM LTD,
DUBLIN, DUBLIN, IE. 		n/a   135 pcap raw alerts
ruleset 		other
6 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
02:56:00 WinXP 122.18.205.95 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
3 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:03:01:00 Win2K-f 216.27.114.73 (PRIMELINK1.NET):
PRIMELINK INC,
PLATTSBURGH, NEW YORK, US. 		n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:206.33.45.125:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
none		 dc20b6fe59
[Firefox: 7 hits: 06-23 to 07-15]
f97070ef2b
[Firefox: 7 hits: 06-23 to 07-15] 		dc20b6fe59 [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
PolyEnE| 		lines=81
none 		trace
trace
T:03:05:00 WinXP 62.11.82.26 (DIALUP.TISCALI.IT):
TISCALI ITALIA SPA,
COSENZA, CALABRIA, IT. (DIAL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		32 of 32 488d27fe97
NEW 		none[none] none:none
 none|none none none
03:06:00 Win2K-f 218.166.236.152 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:03:09:00 WinXP 41.214.169.136 (-):
. 		n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
NO:london.uk.eu.undernet.org
:washington.dc.us.undernet.org
SE:viking.dal.net
HK:210.245.211.11:65520 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 33 8178c88f5e
[Firefox:10 hits: 07-08 to 07-19] 		none[none] none:none
 none|none none none
03:09:00 WinXP 41.214.169.136 (-):
. 		n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 33 8178c88f5e
[Firefox:10 hits: 07-08 to 07-19] 		none[none] none:none
 none|none none none
T:03:37:00 WinXP 123.204.78.21 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) 		194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 33 b94a769a67
NEW 		none[none] none:none
 none|none none none
03:43:00 Win2K-f 220.139.219.148 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:04:03:00 Win2K-f 92.40.62.130 (IKBCC.COM):
EU-ZZ,
UK. 		n/a   135 pcap raw alerts
ruleset 		other
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:04:21:00 Win2K-f 218.237.236.57 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
US:download.microsoft.com
US:4.23.60.126:80 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33
33 of 33
0 of 32		 4c3df24b32
[Firefox:101 hits: 06-17 to 07-19]
53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
b5919931fe
[Firefox:138 hits: 06-20 to 07-19] 		4c3df24b32 [1]
none [4]
b5919931fe[1] 		ASM:Graph
none:none
ASM:Graph
 Armadillo|
tElock|
ASProtect| 		lines=81
none
lines=90 		trace
trace
trace
04:35:00 Win2K-f 124.241.151.57 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. 		n/a US:mx1.hotmail.com
HK:proxim.ircgalaxy.pl
US:ftp.newaol.com
US:yutunrz.1dumb.com
US:maila.microsoft.com
US:mailin-02.mx.aol.com
US:mailin-04.mx.aol.com
SE:ftp.icq.com
BE:ftp.scarlet.be
:xx.nadnadzz.info
US:mcduii.3-a.net
:jdjsloy.dynserv.com
**:wyqggvow.afraid.org
**:nttstziinpa.hn.org
US:fcnhysydw.yi.org
US:143.215.15.145:80
US:143.215.15.60:80
HK:210.245.211.11:65520
CA:67.43.236.98:10324
CA:67.43.236.99:10324 		135 pcap raw alerts
ruleset 		other
666 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33 48a8b58d74
NEW 		none[none] none:none
 none|none none none
T:04:40:00 WinXP 218.168.65.17 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
19 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 33 511dcda8ce
[Firefox: 2 hits: 07-16 to 07-17] 		none[none] none:none
 none|none none none
T:04:46:00 Win2K-f 68.154.33.26 (BELLSOUTH.NET):
BELLSOUTH.NET INC,
ATLANTA, GEORGIA, US. (DSL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
19 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
05:03:00 WinXP 189.48.7.157 (BRASILTELECOM.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 31 743e51a884
[Firefox: 6 hits: 07-01 to 07-18] 		none[none] none:none
 none|none none none
05:22:00 Win2K-f 4.157.74.215 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SCHENECTADY, NEW YORK, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
20 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:05:31:00 Win2K-f 125.203.196.123 (PLALA.OR.JP):
PLALA NETWORKS INC,
JP. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33 1eabea0858
NEW 		none[none] none:none
 none|none none none
05:35:00 Win2K-f 221.190.26.133 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 		n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:80
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 33 145421a65e
NEW 		none[none] none:none
 none|none none none
T:06:06:00 Win2K-f 222.239.165.157 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a   135 pcap raw alerts
ruleset 		other
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:06:23:00 WinXP 221.245.131.189 (UCOM.NE.JP):
N-KG,
KAWASAKI, KANAGAWA, JP. (100Mbps) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33 3605e1c1fb
NEW 		none[none] none:none
 none|none none none
06:29:00 WinXP 89.204.204.142 (O2.IE):
O2 IRELAND MOBILE PHONE OPERATOR,
IE. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:717 hits: 07-11 to 07-19] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
T:06:31:00 WinXP 212.27.5.207 (-):
MLIFENET,
RU. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 ea096a2bdf
[Firefox: 7 hits: 07-12 to 07-18] 		none[none] none:none
 none|none none none
T:06:49:00 WinXP 12.73.201.105 (ATT.NET):
AT&T WORLDNET SERVICES,
SHAWNEE, KANSAS, US. (DIAL) 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:07:07:00 Win2K-f 122.146.225.31 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a US:microsoft.com
US:download.microsoft.com
US:205.128.79.126:80
US:207.123.46.125:80
US:8.12.202.125:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:07:17:00 WinXP 4.243.30.206 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SALEM, OREGON, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
150 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 32
15 of 33		 73f1082158
[Firefox:370 hits: 06-18 to 07-19]
ae38085a44
NEW 		73f1082158 [1]
none [none] 		ASM:Graph
none:none
 Armadillo|
none|none 		lines=81
none 		trace
none
T:07:36:00 Win2K-f 122.116.174.236 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:07:36:00 WinXP 118.15.104.235 (-):
. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:176 hits: 09-28 to 07-19] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
07:37:00 WinXP 119.72.69.117 (-):
. 		n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		32 of 33 8aaa5621ab
NEW 		none[none] none:none
 none|none none none
07:43:00 Win2K-f 172.129.252.215 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.16:80
US:208.111.173.42:80 		135 pcap raw alerts
ruleset 		other
117 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
8 of 33		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
b7082104e4
[Firefox:52 hits: 06-18 to 07-19] 		none[4]
none [4] 		none:none
none:none
 tElock|
tElock| 		none
none 		trace
trace
T:07:48:00 WinXP 67.55.134.94 (WCCTA.NET):
WEBSTER CALHOUN TELEPHONE CO,
FT. DODGE, IOWA, US. (DSL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 33 8e4e9c46a1
[Firefox: 2 hits: 07-13 to 07-17] 		none[none] none:none
 none|none none none
T:07:55:00 Win2K-f 71.119.195.123 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
UPLAND, CALIFORNIA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
08:01:00 Win2K-f 85.127.5.45 (INODE.AT):
INODE TELEKOMMUNIKATIONSDIENSTLEITUNG GESMBH,
AT. (DSL) 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
08:09:00 WinXP 123.225.97.8 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
TOKYO, TOKYO, JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:176 hits: 09-28 to 07-19] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
08:19:00 Win2K-f 211.203.31.26 (HANANET.NET):
HANARO TELECOM INC,
KR. 		n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
HK:210.245.211.11:65520
US:69.28.178.10:80 		135 pcap raw alerts
ruleset 		other
97 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
31 of 33		 9d571adc3c
[Firefox: 3 hits: 07-04 to 07-09]
a704164588
[Firefox: 5 hits: 07-04 to 07-14] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
08:44:00 Win2K-f 172.133.114.51 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:8.12.202.125:80 		135 pcap raw alerts
ruleset 		other
139 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:08:53:00 Win2K-f 216.210.223.126 (-):
ADVANCED TELCOM GROUP / DIAL-UP,
SALEM, OREGON, US. (100Mbps) 		n/a   135 pcap raw alerts
ruleset 		other
146 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33 a08f3b74a4
[Firefox:251 hits: 06-18 to 07-19] 		a08f3b74a4 [1] ASM:Graph
 Armadillo| lines=81 trace
09:02:00 WinXP 4.168.108.102 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
TEMPLE CITY, CALIFORNIA, US. (DIAL) 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:205.128.66.124:80
US:205.128.79.125:80
US:207.123.46.125:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
148 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 33
29 of 33		 5c089fe241
NEW
6aff15795d
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
09:23:00 Win2K-f 196.208.95.212 (TELKOM-IPNET.CO.ZA):
AFRINIC,
CAPE TOWN, WESTERN CAPE, ZA. 		n/a US:microsoft.com
US:download.microsoft.com
US:207.123.47.126:80 		135 pcap raw alerts
ruleset 		other
95 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:09:28:00 WinXP 85.127.5.45 (INODE.AT):
INODE TELEKOMMUNIKATIONSDIENSTLEITUNG GESMBH,
AT. (DSL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:09:38:00 WinXP 117.99.4.106 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:1425 hits: 12-31 to 07-19] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
09:43:00 Win2K-f 121.92.73.65 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
22 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:09:50:00 Win2K-f 88.111.201.225 (AS9105.COM):
TISCALI UK LTD,
LONDON, ENGLAND, UK. (DSL) 		217.170.244.2:443  
CZ:217.170.244.2:443 		445 pcap raw alerts
ruleset 		shell
ftp
irc
27 lines 		Yeah : 1.8
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:09:54:00 WinXP 61.217.162.183 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:10:02:00 Win2K-f 85.177.83.171 (ALICEDSL.DE):
HANSENET-ADSL,
BERLIN, BERLIN, DE. 		n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33 deef244df5
NEW 		none[none] none:none
 none|none none none
T:10:02:00 WinXP 209.60.99.46 (FAST.NET):
FASTNET CORPORATION,
BETHLEHEM, PENNSYLVANIA, US. 		n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:1425 hits: 12-31 to 07-19] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:10:09:00 WinXP 85.176.21.184 (ALICEDSL.DE):
HANSENET-ADSL,
HAMBURG, HAMBURG, DE. (DSL) 		217.170.244.2:443  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
irc
27 lines 		Yeah : 1.8
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:10:10:00 WinXP 202.132.152.129 (TTN.NET):
TAIWAN TELECOMMUNICATION NETWORK SERVICES CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a   445 pcap raw alerts
ruleset 		other
0 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
10:14:00 WinXP 4.226.222.77 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
OKLAHOMA, US. (DIAL) 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:1425 hits: 12-31 to 07-19] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:10:19:00 Win2K-f 221.191.237.88 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 		217.170.244.2:443 HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		irc
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:10:19:00 Win2K-f 71.102.246.168 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
SANTA MARIA, CALIFORNIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.126:80
US:207.123.44.126:80
US:207.123.46.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
10:20:00 WinXP 85.177.83.171 (ALICEDSL.DE):
HANSENET-ADSL,
BERLIN, BERLIN, DE. 		n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33 deef244df5
NEW 		none[none] none:none
 none|none none none
10:45:00 Win2K-f 61.251.14.135 (-):
DAEJEON TELECOM,
SEOUL, KYONGGI-DO, KR. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:199.93.44.126:80
US:207.123.37.125:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		24 of 33
32 of 33		 074325ecbc
[Firefox: 2 hits: 07-02 to 07-02]
2a66fc87fa
[Firefox: 2 hits: 07-02 to 07-02] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
10:50:00 WinXP 67.10.175.117 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HOUSTON, TEXAS, US. 		n/a EU:siliconfireware.ru
:www.proxy-socks.net
:wpad
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a12cab51ef
[Firefox:1124 hits: 05-01 to 07-18] 		40f7f463c4 [0] ASM:Graph
 ASPack| lines=281
embedded dns 		trace
T:10:53:00 WinXP 99.146.190.103 (-):
. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:490 hits: 12-31 to 07-17] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
11:12:00 WinXP 86.96.64.137 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. 		n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		30 of 32 3f5ec58a6b
[Firefox:32 hits: 04-24 to 07-03] 		4a77430a59 [0] ASM:Graph
 PolyEnE| lines=70 trace
T:11:12:00 WinXP 86.96.64.137 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. 		n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		30 of 32 3f5ec58a6b
[Firefox:32 hits: 04-24 to 07-03] 		4a77430a59 [0] ASM:Graph
 PolyEnE| lines=70 trace
T:11:14:00 WinXP 78.49.206.112 (ALICEDSL.DE):
HANSENET TELEKOMMUNIKATION GMBH,
HAMBURG, HAMBURG, DE. (DSL) 		217.170.244.2:443   445 pcap raw alerts
ruleset 		shell
ftp
shell
shell
shell
irc
30 lines 		Yeah : 1.8
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:11:23:00 WinXP 117.99.9.105 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 33 7f6ea12654
[Firefox: 4 hits: 07-13 to 07-15] 		none[none] none:none
 none|none none none
11:24:00 WinXP 117.99.9.105 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		32 of 33 7f6ea12654
[Firefox: 4 hits: 07-13 to 07-15] 		none[none] none:none
 none|none none none
T:11:40:00 WinXP 75.3.247.229 (SBCGLOBAL.NET):
RBACK19A.IRVNCA,
COMPTON, CALIFORNIA, US. (DSL) 		217.170.244.2:443  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
irc
28 lines 		Yeah : 1.8
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:12:32:00 Win2K-f 217.184.22.185 (MEDIAWAYS.NET):
VARIOUS ONLINE SERVICES,
DE. 		n/a   445 pcap raw alerts
ruleset 		shell
shell
ftp
19 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
12:35:00 Win2K-f 12.74.177.56 (ATT.NET):
AT&T WORLDNET SERVICES,
MOBILE, ALABAMA, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
3 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
12:43:00 WinXP 92.40.40.179 (IKBCC.COM):
EU-ZZ,
UK. 		n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 33 c1688c66a4
NEW 		none[none] none:none
 none|none none none
13:07:00 WinXP 79.76.26.199 (AS9105.COM):
TELINCO,
UK. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 986b59708d
[Firefox:305 hits: 05-03 to 07-17] 		8a00217866 [0] ASM:Graph
 PolyEnE| lines=57 trace
T:13:08:00 WinXP 216.57.114.23 (PSHIFT.NET):
POWER SHIFT COMPUTER SERVICES INC,
STOWE, VERMONT, US. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:1425 hits: 12-31 to 07-19] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
13:20:00 Win2K-f 61.34.136.70 (BORA.NET):
DACOM CORP,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80 		135 pcap raw alerts
ruleset 		other
95 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33
29 of 32		 57ce4acac2
[Firefox:63 hits: 06-17 to 07-17]
83f26f5044
[Firefox: 9 hits: 06-20 to 07-16] 		57ce4acac2 [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
tElock| 		lines=81
none 		trace
trace
T:13:29:00 WinXP 66.38.51.108 (DUO-COUNTY.COM):
DUO COUNTY TELEPHONE COOPERATIVE,
CAVE CITY, KENTUCKY, US. (DSL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a0139d7ad8
[Firefox:452 hits: 05-02 to 07-17] 		d9e9662db1 [0] ASM:Graph
 PolyEnE| lines=68 trace
13:31:00 WinXP 41.214.144.191 (-):
. 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 f502585714
[Firefox:95 hits: 05-03 to 07-19] 		ae590430c5 [0] ASM:Graph
 PolyEnE| lines=63 trace
T:13:31:00 WinXP 41.214.144.191 (-):
. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 f502585714
[Firefox:95 hits: 05-03 to 07-19] 		ae590430c5 [0] ASM:Graph
 PolyEnE| lines=63 trace
T:13:36:00 WinXP 62.40.61.166 (O2.IE):
O2 IRELAND MOBILE PHONE OPERATOR,
DUBLIN, DUBLIN, IE. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:717 hits: 07-11 to 07-19] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
13:58:00 WinXP 75.51.226.196 (SBCGLOBAL.NET):
PPPOX POOL - RBACK7.IPLTIN-1162879261,
INDIANAPOLIS, INDIANA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.126:80
US:192.221.99.124:80
US:205.128.79.124:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:14:01:00 Win2K-f 4.178.195.99 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
VANCOUVER, WASHINGTON, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.126:80
US:192.221.99.124:80
US:205.128.79.124:80 		135 pcap raw alerts
ruleset 		other
77 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:14:05:00 WinXP 200.225.152.237 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3217 hits: 12-31 to 07-19] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:14:15:00 Win2K-f 218.168.158.169 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a   445 pcap raw alerts
ruleset 		shell
3 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:14:18:00 WinXP 190.139.141.89 (NET.AR):
TELECOM ARGENTINA S.A,
AR. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 986b59708d
[Firefox:305 hits: 05-03 to 07-17] 		8a00217866 [0] ASM:Graph
 PolyEnE| lines=57 trace
T:14:28:00 WinXP 63.19.13.235 (UU.NET):
UUNET TECHNOLOGIES INC,
ST. LOUIS, MISSOURI, US. (DIAL) 		n/a DE:siliconfireware.ru
US:searchportal.information.com
US:sprw.information.com
US:spi.domainsponsor.com
GB:welcome3.smile.co.uk
:wpad
GB:195.92.84.198:80 		445 pcap raw alerts
ruleset 		http
http
http
21 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29
0 of 33		 a12cab51ef
[Firefox:1124 hits: 05-01 to 07-18]
a1a5487948
NEW 		40f7f463c4 [0]
none [none] 		ASM:Graph
none:none
 ASPack|
none|none 		lines=281
embedded dns
none 		trace
none
14:29:00 Win2K-f 4.253.19.255 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
VIDOR, TEXAS, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
shell
ftp
21 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
14:34:00 WinXP 172.129.230.140 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.16:80
US:208.111.173.42:80 		135 pcap raw alerts
ruleset 		other
121 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
15:02:00 WinXP 92.40.21.189 (IKBCC.COM):
EU-ZZ,
UK. 		n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:80
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33 b2876f631c
NEW 		none[none] none:none
 none|none none none
15:07:00 WinXP 211.128.44.237 (SO-NET.NE.JP):
SO-NET ENTERTAINMENT CORPORATION,
TOKYO, TOKYO, JP. 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:717 hits: 07-11 to 07-19] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
15:45:00 WinXP 76.76.71.170 (LPBROADBAND.COM):
LP BROADBAND INC,
LOVELAND, COLORADO, US. 		n/a   135 pcap raw alerts
ruleset 		other
37 lines 		Yeah : 1.3
profile 		none summary
tarball 		8 of 33 b7082104e4
[Firefox:52 hits: 06-18 to 07-19] 		none[4] none:none
 tElock| none trace
T:15:50:00 Win2K-f 218.166.236.152 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:16:18:00 WinXP 78.52.60.157 (ALICEDSL.DE):
HANSENET TELEKOMMUNIKATION GMBH,
HAMBURG, HAMBURG, DE. (DSL) 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:16:19:00 WinXP 67.150.60.242 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
LOS ANGELES, CALIFORNIA, US. 		n/a   445 pcap raw alerts
ruleset 		ftp
14 lines 		Yeah : 0.8
profile 		none summary
tarball 		32 of 32 03f912899b
[Firefox:48 hits: 12-14 to 07-17] 		83893bd25d [0] ASM:Graph
 none|none lines=65 trace
16:28:00 WinXP 4.154.58.71 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
KINGSTON, TENNESSEE, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:16:34:00 WinXP 4.175.216.15 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
LAWRENCEVILLE, NEW JERSEY, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
139 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 32 73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		73f1082158 [1] ASM:Graph
 Armadillo| lines=81 trace
T:16:48:00 WinXP 76.254.87.107 (PACBELL.NET):
AT&T INTERNET SERVICES,
US. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 32 03f912899b
[Firefox:48 hits: 12-14 to 07-17] 		83893bd25d [0] ASM:Graph
 none|none lines=65 trace
17:05:00 Win2K-f 24.67.144.25 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COURTENAY, BRITISH COLUMBIA, CA. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:207.123.46.125:80
US:207.123.47.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:17:48:00 Win2K-f 122.148.157.146 (DODO.COM.AU):
LAYER 2 BROADBAND CUSTOMER NETWORK,
AU. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.126:80
US:205.128.79.124:80
US:207.123.47.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
17:59:00 Win2K-f 222.150.92.8 (PLALA.OR.JP):
PLALA NETWORKS INC,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:18:00:00 WinXP 206.125.146.118 (SHAWNEELINK.NET):
SHAWNEELINK,
US. 		194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33 366148f7b7
[Firefox: 8 hits: 07-06 to 07-17] 		none[none] none:none
 none|none none none
T:18:08:00 WinXP 122.133.35.208 (MESH.AD.JP):
NEC BIGLOBE LTD,
TOKYO, TOKYO, JP. 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:717 hits: 07-11 to 07-19] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
18:11:00 WinXP 216.57.114.30 (PSHIFT.NET):
POWER SHIFT COMPUTER SERVICES INC,
STOWE, VERMONT, US. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
18:26:00 WinXP 12.74.176.217 (ATT.NET):
AT&T WORLDNET SERVICES,
CHOCTAW, OKLAHOMA, US. (DIAL) 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
18:33:00 WinXP 96.14.222.240 (-):
. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 3ae357d17b
[Firefox:739 hits: 05-01 to 07-18] 		462a7be171 [0] ASM:Graph
 PolyEnE| lines=73 trace
T:18:48:00 WinXP 123.50.70.81 (-):
MANA INTERNET SERVICE PROVIDER,
PAPEETE, FRENCH POLYNESIA, PF. 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:176 hits: 09-28 to 07-19] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:18:59:00 WinXP 123.204.78.86 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 f502585714
[Firefox:95 hits: 05-03 to 07-19] 		ae590430c5 [0] ASM:Graph
 PolyEnE| lines=63 trace
T:19:01:00 WinXP 60.250.68.68 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
73f1082158
[Firefox:370 hits: 06-18 to 07-19] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:19:17:00 Win2K-f 60.36.56.20 (PLALA.OR.JP):
PLALA NETWORKS INC,
OSAKA, OSAKA, JP. 		n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 33 990dab20ec
NEW 		none[none] none:none
 none|none none none
T:19:26:00 Win2K-f 61.229.138.2 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
19:34:00 Win2K-f 58.111.190.241 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
SYDNEY, NEW SOUTH WALES, AU. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33 f9c8449e01
NEW 		none[none] none:none
 none|none none none
T:19:35:00 WinXP 119.95.181.10 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:205.128.66.126:80
US:207.123.47.126:80 		135 pcap raw alerts
ruleset 		other
380 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33
30 of 32		 5601dcf617
[Firefox: 3 hits: 07-11 to 07-14]
d0c1f3c8c7
[Firefox: 3 hits: 07-11 to 07-14] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:19:42:00 Win2K-f 122.2.44.176 (PLDT.NET):
JNEC7300I03_CONSUMER,
CEBU, CEBU CITY, PH. 		n/a   135 pcap raw alerts
ruleset 		other
171 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 32 8354fa612f
[Firefox: 4 hits: 06-30 to 07-19] 		none[none] none:none
 none|none none none
T:19:44:00 WinXP 196.12.181.213 (ATENAS.COM):
INTERNET COMMUNICATIONS ENVIRONMENTAL INC,
MANATI, PUERTO RICO, PR. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:3217 hits: 12-31 to 07-19] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:19:49:00 WinXP 65.5.53.70 (BELLSOUTH.NET):
BELLSOUTH.NET INC,
FAYETTEVILLE, TENNESSEE, US. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:1425 hits: 12-31 to 07-19] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
19:54:00 Win2K-f 125.203.192.113 (PLALA.OR.JP):
PLALA NETWORKS INC,
JP. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33 1eabea0858
NEW 		none[none] none:none
 none|none none none
T:20:06:00 WinXP 70.60.7.92 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COLUMBUS, OHIO, US. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80
US:208.111.173.53:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
28 of 33		 abb7f9922d
NEW
e504dcb886
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
20:10:00 WinXP 4.225.85.147 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
OHIO, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80
US:208.111.173.53:80 		135 pcap raw alerts
ruleset 		other
90 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
a08f3b74a4
[Firefox:251 hits: 06-18 to 07-19] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
20:50:00 WinXP 122.133.214.202 (MESH.AD.JP):
NEC BIGLOBE LTD,
TOKYO, TOKYO, JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:490 hits: 12-31 to 07-17] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
T:20:53:00 WinXP 125.100.135.138 (UCOM.NE.JP):
G-TK0008N,
JP. (100Mbps) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:176 hits: 09-28 to 07-19] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:20:54:00 Win2K-f 64.201.189.219 (CERTIS.CA):
VOI NETWORKS INC,
WINNIPEG, MANITOBA, CA. 		n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:208.111.148.108:80
US:208.111.148.115:80
HK:210.245.211.11:65520
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
a08f3b74a4
[Firefox:251 hits: 06-18 to 07-19] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
21:03:00 Win2K-f 221.184.235.177 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:21:13:00 Win2K-f 75.4.2.149 (SBCGLOBAL.NET):
RBACK19B.IRVNCA,
COMPTON, CALIFORNIA, US. (DSL) 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
19 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
21:26:00 Win2K-f 118.218.141.40 (-):
. 		n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:208.111.148.226:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 32
28 of 32		 8a75955033
[Firefox: 8 hits: 06-20 to 07-11]
9276c8b36b
[Firefox: 8 hits: 06-20 to 07-11] 		none[4]
9276c8b36b[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:22:02:00 WinXP 119.95.60.131 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:207.123.46.125:80 		135 pcap raw alerts
ruleset 		http
89 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
29 of 33		 53bfe15e91
[Firefox:767 hits: 06-17 to 07-19]
8020eb2d22
NEW 		none[4]
none [none] 		none:none
none:none
 tElock|
none|none 		none
none 		trace
none
T:22:28:00 WinXP 4.230.93.194 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
HOUSTON, TEXAS, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
22:32:00 WinXP 61.206.233.16 (MS01.ITSCOM.JP):
ITSCOM_MANSIONLAN,
TOKYO, TOKYO, JP. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:22:38:00 WinXP 58.230.192.37 (-):
THRUNET-INFRA-SEOUL03,
SEOUL, KYONGGI-DO, KR. 		n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:205.128.79.125:80
US:205.128.79.126:80
US:207.123.37.126:80
HK:210.245.211.11:65520 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		28 of 32
30 of 32		 3dffacd270
[Firefox: 3 hits: 06-20 to 07-08]
d5bf17f14e
[Firefox: 3 hits: 06-20 to 07-08] 		3dffacd270 [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
tElock| 		lines=82
none 		trace
trace
T:22:42:00 WinXP 216.199.165.252 (FDN.COM):
FDN.COM,
JACKSONVILLE, FLORIDA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:205.128.79.125:80
US:205.128.79.126:80
US:207.123.37.126:80 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33
28 of 32		 3cd7958258
[Firefox: 8 hits: 06-17 to 07-18]
41efedf70f
[Firefox: 7 hits: 06-19 to 07-18] 		none[4]
41efedf70f[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=82 		trace
trace
22:43:00 WinXP 218.160.208.213 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:22:48:00 WinXP 118.160.147.162 (-):
. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
22:58:00 Win2K-f 122.110.152.198 (-):
. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33 9cbcea2c02
NEW 		none[none] none:none
 none|none none none
T:22:59:00 WinXP 12.74.63.250 (ATT.NET):
AT&T WORLDNET SERVICES,
LOUISVILLE, KENTUCKY, US. (DIAL) 		n/a DE:siliconfireware.ru
:www.proxy-socks.net
:wpad
US:searchportal.information.com
US:spi.domainsponsor.com
US:204.13.161.51:80
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 		445 pcap raw alerts
ruleset 		http
http
11 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a12cab51ef
[Firefox:1124 hits: 05-01 to 07-18] 		40f7f463c4 [0] ASM:Graph
 ASPack| lines=281
embedded dns 		trace
23:13:00 WinXP 125.195.148.161 (MESH.AD.JP):
NEC CORPORATION,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
shell
30 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 32
31 of 32		 03f912899b
[Firefox:48 hits: 12-14 to 07-17]
741e3b03b3
[Firefox:176 hits: 09-28 to 07-19] 		83893bd25d [0]
e0197e8a64[0] 		ASM:Graph
ASM:Graph
 none|none
none|none 		lines=65
lines=62 		trace
trace
T:23:23:00 Win2K-f 61.206.233.16 (MS01.ITSCOM.JP):
ITSCOM_MANSIONLAN,
TOKYO, TOKYO, JP. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
23:24:00 Win2K-f 213.102.99.119 (TELE2.DE):
TELE2 GERMANY GMBH,
DE. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
23:31:00 WinXP 220.139.42.114 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a  
CZ:217.170.244.2:443
CZ:82.114.64.251:443 		445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 28 7fdfe363d5
[Firefox:3027 hits: 12-31 to 07-19] 		10862ea8b8 [0] ASM:Graph
 FSG| lines=1933
embedded dns 		trace
T:23:39:00 Win2K-f 208.79.98.144 (-):
GLOBAL CARIBBEAN NETWORK,
GP. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:23:47:00 WinXP 218.169.184.239 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:176 hits: 09-28 to 07-19] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace