Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

18 September 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:15:00 WinXP 117.96.147.130 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 33 of 36 d175563b7f
NEW none[none] none:none
none|none none none

T:00:41:00 WinXP 78.34.18.121 (NETCOLOGNE.DE):
NETCOLOGNE GMBH,
KOELN, NORDRHEIN-WESTFALEN, DE. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 f353d4eed9
NEW none[none] none:none
none|none none none

T:00:46:00 Win2K-f 68.119.202.3 (CHARTER.COM):
CHARTER COMMUNICATIONS,
HICKORY, NORTH CAROLINA, US. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.42.126:80
US:207.123.46.125:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17]
b5919931fe
[Firefox:593 hits: 06-20 to 09-17] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:00:46:00 WinXP 70.73.192.157 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:207.123.46.125:80
HK:210.245.211.11:80 135 pcap raw alerts
ruleset http
257 lines Yeah : 1.3
profile none summary
tarball 33 of 36
34 of 36
0 of 33 6df1b03604
NEW
74fa06e356
NEW
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

T:01:02:00 Win2K-f 58.224.199.235 (HANANET.NET):
HANARO TELECOM INC,
KR. n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.53:80
HK:210.245.211.11:65520
US:69.28.178.10:80 135 pcap raw alerts
ruleset other
143 lines Yeah : 1.3
profile none summary
tarball 31 of 33
24 of 33 6e2eaa0359
[Firefox: 8 hits: 07-10 to 09-14]
740e3bffe0
[Firefox: 9 hits: 06-25 to 09-14] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

01:25:00 Win2K-f 75.6.231.151 (SBCGLOBAL.NET):
RBACK5.PLTNCA,
SAN JOSE, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

01:48:00 WinXP 92.96.90.113 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:125 hits: 01-08 to 09-17] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

T:02:00:00 WinXP 79.132.203.141 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

02:09:00 Win2K-f 203.153.41.34 (-):
RAILWAY BOARD NEW DELHI,
DELHI, DELHI, IN. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
122 lines Yeah : 1.3
profile none summary
tarball 32 of 36
33 of 35
0 of 32 77bf3c6d25
[Firefox: 2 hits: 08-23 to 09-15]
88fd020726
[Firefox: 2 hits: 08-23 to 09-15]
b5919931fe
[Firefox:593 hits: 06-20 to 09-17] none[none]
none [none]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
none|none
ASProtect| none
none
lines=90 none
none
trace

02:14:00 Win2K-f 65.185.123.119 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LIMA, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.42.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17]
b5919931fe
[Firefox:593 hits: 06-20 to 09-17] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:03:13:00 Win2K-f 121.73.134.78 (TELSTRACLEAR.NET):
TELECOMMUNICATIONS COMPANY,
NZ. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
350 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 7f89b38665
[Firefox:11 hits: 08-02 to 09-17]
a51a50404e
[Firefox:11 hits: 08-02 to 09-17] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

03:31:00 WinXP 24.240.103.165 (CHARTER.COM):
CHARTER COMMUNICATIONS,
DOUGLAS, GEORGIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.43:80
US:208.111.148.54:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

03:47:00 WinXP 12.208.80.133 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
VERNON HILLS, ILLINOIS, US. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:367 hits: 01-05 to 09-17] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

04:16:00 Win2K-f 208.127.8.112 (DSLEXTREME.COM):
DSL EXTREME,
LOS ANGELES, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:207.123.42.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:04:17:00 WinXP 114.121.47.97 (-):
. n/a 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

05:01:00 WinXP 86.154.237.42 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
SWANSEA, WALES, UK. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:538 hits: 01-01 to 09-17] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

05:16:00 WinXP 117.99.47.16 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:568 hits: 12-31 to 09-17] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:05:17:00 WinXP 117.99.47.16 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:568 hits: 12-31 to 09-17] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

05:23:00 Win2K-f 61.155.20.168 (-):
SUZHOU-DATONG-TECHNOLOGY-CORP,
SUZHOU, JIANGSU, CN. (100Mbps) n/a 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 0 of 33 57ce4acac2
[Firefox:183 hits: 06-17 to 09-16] 57ce4acac2 [1] ASM:Graph
Armadillo| lines=81 trace

05:43:00 Win2K-f 66.11.5.5 (CONTBB.NET):
CONTINENTAL BROADBAND,
NORFOLK, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
100 lines Yeah : 1.3
profile none summary
tarball 32 of 36
33 of 36
0 of 32 203a4cb5a4
NEW
990354b619
NEW
b5919931fe
[Firefox:593 hits: 06-20 to 09-17] none[none]
none [none]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
none|none
ASProtect| none
none
lines=90 none
none
trace

05:43:00 Win2K-f 189.48.126.225 (BRASILTELECOM.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. n/a DE:qtas.net
SE:dzuc.net
SE:84.244.6.253:2345 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 5 of 36 d7525690c2
NEW none[none] none:none
none|none none none

05:49:00 WinXP 222.184.143.175 (163DATA.COM.CN):
CHINANET JIANGSU PROVINCE NETWORK,
BEIJING, BEIJING, CN. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:568 hits: 12-31 to 09-17] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

06:13:00 WinXP 77.21.186.133 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:06:13:00 WinXP 77.21.186.133 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

06:19:00 WinXP 210.221.46.126 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. 210.245.211.11:65520 :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
DE:dl2.teenpassage.com
DE:85.114.141.207:80 135 pcap raw alerts
ruleset irc
http
117 lines Yeah : 1.8
profile none summary
tarball 30 of 33
32 of 33 0a2b1894da
[Firefox: 7 hits: 06-26 to 09-13]
414b95a784
[Firefox: 7 hits: 06-26 to 09-13] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

06:24:00 Win2K-f 4.248.238.174 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
LOUISA, VIRGINIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80
US:208.111.173.53:80 135 pcap raw alerts
ruleset other
99 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:06:33:00 WinXP 65.185.123.119 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LIMA, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17]
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:06:33:00 WinXP 216.57.114.18 (PSHIFT.NET):
POWER SHIFT COMPUTER SERVICES INC,
STOWE, VERMONT, US. n/a 445 pcap raw alerts
ruleset other
0 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:06:47:00 Win2K-f 219.250.172.79 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
115 lines Yeah : 1.3
profile none summary
tarball 29 of 32
28 of 32
0 of 32 8a75955033
[Firefox:31 hits: 06-20 to 08-27]
9276c8b36b
[Firefox:31 hits: 06-20 to 08-27]
b5919931fe
[Firefox:593 hits: 06-20 to 09-17] none[4]
9276c8b36b[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

06:49:00 WinXP 89.155.226.146 (-):
TVCABO PORTUGAL S.A,
PT. n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
GB:new.egg.com
:wpad 445 pcap raw alerts
ruleset http
http
http
http
38 lines Yeah : 0.8
profile none summary
tarball 29 of 30 af79e0c602
[Firefox: 7 hits: 01-08 to 09-16] none[4] none:none
ASPack| none trace

06:53:00 WinXP 24.85.210.190 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) 210.245.211.11:65520 HK:proxim.ircgalaxy.pl
DE:dl2.teenpassage.com
:fleshkatera.cn
:lolika.cn
:www.upononjob.cn
EU:reservjob.cn
US:windowsupdate.microsoft.com
:av-xp2008.com
US:stableclick2.com
:stat.av-xp2008.com
US:www.microsoft.com
:updatemic0.com
72.233.79.43:80
EU:77.244.220.134:80
DE:85.114.141.207:80 135 pcap raw alerts
ruleset irc
http
http
1073 lines Yeah : 1.8
profile none summary
tarball 27 of 36
33 of 36
10 of 36 2a0ee3c795
[Firefox: 5 hits: 09-13 to 09-17]
3e0c5e5ebf
NEW
d3b4e5e7df
NEW none[none]
none [none]
none [none] none:none
none:none
none:none
none|none
none|none
none|none none
none
none none
none
none

T:07:03:00 WinXP 86.96.18.93 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 32 of 33 78b29f38ed
[Firefox: 7 hits: 06-29 to 09-13] none[none] none:none
none|none none none

T:07:09:00 WinXP 118.237.117.23 (-):
. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 31 of 32 27b945de66
[Firefox:20 hits: 06-20 to 09-17] none[4] none:none
none|none none trace

07:15:00 WinXP 212.27.1.190 (-):
MLIFENET,
RU. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1098 hits: 12-31 to 09-17] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:07:17:00 WinXP 98.27.10.129 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80 135 pcap raw alerts
ruleset http
81 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17]
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:07:33:00 WinXP 81.84.162.44 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
AMADORA, LISBOA, PT. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 a84ffdf670
[Firefox: 2 hits: 09-14 to 09-16] none[none] none:none
none|none none none

T:07:38:00 WinXP 85.27.148.81 (1101232.SYDFYNSNET.DK):
IP ADRESSES FOR CONNECTED CUSTOMERS,
DK. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:568 hits: 12-31 to 09-17] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

07:43:00 WinXP 195.116.178.51 (TPNET.PL):
TPSA,
PL. 210.245.211.11:65520 HK:proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset irc
2 lines Yeah : 1.3
profile none summary
tarball 34 of 36 f8503f879a
NEW none[none] none:none
none|none none none

07:50:00 Win2K-f 58.230.192.35 (-):
THRUNET-INFRA-SEOUL03,
SEOUL, KYONGGI-DO, KR. n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80
US:208.111.153.215:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
124 lines Yeah : 1.3
profile none summary
tarball 27 of 33
31 of 33 1951eee0cd
[Firefox: 5 hits: 06-18 to 08-30]
e5e0dbde57
[Firefox: 5 hits: 06-18 to 08-30] 1951eee0cd [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

07:50:00 Win2K-f 203.91.176.23 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80
US:208.111.153.215:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:08:05:00 WinXP 117.99.17.102 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 571e381ed4
[Firefox: 7 hits: 09-14 to 09-17] none[none] none:none
none|none none none

08:17:00 Win2K-f 60.250.246.206 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a 135 pcap raw alerts
ruleset other
3 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

08:19:00 WinXP 62.255.48.30 (NTLI.NET):
NTL INTERNET,
BIRMINGHAM, ENGLAND, UK. (DIAL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 31 of 32 7e8782e8f4
[Firefox: 4 hits: 04-19 to 08-29] 486e5604b0 [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:26:00 Win2K-f 119.95.210.250 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:207.123.37.126:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset other
126 lines Yeah : 1.3
profile none summary
tarball 29 of 32
29 of 33 a4eb225807
[Firefox: 2 hits: 06-19 to 07-12]
f85f8eb994
[Firefox: 2 hits: 06-19 to 07-12] none[4]
f85f8eb994[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

T:08:33:00 WinXP 83.176.229.34 (TELE2.SE):
SWIPNET-STADSNAT,
SOLLENTUNA, STOCKHOLM, SE. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1098 hits: 12-31 to 09-17] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

08:33:00 WinXP 83.176.229.34 (TELE2.SE):
SWIPNET-STADSNAT,
SOLLENTUNA, STOCKHOLM, SE. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1098 hits: 12-31 to 09-17] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:38:00 WinXP 12.74.53.162 (ATT.NET):
AT&T WORLDNET SERVICES,
LOUISVILLE, KENTUCKY, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
192 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

08:56:00 Win2K-f 24.166.155.110 (RR.COM):
ROAD RUNNER HOLDCO LLC,
APPLETON, WISCONSIN, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:207.123.37.124:80
US:207.123.42.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

09:24:00 WinXP 4.225.148.122 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CINCINNATI, OHIO, US. (DIAL) n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:207.123.42.126:80
US:207.123.47.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset other
204 lines Yeah : 1.3
profile none summary
tarball 35 of 36
32 of 36 6528697102
NEW
667b157f26
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:09:40:00 WinXP 118.140.33.181 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
193 lines Yeah : 1.3
profile none summary
tarball 33 of 36
0 of 33
34 of 36 8d3ac9bfce
NEW
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17]
e8876f10e2
NEW none[none]
e07c29c4ae[1]
none [none] none:none
ASM:Graph
none:none
none|none
FSG|
none|none none
lines=92
none none
trace
none

09:45:00 WinXP 67.241.72.97 (-):
. n/a EU:siliconfireware.ru
US:searchportal.information.com
:www.proxy-socks.net
:wpad
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:236 hits: 01-01 to 09-17] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

10:01:00 WinXP 83.132.30.60 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
AMADORA, LISBOA, PT. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 36 of 36 e4ed963a77
NEW none[none] none:none
none|none none none

T:10:06:00 Win2K-f 98.141.161.158 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

10:12:00 WinXP 91.141.52.154 (I-ONE.AT):
NETWORK OF ONE GMBH,
VIENNA, WIEN, AT. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 97a3feb53f
NEW none[none] none:none
none|none none none

10:12:00 Win2K-f 70.233.229.132 (SBCGLOBAL.NET):
PPPOX POOL - BRAS2 OKCYOK 070704,
EDMOND, OKLAHOMA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.231:80
US:208.111.153.236:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

10:21:00 WinXP 87.205.251.68 (INETIA.PL):
NETIA,
VIENNA, WIEN, AT. (DSL) 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 b872c76081
[Firefox: 6 hits: 09-13 to 09-17] none[none] none:none
none|none none none

10:22:00 WinXP 59.104.10.247 (SEED.NET.TW):
DIGITAL UNITED I,
TAIPEI, T'AI-PEI, TW. (DSL) n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
:flanders.be.eu.undernet.org
SE:ced.dal.net
SE:broadway.ny.us.dal.net
NL:london.uk.eu.undernet.org
:lulea.se.eu.undernet.org
:washington.dc.us.undernet.org
:los-angeles.ca.us.undernet.org
SE:vancouver.dal.net
SE:coins.dal.net
US:lia.zanet.net
:gaspode.zanet.org.za
:caen.fr.eu.undernet.org
SE:ozbytes.dal.net
NL:diemen.nl.eu.undernet.org
SE:viking.dal.net
RU:194.6.222.11:6667
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 d99da8735e
NEW none[none] none:none
none|none none none

T:10:22:00 WinXP 59.104.10.247 (SEED.NET.TW):
DIGITAL UNITED I,
TAIPEI, T'AI-PEI, TW. (DSL) n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 d99da8735e
NEW none[none] none:none
none|none none none

10:36:00 WinXP 89.137.200.14 (-):
ASTRAL CONSTANTA DOCSIS NETWORK,
CONSTANTA, CONSTANTA, RO. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:101 hits: 01-03 to 09-17] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

10:54:00 WinXP 78.34.18.121 (NETCOLOGNE.DE):
NETCOLOGNE GMBH,
KOELN, NORDRHEIN-WESTFALEN, DE. n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 f353d4eed9
NEW none[none] none:none
none|none none none

T:11:09:00 WinXP 210.79.132.141 (MEDIATTI.NET):
MEDIATTI COMMUNICATIONS INC,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:538 hits: 01-01 to 09-17] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

11:49:00 WinXP 41.214.166.238 (-):
. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 c9d01112a8
[Firefox:10 hits: 08-06 to 09-17] none[none] none:none
none|none none none

T:11:53:00 WinXP 206.82.88.160 (ALLTEL.NET):
ALLTEL DIAL POOL LIVE OAK FL,
LIVE OAK, FLORIDA, US. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1098 hits: 12-31 to 09-17] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:12:06:00 WinXP 67.150.246.123 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
SAN JOSE, CALIFORNIA, US. n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

12:21:00 WinXP 82.4.208.233 (NTL.COM):
NTL INFRASTRUCTURE - BELFAST,
LUTON, ENGLAND, UK. (DSL) 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1098 hits: 12-31 to 09-17] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:12:40:00 WinXP 118.140.51.208 (-):
. n/a 135 pcap raw alerts
ruleset other
532 lines Yeah : 1.3
profile none summary
tarball 33 of 36 7df84ee3d1
NEW none[none] none:none
none|none none none

12:45:00 WinXP 67.128.191.96 (SIDLINGER.COM):
EASTEX TELEPHONE COOPERATIVE INC,
LIVINGSTON, TEXAS, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 e2cd0c3b41
NEW none[none] none:none
none|none none none

12:53:00 Win2K-f 68.184.109.17 (CHARTER.COM):
CHARTER COMMUNICATIONS,
DOUGLAS, GEORGIA, US. n/a 445 pcap raw alerts
ruleset shell
ftp
12 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:12:59:00 WinXP 98.25.121.246 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:395 hits: 12-31 to 09-17] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:13:07:00 Win2K-f 172.162.41.236 (AOL.COM):
AMERICA ONLINE,
US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:13:15:00 WinXP 201.231.109.103 (SRC.ORG):
CABLEVISION S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) n/a HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 1b7ec6ce60
[Firefox: 2 hits: 09-16 to 09-16] none[none] none:none
none|none none none

13:15:00 WinXP 201.231.109.103 (SRC.ORG):
CABLEVISION S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) 194.54.90.246:80 HK:proxim.ircgalaxy.pl
UA:citi-bank.ru
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 36 1b7ec6ce60
[Firefox: 2 hits: 09-16 to 09-16] none[none] none:none
none|none none none

13:30:00 Win2K-f 72.230.139.136 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.69:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

13:47:00 Win2K-f 24.32.95.154 (CEBRIDGE.NET):
CEBRIDGE CONNECTIONS,
CABOT, ARKANSAS, US. n/a 135 pcap raw alerts
ruleset other
10 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

13:47:00 WinXP 92.96.113.85 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:14:10:00 WinXP 121.73.137.80 (TELSTRACLEAR.NET):
TELECOMMUNICATIONS COMPANY,
NZ. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.43:80
US:208.111.148.54:80 135 pcap raw alerts
ruleset other
349 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 7f89b38665
[Firefox:11 hits: 08-02 to 09-17]
a51a50404e
[Firefox:11 hits: 08-02 to 09-17] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

14:22:00 WinXP 70.182.172.89 (COX.NET):
COX COMMUNICATIONS,
ATLANTA, GEORGIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.69:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17]
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

14:25:00 Win2K-f 172.162.41.236 (AOL.COM):
AMERICA ONLINE,
US. n/a 135 pcap raw alerts
ruleset other
5 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:14:34:00 WinXP 78.34.24.216 (NETCOLOGNE.DE):
NETCOLOGNE GMBH,
KOELN, NORDRHEIN-WESTFALEN, DE. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:568 hits: 12-31 to 09-17] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

14:35:00 WinXP 71.111.226.111 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
DURHAM, NORTH CAROLINA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:69.28.178.10:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

14:47:00 WinXP 99.224.84.91 (ROGERS.COM):
ROGERS CABLE COMMUNICATIONS INC,
TORONTO, ONTARIO, CA. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17]
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

14:59:00 WinXP 87.61.241.210 (ADSL-DHCP.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 c05385e600
[Firefox:13 hits: 01-20 to 09-15] 6a383b021d [0] ASM:Graph
PolyEnE| lines=68 trace

T:14:59:00 WinXP 87.61.241.210 (ADSL-DHCP.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 c05385e600
[Firefox:13 hits: 01-20 to 09-15] 6a383b021d [0] ASM:Graph
PolyEnE| lines=68 trace

T:14:59:00 WinXP 212.205.245.127 (OTENET.GR):
MULTIPROTOCOL SERVICE PROVIDER TO OTHER ISP'S AND END USERS,
ATHENS, ATTIKI, GR. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 0.8
profile none summary
tarball 32 of 32 03f912899b
[Firefox:125 hits: 01-08 to 09-17] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

15:00:00 Win2K-f 24.77.71.211 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
MAPLE RIDGE, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.46:80 135 pcap raw alerts
ruleset other
95 lines Yeah : 1.3
profile none summary
tarball 31 of 32
2 of 32 607b60ad51
[Firefox:34 hits: 06-20 to 09-17]
e5c7bce70e
[Firefox:33 hits: 06-20 to 09-17] none[4]
e5c7bce70e[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:15:04:00 WinXP 81.41.64.59 (RIMA-TDE.NET):
TELEFONICA DE ESPANA SAU,
ES. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 83959d63ea
NEW none[none] none:none
none|none none none

15:33:00 Win2K-f 24.44.234.137 (OPTONLINE.NET):
OPTIMUM ONLINE (CABLEVISION SYSTEMS),
NORWALK, CONNECTICUT, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.46:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:15:33:00 WinXP 75.16.240.249 (SBCGLOBAL.NET):
PPPOX POOL - RBACK3.KNTPIN,
EVANSVILLE, INDIANA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.42:80
US:208.111.173.46:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

15:42:00 Win2K-f 116.120.240.150 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
HK:proxim.ircgalaxy.pl
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
95 lines Yeah : 1.3
profile none summary
tarball 30 of 33
2 of 35 6ec2a8994b
[Firefox:22 hits: 06-18 to 09-17]
bcf66a38c8
[Firefox: 9 hits: 07-30 to 09-17] none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

15:50:00 WinXP 24.234.205.187 (COX.NET):
COX COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:16:00:00 WinXP 76.176.158.41 (RR.COM):
ROAD RUNNER HOLDCO LLC,
SAN DIEGO, CALIFORNIA, US. n/a DE:siliconfireware.ru
US:searchportal.information.com
DE:ebookfinaltrash.ru
:wpad
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
http
4 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:522 hits: 01-01 to 09-17] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

16:06:00 WinXP 216.10.170.160 (WISPNET.NET):
WISPNET LLC,
WILSON, NORTH CAROLINA, US. n/a DE:siliconfireware.ru
US:searchportal.information.com
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:236 hits: 01-01 to 09-17] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

T:16:13:00 WinXP 75.176.38.167 (RR.COM):
ROAD RUNNER HOLDCO LLC,
GASTONIA, NORTH CAROLINA, US. n/a EU:siliconfireware.ru
US:searchportal.information.com
:wpad
:www.proxy-socks.net
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
3 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:236 hits: 01-01 to 09-17] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

16:19:00 WinXP 96.14.197.14 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1098 hits: 12-31 to 09-17] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

16:46:00 Win2K-f 24.84.6.184 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:204.160.104.126:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 31 of 36
33 of 36 9b891c1007
NEW
c64bd50d88
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

17:01:00 WinXP 4.138.45.9 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NASHVILLE, TENNESSEE, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
2 lines Argh : 0.3
profile none summary
tarball none none none none none none none

17:03:00 WinXP 98.25.121.246 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:395 hits: 12-31 to 09-17] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:17:12:00 WinXP 4.233.194.201 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NEW HAMPSHIRE, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 0.8
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:395 hits: 12-31 to 09-17] 048df78048 [0] ASM:Graph
none|none lines=61 trace

17:52:00 Win2K-f 60.249.77.193 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a 135 pcap raw alerts
ruleset other
100 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
57ce4acac2
[Firefox:183 hits: 06-17 to 09-16] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

17:57:00 Win2K-f 99.250.225.107 (STERLINGSTUDENTS.NET):
ROGERS CABLE COMMUNICATIONS INC,
CA. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17]
b5919931fe
[Firefox:593 hits: 06-20 to 09-17] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

17:59:00 WinXP 207.5.188.172 (GWI.NET):
GREAT WORKS INTERNET,
SHAPLEIGH, MAINE, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
109 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:18:07:00 Win2K-f 4.138.45.9 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NASHVILLE, TENNESSEE, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
115 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
8 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
b5919931fe
[Firefox:593 hits: 06-20 to 09-17]
b7082104e4
[Firefox:135 hits: 06-18 to 09-17] none[4]
b5919931fe[1]
none [4] none:none
ASM:Graph
none:none
tElock|
ASProtect|
tElock| none
lines=90
none trace
trace
trace

18:15:00 Win2K-f 68.144.23.89 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
124 lines Yeah : 1.3
profile none summary
tarball 35 of 36
32 of 36 2204fd4d17
[Firefox: 3 hits: 09-15 to 09-16]
eb0857e1b1
[Firefox: 3 hits: 09-15 to 09-16] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:18:19:00 WinXP 4.153.89.155 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BIRMINGHAM, ALABAMA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

18:33:00 Win2K-f 122.53.14.230 (PLDT.NET):
IPG,
PH. n/a 135 pcap raw alerts
ruleset other
372 lines Yeah : 1.3
profile none summary
tarball 33 of 36 97eb912b2a
NEW none[none] none:none
none|none none none

T:18:34:00 Win2K-f 70.71.101.112 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 72.10.172.218:8492 CA:jiets.soidudrf.com 135 pcap raw alerts
ruleset irc
http
252 lines Yeah : 1.8
profile none summary
tarball 19 of 36
31 of 33 03d5bf43b7
NEW
b9cdf4ca69
[Firefox: 5 hits: 06-18 to 09-16] none[none]
none [4] none:none
none:none
none|none
none|none none
none none
trace

T:18:34:00 WinXP 67.10.81.170 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HOUSTON, TEXAS, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.124:80
US:4.23.60.126:80 135 pcap raw alerts
ruleset http
80 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:18:52:00 Win2K-f 218.211.222.69 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
KAOHSIUNG, KAO-HSIUNG, TW. n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.126:80
US:207.123.42.126:80
US:4.23.60.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:18:56:00 WinXP 4.246.12.3 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SAN JOSE, CALIFORNIA, US. (DIAL) n/a DE:siliconfireware.ru
US:searchportal.information.com
:wpad
GB:new.egg.com
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
3 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:236 hits: 01-01 to 09-17] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

T:18:59:00 WinXP 4.190.167.93 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
[Firefox:76 hits: 01-14 to 09-17] 8a00217866 [0] ASM:Graph
PolyEnE| lines=57 trace

T:19:05:00 WinXP 41.214.168.99 (-):
. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 34 of 36 623e0b5433
[Firefox: 4 hits: 09-14 to 09-17] none[none] none:none
none|none none none

19:09:00 WinXP 4.246.12.3 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SAN JOSE, CALIFORNIA, US. (DIAL) n/a DE:siliconfireware.ru
:wpad
US:searchportal.information.com
US:208.73.210.32:80
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:236 hits: 01-01 to 09-17] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

T:19:35:00 WinXP 190.128.49.150 (-):
EMPRESA DE TELECOMUNICACIONES DE PEREIRA S.A. E.S.P,
MANIZALES, CALDAS, CO. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 cdc0471930
NEW none[none] none:none
none|none none none

19:37:00 Win2K-f 70.72.216.148 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
10 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:20:03:00 Win2K-f 24.83.206.78 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
6 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

20:18:00 Win2K-f 172.136.21.8 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.126:80 135 pcap raw alerts
ruleset http
150 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17]
b5919931fe
[Firefox:593 hits: 06-20 to 09-17] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:20:20:00 WinXP 200.234.3.123 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1098 hits: 12-31 to 09-17] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

20:22:00 WinXP 124.100.99.147 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:367 hits: 01-05 to 09-17] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

20:34:00 WinXP 71.125.110.254 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
FRANKLIN, NORTH CAROLINA, US. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:538 hits: 01-01 to 09-17] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

20:34:00 Win2K-f 218.211.207.80 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:20:40:00 WinXP 24.79.84.14 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
134 lines Yeah : 1.3
profile none summary
tarball 34 of 36
32 of 36
0 of 33 57c095a73a
NEW
71feff97fb
NEW
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

20:51:00 WinXP 68.203.250.240 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LAREDO, TEXAS, US. (100Mbps) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:568 hits: 12-31 to 09-17] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

20:53:00 WinXP 209.74.8.87 (EPIX.NET):
FRONTIER COMMUNICATIONS OF AMERICA INC,
MOUNTAIN TOP, PENNSYLVANIA, US. (DIAL) n/a HK:proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:205.128.73.126:80
HK:210.245.211.11:65520 135 pcap raw alerts
ruleset http
125 lines Yeah : 1.3
profile none summary
tarball 28 of 33
31 of 33
0 of 33 ba4637f8f0
[Firefox:10 hits: 07-01 to 09-16]
d02ae67164
[Firefox:10 hits: 07-01 to 09-16]
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

T:20:54:00 WinXP 68.118.66.45 (CHARTER.COM):
CHARTER COMMUNICATIONS,
BROOKINGS, OREGON, US. n/a HK:proxim.ircgalaxy.pl
RU:moscow-advokat.ru
EU:gaz-prom.ru
:flanders.be.eu.undernet.org
AT:graz.at.eu.undernet.org
:washington.dc.us.undernet.org
:brussels.be.eu.undernet.org
NL:london.uk.eu.undernet.org
:gaspode.zanet.org.za
:caen.fr.eu.undernet.org
US:lia.zanet.net
RU:194.6.222.11:6667
HK:210.245.211.11:65520 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball 34 of 36 0a752bfb2a
NEW none[none] none:none
none|none none none

21:29:00 Win2K-f 24.79.190.144 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
115 lines Yeah : 1.3
profile none summary
tarball 0 of 32
33 of 36
31 of 36 b5919931fe
[Firefox:593 hits: 06-20 to 09-17]
baa3b7672d
NEW
c6db9a9ecd
NEW b5919931fe [1]
none [none]
none [none] ASM:Graph
none:none
none:none
ASProtect|
none|none
none|none lines=90
none
none trace
none
none

21:36:00 WinXP 173.16.65.211 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.41:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17]
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

21:42:00 Win2K-f 70.247.224.169 (SWBELL.NET):
JORGE RICHARDO GARCIA ,
DALLAS, TEXAS, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.47:80
US:208.111.173.52:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:21:44:00 WinXP 12.219.198.173 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
EXCELSIOR SPRINGS, MISSOURI, US. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:4.23.60.125:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17]
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

21:51:00 Win2K-f 208.105.186.90 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:204.160.104.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17]
b5919931fe
[Firefox:593 hits: 06-20 to 09-17] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:21:55:00 Win2K-f 121.125.21.145 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
:proxima.ircgalaxy.pl
US:download.microsoft.com
US:192.221.99.124:80
US:204.160.104.126:80
HK:210.245.211.11:65520
US:4.23.60.126:80 135 pcap raw alerts
ruleset other
86 lines Yeah : 1.3
profile none summary
tarball 31 of 33
0 of 33 168aab35a3
[Firefox:130 hits: 06-17 to 09-17]
4c3df24b32
[Firefox:185 hits: 06-17 to 09-16] none[4]
4c3df24b32[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:17:00 WinXP 70.71.40.48 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BURNABY, BRITISH COLUMBIA, CA. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.126:80 135 pcap raw alerts
ruleset http
92 lines Yeah : 1.3
profile none summary
tarball 35 of 36
3 of 33
0 of 33 126a1d4446
[Firefox: 2 hits: 08-19 to 08-23]
3ed16ae12d
[Firefox:21 hits: 06-19 to 09-17]
e07c29c4ae
[Firefox:455 hits: 06-19 to 09-17] none[none]
3ed16ae12d[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
none|none
Armadillo|
FSG| none
lines=81
lines=92 none
trace
trace

22:24:00 Win2K-f 24.234.205.170 (COX.NET):
COX COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. n/a US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80
US:204.160.104.126:80
US:204.160.126.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
a08f3b74a4
[Firefox:761 hits: 06-18 to 09-17] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:32:00 WinXP 76.187.185.41 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (100Mbps) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:395 hits: 12-31 to 09-17] 048df78048 [0] ASM:Graph
none|none lines=61 trace

22:32:00 WinXP 67.150.127.232 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
LOS ANGELES, CALIFORNIA, US. n/a EU:siliconfireware.ru
US:searchportal.information.com
RU:www.bbin.ru
RU:www.binbank.ru
:wpad
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
22 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:522 hits: 01-01 to 09-17] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

T:22:32:00 Win2K-f 99.170.21.97 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.126:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:22:45:00 WinXP 4.164.123.155 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
AURORA, COLORADO, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
4 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

22:49:00 Win2K-f 4.228.162.145 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
OMAHA, NEBRASKA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:22:55:00 WinXP 211.26.48.28 (IPRIMUS.NET.AU):
PRIMUS TELECOMMUNICATIONS,
ADELAIDE, SOUTH AUSTRALIA, AU. n/a US:microsoft.com
US:download.microsoft.com
US:209.84.20.126:80
US:4.23.60.126:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset other
74 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
57ce4acac2
[Firefox:183 hits: 06-17 to 09-16] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:59:00 WinXP 211.26.48.28 (IPRIMUS.NET.AU):
PRIMUS TELECOMMUNICATIONS,
ADELAIDE, SOUTH AUSTRALIA, AU. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
88 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
57ce4acac2
[Firefox:183 hits: 06-17 to 09-16] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

23:02:00 WinXP 216.144.16.43 (NLS.NET):
NETLINK SERVICES INC,
COLUMBUS, OHIO, US. n/a :www.proxy-socks.net
:wpad
DE:siliconfireware.ru
US:searchportal.information.com
RU:www.bbin.ru
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:522 hits: 01-01 to 09-17] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

23:07:00 WinXP 219.110.164.202 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:367 hits: 01-05 to 09-17] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

23:23:00 WinXP 63.162.17.161 (COMMUNICOMM.COM):
JAMES CABLE,
TOLEDO, OHIO, US. n/a RU:moscow-advokat.ru
:lulea.se.eu.undernet.org
:gaspode.zanet.org.za
SE:broadway.ny.us.dal.net
:brussels.be.eu.undernet.org
US:lia.zanet.net
:caen.fr.eu.undernet.org
:flanders.be.eu.undernet.org
:washington.dc.us.undernet.org
SE:qis.md.us.dal.net 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:568 hits: 12-31 to 09-17] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:23:26:00 Win2K-f 122.53.228.235 (PLDT.NET):
IPG,
PH. n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

23:36:00 WinXP 67.150.122.197 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
LOS ANGELES, CALIFORNIA, US. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:23:39:00 Win2K-f 4.164.183.146 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
OMAHA, NEBRASKA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.215:80 135 pcap raw alerts
ruleset http
89 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2220 hits: 06-17 to 09-17]
73f1082158
[Firefox:1108 hits: 06-18 to 09-17]
b5919931fe
[Firefox:593 hits: 06-20 to 09-17] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

23:46:00 WinXP 173.16.3.43 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1098 hits: 12-31 to 09-17] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

23:51:00 Win2K-f 63.246.122.90 (SPEAKEASY.NET):
US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:23:55:00 WinXP 24.80.200.27 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
NORTH VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 6b1c6d0395
NEW none[none] none:none
none|none none none

23:59:00 WinXP 79.163.213.142 (-):
IDEA,
PL. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 35 dbbc586732
[Firefox:32 hits: 07-28 to 09-15] none[none] none:none
none|none none none