Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

17 September 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:14:00 Win2K-f 116.126.249.246 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:208.111.148.43:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
95 lines Yeah : 1.3
profile none summary
tarball 30 of 33
2 of 35 6ec2a8994b
[Firefox:21 hits: 06-18 to 09-15]
bcf66a38c8
[Firefox: 8 hits: 07-30 to 09-15] none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

T:00:28:00 WinXP 114.121.97.208 (-):
. n/a RU:moscow-advokat.ru
SE:coins.dal.net 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:00:28:00 WinXP 86.157.171.132 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:393 hits: 12-31 to 09-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

00:29:00 WinXP 64.92.60.233 (CONSOLIDATED.NET):
CONSOLIDATED COMMUNICATIONS INC,
MATTOON, ILLINOIS, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80
US:208.111.173.53:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:00:42:00 Win2K-f 121.72.234.20 (TELSTRACLEAR.NET):
TELSTRACLEAR CHRISTCHURCH CABLE CUSTOMERS,
WELLINGTON, WELLINGTON, NZ. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:204.160.104.126:80
US:207.123.42.126:80 135 pcap raw alerts
ruleset other
353 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 7f89b38665
[Firefox:10 hits: 08-02 to 09-14]
a51a50404e
[Firefox:10 hits: 08-02 to 09-14] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

00:43:00 WinXP 78.159.40.79 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 36 of 36 71b183b0c8
NEW none[none] none:none
none|none none none

T:01:00:00 WinXP 78.34.19.111 (NETCOLOGNE.DE):
NETCOLOGNE GMBH,
KOELN, NORDRHEIN-WESTFALEN, DE. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 f353d4eed9
NEW none[none] none:none
none|none none none

T:01:03:00 Win2K-f 124.10.7.67 (TFN.NET.TW):
TAIWAN FIXED NETWORK CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
90 lines Yeah : 1.3
profile none summary
tarball 32 of 36
33 of 33
0 of 32 3aff9129ca
NEW
53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[none]
none [4]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
tElock|
ASProtect| none
none
lines=90 none
trace
trace

01:12:00 Win2K-f 24.84.29.250 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BLAINE, WASHINGTON, US. n/a 135 pcap raw alerts
ruleset other
375 lines Yeah : 1.3
profile none summary
tarball 31 of 35 cfe42c471f
[Firefox: 5 hits: 08-10 to 09-14] none[none] none:none
none|none none none

01:30:00 Win2K-f 67.125.140.230 (PACBELL.NET):
AT&T INTERNET SERVICES,
FRESNO, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:01:38:00 WinXP 117.97.21.96 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:01:43:00 WinXP 87.57.191.164 (IP.TELE.DK):
TELEDANMARK,
DK. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball 29 of 29 32a0d7d0e0
[Firefox:21 hits: 01-11 to 09-16] d791762796 [0] ASM:Graph
tElock| lines=81
embedded dns trace

T:01:46:00 Win2K-f 122.146.82.100 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TW. n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.126:80
US:204.160.104.126:80
US:209.84.20.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:02:27:00 WinXP 79.132.209.149 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a EU:siliconfireware.ru
US:searchportal.information.com
UA:vit.ln.ua
:baner.vit
GB:new.egg.com
:wpad
US:208.73.210.32:80
DE:212.227.111.29:80
DE:217.11.54.126:80 445 pcap raw alerts
ruleset http
http
http
39 lines Yeah : 0.8
profile none summary
tarball 30 of 32 7dd1fe2970
[Firefox:18 hits: 02-03 to 08-19] dcc673c815 [0] ASM:Graph
ASPack| lines=374
embedded dns trace

03:08:00 WinXP 79.32.114.32 (SRC.ORG):
TELECOM ITALIA NET,
ROME, LAZIO, IT. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 32 of 32 03f912899b
[Firefox:124 hits: 01-08 to 09-16] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

03:29:00 WinXP 60.36.193.32 (PLALA.OR.JP):
PLALA NETWORKS INC,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:363 hits: 01-05 to 09-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:03:56:00 WinXP 96.15.37.201 (-):
. n/a 135 pcap raw alerts
ruleset other
276 lines Yeah : 1.3
profile none summary
tarball 33 of 36 69ea6772a5
NEW none[none] none:none
none|none none none

04:13:00 WinXP 119.72.34.125 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:04:13:00 WinXP 119.72.34.125 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

04:24:00 WinXP 217.164.144.185 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:04:24:00 WinXP 92.113.143.108 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

04:30:00 Win2K-f 122.146.243.136 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

04:35:00 WinXP 92.113.148.194 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

04:52:00 Win2K-f 75.87.253.244 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

05:18:00 WinXP 4.252.128.197 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SYCAMORE, ILLINOIS, US. (DIAL) 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:05:18:00 WinXP 4.252.128.197 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SYCAMORE, ILLINOIS, US. (DIAL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

05:21:00 WinXP 66.232.251.207 (TVCCONNECT.NET):
THAMES VALLEY COMMUNICATIONS INC,
GROTON, CONNECTICUT, US. n/a DE:siliconfireware.ru
:wpad
US:searchportal.information.com
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:521 hits: 01-01 to 09-16] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

T:05:22:00 WinXP 85.92.255.124 (NET.BA):
AS53#12 KONJIC TKC,
BA. (100Mbps) n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:363 hits: 01-05 to 09-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:05:35:00 WinXP 4.129.75.243 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a DE:siliconfireware.ru
US:searchportal.information.com
:wpad
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
3 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:233 hits: 01-01 to 09-16] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

05:57:00 Win2K-f 122.147.97.136 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.126:80
US:209.84.20.126:80
US:8.12.202.125:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

06:17:00 WinXP 119.228.182.11 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:363 hits: 01-05 to 09-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:06:37:00 WinXP 75.60.227.3 (SBCGLOBAL.NET):
PPPOX POOL - SE1.WOTNOH,
DALLAS, TEXAS, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.69:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16]
e07c29c4ae
[Firefox:447 hits: 06-19 to 09-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

06:37:00 WinXP 83.26.99.107 (TPNET.PL):
NEOSTRADA PLUS,
BYDGOSZCZ, KUJAWSKO-POMORSKIE, PL. (DSL) n/a EU:siliconfireware.ru
:wpad
US:searchportal.information.com
US:208.73.210.32:80
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
http
2 lines Yeah : 0.8
profile none summary
tarball 28 of 29 330eaa2da2
[Firefox:18 hits: 01-28 to 08-24] none[3] none:none
ASPack| none trace

T:06:42:00 WinXP 218.43.179.56 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:536 hits: 01-01 to 09-16] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

06:57:00 WinXP 124.61.38.40 (-):
POWERCOM,
KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
124 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 09c3d90250
[Firefox: 6 hits: 08-04 to 09-13]
8f34a39070
[Firefox: 6 hits: 08-04 to 09-13] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

07:09:00 WinXP 118.236.126.31 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 32 of 32 93385541f3
[Firefox:26 hits: 06-22 to 09-15] none[4] none:none
none|none none trace

07:16:00 WinXP 71.113.167.57 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
BLOOMINGTON, ILLINOIS, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.42:80
US:208.111.173.46:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:07:32:00 WinXP 92.96.47.220 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
[Firefox:75 hits: 01-14 to 09-14] 8a00217866 [0] ASM:Graph
PolyEnE| lines=57 trace

07:33:00 WinXP 200.117.54.63 (NET.AR):
APOLO -GOLD-TELECOM-PER,
BUENOS AIRES, BUENOS AIRES, AR. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:07:33:00 WinXP 200.117.54.63 (NET.AR):
APOLO -GOLD-TELECOM-PER,
BUENOS AIRES, BUENOS AIRES, AR. n/a RU:moscow-advokat.ru
:lulea.se.eu.undernet.org
SE:qis.md.us.dal.net
SE:ced.dal.net
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:07:50:00 WinXP 114.121.190.23 (-):
. n/a 445 pcap raw alerts
ruleset http
5 lines Yeah : 0.8
profile none summary
tarball 36 of 36 b872c76081
[Firefox: 3 hits: 09-13 to 09-16] none[none] none:none
none|none none none

07:51:00 Win2K-f 208.75.116.159 (-):
JRTNET.CA COMMUNICATIONS LTD,
LUNDBRECK, ALBERTA, CA. n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
332 lines Yeah : 1.3
profile none summary
tarball 34 of 36 4422cc16b4
NEW none[none] none:none
none|none none none

07:55:00 WinXP 189.48.97.200 (BRASILTELECOM.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 d9c778eaa4
[Firefox: 2 hits: 09-15 to 09-16] none[none] none:none
none|none none none

08:05:00 WinXP 59.117.178.234 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:08:06:00 WinXP 59.117.178.234 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:08:20:00 WinXP 116.7.87.176 (163DATA.COM.CN):
CHINANET GUANGDONG PROVINCE NETWORK,
BEIJING, BEIJING, CN. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 1fcc146d70
[Firefox:37 hits: 01-02 to 09-16] 258fafe892 [0] ASM:Graph
PolyEnE| lines=68 trace

08:21:00 WinXP 116.7.87.176 (163DATA.COM.CN):
CHINANET GUANGDONG PROVINCE NETWORK,
BEIJING, BEIJING, CN. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 1fcc146d70
[Firefox:37 hits: 01-02 to 09-16] 258fafe892 [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:29:00 WinXP 89.218.207.253 (ADSL.ONLINE.KZ):
KAZAKHTELECOM DATA NETWORK ADMINISTRATION,
KZ. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 bcc96fab23
NEW none[none] none:none
none|none none none

08:34:00 WinXP 219.249.4.103 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
99 lines Yeah : 1.3
profile none summary
tarball 31 of 33
33 of 35 168aab35a3
[Firefox:128 hits: 06-17 to 09-15]
f7738e7352
[Firefox: 5 hits: 07-25 to 09-15] none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

09:39:00 WinXP 82.248.107.187 (PROXAD.NET):
PROXAD / FREE SAS,
GENEVA, GENEVA, CH. (DSL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

10:21:00 WinXP 77.253.80.100 (COM.PL):
NETIA,
PL. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 b872c76081
[Firefox: 3 hits: 09-13 to 09-16] none[none] none:none
none|none none none

T:10:44:00 WinXP 85.103.69.133 (-):
TURK TELEKOM ADSL-ALCATEL DYNAMIC,
ISTANBUL, ISTANBUL, TR. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 fa869e3765
NEW none[none] none:none
none|none none none

10:44:00 WinXP 85.103.69.133 (-):
TURK TELEKOM ADSL-ALCATEL DYNAMIC,
ISTANBUL, ISTANBUL, TR. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 fa869e3765
NEW none[none] none:none
none|none none none

10:46:00 Win2K-f 70.129.42.127 (SWBELL.NET):
PPPOX POOL - BRAS2 OKCYOK 070704,
EDMOND, OKLAHOMA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.54:80 135 pcap raw alerts
ruleset other
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

10:51:00 Win2K-f 98.175.106.144 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.54:80
US:208.111.148.69:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

11:03:00 WinXP 72.230.139.136 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16]
e07c29c4ae
[Firefox:447 hits: 06-19 to 09-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

11:03:00 WinXP 190.19.55.187 (-):
. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 571e381ed4
[Firefox: 4 hits: 09-14 to 09-16] none[none] none:none
none|none none none

11:11:00 Win2K-f 71.131.139.234 (-):
VALLEY FOOD INC,
PLANO, TEXAS, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.126:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

11:18:00 WinXP 217.20.82.143 (ISURGUT.RU):
OPEN JOINT-STOCK COMPANY URALSVIAZINFORM BRANCH OF THE KHANTYMANSIYSK REGION,
RU. 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 36 71d5528293
[Firefox: 2 hits: 09-13 to 09-16] none[none] none:none
none|none none none

T:11:18:00 WinXP 217.20.82.143 (ISURGUT.RU):
OPEN JOINT-STOCK COMPANY URALSVIAZINFORM BRANCH OF THE KHANTYMANSIYSK REGION,
RU. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 71d5528293
[Firefox: 2 hits: 09-13 to 09-16] none[none] none:none
none|none none none

T:11:35:00 Win2K-f 71.83.94.91 (CHARTER.COM):
CHARTER COMMUNICATIONS,
VICTORVILLE, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.46.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:11:46:00 WinXP 92.114.135.47 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 36 of 36 b872c76081
[Firefox: 3 hits: 09-13 to 09-16] none[none] none:none
none|none none none

12:00:00 WinXP 125.215.125.10 (PIKARA.NE.JP):
PIKARA(STNET INCORPORATED),
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:536 hits: 01-01 to 09-16] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

12:10:00 Win2K-f 196.208.111.47 (TELKOM-IPNET.CO.ZA):
AFRINIC,
ZA. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
124 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

12:20:00 Win2K-f 24.79.72.232 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 33 of 36
31 of 36 baa3b7672d
NEW
c6db9a9ecd
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:12:29:00 WinXP 41.214.182.106 (-):
. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 c9d01112a8
[Firefox: 9 hits: 08-06 to 09-14] none[none] none:none
none|none none none

T:12:30:00 WinXP 124.87.125.211 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
TOKYO, TOKYO, JP. n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 35 of 36 ff56970afb
NEW none[none] none:none
none|none none none

12:30:00 WinXP 88.18.206.157 (RIMA-TDE.NET):
TELEFONICA DE ESPANA,
ES. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

12:37:00 WinXP 190.51.67.40 (COM.AR):
TELEFONICA DE ARGENTINA,
AR. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

12:37:00 Win2K-f 12.218.218.145 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
KENDALLVILLE, INDIANA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
60 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
8 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16]
b7082104e4
[Firefox:132 hits: 06-18 to 09-16] none[4]
b5919931fe[1]
none [4] none:none
ASM:Graph
none:none
tElock|
ASProtect|
tElock| none
lines=90
none trace
trace
trace

T:12:38:00 Win2K-f 12.218.218.145 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
KENDALLVILLE, INDIANA, US. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.125:80
US:207.123.42.126:80
US:209.84.20.126:80 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
b7082104e4
[Firefox:132 hits: 06-18 to 09-16] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

T:12:39:00 WinXP 190.51.67.40 (COM.AR):
TELEFONICA DE ARGENTINA,
AR. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

12:40:00 Win2K-f 4.174.170.17 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MT. JOY, PENNSYLVANIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
87 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

12:45:00 WinXP 75.177.12.117 (RR.COM):
ROAD RUNNER HOLDCO LLC,
GREENSBORO, NORTH CAROLINA, US. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:12:47:00 WinXP 130.13.44.74 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:393 hits: 12-31 to 09-16] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:12:47:00 WinXP 70.119.52.196 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ORLANDO, FLORIDA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16]
e07c29c4ae
[Firefox:447 hits: 06-19 to 09-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:13:08:00 WinXP 75.16.229.114 (SBCGLOBAL.NET):
PPPOX POOL - RBACK3.KNTPIN,
EVANSVILLE, INDIANA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:8.12.222.126:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16]
e07c29c4ae
[Firefox:447 hits: 06-19 to 09-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

13:13:00 Win2K-f 12.101.102.40 (ATT.NET):
AT&T WORLDNET SERVICES,
TAMPA, FLORIDA, US. 210.245.211.11:65520 HK:proxima.ircgalaxy.pl
DE:dl2.teenpassage.com
:fleshkatera.cn
:lolika.cn
:www.upononjob.cn
EU:reservjob.cn 139 pcap raw alerts
ruleset irc
http
324 lines Yeah : 1.3
profile none summary
tarball 11 of 36
27 of 36
35 of 36 284f4c82ba
NEW
2a0ee3c795
[Firefox: 4 hits: 09-13 to 09-13]
3a9cc10db3
NEW none[none]
none [none]
none [none] none:none
none:none
none:none
none|none
none|none
none|none none
none
none none
none
none

T:13:24:00 WinXP 195.46.44.5 (CABLESURF.DE):
KABELFERNSEHEN-MUENCHEN-NET,
DE. (DSL) n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

13:30:00 Win2K-f 218.211.206.234 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.226:80
US:208.111.148.247:80 135 pcap raw alerts
ruleset other
390 lines Yeah : 1.3
profile none summary
tarball 31 of 33
30 of 35 3db2c812c0
[Firefox: 3 hits: 07-23 to 08-23]
797fdec34a
[Firefox: 3 hits: 07-23 to 08-23] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

13:33:00 Win2K-f 216.205.217.132 (CINERGYCOM.NET):
CINERGY COMMUNICATIONS COMPANY,
JACKSON, TENNESSEE, US. (DSL) 210.245.211.11:65520 216.255.182.242:80 HK:proxima.ircgalaxy.pl
US:zemlekop.name 445 pcap raw alerts
ruleset irc
http
7 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:13:54:00 WinXP 219.71.235.221 (NVWTV.COM.TW):
HOSHIN GIGAMEDIA CENTER INC,
TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80
US:4.23.60.126:80
US:8.12.202.125:80 135 pcap raw alerts
ruleset other
189 lines Yeah : 1.3
profile none summary
tarball 33 of 35
30 of 35 017226a316
[Firefox: 8 hits: 07-27 to 09-15]
9b03689ec5
[Firefox: 8 hits: 07-27 to 09-15] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

13:57:00 WinXP 207.5.232.241 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80
US:8.12.202.125:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16]
e07c29c4ae
[Firefox:447 hits: 06-19 to 09-16] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:14:15:00 WinXP 217.203.131.180 (-):
TELECOM ITALIA MOBILE,
IT. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 571e381ed4
[Firefox: 4 hits: 09-14 to 09-16] none[none] none:none
none|none none none

14:22:00 WinXP 71.148.35.37 (SBCGLOBAL.NET):
KASSA KASSA,
PLANO, TEXAS, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16]
e07c29c4ae
[Firefox:447 hits: 06-19 to 09-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

14:25:00 Win2K-f 4.254.227.238 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CALDWELL, IDAHO, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:14:45:00 Win2K-f 71.112.180.17 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
KIRKLAND, WASHINGTON, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:205.128.73.126:80
US:207.123.37.124:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:14:58:00 WinXP 118.237.119.19 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 27b945de66
[Firefox:19 hits: 06-20 to 09-13] none[4] none:none
none|none none trace

T:15:00:00 Win2K-f 64.187.44.26 (PORCHLIGHT.CA):
BELL CANADA,
LONDON, ONTARIO, CA. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:199.93.41.126:80
US:207.123.37.125:80 135 pcap raw alerts
ruleset other
172 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
b7082104e4
[Firefox:132 hits: 06-18 to 09-16] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

15:23:00 WinXP 200.127.47.14 (NET.AR):
PRIMA S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 14 of 36
35 of 36 102c8b308c
NEW
75b1decfa8
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

15:24:00 WinXP 75.79.36.151 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80
US:208.111.148.43:80 135 pcap raw alerts
ruleset other
93 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

15:39:00 WinXP 74.75.233.177 (RR.COM):
ROAD RUNNER HOLDCO LLC,
PORTLAND, MAINE, US. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:100 hits: 01-03 to 09-13] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

T:15:42:00 WinXP 206.169.142.204 (-):
TIME WARNER TELECOM INC,
ZIHUATANEJO, GUERRERO, MX. n/a 135 pcap raw alerts
ruleset other
54 lines Yeah : 1.3
profile none summary
tarball 0 of 33 a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] a08f3b74a4 [1] ASM:Graph
Armadillo| lines=81 trace

15:57:00 Win2K-f 70.182.94.50 (COX.NET):
COX COMMUNICATIONS,
OKLAHOMA CITY, OKLAHOMA, US. n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:208.111.148.43:80
US:208.111.148.54:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 32 of 33
29 of 33 87e1117f2a
[Firefox: 6 hits: 07-18 to 09-14]
b4fe4581c3
[Firefox: 6 hits: 07-18 to 09-14] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

16:03:00 WinXP 118.218.115.190 (-):
. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.43:80
US:208.111.148.54:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
98 lines Yeah : 1.3
profile none summary
tarball 31 of 33
31 of 33 168aab35a3
[Firefox:128 hits: 06-17 to 09-15]
667f0c59f3
[Firefox:22 hits: 07-04 to 08-30] none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

T:16:26:00 Win2K-f 4.172.165.141 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BROOKLYN, NEW YORK, US. (DIAL) 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
DE:dl2.teenpassage.com
US:208.111.153.236:80
US:208.111.173.16:80
DE:85.114.141.207:80 135 pcap raw alerts
ruleset irc
242 lines Yeah : 1.8
profile none summary
tarball 34 of 36
32 of 36 7858181cae
[Firefox: 2 hits: 08-01 to 09-13]
ada2e3617c
[Firefox: 2 hits: 08-01 to 09-13] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:16:44:00 WinXP 71.111.120.248 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
BEAVERTON, OREGON, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16]
e07c29c4ae
[Firefox:447 hits: 06-19 to 09-16] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

16:58:00 WinXP 4.154.52.115 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WEAVERVILLE, NORTH CAROLINA, US. (DIAL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:16:59:00 WinXP 4.154.52.115 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WEAVERVILLE, NORTH CAROLINA, US. (DIAL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

17:16:00 Win2K-f 98.140.59.60 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:17:20:00 Win2K-f 125.58.80.11 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:17:25:00 WinXP 63.246.121.150 (SPEAKEASY.NET):
US. n/a 135 pcap raw alerts
ruleset other
19 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

17:41:00 Win2K-f 116.127.229.56 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
HK:proxima.ircgalaxy.pl
US:download.microsoft.com
US:208.111.148.137:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
97 lines Yeah : 1.3
profile none summary
tarball 31 of 33
31 of 33 776985f561
[Firefox:11 hits: 06-24 to 09-15]
8ec6129efe
[Firefox:11 hits: 06-24 to 09-15] 776985f561 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

17:49:00 WinXP 4.155.250.139 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MARYLAND, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:363 hits: 01-05 to 09-16] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

17:51:00 WinXP 207.177.29.205 (NETINS.NET):
RIVER VALLEY TELEPHONE,
GRAETTINGER, IOWA, US. (DSL) n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 34 of 36 623e0b5433
[Firefox: 3 hits: 09-14 to 09-16] none[none] none:none
none|none none none

T:18:00:00 WinXP 190.227.252.235 (-):
. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 9e4ccec7e5
[Firefox: 5 hits: 08-19 to 09-13] none[none] none:none
none|none none none

18:00:00 WinXP 190.227.252.235 (-):
. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667
HK:210.245.211.11:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 9e4ccec7e5
[Firefox: 5 hits: 08-19 to 09-13] none[none] none:none
none|none none none

T:18:06:00 WinXP 64.49.52.87 (DIXIE-NET.COM):
AYRIX TECHNOLOGIES INC,
MYRTLE, MISSISSIPPI, US. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:233 hits: 01-01 to 09-16] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

T:18:17:00 Win2K-f 98.141.162.197 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

18:19:00 WinXP 65.173.136.35 (MAYSVILLEKY.NET):
LIME STONE CABLE,
MAYSVILLE, KENTUCKY, US. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:18:19:00 WinXP 65.173.136.35 (MAYSVILLEKY.NET):
LIME STONE CABLE,
MAYSVILLE, KENTUCKY, US. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:18:34:00 WinXP 189.28.217.166 (BRASILTELECOM.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

18:54:00 WinXP 72.251.33.239 (1DIAL.COM):
AD-BASE SYSTEMS INC. (DBA GLOBALPOPS),
NEW KENSINGTON, PENNSYLVANIA, US. (DIAL) n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 d9c778eaa4
[Firefox: 2 hits: 09-15 to 09-16] none[none] none:none
none|none none none

19:03:00 WinXP 4.246.15.173 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a DE:siliconfireware.ru
US:searchportal.information.com
:wpad
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
3 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:233 hits: 01-01 to 09-16] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

T:19:07:00 Win2K-f 207.5.204.71 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.247:80
US:208.111.148.254:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

19:12:00 Win2K-f 4.173.207.124 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CENTEREACH, NEW YORK, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
93 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

19:17:00 Win2K-f 4.129.65.242 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
RESACA, GEORGIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.41:80 135 pcap raw alerts
ruleset http
78 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

19:17:00 WinXP 4.154.55.240 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WEAVERVILLE, NORTH CAROLINA, US. (DIAL) n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:19:20:00 WinXP 118.231.100.167 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

19:24:00 Win2K-f 125.58.80.11 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.41:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

19:25:00 WinXP 24.85.208.53 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
:parex-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 36 571e381ed4
[Firefox: 4 hits: 09-14 to 09-16] none[none] none:none
none|none none none

19:32:00 WinXP 122.2.248.100 (PLDT.NET):
IPG,
BAGUIO, BAGUIO, PH. 194.54.90.246:80 UA:citi-bank.ru
DE:kidos-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:19:59:00 Win2K-f 67.125.140.230 (PACBELL.NET):
AT&T INTERNET SERVICES,
FRESNO, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:69.28.178.10:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:20:07:00 WinXP 217.202.148.110 (-):
TELECOM ITALIA MOBILE,
IT. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

20:14:00 Win2K-f 70.233.230.205 (SBCGLOBAL.NET):
PPPOX POOL - BRAS2 OKCYOK 070704,
EDMOND, OKLAHOMA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.126:80
US:207.123.42.126:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset other
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:20:36:00 WinXP 12.202.140.247 (MCHSI.COM):
AT&T WORLDNET SERVICES,
LOUISVILLE, KENTUCKY, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80
US:208.111.153.215:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:20:45:00 Win2K-f 68.144.166.87 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80
US:208.111.173.16:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

20:45:00 WinXP 70.60.96.252 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CHAPIN, SOUTH CAROLINA, US. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:554 hits: 12-31 to 09-16] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

20:49:00 WinXP 68.144.166.87 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.126:80
US:207.123.46.126:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16]
e07c29c4ae
[Firefox:447 hits: 06-19 to 09-16] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

21:18:00 WinXP 222.234.234.234 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a HK:proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
99 lines Yeah : 1.3
profile none summary
tarball 31 of 33
31 of 33 b74e792974
[Firefox: 7 hits: 06-18 to 08-25]
f0e73c39a8
[Firefox: 8 hits: 06-18 to 08-25] b74e792974 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

T:21:26:00 WinXP 117.97.198.137 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 35 of 36 cdf8cd94a9
[Firefox: 4 hits: 09-14 to 09-16] none[none] none:none
none|none none none

T:21:30:00 WinXP 124.56.8.66 (-):
POWERCOM,
KR. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 34 of 36 125bd14ed4
NEW none[none] none:none
none|none none none

21:47:00 Win2K-f 67.125.140.230 (PACBELL.NET):
AT&T INTERNET SERVICES,
FRESNO, CALIFORNIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:209.84.20.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

21:49:00 Win2K-f 99.164.57.43 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16]
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

22:11:00 Win2K-f 71.112.180.17 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
KIRKLAND, WASHINGTON, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:8.12.222.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:11:00 WinXP 208.83.218.51 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 eca9a5fa95
[Firefox:11 hits: 08-09 to 09-16] none[none] none:none
none|none none none

T:22:11:00 WinXP 208.83.218.51 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 eca9a5fa95
[Firefox:11 hits: 08-09 to 09-16] none[none] none:none
none|none none none

22:22:00 Win2K-f 70.184.102.222 (COX.NET):
COX COMMUNICATIONS,
CHANDLER, ARIZONA, US. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 0 of 32
32 of 36
35 of 36 b5919931fe
[Firefox:581 hits: 06-20 to 09-16]
bea8cb1865
[Firefox:10 hits: 08-11 to 09-13]
fac78fde16
NEW b5919931fe [1]
none [none]
none [none] ASM:Graph
none:none
none:none
ASProtect|
none|none
none|none lines=90
none
none trace
none
none

T:22:32:00 Win2K-f 210.79.185.53 (MEDIATTI.NET):
MEDIATTI COMMUNICATIONS INC,
OKINAWA, OKINAWA, JP. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.42:80
US:208.111.173.46:80 135 pcap raw alerts
ruleset other
85 lines Yeah : 1.3
profile none summary
tarball 3 of 33
33 of 33 3ed16ae12d
[Firefox:20 hits: 06-19 to 09-15]
79c01ec060
[Firefox:35 hits: 06-18 to 09-15] 3ed16ae12d [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

T:22:35:00 WinXP 210.139.204.204 (SO-NET.NE.JP):
SO-NET ENTERTAINMENT CORPORATION,
NAHA, OKINAWA, JP. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1084 hits: 12-31 to 09-16] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

22:40:00 Win2K-f 76.73.239.207 (-):
. n/a HK:proxim.ircgalaxy.pl
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
5 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:22:42:00 Win2K-f 24.80.178.213 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.53:80
US:69.28.178.10:80 135 pcap raw alerts
ruleset other
95 lines Yeah : 1.3
profile none summary
tarball 31 of 32
2 of 32 607b60ad51
[Firefox:33 hits: 06-20 to 09-14]
e5c7bce70e
[Firefox:32 hits: 06-20 to 09-15] none[4]
e5c7bce70e[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:46:00 WinXP 4.158.198.167 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CHICAGO, ILLINOIS, US. (DIAL) 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 36 f11bb34095
NEW none[none] none:none
none|none none none

22:47:00 Win2K-f 61.131.149.193 (163DATA.COM.CN):
CHINANET JIANGXI PROVINCE NETWORK,
JIANGXI, JIANGXI, CN. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
131 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:22:55:00 WinXP 67.11.54.150 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 eca9a5fa95
[Firefox:11 hits: 08-09 to 09-16] none[none] none:none
none|none none none

22:59:00 WinXP 217.184.74.16 (MEDIAWAYS.NET):
VARIOUS ONLINE SERVICES,
CHEMNITZ, SACHSEN, DE. n/a 445 pcap raw alerts
ruleset http
1 line Argh : 0.3
profile none summary
tarball none none none none none none none

23:12:00 Win2K-f 72.67.130.47 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
LOS ANGELES, CALIFORNIA, US. (DSL) n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
US:208.111.173.53:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 33 of 36
35 of 36
0 of 32 5706f2fc14
NEW
68c7a1f625
NEW
b5919931fe
[Firefox:581 hits: 06-20 to 09-16] none[none]
none [none]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
none|none
ASProtect| none
none
lines=90 none
none
trace

23:34:00 WinXP 96.15.80.202 (-):
. 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 35 of 36 cdf8cd94a9
[Firefox: 4 hits: 09-14 to 09-16] none[none] none:none
none|none none none

T:23:36:00 WinXP 96.15.80.202 (-):
. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 33 of 36 4c80ee66f2
NEW none[none] none:none
none|none none none

23:51:00 WinXP 118.236.85.152 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 32 of 32 93385541f3
[Firefox:26 hits: 06-22 to 09-15] none[4] none:none
none|none none trace

T:23:53:00 Win2K-f 173.16.65.211 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80
US:208.111.153.215:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
a08f3b74a4
[Firefox:738 hits: 06-18 to 09-16] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:23:57:00 WinXP 24.44.234.137 (OPTONLINE.NET):
OPTIMUM ONLINE (CABLEVISION SYSTEMS),
NORWALK, CONNECTICUT, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80
US:208.111.153.215:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2178 hits: 06-17 to 09-16]
73f1082158
[Firefox:1092 hits: 06-18 to 09-16] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace