Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

17 August 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:13:00 Win2K-f 70.121.31.175 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ORLANDO, FLORIDA, US. n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
118 lines Yeah : 1.3
profile none summary
tarball 30 of 33
31 of 33 23b2288763
[Firefox: 2 hits: 07-15 to 07-27]
ef8dc9850c
[Firefox: 2 hits: 07-15 to 07-27] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:00:17:00 WinXP 118.237.113.91 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 27b945de66
[Firefox:13 hits: 06-20 to 08-14] none[4] none:none
none|none none trace

00:23:00 WinXP 24.66.227.226 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SASKATOON, SASKATCHEWAN, CA. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
117 lines Yeah : 1.3
profile none summary
tarball 35 of 36
33 of 36
0 of 33 1790f3a44b
NEW
e05c782a35
NEW
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

00:43:00 WinXP 203.121.180.155 (-):
COLO-CATIONPI-2-203121180128,
TH. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:207.123.37.125:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

01:00:00 WinXP 76.231.8.229 (SBCGLOBAL.NET):
PPPOX POOL - BRAS16.LSAN,
LOS ANGELES, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:205.128.73.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

01:03:00 WinXP 118.9.249.225 (-):
. n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 36 of 36 996e09cd66
[Firefox: 3 hits: 08-01 to 08-05] none[none] none:none
none|none none none

T:01:07:00 WinXP 217.247.240.141 (T-IPCONNECT.DE):
DEUTSCHE TELEKOM AG,
DE. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 35 3874ef05b8
NEW none[none] none:none
none|none none none

T:01:17:00 WinXP 99.135.34.59 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:329 hits: 12-31 to 08-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

01:32:00 Win2K-f 67.1.15.102 (QWEST.NET):
QWEST COMMUNICATIONS CORPORATION,
MERIDIAN, IDAHO, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
105 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:01:36:00 WinXP 41.214.161.91 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 33 of 33 a483ba8aa1
[Firefox:17 hits: 07-09 to 08-14] none[none] none:none
none|none none none

01:38:00 WinXP 118.237.49.139 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 27b945de66
[Firefox:13 hits: 06-20 to 08-14] none[4] none:none
none|none none trace

T:01:48:00 WinXP 117.99.20.17 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:457 hits: 12-31 to 08-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

02:33:00 WinXP 210.174.8.108 (SO-NET.NE.JP):
SO-NET ENTERTAINMENT CORPORATION,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 28 of 31 cc545e1c99
[Firefox: 3 hits: 05-30 to 08-09] 97a4355156 [0] ASM:Graph
none|none lines=90 trace

03:15:00 Win2K-f 98.175.106.144 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:205.128.73.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:03:31:00 WinXP 84.3.188.231 (T-ONLINE.HU):
HUNGARIAN TELECOM,
HU. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 34 of 35 eae4b4bd5b
NEW none[none] none:none
none|none none none

03:35:00 WinXP 71.131.139.132 (SBCGLOBAL.NET):
DOMINO'S PIZZA,
PLANO, TEXAS, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.152:80
US:208.111.148.174:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:03:40:00 WinXP 77.57.91.63 (SOLPA.NET):
CABLECOM,
ZURICH, ZURICH, CH. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 35 of 36 25d78144c5
[Firefox: 8 hits: 08-01 to 08-10] none[none] none:none
none|none none none

03:41:00 WinXP 203.91.165.254 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.152:80
US:208.111.148.174:80 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
b7082104e4
[Firefox:91 hits: 06-18 to 08-16] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

03:53:00 Win2K-f 124.61.34.217 (-):
POWERCOM,
KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:205.128.73.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
124 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 09c3d90250
[Firefox: 3 hits: 08-04 to 08-15]
8f34a39070
[Firefox: 3 hits: 08-04 to 08-15] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

04:14:00 Win2K-f 67.3.218.246 (QWEST.NET):
QWEST COMMUNICATIONS CORPORATION,
MESA, ARIZONA, US. n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:04:23:00 Win2K-f 70.61.156.13 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COLUMBUS, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80
US:208.111.148.43:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

04:43:00 Win2K-f 72.230.139.136 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

04:47:00 WinXP 124.115.15.45 (163DATA.COM.CN):
CHINANET SHANXI(SN) PROVINCE NETWORK,
BEIJING, BEIJING, CN. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.42:80
US:208.111.173.46:80 135 pcap raw alerts
ruleset other
82 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

05:14:00 WinXP 63.245.42.216 (FLAMINGOTV.NET):
FLAMINGO TELEVISION BONAIRE,
AN. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
US:199.93.44.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

05:19:00 WinXP 4.233.194.190 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NEW HAMPSHIRE, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:329 hits: 12-31 to 08-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:05:32:00 WinXP 98.141.178.75 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:05:36:00 WinXP 211.129.128.214 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:285 hits: 01-05 to 08-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:06:05:00 WinXP 24.95.242.200 (RR.COM):
ROAD RUNNER HOLDCO LLC,
WINTER PARK, FLORIDA, US. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:457 hits: 12-31 to 08-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

06:06:00 WinXP 220.105.124.119 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:487 hits: 01-01 to 08-16] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

06:19:00 WinXP 222.238.27.244 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:192.221.110.126:80
US:199.93.44.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
97 lines Yeah : 1.3
profile none summary
tarball 1 of 36
30 of 32 1056cef861
NEW
8390780c27
[Firefox:33 hits: 06-18 to 08-06] none[none]
none [4] none:none
none:none
none|none
tElock| none
none none
trace

06:25:00 Win2K-f 70.166.111.207 (COX.NET):
COX COMMUNICATIONS,
ATLANTA, GEORGIA, US. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:199.93.53.125:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 0 of 32
34 of 36
28 of 33 b5919931fe
[Firefox:333 hits: 06-20 to 08-16]
da00a8e7a1
[Firefox: 6 hits: 08-05 to 08-15]
f685f8e027
[Firefox:10 hits: 06-18 to 08-15] b5919931fe [1]
none [none]
f685f8e027[1] ASM:Graph
none:none
ASM:Graph
ASProtect|
none|none
Armadillo| lines=90
none
lines=82 trace
none
trace

06:37:00 WinXP 77.57.127.33 (SOLPA.NET):
CABLECOM,
CH. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 aeac95b893
NEW none[none] none:none
none|none none none

06:40:00 WinXP 218.210.80.111 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
57ce4acac2
[Firefox:115 hits: 06-17 to 08-16] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

06:52:00 Win2K-f 122.2.88.9 (PLDT.NET):
IPG,
PH. n/a US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80
US:205.128.73.126:80
US:207.123.47.126:80 135 pcap raw alerts
ruleset other
320 lines Yeah : 1.3
profile none summary
tarball 31 of 33
29 of 33 2c85520f75
NEW
c61d687649
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

06:52:00 WinXP 125.177.139.48 (-):
POWC-025,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80
US:205.128.73.126:80
US:207.123.47.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
86 lines Yeah : 1.3
profile none summary
tarball 1 of 33
31 of 33 2ec24780fe
NEW
780febebd5
[Firefox: 2 hits: 06-25 to 07-10] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

07:10:00 Win2K-f 218.216.188.6 (I-CHUBU.NE.JP):
CHUBU TELECOMMUNICATIONS CO. INC,
JP. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.46:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
192 lines Yeah : 1.3
profile none summary
tarball 32 of 36
35 of 36 38f6fc3dfb
NEW
4b77b2419c
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:07:11:00 Win2K-f 122.53.26.21 (PLDT.NET):
IPG,
PH. n/a 135 pcap raw alerts
ruleset other
306 lines Yeah : 1.3
profile none summary
tarball 31 of 33 954a98c971
[Firefox: 8 hits: 06-09 to 08-07] none[4] none:none
FSG| none trace

07:19:00 WinXP 65.184.28.105 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CHARLOTTE, NORTH CAROLINA, US. n/a US:microsoft.com
US:download.microsoft.com
US:69.28.178.10:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

07:31:00 WinXP 114.120.55.21 (-):
. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:457 hits: 12-31 to 08-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:07:31:00 WinXP 114.120.55.21 (-):
. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:457 hits: 12-31 to 08-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:07:50:00 WinXP 124.100.192.229 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:285 hits: 01-05 to 08-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:07:53:00 Win2K-f 24.84.232.228 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
KAMLOOPS, BRITISH COLUMBIA, CA. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16]
b5919931fe
[Firefox:333 hits: 06-20 to 08-16] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

08:12:00 Win2K-f 219.255.127.65 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:205.128.73.126:80
US:207.123.37.124:80
US:207.123.37.125:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
118 lines Yeah : 1.3
profile none summary
tarball 30 of 33
32 of 33 0a2b1894da
[Firefox: 2 hits: 06-26 to 08-13]
414b95a784
[Firefox: 2 hits: 06-26 to 08-13] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

08:13:00 WinXP 124.100.192.229 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:285 hits: 01-05 to 08-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

08:18:00 WinXP 92.41.137.152 (IKBCC.COM):
EU-ZZ,
UK. n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 33 dfec585ee1
NEW none[none] none:none
none|none none none

T:08:18:00 Win2K-f 68.121.87.20 (PACBELL.NET):
PPPOX POOL - RBACK4 IRVNCA,
LOS ANGELES, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
US:198.78.201.126:80
US:205.128.73.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:08:25:00 WinXP 67.10.81.170 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HOUSTON, TEXAS, US. (100Mbps) 194.109.11.65:6556 NL:0x80.online-software.org 135 pcap raw alerts
ruleset other
196 lines Yeah : 1.8
profile none summary
tarball 32 of 32 15d4d85dc0
[Firefox: 4 hits: 06-10 to 08-13] none[4] none:none
StarForce| none trace

T:08:43:00 WinXP 93.81.92.245 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 194.109.11.65:6556 NL:0x80.online-software.org 445 pcap raw alerts
ruleset other
13 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

08:44:00 Win2K-f 172.163.30.252 (AOL.COM):
AMERICA ONLINE,
US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80 135 pcap raw alerts
ruleset http
136 lines Yeah : 1.3
profile none summary
tarball 30 of 33
29 of 33 3373948767
[Firefox:17 hits: 07-03 to 08-09]
c73f738c30
[Firefox:17 hits: 07-03 to 08-09] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

08:59:00 Win2K-f 68.146.195.227 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16]
b5919931fe
[Firefox:333 hits: 06-20 to 08-16] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

09:05:00 WinXP 124.241.139.170 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
96 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
57ce4acac2
[Firefox:115 hits: 06-17 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[4]
57ce4acac2[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

09:14:00 WinXP 98.141.179.92 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:09:17:00 WinXP 98.141.179.92 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

09:33:00 WinXP 79.64.198.134 (AS9105.COM):
TELINCO,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:285 hits: 01-05 to 08-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

09:43:00 Win2K-f 24.100.1.88 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:207.123.37.125:80 135 pcap raw alerts
ruleset http
423 lines Yeah : 1.3
profile none summary
tarball 34 of 36
33 of 33 1ad9dd6d67
NEW
53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16] none[none]
none [4] none:none
none:none
none|none
tElock| none
none none
trace

10:24:00 WinXP 41.233.246.55 (TEDATA.NET):
PROVIDER LOCAL REGISTRY,
EG. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
[Firefox:61 hits: 01-14 to 08-16] 8a00217866 [0] ASM:Graph
PolyEnE| lines=57 trace

T:10:25:00 WinXP 41.233.246.55 (TEDATA.NET):
PROVIDER LOCAL REGISTRY,
EG. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 986b59708d
[Firefox:61 hits: 01-14 to 08-16] 8a00217866 [0] ASM:Graph
PolyEnE| lines=57 trace

10:41:00 Win2K-f 68.121.87.20 (PACBELL.NET):
PPPOX POOL - RBACK4 IRVNCA,
LOS ANGELES, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:205.128.73.126:80
US:206.33.45.125:80
US:4.23.60.125:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

11:00:00 WinXP 4.157.5.232 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
ENOSBURG FALLS, VERMONT, US. (DIAL) 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:11:06:00 WinXP 61.34.136.32 (BORA.NET):
DACOM CORP,
SEOUL, KYONGGI-DO, KR. 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
IL:ksn.a1001186.wrs.mcboo.com
DE:dl2.teenpassage.com
:fleshkatera.cn
EU:terahost.cn
:www.upononjob.cn
US:mysoft-forum.net
:mulfika.cn
IL:wr.mcboo.com
IL:bfb88.a1001186.wrs.loloplanet.com
US:204.160.126.126:80
HK:210.245.211.11:65520
IL:62.90.134.24:80 135 pcap raw alerts
ruleset http
irc
1264 lines Yeah : 1.8
profile none summary
tarball 19 of 35
17 of 35
27 of 36
32 of 36
34 of 36
12 of 36
0 of 33 37f41fd8ab
[Firefox:84 hits: 07-24 to 08-16]
5ab0a45f63
[Firefox:102 hits: 07-24 to 08-16]
664857e986
NEW
9d1c8d89a4
[Firefox: 2 hits: 08-10 to 08-14]
b57dbae4a3
[Firefox: 2 hits: 08-10 to 08-14]
c5e5182fde
[Firefox: 3 hits: 08-15 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
e07c29c4ae[1] none:none
none:none
none:none
none:none
none:none
none:none
ASM:Graph
none|none
none|none
none|none
none|none
none|none
none|none
FSG| none
none
none
none
none
none
lines=92 none
none
none
none
none
none
trace

11:13:00 Win2K-f 70.169.52.95 (COX.NET):
COX COMMUNICATIONS,
TULSA, OKLAHOMA, US. 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
IL:ksn.a1001186.wrs.mcboo.com
DE:dl2.teenpassage.com
:fleshkatera.cn
EU:terahost.cn
:www.upononjob.cn
US:mysoft-forum.net
:mulfika.cn
IL:wr.mcboo.com
IL:bfb88.a1001186.wrs.loloplanet.com
US:192.221.108.126:80
IL:194.90.224.86:80
US:205.128.73.126:80
US:207.123.47.126:80
IL:62.90.134.24:80 135 pcap raw alerts
ruleset irc
http
294 lines Yeah : 1.8
profile none summary
tarball 19 of 35
17 of 35
27 of 36
35 of 36
12 of 36
32 of 36 37f41fd8ab
[Firefox:84 hits: 07-24 to 08-16]
5ab0a45f63
[Firefox:102 hits: 07-24 to 08-16]
664857e986
NEW
6d0afb2b54
[Firefox: 3 hits: 08-06 to 08-14]
c5e5182fde
[Firefox: 3 hits: 08-15 to 08-16]
fbd87f4eaa
[Firefox: 3 hits: 08-06 to 08-14] none[none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none none
none
none
none
none
none

T:11:14:00 Win2K-f 24.195.233.174 (RR.COM):
ROAD RUNNER HOLDCO LLC,
TROY, NEW YORK, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

11:30:00 WinXP 205.238.247.11 (EPIX.NET):
FRONTIER COMMUNICATIONS OF AMERICA INC,
MOUNTAIN TOP, PENNSYLVANIA, US. (DIAL) 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
IL:ksn.a1001186.wrs.mcboo.com
DE:dl2.teenpassage.com
:fleshkatera.cn
EU:terahost.cn
:www.upononjob.cn
US:mysoft-forum.net
:mulfika.cn
IL:wr.mcboo.com
IL:bfb88.a1001186.wrs.loloplanet.com 135 pcap raw alerts
ruleset irc
http
703 lines Yeah : 1.8
profile none summary
tarball 19 of 35
17 of 35
27 of 36
28 of 33
12 of 36
31 of 33 37f41fd8ab
[Firefox:84 hits: 07-24 to 08-16]
5ab0a45f63
[Firefox:102 hits: 07-24 to 08-16]
664857e986
NEW
ba4637f8f0
[Firefox: 3 hits: 07-01 to 07-30]
c5e5182fde
[Firefox: 3 hits: 08-15 to 08-16]
d02ae67164
[Firefox: 3 hits: 07-01 to 07-30] none[none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none none
none
none
none
none
none

11:37:00 Win2K-f 83.88.133.27 (ADSL-DHCP.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
GREVE, ROSKILDE, DK. (DSL) n/a IL:wr.mcboo.com 445 pcap raw alerts
ruleset http
3 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:39:00 WinXP 82.207.31.224 (UKRTEL.NET):
UKRTELECOM IP ACCESS NETWORK IN KIEV,
UA. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 33 366148f7b7
[Firefox:15 hits: 07-06 to 07-25] none[none] none:none
none|none none none

11:58:00 Win2K-f 68.124.137.88 (PACBELL.NET):
PPPOX POOL - BRAS1.PLTN,
SAN JOSE, CALIFORNIA, US. 210.245.211.11:65520 US:mysoft-forum.net
HK:proxim.ircgalaxy.pl
IL:ksn.a1001186.wrs.mcboo.com
IL:wr.mcboo.com
US:microsoft.com
US:download.microsoft.com
IL:194.90.224.86:80 445 pcap raw alerts
ruleset http
irc
21 lines Yeah : 1.3
profile none summary
tarball 19 of 35
17 of 35 37f41fd8ab
[Firefox:84 hits: 07-24 to 08-16]
5ab0a45f63
[Firefox:102 hits: 07-24 to 08-16] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

12:03:00 WinXP 118.243.129.109 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 30 of 32 8ae058b2d0
[Firefox: 9 hits: 05-01 to 08-12] e6a9383b75 [0] ASM:Graph
none|none lines=59 trace

T:12:13:00 Win2K-f 70.63.253.82 (RR.COM):
ROAD RUNNER HOLDCO LLC,
FLORENCE, SOUTH CAROLINA, US. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.46.126:80 135 pcap raw alerts
ruleset http
6 lines Yeah : 1.3
profile none summary
tarball 0 of 32 b5919931fe
[Firefox:333 hits: 06-20 to 08-16] b5919931fe [1] ASM:Graph
ASProtect| lines=90 trace

12:16:00 Win2K-f 4.162.204.222 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
FT. WORTH, TEXAS, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:207.123.46.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16]
b5919931fe
[Firefox:333 hits: 06-20 to 08-16] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:12:31:00 Win2K-f 91.51.211.232 (T-IPCONNECT.DE):
DEUTSCHE TELEKOM AG,
DE. 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
IL:ksn.a1001186.wrs.mcboo.com 445 pcap raw alerts
ruleset irc
http
18 lines Yeah : 1.3
profile none summary
tarball 19 of 35
17 of 35 37f41fd8ab
[Firefox:84 hits: 07-24 to 08-16]
5ab0a45f63
[Firefox:102 hits: 07-24 to 08-16] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:12:32:00 WinXP 216.10.188.82 (WISPNET.NET):
WISPNET LLC,
PLYMOUTH, NORTH CAROLINA, US. n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:wpad
GB:welcome3.smile.co.uk
GB:195.92.84.198:80 445 pcap raw alerts
ruleset http
http
http
13 lines Yeah : 0.8
profile none summary
tarball 0 of 36
29 of 29 8fe109b183
NEW
df17a625ee
[Firefox:214 hits: 01-01 to 08-16] none[none]
9bbdd086c5[0] none:none
ASM:Graph
none|none
ASPack| none
lines=186
embedded dns none
trace

12:34:00 Win2K-f 216.211.247.252 (NORWOODLIGHT.COM):
NORWOOD LIGHT BROADBAND,
NORWOOD, MASSACHUSETTS, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

12:37:00 WinXP 88.104.241.140 (AS9105.COM):
TISCALI UK LTD,
MANCHESTER, ENGLAND, UK. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 36 c8ea4e7945
NEW none[none] none:none
none|none none none

T:13:02:00 WinXP 124.241.188.242 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:207.123.42.126:80 135 pcap raw alerts
ruleset http
60 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
b7082104e4
[Firefox:91 hits: 06-18 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[4]
none [4]
e07c29c4ae[1] none:none
none:none
ASM:Graph
tElock|
tElock|
FSG| none
none
lines=92 trace
trace
trace

13:11:00 WinXP 71.148.35.35 (SBCGLOBAL.NET):
KASSA KASSA,
PLANO, TEXAS, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

13:32:00 Win2K-f 70.165.19.46 (COX.NET):
COX COMMUNICATIONS,
OKLAHOMA CITY, OKLAHOMA, US. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

13:35:00 WinXP 206.171.178.11 (LEMOORENET.COM):
LEMOORE NET,
LEMOORE, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.126:80
US:207.123.46.125:80
US:207.123.46.126:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

13:48:00 Win2K-f 75.191.146.224 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.215:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

14:06:00 WinXP 41.214.178.143 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 33 of 33 a483ba8aa1
[Firefox:17 hits: 07-09 to 08-14] none[none] none:none
none|none none none

T:14:08:00 WinXP 41.214.178.143 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 33 of 33 a483ba8aa1
[Firefox:17 hits: 07-09 to 08-14] none[none] none:none
none|none none none

14:10:00 Win2K-f 125.215.205.184 (IMSBIZ.COM):
PCCW BUSINESS INTERNET ACCESS,
HONG KONG, HONG KONG (SAR), HK. (100Mbps) n/a 135 pcap raw alerts
ruleset other
52 lines Yeah : 1.3
profile none summary
tarball 0 of 33 57ce4acac2
[Firefox:115 hits: 06-17 to 08-16] 57ce4acac2 [1] ASM:Graph
Armadillo| lines=81 trace

14:16:00 Win2K-f 72.189.70.197 (RR.COM):
ROAD RUNNER HOLDCO LLC,
TAMPA, FLORIDA, US. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:205.128.73.126:80
US:8.12.202.125:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

14:16:00 WinXP 99.147.194.129 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:285 hits: 01-05 to 08-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

14:42:00 WinXP 66.16.121.130 (CAVTEL.NET):
CAVALIER TELEPHONE,
BALTIMORE, MARYLAND, US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:14:43:00 Win2K-f 66.16.121.130 (CAVTEL.NET):
CAVALIER TELEPHONE,
BALTIMORE, MARYLAND, US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

14:56:00 Win2K-f 24.137.124.128 (EASTLINK.CA):
EASTLINK,
DARTMOUTH, NOVA SCOTIA, CA. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

15:45:00 WinXP 194.125.158.114 (EIRCOM.NET):
EIRCOM LTD,
DUBLIN, DUBLIN, IE. n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:329 hits: 12-31 to 08-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

16:01:00 WinXP 58.230.146.15 (-):
THRUNET-INFRA-SEOUL02,
SEOUL, KYONGGI-DO, KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 28 of 32
30 of 32
0 of 33 3dffacd270
[Firefox: 7 hits: 06-20 to 08-14]
d5bf17f14e
[Firefox: 7 hits: 06-20 to 08-14]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] 3dffacd270 [1]
none [4]
e07c29c4ae[1] ASM:Graph
none:none
ASM:Graph
Armadillo|
tElock|
FSG| lines=82
none
lines=92 trace
trace
trace

16:04:00 Win2K-f 4.158.27.196 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CHICAGO, ILLINOIS, US. (DIAL) n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 35 of 36
0 of 32
32 of 36 16093f1f91
NEW
b5919931fe
[Firefox:333 hits: 06-20 to 08-16]
f922aca9bb
NEW none[none]
b5919931fe[1]
none [none] none:none
ASM:Graph
none:none
none|none
ASProtect|
none|none none
lines=90
none none
trace
none

16:11:00 WinXP 172.168.178.4 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80
US:207.123.47.126:80
US:4.23.60.125:80 135 pcap raw alerts
ruleset other
183 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:16:20:00 Win2K-f 71.96.163.83 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
PLANO, TEXAS, US. (DSL) n/a 135 pcap raw alerts
ruleset other
204 lines Yeah : 1.3
profile none summary
tarball 31 of 36 72d732b448
NEW none[none] none:none
none|none none none

T:16:30:00 WinXP 189.49.151.204 (BRASILTELECOM.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:16:32:00 Win2K-f 98.175.106.144 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

16:37:00 Win2K-f 71.190.81.120 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
NEW YORK, NEW YORK, US. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Argh : 0.3
profile none summary
tarball none none none none none none none

16:53:00 WinXP 97.104.15.114 (-):
. n/a DE:siliconfireware.ru
US:searchportal.information.com
:www.proxy-socks.net
:wpad
GB:welcome3.smile.co.uk
US:208.73.210.32:80
DE:212.227.111.29:80 445 pcap raw alerts
ruleset http
http
http
6 lines Yeah : 0.8
profile none summary
tarball 29 of 29
0 of 36 a12cab51ef
[Firefox:471 hits: 01-01 to 08-16]
d59a3d6a6e
NEW 40f7f463c4 [0]
none [none] ASM:Graph
none:none
ASPack|
none|none lines=281
embedded dns
none trace
none

16:57:00 WinXP 98.28.249.50 (-):
. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball 29 of 29 042774a2b7
[Firefox:31 hits: 01-14 to 08-05] 1c9a472cd7 [0] ASM:Graph
PolyEnE| lines=71
embedded dns trace

16:59:00 Win2K-f 211.239.2.56 (EPNETWORKS.CO.KR):
ENTERPRISENET-INFRA,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:192.221.108.126:80
HK:210.245.211.11:65520
US:8.12.202.125:80 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 32 of 33
0 of 32
29 of 33 686d4ca67b
[Firefox: 2 hits: 07-08 to 07-27]
b5919931fe
[Firefox:333 hits: 06-20 to 08-16]
b7e379b157
[Firefox: 2 hits: 07-08 to 07-27] none[none]
b5919931fe[1]
none [none] none:none
ASM:Graph
none:none
none|none
ASProtect|
none|none none
lines=90
none none
trace
none

16:59:00 WinXP 221.227.192.104 (163DATA.COM.CN):
CHINANET JIANGSU PROVINCE NETWORK,
BEIJING, BEIJING, CN. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:329 hits: 12-31 to 08-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:17:23:00 WinXP 123.212.80.185 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
98 lines Yeah : 1.3
profile none summary
tarball 31 of 33
31 of 33 168aab35a3
[Firefox:96 hits: 06-17 to 08-16]
667f0c59f3
[Firefox:14 hits: 07-04 to 08-16] none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

T:17:47:00 WinXP 77.20.209.57 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 bfec7d0b0b
[Firefox: 6 hits: 08-06 to 08-12] none[none] none:none
none|none none none

T:17:53:00 WinXP 75.85.148.18 (RR.COM):
ROAD RUNNER HOLDCO LLC,
KAILUA, HAWAII, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 1fcc146d70
[Firefox:27 hits: 01-02 to 08-16] 258fafe892 [0] ASM:Graph
PolyEnE| lines=68 trace

18:00:00 WinXP 24.80.170.73 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
97 lines Yeah : 1.3
profile none summary
tarball 31 of 32
0 of 33
2 of 32 607b60ad51
[Firefox:18 hits: 06-20 to 08-15]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16]
e5c7bce70e
[Firefox:18 hits: 06-20 to 08-15] none[4]
e07c29c4ae[1]
e5c7bce70e[1] none:none
ASM:Graph
ASM:Graph
tElock|
FSG|
Armadillo| none
lines=92
lines=81 trace
trace
trace

T:18:04:00 WinXP 4.158.27.196 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CHICAGO, ILLINOIS, US. (DIAL) n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:205.128.73.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
128 lines Yeah : 1.3
profile none summary
tarball 35 of 36
0 of 33
32 of 36 16093f1f91
NEW
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16]
f922aca9bb
NEW none[none]
e07c29c4ae[1]
none [none] none:none
ASM:Graph
none:none
none|none
FSG|
none|none none
lines=92
none none
trace
none

18:06:00 WinXP 114.120.34.223 (-):
. 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 a0044bcb25
[Firefox: 5 hits: 08-02 to 08-16] none[none] none:none
none|none none none

T:18:06:00 WinXP 114.120.34.223 (-):
. 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 a0044bcb25
[Firefox: 5 hits: 08-02 to 08-16] none[none] none:none
none|none none none

18:11:00 WinXP 118.237.43.250 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 31 of 32 27b945de66
[Firefox:13 hits: 06-20 to 08-14] none[4] none:none
none|none none trace

18:21:00 WinXP 67.10.153.22 (RR.COM):
ROAD RUNNER HOLDCO LLC,
KATY, TEXAS, US. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:457 hits: 12-31 to 08-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

18:24:00 WinXP 220.215.221.181 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
JP. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:285 hits: 01-05 to 08-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:18:40:00 Win2K-f 98.140.228.136 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

19:14:00 WinXP 190.8.215.163 (-):
UNION DE CABLEOPERADORES DEL CENTRO CABLECENTRO S.A,
CO. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:19:14:00 WinXP 190.8.215.163 (-):
UNION DE CABLEOPERADORES DEL CENTRO CABLECENTRO S.A,
CO. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

19:19:00 WinXP 218.211.223.215 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.174:80
US:208.111.148.219:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

19:34:00 Win2K-f 76.177.220.127 (RR.COM):
ROAD RUNNER HOLDCO LLC,
YULEE, FLORIDA, US. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

20:04:00 WinXP 70.247.166.188 (SWBELL.NET):
PPPOX POOL - BRAS17 RCSNTX,
FT. WORTH, TEXAS, US. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:329 hits: 12-31 to 08-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

20:08:00 WinXP 71.14.41.195 (CHARTER.COM):
CHARTER COMMUNICATIONS,
LAGRANGE, GEORGIA, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:198.78.201.126:80
US:207.123.46.126:80 135 pcap raw alerts
ruleset other
316 lines Yeah : 1.3
profile none summary
tarball 30 of 33
29 of 33 378a4bac36
[Firefox: 7 hits: 07-01 to 08-09]
d11b4c2e19
[Firefox: 7 hits: 07-01 to 08-09] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:20:15:00 WinXP 75.177.90.175 (RR.COM):
ROAD RUNNER HOLDCO LLC,
GREENSBORO, NORTH CAROLINA, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 a92e3f8fc8
[Firefox:26 hits: 01-26 to 07-28] dfe02a1e52 [0] ASM:Graph
PolyEnE| lines=68 trace

20:37:00 WinXP 205.163.99.16 (NETSCOPE.NET):
MIKROTEC INTERNET SERVICES INC,
LEXINGTON, KENTUCKY, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

20:38:00 WinXP 98.141.178.91 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:20:47:00 WinXP 72.188.111.6 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ORLANDO, FLORIDA, US. n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:wpad
RU:www.bbin.ru
RU:www.binbank.ru 445 pcap raw alerts
ruleset http
http
http
http
15 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:214 hits: 01-01 to 08-16] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

20:48:00 Win2K-f 67.1.4.223 (QWEST.NET):
QWEST COMMUNICATIONS CORPORATION,
EMMETT, IDAHO, US. n/a US:microsoft.com
US:download.microsoft.com
US:205.128.73.126:80
US:207.123.37.126:80
US:207.123.42.126:80 135 pcap raw alerts
ruleset other
86 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:21:04:00 WinXP 71.108.69.168 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
LANCASTER, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:21:06:00 Win2K-f 61.34.136.180 (BORA.NET):
DACOM CORP,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80 135 pcap raw alerts
ruleset other
95 lines Yeah : 1.3
profile none summary
tarball 0 of 33
29 of 32 57ce4acac2
[Firefox:115 hits: 06-17 to 08-16]
83f26f5044
[Firefox:18 hits: 06-20 to 07-28] 57ce4acac2 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

21:16:00 Win2K-f 219.68.33.249 (GIGA.NET.TW):
HOSHIN GIGAMEDIA CENTER INC,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:207.123.37.123:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

21:16:00 WinXP 99.129.197.142 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:329 hits: 12-31 to 08-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:21:19:00 Win2K-f 66.54.122.250 (DIGICELBROADBAND.COM):
DIGICEL JAMAICA,
KINGSTON, KINGSTON, JM. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
73f1082158
[Firefox:754 hits: 06-18 to 08-16]
b5919931fe
[Firefox:333 hits: 06-20 to 08-16] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

21:29:00 WinXP 118.12.232.29 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:487 hits: 01-01 to 08-16] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:22:00:00 WinXP 121.232.3.83 (163DATA.COM.CN):
CHINANET JIANGSU PROVINCE NETWORK,
BEIJING, BEIJING, CN. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 36 of 36 4565d1626f
[Firefox: 2 hits: 08-16 to 08-16] none[none] none:none
none|none none none

22:02:00 WinXP 121.232.3.83 (163DATA.COM.CN):
CHINANET JIANGSU PROVINCE NETWORK,
BEIJING, BEIJING, CN. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 4565d1626f
[Firefox: 2 hits: 08-16 to 08-16] none[none] none:none
none|none none none

22:12:00 Win2K-f 211.52.164.94 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
87 lines Yeah : 1.3
profile none summary
tarball 31 of 33
0 of 33
0 of 32 168aab35a3
[Firefox:96 hits: 06-17 to 08-16]
4c3df24b32
[Firefox:150 hits: 06-17 to 08-16]
b5919931fe
[Firefox:333 hits: 06-20 to 08-16] none[4]
4c3df24b32[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

22:30:00 Win2K-f 61.218.193.250 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a HK:proxima.ircgalaxy.pl
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
5 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:22:33:00 WinXP 70.117.12.67 (RR.COM):
ROAD RUNNER HOLDCO LLC,
SAN ANTONIO, TEXAS, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:22:40:00 WinXP 99.129.197.142 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:329 hits: 12-31 to 08-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

22:45:00 WinXP 190.139.138.251 (NET.AR):
TELECOM ARGENTINA S.A,
AR. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 986b59708d
[Firefox:61 hits: 01-14 to 08-16] 8a00217866 [0] ASM:Graph
PolyEnE| lines=57 trace

22:51:00 WinXP 116.125.89.6 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 29 of 32
28 of 32
0 of 33 8a75955033
[Firefox:22 hits: 06-20 to 08-16]
9276c8b36b
[Firefox:22 hits: 06-20 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[4]
9276c8b36b[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

23:05:00 Win2K-f 219.109.155.114 (ICN-NET.NE.JP):
ICHINOSEKI CABLE NETWORK CO. LTD,
JP. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Argh : 0.3
profile none summary
tarball none none none none none none none

T:23:10:00 WinXP 72.230.139.136 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.16:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16]
e07c29c4ae
[Firefox:264 hits: 06-19 to 08-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

23:13:00 WinXP 12.208.93.202 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
DEERFIELD, ILLINOIS, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
a08f3b74a4
[Firefox:480 hits: 06-18 to 08-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

23:15:00 WinXP 114.120.28.203 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:964 hits: 12-31 to 08-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:23:22:00 Win2K-f 211.239.4.83 (EPNETWORKS.CO.KR):
ENTERPRISENET-INFRA,
SEOUL, KYONGGI-DO, KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:207.123.47.126:80
HK:210.245.211.11:65520
US:4.23.60.125:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 32 of 33
29 of 33 686d4ca67b
[Firefox: 2 hits: 07-08 to 07-27]
b7e379b157
[Firefox: 2 hits: 07-08 to 07-27] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:23:30:00 WinXP 202.132.152.129 (TTN.NET):
TAIWAN TELECOMMUNICATION NETWORK SERVICES CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

23:45:00 WinXP 66.75.198.30 (RR.COM):
ROAD RUNNER HOLDCO LLC,
BAKERSFIELD, CALIFORNIA, US. n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:329 hits: 12-31 to 08-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:23:47:00 WinXP 70.182.79.231 (COX.NET):
COX COMMUNICATIONS,
OKLAHOMA CITY, OKLAHOMA, US. n/a US:microsoft.com
US:download.microsoft.com
HK:proxim.ircgalaxy.pl
US:192.221.108.126:80
US:192.221.110.125:80
HK:210.245.211.11:65520
US:8.12.222.126:80 135 pcap raw alerts
ruleset other
95 lines Yeah : 1.3
profile none summary
tarball 33 of 33
32 of 36 53bfe15e91
[Firefox:1473 hits: 06-17 to 08-16]
bea8cb1865
[Firefox: 2 hits: 08-11 to 08-15] none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none