Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

12 September 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

00:13:00 Win2K-f 203.115.86.54 (PACENET-INDIA.COM):
INDIA'S PREMEIR BROADBAND AND IPTV SERVICES MUMBAI,
MUMBAI, MAHARASHTRA, IN. (DSL) 64.85.160.111:5001 US:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

00:15:00 WinXP 125.58.80.11 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30]
e07c29c4ae
[Firefox:411 hits: 06-19 to 08-30] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

00:16:00 WinXP 79.35.119.99 (SRC.ORG):
TELECOM ITALIA NET,
ROME, LAZIO, IT. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 32 of 32 03f912899b
[Firefox:111 hits: 01-08 to 08-30] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

00:54:00 WinXP 81.84.16.107 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
CASCAIS, LISBOA, PT. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball none 14d02d7a70
NEW none[none] none:none
none|none none none

00:59:00 WinXP 84.187.64.137 (T-IPCONNECT.DE):
DEUTSCHE TELEKOM AG,
KAMEN, NORDRHEIN-WESTFALEN, DE. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 35 of 36 f04fb66461
NEW none[none] none:none
none|none none none

T:00:59:00 WinXP 84.187.64.137 (T-IPCONNECT.DE):
DEUTSCHE TELEKOM AG,
KAMEN, NORDRHEIN-WESTFALEN, DE. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 f04fb66461
NEW none[none] none:none
none|none none none

01:11:00 WinXP 68.175.57.173 (RR.COM):
ROAD RUNNER HOLDCO LLC,
KEW GARDENS, NEW YORK, US. n/a 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:01:11:00 WinXP 68.175.57.173 (RR.COM):
ROAD RUNNER HOLDCO LLC,
KEW GARDENS, NEW YORK, US. n/a 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:01:31:00 Win2K-f 203.73.84.142 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset http
78 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
57ce4acac2
[Firefox:170 hits: 06-17 to 08-30] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

02:00:00 Win2K-f 87.12.150.160 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
IT. 64.85.160.111:5001 DE:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

02:09:00 WinXP 117.99.10.57 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 3ae357d17b
[Firefox:170 hits: 01-01 to 08-27] 462a7be171 [0] ASM:Graph
PolyEnE| lines=73 trace

T:02:10:00 WinXP 117.99.10.57 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 3ae357d17b
[Firefox:170 hits: 01-01 to 08-27] 462a7be171 [0] ASM:Graph
PolyEnE| lines=73 trace

02:24:00 Win2K-f 68.150.134.110 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
LEDUC, ALBERTA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

02:37:00 Win2K-f 218.211.223.175 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.124:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

02:51:00 Win2K-f 24.80.98.70 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BURNABY, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.41:80 135 pcap raw alerts
ruleset http
124 lines Yeah : 1.3
profile none summary
tarball none
none
0 of 32 0115338c8b
NEW
321f4fc27d
NEW
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[none]
none [none]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
none|none
ASProtect| none
none
lines=90 none
none
trace

03:03:00 WinXP 222.233.15.105 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.46:80
US:208.111.173.47:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
97 lines Yeah : 1.3
profile none summary
tarball 31 of 33
30 of 32 1509c8d024
[Firefox:20 hits: 06-17 to 08-22]
f23b040440
[Firefox:11 hits: 06-22 to 08-22] none[4]
f23b040440[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

T:03:04:00 Win2K-f 24.84.29.250 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BLAINE, WASHINGTON, US. n/a 135 pcap raw alerts
ruleset other
373 lines Yeah : 1.3
profile none summary
tarball 31 of 35 cfe42c471f
[Firefox: 2 hits: 08-10 to 08-20] none[none] none:none
none|none none none

03:37:00 WinXP 118.170.141.249 (-):
. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 9e4ccec7e5
[Firefox: 2 hits: 08-19 to 08-20] none[none] none:none
none|none none none

T:03:41:00 Win2K-f 151.80.150.183 (38-151.NET24.IT):
IUNET-BNET,
IT. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:03:44:00 Win2K-f 75.85.116.175 (RR.COM):
ROAD RUNNER HOLDCO LLC,
PLACENTIA, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.46:80
US:208.111.173.47:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:03:48:00 WinXP 220.141.126.35 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 d28bf8aa1a
NEW none[none] none:none
none|none none none

03:52:00 Win2K-f 196.208.68.31 (TELKOM-IPNET.CO.ZA):
AFRINIC,
JOHANNESBURG, GAUTENG, ZA. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

03:53:00 WinXP 193.250.20.223 (ABO.WANADOO.FR):
WANADOO FRANCE,
LYON, RHONE-ALPES, FR. n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:377 hits: 12-31 to 08-30] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:03:55:00 WinXP 86.96.64.163 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball none e32e62a49b
NEW none[none] none:none
none|none none none

T:04:11:00 WinXP 221.170.11.148 (MESH.AD.JP):
BIGLOBE-CIDR-BLK,
JP. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:524 hits: 12-31 to 08-30] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:04:17:00 WinXP 72.177.163.69 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HOUSTON, TEXAS, US. n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
GB:new.egg.com
:wpad
:www.proxy-socks.net
US:208.73.210.32:80
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
http
http
http
35 lines Yeah : 0.8
profile none summary
tarball 29 of 29
none a12cab51ef
[Firefox:500 hits: 01-01 to 08-30]
c4421792b2
NEW 40f7f463c4 [0]
none [none] ASM:Graph
none:none
ASPack|
none|none lines=281
embedded dns
none trace
none

T:04:22:00 WinXP 220.102.233.101 (MESH.AD.JP):
NEC BIGLOBE LTD,
ATSUGI, KANAGAWA, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:524 hits: 01-01 to 08-30] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:04:25:00 WinXP 67.38.174.11 (AMERITECH.NET):
DIAL POOL - TNT1.KALAMAZOO.MI.AMERITECH.NET,
GRAND RAPIDS, MICHIGAN, US. (DIAL) n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1041 hits: 12-31 to 08-30] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

04:27:00 Win2K-f 85.179.251.127 (ALICEDSL.DE):
HANSENET-ADSL,
DE. (DSL) 64.85.160.111:5001 US:cookie.roltf.ws
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:04:49:00 WinXP 69.89.102.70 (ACD.NET):
ACD.NET,
US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.43:80
US:208.111.148.54:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

04:55:00 WinXP 119.228.184.15 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:111 hits: 01-08 to 08-30] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

T:05:00:00 WinXP 75.16.227.207 (SBCGLOBAL.NET):
PPPOX POOL - RBACK3.KNTPIN,
EVANSVILLE, INDIANA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30]
e07c29c4ae
[Firefox:411 hits: 06-19 to 08-30] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

05:01:00 Win2K-f 219.255.41.27 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 210.245.211.11:65520 US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
DE:dl2.teenpassage.com
:fleshkatera.cn
:lolika.cn
US:iphonenewline.com
US:fluorcorpinvest.com
:www.upononjob.cn
CN:second-reason.com
EU:reservjob.cn
:mulfika.cn
:virus-quick-scan.com
:voovle.info
US:antispyware-quick-scan.com
US:spyware-quickscan-2008.com
115.126.2.110:80
US:208.111.148.152:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
irc
1165 lines Yeah : 1.8
profile none summary
tarball 30 of 33
30 of 36
32 of 33
none
10 of 36
none
none
0 of 32
8 of 36 0a2b1894da
[Firefox: 4 hits: 06-26 to 08-20]
34ea4db965
NEW
414b95a784
[Firefox: 4 hits: 06-26 to 08-20]
42c978cb3c
NEW
664bac8971
NEW
68ee501dc9
NEW
8abb36799e
NEW
b5919931fe
[Firefox:531 hits: 06-20 to 08-30]
d2c30239b2
NEW none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
b5919931fe[1]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none:none
ASM:Graph
none:none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
ASProtect|
none|none none
none
none
none
none
none
none
lines=90
none none
none
none
none
none
none
none
trace
none

T:05:13:00 WinXP 213.22.114.40 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
ALMADA, SETUBAL, PT. 194.54.90.246:80 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
DE:dl2.teenpassage.com 445 pcap raw alerts
ruleset http
irc
5 lines Yeah : 1.3
profile none summary
tarball 36 of 36 6cf11d6364
NEW none[none] none:none
none|none none none

05:22:00 WinXP 118.165.180.43 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball none f0348270ec
NEW none[none] none:none
none|none none none

T:05:41:00 Win2K-f 66.169.92.21 (CHARTER.COM):
CHARTER COMMUNICATIONS,
HICKORY, NORTH CAROLINA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80 135 pcap raw alerts
ruleset http
167 lines Yeah : 1.3
profile none summary
tarball 30 of 33
0 of 32
29 of 33 65494b4a08
[Firefox: 4 hits: 06-29 to 07-09]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30]
eeb51a6e9e
[Firefox: 4 hits: 06-29 to 07-09] none[none]
b5919931fe[1]
none [none] none:none
ASM:Graph
none:none
none|none
ASProtect|
none|none none
lines=90
none none
trace
none

05:42:00 WinXP 219.105.90.178 (ADACHI.NE.JP):
CABLE TELEVISION ADACHI CORP,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:524 hits: 01-01 to 08-30] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

06:03:00 WinXP 86.56.73.105 (-):
INFOCITY,
DE. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:111 hits: 01-08 to 08-30] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

T:06:06:00 Win2K-f 222.234.183.112 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 210.245.211.11:65520 US:microsoft.com
HK:proxima.ircgalaxy.pl
US:download.microsoft.com
US:208.111.148.23:80
US:208.111.148.43:80 135 pcap raw alerts
ruleset irc
http
91 lines Yeah : 1.8
profile none summary
tarball 0 of 33
30 of 32 4c3df24b32
[Firefox:178 hits: 06-17 to 08-29]
8390780c27
[Firefox:36 hits: 06-18 to 08-27] 4c3df24b32 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

T:06:19:00 WinXP 88.160.226.70 (PROXAD.NET):
PROXAD / FREE SAS,
FR. 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
DE:dl2.teenpassage.com 445 pcap raw alerts
ruleset http
irc
6 lines Yeah : 1.3
profile none summary
tarball 30 of 32 a41d9d371e
[Firefox: 7 hits: 04-21 to 08-29] c2640d398b [0] ASM:Graph
PolyEnE| lines=129 trace

T:06:25:00 Win2K-f 93.81.80.97 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 210.245.211.11:65520 77.91.227.179:80 US:microsoft.com
HK:proxima.ircgalaxy.pl
US:download.microsoft.com
DE:dl2.teenpassage.com
:fleshkatera.cn
:lolika.cn
US:iphonenewline.com
US:fluorcorpinvest.com
:www.upononjob.cn
EU:reservjob.cn
CN:second-reason.com
:mulfika.cn
:viacodecright-2.com
:voovle.info
:virus-quick-scan.com
US:antispyware-quick-scan.com
US:spyware-quickscan-2008.com
US:winantispyware2008.com
US:virus-quickscan-2008.com
US:spyware-quickscan-2009.com
US:virus-quickscan-2009.com
US:antivirus-quick-scan.com
US:204.160.104.126:80
CN:220.196.42.218:80 445 pcap raw alerts
ruleset irc
http
950 lines Yeah : 1.3
profile none summary
tarball 30 of 36
10 of 36
none
none
0 of 32 34ea4db965
NEW
664bac8971
NEW
68ee501dc9
NEW
9dd8cfa0cf
NEW
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[none]
none [none]
none [none]
none [none]
b5919931fe[1] none:none
none:none
none:none
none:none
ASM:Graph
none|none
none|none
none|none
none|none
ASProtect| none
none
none
none
lines=90 none
none
none
none
trace

06:27:00 WinXP 96.247.59.250 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80
US:204.160.104.126:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30]
e07c29c4ae
[Firefox:411 hits: 06-19 to 08-30] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

06:39:00 Win2K-f 61.221.64.15 (HINET.NET):
DATA COMMUNICATION BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
57ce4acac2
[Firefox:170 hits: 06-17 to 08-30] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

06:48:00 WinXP 96.14.3.119 (-):
. n/a US:microsoft.com
US:download.microsoft.com
HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
120 lines Yeah : 1.3
profile none summary
tarball 31 of 33
29 of 34
0 of 33 0bfa79dc19
[Firefox: 9 hits: 07-22 to 08-26]
8dfb3b619f
[Firefox:10 hits: 07-22 to 08-26]
e07c29c4ae
[Firefox:411 hits: 06-19 to 08-30] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

T:06:59:00 WinXP 91.126.53.37 (RP80.SE):
WEBTECH NORD HELSINGBORG,
HELSINGBORG, SKANE, SE. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 a9cfbd1b0c
NEW none[none] none:none
none|none none none

07:06:00 WinXP 86.96.39.61 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 0.8
profile none summary
tarball 35 of 36 790dcb2cfc
[Firefox: 2 hits: 08-06 to 08-09] none[none] none:none
none|none none none

07:12:00 WinXP 79.163.228.222 (-):
IDEA,
PL. n/a 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

07:25:00 Win2K-f 12.219.198.173 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
EXCELSIOR SPRINGS, MISSOURI, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

07:35:00 WinXP 85.177.20.103 (ALICEDSL.DE):
HANSENET-ADSL,
DE. 64.85.160.111:5001 DE:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

07:41:00 WinXP 118.0.49.238 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:524 hits: 01-01 to 08-30] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:07:51:00 Win2K-f 170.51.71.181 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. 213.239.192.125:5001 US:cookie.roltf.ws
DE:213.239.192.125:5001 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

07:55:00 WinXP 82.246.67.2 (PROXAD.NET):
PROXAD / FREE SAS,
FOURMIES, NORD-PAS-DE-CALAIS, FR. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 35 of 36 75cf39cba2
NEW none[none] none:none
none|none none none

T:07:59:00 WinXP 186.12.33.50 (-):
. 64.85.160.111:5001 DE:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 33 of 36 30d50bdc3d
NEW none[none] none:none
none|none none none

08:19:00 WinXP 130.13.42.185 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:377 hits: 12-31 to 08-30] 048df78048 [0] ASM:Graph
none|none lines=61 trace

08:33:00 Win2K-f 170.51.68.184 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. 64.85.160.111:5001 US:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 33 of 36 30d50bdc3d
NEW none[none] none:none
none|none none none

T:08:33:00 Win2K-f 219.255.6.118 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 210.245.211.11:65520 US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:208.111.153.236:80 135 pcap raw alerts
ruleset irc
http
121 lines Yeah : 1.8
profile none summary
tarball 30 of 33
32 of 33
0 of 32 0a2b1894da
[Firefox: 4 hits: 06-26 to 08-20]
414b95a784
[Firefox: 4 hits: 06-26 to 08-20]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[none]
none [none]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
none|none
ASProtect| none
none
lines=90 none
none
trace

T:08:35:00 WinXP 12.214.175.206 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
OTTAWA, ILLINOIS, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1041 hits: 12-31 to 08-30] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:46:00 WinXP 170.51.68.184 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. 213.239.192.125:5001 DE:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 33 of 36 30d50bdc3d
NEW none[none] none:none
none|none none none

08:52:00 WinXP 122.52.18.151 (PLDT.NET):
IPG,
PH. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 22999be88c
[Firefox:15 hits: 04-05 to 08-27] eda2056971 [0] ASM:Graph
PolyEnE| lines=154
embedded dns trace

08:59:00 WinXP 88.181.103.121 (PROXAD.NET):
PROXAD / FREE SAS,
FR. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 9e4ccec7e5
[Firefox: 2 hits: 08-19 to 08-20] none[none] none:none
none|none none none

09:06:00 WinXP 219.71.114.234 (NVWTV.COM.TW):
HOSHIN GIGAMEDIA CENTER INC,
TW. (DSL) 213.239.192.125:5001 US:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 34 of 36 b4b2ce01ca
NEW none[none] none:none
none|none none none

T:09:41:00 WinXP 116.127.144.91 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
DE:dl2.teenpassage.com
DE:85.114.141.207:80 135 pcap raw alerts
ruleset irc
http
137 lines Yeah : 1.8
profile none summary
tarball 32 of 36
34 of 36 0c3d1ec2df
[Firefox: 5 hits: 08-11 to 08-30]
8de905030e
[Firefox: 5 hits: 08-11 to 08-30] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

09:52:00 Win2K-f 4.176.33.113 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
APACHE JUNCTION, ARIZONA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80 135 pcap raw alerts
ruleset other
91 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:09:54:00 Win2K-f 170.51.81.186 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

10:09:00 Win2K-f 76.244.176.42 (PACBELL.NET):
AT&T INTERNET SERVICES,
US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.41:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:10:13:00 WinXP 89.246.193.199 (VERSANETONLINE.DE):
VERSATEL NORD-DEUTSCHLAND GMBH,
DE. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:344 hits: 01-05 to 08-30] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:10:35:00 WinXP 66.217.35.47 (USLEC.NET):
USLEC CORP,
MIAMI, FLORIDA, US. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:524 hits: 12-31 to 08-30] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:11:05:00 Win2K-f 151.33.81.64 (33-151.IOL.IT):
ITALIA ONLINE S.P.A,
MILANO, LOMBARDIA, IT. (DIAL) n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

11:16:00 Win2K-f 68.151.232.239 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
EDMONTON, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

11:24:00 Win2K-f 4.154.84.242 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SUWANEE, GEORGIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80 135 pcap raw alerts
ruleset http
144 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
8 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30]
b7082104e4
[Firefox:120 hits: 06-18 to 08-30] none[4]
b5919931fe[1]
none [4] none:none
ASM:Graph
none:none
tElock|
ASProtect|
tElock| none
lines=90
none trace
trace
trace

11:43:00 WinXP 82.246.67.2 (PROXAD.NET):
PROXAD / FREE SAS,
FOURMIES, NORD-PAS-DE-CALAIS, FR. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 36 75cf39cba2
NEW none[none] none:none
none|none none none

11:54:00 Win2K-f 61.218.193.250 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80 135 pcap raw alerts
ruleset other
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
57ce4acac2
[Firefox:170 hits: 06-17 to 08-30] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

11:59:00 WinXP 210.221.49.102 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
97 lines Yeah : 1.3
profile none summary
tarball 31 of 33
31 of 33 776985f561
[Firefox: 9 hits: 06-24 to 08-23]
8ec6129efe
[Firefox: 9 hits: 06-24 to 08-23] 776985f561 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

12:20:00 Win2K-f 70.119.117.202 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LAKELAND, FLORIDA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:12:37:00 Win2K-f 4.158.240.70 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MILWAUKEE, WISCONSIN, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80 135 pcap raw alerts
ruleset other
91 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:12:54:00 Win2K-f 70.168.9.44 (COX.NET):
COX COMMUNICATIONS,
PAWTUCKET, RHODE ISLAND, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.247:80
US:208.111.148.254:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

12:57:00 Win2K-f 186.12.119.119 (-):
. 213.239.192.125:5001 DE:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

12:59:00 Win2K-f 72.51.193.165 (NEWWAVECOMM.NET):
NEW WAVE COMMUNICATIONS,
CORBIN, KENTUCKY, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
254 lines Yeah : 1.3
profile none summary
tarball 34 of 36
0 of 32
34 of 36 0b09052fb7
NEW
b5919931fe
[Firefox:531 hits: 06-20 to 08-30]
d8cf9fc784
NEW none[none]
b5919931fe[1]
none [none] none:none
ASM:Graph
none:none
none|none
ASProtect|
none|none none
lines=90
none none
trace
none

13:04:00 WinXP 118.174.208.247 (-):
. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 35 of 36 4b2541d5f7
[Firefox: 7 hits: 08-19 to 08-24] none[none] none:none
none|none none none

T:13:19:00 WinXP 151.80.215.144 (38-151.NET24.IT):
IUNET-BNET,
IT. (DSL) 213.239.192.125:5001 US:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

13:31:00 WinXP 121.73.133.14 (TELSTRACLEAR.NET):
TELECOMMUNICATIONS COMPANY,
NZ. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball none a234560774
NEW none[none] none:none
none|none none none

T:13:33:00 WinXP 67.11.55.2 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 eca9a5fa95
NEW none[none] none:none
none|none none none

13:42:00 WinXP 74.207.18.178 (HCIS.NET):
HEARTLAND COMMUNICATIONS INTERNET SERVICES INC,
PADUCAH, KENTUCKY, US. n/a DE:siliconfireware.ru
US:searchportal.information.com
DE:ebookfinaltrash.ru
:wpad
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
http
4 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:500 hits: 01-01 to 08-30] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

14:05:00 Win2K-f 218.211.190.244 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TW. 67.43.236.98:5190 CA:xx.sqlteam.info
CA:alwayssam.com
US:130.107.142.110:52061 135 pcap raw alerts
ruleset irc
http
344 lines Yeah : 1.8
profile none summary
tarball 17 of 36
17 of 36
none
14 of 36 4abdfdab44
NEW
79a81e4dd6
NEW
98313e1004
NEW
9b09258622
[Firefox:13 hits: 08-05 to 08-30] none[none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none none
none
none
none none
none
none
none

14:09:00 WinXP 24.80.184.211 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
126 lines Yeah : 1.3
profile none summary
tarball 31 of 36
0 of 33
33 of 36 28ce5fc467
NEW
e07c29c4ae
[Firefox:411 hits: 06-19 to 08-30]
e7335cb667
NEW none[none]
e07c29c4ae[1]
none [none] none:none
ASM:Graph
none:none
none|none
FSG|
none|none none
lines=92
none none
trace
none

14:27:00 WinXP 24.85.99.145 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:199.93.44.124:80
US:199.93.44.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:14:38:00 WinXP 205.214.251.15 (SPEAKEASY.NET):
US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1041 hits: 12-31 to 08-30] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:14:50:00 WinXP 66.57.203.162 (RR.COM):
ROAD RUNNER HOLDCO LLC,
PINEHURST, NORTH CAROLINA, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1041 hits: 12-31 to 08-30] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:14:57:00 Win2K-f 68.151.104.222 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80
US:208.111.148.115:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

14:59:00 WinXP 71.43.102.123 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1041 hits: 12-31 to 08-30] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:14:59:00 WinXP 71.43.102.123 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1041 hits: 12-31 to 08-30] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

15:02:00 Win2K-f 172.165.184.240 (AOL.COM):
AMERICA ONLINE,
US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.115:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:15:09:00 WinXP 217.202.111.71 (-):
TELECOM ITALIA MOBILE,
IT. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none 8ef9e03ad3
NEW none[none] none:none
none|none none none

T:15:19:00 Win2K-f 207.195.112.251 (HARVARDBROADCASTING.COM):
HARVARD BROADCASTING INC,
REGINA, SASKATCHEWAN, CA. (100Mbps) 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
DE:dl2.teenpassage.com
DE:85.114.141.207:80 139 pcap raw alerts
ruleset irc
32 lines Yeah : 1.3
profile none summary
tarball none 4a5657d3c4
NEW none[none] none:none
none|none none none

15:23:00 WinXP 122.132.121.195 (MESH.AD.JP):
NEC BIGLOBE LTD,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:344 hits: 01-05 to 08-30] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

15:25:00 Win2K-f 186.12.7.191 (-):
. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

15:45:00 WinXP 99.160.60.75 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.115:80
US:208.111.148.247:80
US:208.111.148.254:80 135 pcap raw alerts
ruleset http
61 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
b7082104e4
[Firefox:120 hits: 06-18 to 08-30]
e07c29c4ae
[Firefox:411 hits: 06-19 to 08-30] none[4]
none [4]
e07c29c4ae[1] none:none
none:none
ASM:Graph
tElock|
tElock|
FSG| none
none
lines=92 trace
trace
trace

15:57:00 Win2K-f 68.74.72.188 (-):
PPPOX POOL - EMHRIL RBACK,
CHICAGO, ILLINOIS, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.115:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

16:14:00 Win2K-f 66.212.145.204 (NAUTICOM.NET):
PINNATECH INC,
WEST MIFFLIN, PENNSYLVANIA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
255 lines Yeah : 1.3
profile none summary
tarball none
none
0 of 32 1421136df9
NEW
a4f2231d1a
NEW
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[none]
none [none]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
none|none
ASProtect| none
none
lines=90 none
none
trace

T:16:16:00 WinXP 70.74.199.150 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80
US:208.111.173.16:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

16:18:00 WinXP 75.185.37.32 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COLUMBUS, OHIO, US. 194.54.90.246:80 UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1041 hits: 12-31 to 08-30] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:16:20:00 Win2K-f 170.51.143.94 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. 64.85.160.111:5001 DE:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:149 hits: 05-22 to 08-14] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

16:23:00 WinXP 201.212.101.235 (NET.AR):
PRIMA S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) n/a RU:moscow-advokat.ru
SE:vancouver.dal.net
FI:london.uk.eu.undernet.org
:washington.dc.us.undernet.org
SE:viking.dal.net
:brussels.be.eu.undernet.org
SE:qis.md.us.dal.net 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 35 of 35 b9e6a0c882
NEW none[none] none:none
none|none none none

T:16:23:00 WinXP 201.212.101.235 (NET.AR):
PRIMA S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) n/a RU:moscow-advokat.ru
:lulea.se.eu.undernet.org
:flanders.be.eu.undernet.org
NL:diemen.nl.eu.undernet.org
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 35 b9e6a0c882
NEW none[none] none:none
none|none none none

T:16:41:00 WinXP 70.109.0.203 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
FRANKLIN, NORTH CAROLINA, US. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:524 hits: 01-01 to 08-30] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

17:08:00 Win2K-f 218.211.206.82 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:17:09:00 WinXP 98.174.40.91 (-):
. n/a 135 pcap raw alerts
ruleset other
23 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

17:18:00 WinXP 210.79.132.100 (MEDIATTI.NET):
MEDIATTI COMMUNICATIONS INC,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:524 hits: 01-01 to 08-30] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:17:54:00 WinXP 66.50.175.124 (PRTC.NET):
PUERTO RICO TELEPHONE COMPANY,
SAN JUAN, PUERTO RICO, PR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
[Firefox:73 hits: 01-14 to 08-26] 8a00217866 [0] ASM:Graph
PolyEnE| lines=57 trace

T:18:00:00 WinXP 116.0.202.91 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
JP. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

18:06:00 WinXP 218.164.36.5 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
KAOHSIUNG, KAO-HSIUNG, TW. n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:524 hits: 01-01 to 08-30] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

18:06:00 WinXP 208.83.218.92 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 eca9a5fa95
NEW none[none] none:none
none|none none none

18:21:00 Win2K-f 219.251.192.240 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
US:download.microsoft.com
HK:proxima.ircgalaxy.pl
US:208.111.153.215:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
87 lines Yeah : 1.3
profile none summary
tarball 30 of 32
33 of 33
0 of 32 5364c612fa
[Firefox: 6 hits: 07-06 to 08-23]
53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[none]
none [4]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
tElock|
ASProtect| none
none
lines=90 none
trace
trace

18:32:00 WinXP 93.156.120.117 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1041 hits: 12-31 to 08-30] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

18:35:00 Win2K-f 140.239.43.19 (XO.NET):
XO COMMUNICATIONS,
HOPKINTON, MASSACHUSETTS, US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

19:11:00 WinXP 116.123.40.35 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
125 lines Yeah : 1.3
profile none summary
tarball 30 of 33
30 of 33 2e04b06527
[Firefox: 6 hits: 06-18 to 08-23]
5c054291de
[Firefox: 6 hits: 06-18 to 08-23] none[4]
5c054291de[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

19:18:00 Win2K-f 116.125.128.195 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:207.123.42.126:80
US:209.84.20.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
124 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 0c3d1ec2df
[Firefox: 5 hits: 08-11 to 08-30]
8de905030e
[Firefox: 5 hits: 08-11 to 08-30] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

19:34:00 Win2K-f 61.20.138.96 (-):
FAR EASTONE TELECOMMUNICATION CO. LTD,
TW. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

19:41:00 WinXP 114.120.9.241 (-):
. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:97 hits: 01-03 to 08-30] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

T:19:45:00 WinXP 4.162.9.42 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MIDLOTHIAN, TEXAS, US. (DIAL) n/a EU:siliconfireware.ru
US:searchportal.information.com
GB:welcome3.smile.co.uk
:wpad
GB:195.92.84.198:80
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
3 lines Yeah : 0.8
profile none summary
tarball 22 of 32 68cd473638
NEW none[none] none:none
none|none none none

T:19:49:00 WinXP 207.144.212.129 (INFOAVE.NET):
PALMETTO RURAL TELEPHONE COMPANY (DIAL-UP),
WALTERBORO, SOUTH CAROLINA, US. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:524 hits: 12-31 to 08-30] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

19:58:00 WinXP 67.11.53.28 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 eca9a5fa95
NEW none[none] none:none
none|none none none

T:19:59:00 WinXP 67.11.53.28 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 36 of 36 eca9a5fa95
NEW none[none] none:none
none|none none none

20:08:00 Win2K-f 70.182.251.209 (MAXONCORP.COM):
COX COMMUNICATIONS,
WICHITA, KANSAS, US. n/a 135 pcap raw alerts
ruleset other
210 lines Yeah : 1.3
profile none summary
tarball 34 of 36
33 of 36 aa9a5814b5
NEW
d65dae6c35
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

20:18:00 WinXP 69.153.103.144 (SWBELL.NET):
PPPOX POOL - BRAS1 STLSMO,
ST. LOUIS, MISSOURI, US. (DSL) n/a DE:siliconfireware.ru
US:searchportal.information.com
SE:kavkazcenter.com
SE:kavkazcenter.net
FI:kavkazchat.com
US:chechenpress.info
GB:chechenpress.co.uk
US:shaheeds.org
:daymohk.info
:chripress.org
:marsho.dk
US:www.jamaatshariat.com
US:www.counterdata.com
DE:m1.webstats.motigo.com
FI:imgs2.kavkazcenter.com
:www.google.com
FI:static.kavkazchat.com
GB:www.chechenpress.co.uk
:www.islamicfinder.org
:www.youtube.com
:www.vimeo.com
US:www.google-analytics.com
US:video.google.com
FI:www.kavkazchat.com
:wpad
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
323 lines Yeah : 0.8
profile none summary
tarball 29 of 29 ab5e47bf8d
[Firefox:38 hits: 01-02 to 08-20] none[3] none:none
ASPack| none trace

20:20:00 WinXP 114.120.76.206 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 e4157a2cc3
[Firefox: 5 hits: 08-23 to 08-26] none[none] none:none
none|none none none

20:21:00 WinXP 118.240.39.100 (-):
. n/a 445 pcap raw alerts
ruleset shell
2 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

20:31:00 Win2K-f 75.85.116.175 (RR.COM):
ROAD RUNNER HOLDCO LLC,
PLACENTIA, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.247:80
US:208.111.148.254:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:20:40:00 Win2K-f 24.85.99.145 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
78 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

20:53:00 WinXP 24.174.22.145 (CARRERACOMMUNICATIONS.NET):
ROAD RUNNER HOLDCO LLC,
HOUSTON, TEXAS, US. n/a :daymohk.info
:marsho.dk
US:www.jamaatshariat.com
US:www.counterdata.com
DE:m1.webstats.motigo.com
FI:80.81.183.151:80 445 pcap raw alerts
ruleset http
136 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:500 hits: 01-01 to 08-30] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

20:57:00 WinXP 172.169.251.163 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
131 lines Yeah : 1.3
profile none summary
tarball 33 of 33
none
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
5460b1fa77
NEW
e07c29c4ae
[Firefox:411 hits: 06-19 to 08-30] none[4]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
tElock|
none|none
FSG| none
none
lines=92 trace
none
trace

T:20:57:00 WinXP 24.174.22.145 (CARRERACOMMUNICATIONS.NET):
ROAD RUNNER HOLDCO LLC,
HOUSTON, TEXAS, US. n/a DE:siliconfireware.ru
US:searchportal.information.com
GB:new.egg.com
:wpad
DE:ebookfinaltrash.ru
US:208.73.210.32:80
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
http
http
http
26 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:500 hits: 01-01 to 08-30] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

20:59:00 WinXP 119.77.240.191 (-):
. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none 4efecd976f
NEW none[none] none:none
none|none none none

21:07:00 WinXP 202.150.124.47 (-):
KOL-DIAL,
AUCKLAND, AUCKLAND, NZ. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.247:80
US:208.111.148.254:80 135 pcap raw alerts
ruleset other
101 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:21:17:00 WinXP 220.209.199.69 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:377 hits: 12-31 to 08-30] 048df78048 [0] ASM:Graph
none|none lines=61 trace

21:27:00 Win2K-f 63.28.35.55 (UU.NET):
UUNET TECHNOLOGIES INC,
CHICAGO, ILLINOIS, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:192.221.110.126:80
US:199.93.41.126:80 135 pcap raw alerts
ruleset other
79 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:00:00 Win2K-f 12.219.244.164 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
RIDGECREST, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80
US:208.111.173.16:80 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
b7082104e4
[Firefox:120 hits: 06-18 to 08-30] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

T:22:41:00 WinXP 114.120.79.112 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:97 hits: 01-03 to 08-30] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

T:23:02:00 WinXP 219.71.114.234 (NVWTV.COM.TW):
HOSHIN GIGAMEDIA CENTER INC,
TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
189 lines Yeah : 1.3
profile none summary
tarball 33 of 35
30 of 35
0 of 33 017226a316
[Firefox: 6 hits: 07-27 to 08-29]
9b03689ec5
[Firefox: 6 hits: 07-27 to 08-29]
e07c29c4ae
[Firefox:411 hits: 06-19 to 08-30] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

23:28:00 WinXP 24.165.140.55 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LORAIN, OHIO, US. n/a EU:siliconfireware.ru
EU:ebookfinaltrash.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:wpad
GB:welcome3.smile.co.uk
GB:195.92.84.198:80
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
http
9 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:500 hits: 01-01 to 08-30] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

T:23:28:00 WinXP 66.188.66.0 (CHARTER.COM):
CHARTER COMMUNICATIONS,
ATHENS, GEORGIA, US. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:209.84.20.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
211 lines Yeah : 1.3
profile none summary
tarball 31 of 33
29 of 33
0 of 33 7ba9e53288
[Firefox: 2 hits: 07-11 to 07-14]
d2e7fab9c3
[Firefox: 2 hits: 07-11 to 07-14]
e07c29c4ae
[Firefox:411 hits: 06-19 to 08-30] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

23:33:00 Win2K-f 76.211.0.175 (AMERITECH.NET):
RBACK3.AKRNOH,
CANTON, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com
US:205.128.73.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
a08f3b74a4
[Firefox:669 hits: 06-18 to 08-30]
b5919931fe
[Firefox:531 hits: 06-20 to 08-30] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:23:47:00 WinXP 67.213.14.148 (-):
. n/a 135 pcap raw alerts
ruleset other
1009 lines Yeah : 1.3
profile none summary
tarball none c7428c259b
NEW none[none] none:none
none|none none none

23:55:00 Win2K-f 64.139.104.242 (RCABLETV.COM):
NCI DATA.COM INC,
REPUBLIC, WASHINGTON, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.54:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
none 53bfe15e91
[Firefox:1992 hits: 06-17 to 08-30]
73f1082158
[Firefox:998 hits: 06-18 to 08-30]
956cca27e8
NEW none[4]
73f1082158[1]
none [none] none:none
ASM:Graph
none:none
tElock|
Armadillo|
none|none none
lines=81
none trace
trace
none