Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

22 September 2008
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
00:19:00 WinXP 70.182.91.221 (COX.NET):
COX COMMUNICATIONS,
OKLAHOMA CITY, OKLAHOMA, US. 		n/a US:microsoft.com
US:download.microsoft.com
:proxim.ircgalaxy.pl
US:208.111.153.236:80
US:208.111.173.16:80 		135 pcap raw alerts
ruleset 		other
95 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
32 of 36		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
bea8cb1865
[Firefox:13 hits: 08-11 to 09-21] 		none[4]
none [none] 		none:none
none:none
 tElock|
none|none 		none
none 		trace
none
T:00:19:00 WinXP 87.205.48.164 (INETIA.PL):
INTERNETIA,
PL. (DSL) 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 26e3526604
[Firefox: 2 hits: 09-16 to 09-20] 		none[none] none:none
 none|none none none
T:00:30:00 Win2K-f 24.234.205.56 (COX.NET):
COX COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.215:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:00:59:00 Win2K-f 70.63.133.180 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ORLANDO, FLORIDA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:192.221.99.126:80
US:8.12.222.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:01:30:00 WinXP 76.175.118.71 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CHINO HILLS, CALIFORNIA, US. 		n/a   445 pcap raw alerts
ruleset 		shell
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
01:39:00 Win2K-f 4.162.234.5 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:01:56:00 WinXP 61.222.2.212 (HINET.NET):
DATA COMMUNICATION BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.124:80
US:207.123.42.126:80
US:207.123.46.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
57ce4acac2
[Firefox:195 hits: 06-17 to 09-21] 		none[4]
57ce4acac2[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
02:04:00 WinXP 196.2.12.39 (-):
AFRINIC,
BI. 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:02:17:00 Win2K-f 203.97.99.40 (TELSTRACLEAR.NET):
TELSTRACLEAR WELLINGTON CABLE CUSTOMERS,
WELLINGTON, WELLINGTON, NZ. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80
US:199.93.44.124:80
US:205.128.73.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:02:26:00 WinXP 220.97.173.187 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
YOKOHAMA, KANAGAWA, JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:549 hits: 01-01 to 09-21] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
T:02:27:00 Win2K-f 208.105.186.90 (-):
. 		n/a   135 pcap raw alerts
ruleset 		other
11 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:02:28:00 WinXP 59.101.169.236 (CONNECT.NET.AU):
AAPT LIMITED,
RICHMOND, QUEENSLAND, AU. 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
:caen.fr.eu.undernet.org
SE:viking.dal.net
:brussels.be.eu.undernet.org
SE:coins.dal.net
:los-angeles.ca.us.undernet.org
SE:ced.dal.net
NL:diemen.nl.eu.undernet.org
US:lia.zanet.net
SE:broadway.ny.us.dal.net
SE:qis.md.us.dal.net
SE:vancouver.dal.net
:gaspode.zanet.org.za
:flanders.be.eu.undernet.org 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 f04fb66461
[Firefox: 2 hits: 09-12 to 09-12] 		none[none] none:none
 none|none none none
02:34:00 Win2K-f 144.134.27.175 (TMNS.NET.AU):
TELSTRAINTERNET27,
GOLD COAST, QUEENSLAND, AU. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
US:198.78.201.126:80
US:207.123.42.126:80 		135 pcap raw alerts
ruleset 		other
59 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
8 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
b7082104e4
[Firefox:141 hits: 06-18 to 09-21] 		none[4]
none [4] 		none:none
none:none
 tElock|
tElock| 		none
none 		trace
trace
02:40:00 WinXP 81.9.144.96 (CM-81-9-141-10.TELECABLE.ES):
TELECABLE,
GIJON, ASTURIAS, ES. (DSL) 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
3 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 d42c1cc7c0
[Firefox:131 hits: 01-01 to 09-21] 		af9ca5bed1 [0] ASM:Graph
 PolyEnE| lines=54 trace
T:02:41:00 WinXP 81.9.144.96 (CM-81-9-141-10.TELECABLE.ES):
TELECABLE,
GIJON, ASTURIAS, ES. (DSL) 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 d42c1cc7c0
[Firefox:131 hits: 01-01 to 09-21] 		af9ca5bed1 [0] ASM:Graph
 PolyEnE| lines=54 trace
02:52:00 WinXP 80.199.42.63 (ADSL-FIXED.TELE.DK):
TDC-INTERNET-STATIC-ASSIGNED-IP,
COPENHAGEN, COPENHAGEN, DK. (DSL) 		n/a DE:siliconfireware.ru
US:searchportal.information.com
:wpad
DE:ebookfinaltrash.ru
US:208.73.210.32:80
DE:212.227.111.29:80 		445 pcap raw alerts
ruleset 		http
http
http
3 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 df17a625ee
[Firefox:244 hits: 01-01 to 09-21] 		9bbdd086c5 [0] ASM:Graph
 ASPack| lines=186
embedded dns 		trace
T:03:00:00 WinXP 86.155.14.149 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
SWANSEA, WALES, UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:549 hits: 01-01 to 09-21] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
03:03:00 WinXP 78.34.15.130 (NETCOLOGNE.DE):
NETCOLOGNE GMBH,
KOELN, NORDRHEIN-WESTFALEN, DE. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 f353d4eed9
[Firefox: 6 hits: 09-17 to 09-20] 		none[none] none:none
 none|none none none
03:37:00 WinXP 64.141.65.231 (MERCURYSPEED.COM):
BIG PIPE INC,
KAMLOOPS, BRITISH COLUMBIA, CA. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80
US:208.111.153.215:80 		135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
04:25:00 WinXP 85.85.121.140 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 92010e1c85
NEW 		none[none] none:none
 none|none none none
T:04:25:00 WinXP 85.85.121.140 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 92010e1c85
NEW 		none[none] none:none
 none|none none none
T:04:59:00 WinXP 84.140.192.237 (T-IPCONNECT.DE):
DEUTSCHE TELEKOM AG,
HAMBURG, HAMBURG, DE. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 32 03f912899b
[Firefox:134 hits: 01-08 to 09-21] 		83893bd25d [0] ASM:Graph
 none|none lines=65 trace
T:05:04:00 WinXP 220.176.182.31 (163DATA.COM.CN):
CHINANET JIANGXI PROVINCE NETWORK,
BEIJING, BEIJING, CN. 		n/a   445 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:407 hits: 12-31 to 09-21] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
T:05:28:00 WinXP 92.114.220.187 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none 00835ad53f
NEW 		none[none] none:none
 none|none none none
05:31:00 Win2K-f 116.126.249.246 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:207.123.46.125:80
US:8.12.202.125:80 		135 pcap raw alerts
ruleset 		http
95 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33
0 of 32
2 of 35		 6ec2a8994b
[Firefox:23 hits: 06-18 to 09-18]
b5919931fe
[Firefox:628 hits: 06-20 to 09-21]
bcf66a38c8
[Firefox:10 hits: 07-30 to 09-18] 		none[4]
b5919931fe[1]
none [none] 		none:none
ASM:Graph
none:none
 tElock|
ASProtect|
none|none 		none
lines=90
none 		trace
trace
none
T:05:34:00 WinXP 41.234.195.13 (TEDATA.NET):
PROVIDER LOCAL REGISTRY,
EG. 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 d6158c8ce9
NEW 		none[none] none:none
 none|none none none
05:34:00 WinXP 41.234.195.13 (TEDATA.NET):
PROVIDER LOCAL REGISTRY,
EG. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 d6158c8ce9
NEW 		none[none] none:none
 none|none none none
05:41:00 WinXP 91.126.53.99 (RP80.SE):
WEBTECH NORD HELSINGBORG,
HELSINGBORG, SKANE, SE. 		n/a RU:moscow-advokat.ru
SE:viking.dal.net
SE:ozbytes.dal.net 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 a9cfbd1b0c
[Firefox: 7 hits: 09-12 to 09-21] 		none[none] none:none
 none|none none none
T:05:41:00 WinXP 91.126.53.99 (RP80.SE):
WEBTECH NORD HELSINGBORG,
HELSINGBORG, SKANE, SE. 		n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 a9cfbd1b0c
[Firefox: 7 hits: 09-12 to 09-21] 		none[none] none:none
 none|none none none
05:47:00 Win2K-f 93.81.9.10 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		0 of 32 b5919931fe
[Firefox:628 hits: 06-20 to 09-21] 		b5919931fe [1] ASM:Graph
 ASProtect| lines=90 trace
05:50:00 WinXP 124.241.177.91 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.16:80
US:208.111.173.41:80 		135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
06:03:00 Win2K-f 68.184.98.46 (CHARTER.COM):
CHARTER COMMUNICATIONS,
DOUGLAS, GEORGIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80
US:208.111.148.115:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:06:04:00 Win2K-f 211.244.75.155 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
:proxima.ircgalaxy.pl
US:download.microsoft.com
US:208.111.148.108:80
US:208.111.148.115:80 		135 pcap raw alerts
ruleset 		other
97 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
30 of 32		 1509c8d024
[Firefox:28 hits: 06-17 to 09-21]
f23b040440
[Firefox:18 hits: 06-22 to 09-21] 		none[4]
f23b040440[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=82 		trace
trace
06:13:00 WinXP 219.241.190.25 (HANANET.NET):
HANARO TELECOM INC,
BUCHEON CITY, SOUL-T'UKPYOLSI, KR. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.16:80
US:208.111.173.41:80 		135 pcap raw alerts
ruleset 		other
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
none		 4f64b12bec
NEW
ebc7258ea1
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
06:19:00 WinXP 65.24.122.170 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COLUMBUS, OHIO, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.16:80
US:208.111.173.41:80 		135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
06:36:00 Win2K-f 222.237.133.203 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:199.93.41.126:80
US:199.93.53.125:80
US:8.12.222.126:80 		135 pcap raw alerts
ruleset 		other
97 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
30 of 32		 1509c8d024
[Firefox:28 hits: 06-17 to 09-21]
f23b040440
[Firefox:18 hits: 06-22 to 09-21] 		none[4]
f23b040440[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=82 		trace
trace
06:39:00 WinXP 220.219.253.241 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:388 hits: 01-05 to 09-21] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:06:42:00 WinXP 91.141.34.83 (I-ONE.AT):
NETWORK OF ONE GMBH,
VIENNA, WIEN, AT. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none 586c70f63b
NEW 		none[none] none:none
 none|none none none
06:46:00 WinXP 78.34.30.131 (NETCOLOGNE.DE):
NETCOLOGNE GMBH,
KOELN, NORDRHEIN-WESTFALEN, DE. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 f353d4eed9
[Firefox: 6 hits: 09-17 to 09-20] 		none[none] none:none
 none|none none none
06:49:00 WinXP 119.228.11.223 (-):
. 		n/a :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		none e97aedd0ab
NEW 		none[none] none:none
 none|none none none
T:07:11:00 WinXP 96.10.249.88 (-):
. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none 0f99623be1
NEW 		none[none] none:none
 none|none none none
T:07:11:00 WinXP 78.34.20.246 (NETCOLOGNE.DE):
NETCOLOGNE GMBH,
KOELN, NORDRHEIN-WESTFALEN, DE. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 f353d4eed9
[Firefox: 6 hits: 09-17 to 09-20] 		none[none] none:none
 none|none none none
T:07:12:00 Win2K-f 70.71.251.80 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) 		72.10.172.218:9283 CA:abc.ihshsd8.com
US:130.107.169.29:27966 		135 pcap raw alerts
ruleset 		irc
244 lines 		Yeah : 1.8
profile 		none summary
tarball 		31 of 33 b9cdf4ca69
[Firefox: 7 hits: 06-18 to 09-19] 		none[4] none:none
 none|none none trace
T:07:13:00 WinXP 117.99.16.252 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. 		n/a UA:citi-bank.ru
:parex-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1135 hits: 12-31 to 09-21] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
07:22:00 WinXP 87.205.54.158 (INETIA.PL):
INTERNETIA,
PL. (DSL) 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 26e3526604
[Firefox: 2 hits: 09-16 to 09-20] 		none[none] none:none
 none|none none none
T:07:25:00 WinXP 87.205.54.158 (INETIA.PL):
INTERNETIA,
PL. (DSL) 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
:washington.dc.us.undernet.org
SE:coins.dal.net
:flanders.be.eu.undernet.org
AT:graz.at.eu.undernet.org
SE:vancouver.dal.net
:lulea.se.eu.undernet.org
NL:london.uk.eu.undernet.org
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36 26e3526604
[Firefox: 2 hits: 09-16 to 09-20] 		none[none] none:none
 none|none none none
T:07:37:00 WinXP 151.80.14.166 (38-151.NET24.IT):
IUNET-BNET,
IT. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a0139d7ad8
[Firefox:107 hits: 01-03 to 09-21] 		d9e9662db1 [0] ASM:Graph
 PolyEnE| lines=68 trace
07:43:00 WinXP 130.13.43.83 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a   445 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:407 hits: 12-31 to 09-21] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
T:07:43:00 WinXP 85.138.72.99 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
LISBON, LISBOA, PT. 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 22999be88c
[Firefox:20 hits: 04-05 to 09-21] 		eda2056971 [0] ASM:Graph
 PolyEnE| lines=154
embedded dns 		trace
07:49:00 WinXP 72.0.250.12 (SPEAKEASY.NET):
US. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 cdf8cd94a9
[Firefox: 9 hits: 09-14 to 09-20] 		none[none] none:none
 none|none none none
08:06:00 WinXP 117.99.58.22 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. 		n/a RU:moscow-advokat.ru
SE:qis.md.us.dal.net
US:lia.zanet.net
NL:london.uk.eu.undernet.org
:brussels.be.eu.undernet.org
:flanders.be.eu.undernet.org
SE:ozbytes.dal.net
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:602 hits: 12-31 to 09-21] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:08:36:00 WinXP 219.91.91.41 (APOL.COM.TW):
ASIA PACIFIC ON-LINE SERVICES INC,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1135 hits: 12-31 to 09-21] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
08:47:00 WinXP 210.79.133.45 (MEDIATTI.NET):
MEDIATTI COMMUNICATIONS INC,
TOKYO, TOKYO, JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:549 hits: 01-01 to 09-21] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
09:23:00 WinXP 216.57.114.105 (PSHIFT.NET):
POWER SHIFT COMPUTER SERVICES INC,
STOWE, VERMONT, US. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:602 hits: 12-31 to 09-21] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:09:24:00 WinXP 216.57.114.105 (PSHIFT.NET):
POWER SHIFT COMPUTER SERVICES INC,
STOWE, VERMONT, US. 		n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:602 hits: 12-31 to 09-21] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
09:30:00 WinXP 64.183.209.202 (RR.COM):
ROAD RUNNER HOLDCO LLC,
DALLAS, TEXAS, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:209.84.20.126:80
US:4.23.60.126:80 		135 pcap raw alerts
ruleset 		http
60 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
8 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
b7082104e4
[Firefox:141 hits: 06-18 to 09-21]
e07c29c4ae
[Firefox:483 hits: 06-19 to 09-21] 		none[4]
none [4]
e07c29c4ae[1] 		none:none
none:none
ASM:Graph
 tElock|
tElock|
FSG| 		none
none
lines=92 		trace
trace
trace
T:09:41:00 Win2K-f 76.227.0.133 (SBCGLOBAL.NET):
PPPOX POOL - BRAS16.LSAN,
LOS ANGELES, CALIFORNIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
78 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:09:46:00 WinXP 86.96.54.153 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. 		n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:602 hits: 12-31 to 09-21] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:09:48:00 Win2K-f 4.228.186.57 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
DURANGO, COLORADO, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80
US:208.111.173.16:80 		135 pcap raw alerts
ruleset 		other
136 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:09:53:00 WinXP 82.244.243.161 (PROXAD.NET):
PROXAD / FREE SAS,
NICE, PROVENCE-ALPES-COTE D'AZUR, FR. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		none bd0c947bd4
NEW 		none[none] none:none
 none|none none none
T:10:07:00 WinXP 125.225.8.12 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 d28bf8aa1a
[Firefox: 6 hits: 09-12 to 09-13] 		none[none] none:none
 none|none none none
10:18:00 WinXP 78.82.210.242 (TELENOR.SE):
TELENOR BUSINESS SOLUTION AB,
SE. 		n/a :www.google.com.au
US:www.yahoo.com
:jbeegvia.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 17028f1eda
[Firefox:34 hits: 04-18 to 09-20] 		none[3] none:none
 tElock| none trace
T:10:24:00 Win2K-f 99.224.126.113 (ROGERS.COM):
ROGERS CABLE COMMUNICATIONS INC,
TORONTO, ONTARIO, CA. 		n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:8.12.202.125:80
US:8.12.222.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:10:27:00 WinXP 70.68.178.46 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COQUITLAM, BRITISH COLUMBIA, CA. (DSL) 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:8.12.202.125:80
US:8.12.222.126:80 		135 pcap raw alerts
ruleset 		other
127 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
none		 e90f8b883b
NEW
f0e937602b
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
10:40:00 Win2K-f 98.134.190.6 (-):
. 		n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:192.221.108.126:80
US:192.221.99.126:80
US:207.123.37.126:80 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		28 of 33
31 of 33		 6d86a1ff5a
[Firefox:36 hits: 06-25 to 09-20]
7f6e032fc0
[Firefox:36 hits: 06-25 to 09-20] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
10:41:00 WinXP 207.5.224.248 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:192.221.99.126:80
US:207.123.37.126:80 		135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
10:47:00 WinXP 89.24.28.66 (4GINTERNET.CZ):
GPRS/WBA CUSTOMER NETWORKS,
PRAGUE, HLAVNI MESTO PRAHA, CZ. 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
:flanders.be.eu.undernet.org
:los-angeles.ca.us.undernet.org
SE:ced.dal.net
US:lia.zanet.net
:lulea.se.eu.undernet.org
:caen.fr.eu.undernet.org
SE:qis.md.us.dal.net
SE:broadway.ny.us.dal.net
SE:coins.dal.net 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		33 of 36 c3bc53e727
[Firefox: 2 hits: 09-14 to 09-15] 		none[none] none:none
 none|none none none
T:11:06:00 Win2K-f 68.184.98.46 (CHARTER.COM):
CHARTER COMMUNICATIONS,
DOUGLAS, GEORGIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.226:80
US:208.111.148.247:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:11:18:00 WinXP 70.246.102.240 (SWBELL.NET):
PPPOX POOL - BRAS14 RCSNTX,
DALLAS, TEXAS, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80
US:204.160.104.126:80
US:204.160.126.126:80 		135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:11:20:00 WinXP 213.22.210.233 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
LISBON, LISBOA, PT. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 f353d4eed9
[Firefox: 6 hits: 09-17 to 09-20] 		none[none] none:none
 none|none none none
T:11:21:00 Win2K-f 24.84.232.228 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
KAMLOOPS, BRITISH COLUMBIA, CA. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:11:31:00 WinXP 83.141.156.217 (EVC.NET):
DHCP POOL EVC,
BASEL, BASEL-STADT, CH. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 b872c76081
[Firefox:14 hits: 09-13 to 09-21] 		none[none] none:none
 none|none none none
11:48:00 WinXP 70.169.52.32 (COX.NET):
COX COMMUNICATIONS,
TULSA, OKLAHOMA, US. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.247:80
US:208.111.148.254:80 		135 pcap raw alerts
ruleset 		other
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36
28 of 33		 da00a8e7a1
[Firefox:17 hits: 08-05 to 09-21]
f685f8e027
[Firefox:21 hits: 06-18 to 09-21] 		none[none]
f685f8e027[1] 		none:none
ASM:Graph
 none|none
Armadillo| 		none
lines=82 		none
trace
T:12:33:00 WinXP 87.168.188.63 (T-DIALIN.NET):
DEUTSCHE TELEKOM AG,
DE. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
12:34:00 WinXP 217.201.69.123 (-):
TELECOM ITALIA MOBILE,
IT. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 371da6aedc
NEW 		none[none] none:none
 none|none none none
T:12:34:00 WinXP 217.201.69.123 (-):
TELECOM ITALIA MOBILE,
IT. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 371da6aedc
NEW 		none[none] none:none
 none|none none none
12:39:00 WinXP 79.130.91.58 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:407 hits: 12-31 to 09-21] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
T:12:39:00 WinXP 117.97.85.152 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1fcc146d70
[Firefox:46 hits: 01-02 to 09-21] 		258fafe892 [0] ASM:Graph
 PolyEnE| lines=68 trace
12:58:00 WinXP 204.193.210.148 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
DENVER, COLORADO, US. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 371da6aedc
NEW 		none[none] none:none
 none|none none none
T:12:59:00 WinXP 204.193.210.148 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
DENVER, COLORADO, US. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 371da6aedc
NEW 		none[none] none:none
 none|none none none
13:08:00 Win2K-f 98.141.161.7 (-):
. 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
13:25:00 Win2K-f 24.65.82.22 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
EDMONTON, ALBERTA, CA. (DSL) 		91.192.36.142:7000 NL:realtek.aswend.com 135 pcap raw alerts
ruleset 		irc
598 lines 		Yeah : 1.8
profile 		none summary
tarball 		none 3e59f4e680
NEW 		none[none] none:none
 none|none none none
13:32:00 WinXP 92.41.83.50 (IKBCC.COM):
EU-ZZ,
UK. 		n/a :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		none 492341416e
NEW 		none[none] none:none
 none|none none none
13:33:00 WinXP 24.76.174.59 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.215:80
US:208.111.153.231:80 		135 pcap raw alerts
ruleset 		other
95 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
25 of 34		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
b6cf789b7d
[Firefox: 3 hits: 07-22 to 08-21] 		none[4]
none [none] 		none:none
none:none
 tElock|
none|none 		none
none 		trace
none
13:46:00 Win2K-f 192.160.7.142 (ALCATEL.COM):
ALCATEL NETWORK SERVICES,
PLANO, TEXAS, US. 		n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80
US:208.111.173.53:80 		135 pcap raw alerts
ruleset 		other
97 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
none		 168aab35a3
[Firefox:133 hits: 06-17 to 09-20]
bba5ec5f4d
NEW 		none[4]
none [none] 		none:none
none:none
 tElock|
none|none 		none
none 		trace
none
T:13:51:00 WinXP 84.74.162.217 (HISPEED.CH):
CABLECOMMAIN-NET,
ZURICH, ZURICH, CH. (DSL) 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 b872c76081
[Firefox:14 hits: 09-13 to 09-21] 		none[none] none:none
 none|none none none
14:00:00 WinXP 130.13.199.113 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none f9d832dfd2
NEW 		none[none] none:none
 none|none none none
T:14:04:00 Win2K-f 96.15.170.241 (-):
. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80 		135 pcap raw alerts
ruleset 		http
116 lines 		Yeah : 1.3
profile 		none summary
tarball 		28 of 33
31 of 33
0 of 32		 6d86a1ff5a
[Firefox:36 hits: 06-25 to 09-20]
7f6e032fc0
[Firefox:36 hits: 06-25 to 09-20]
b5919931fe
[Firefox:628 hits: 06-20 to 09-21] 		none[none]
none [none]
b5919931fe[1] 		none:none
none:none
ASM:Graph
 none|none
none|none
ASProtect| 		none
none
lines=90 		none
none
trace
14:10:00 WinXP 24.79.153.127 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
RICHMOND, BRITISH COLUMBIA, CA. (DSL) 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
134 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
none		 40870345c3
NEW
6c539a9f23
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:14:33:00 Win2K-f 4.245.164.152 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
DANBURY, CONNECTICUT, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
14:53:00 Win2K-f 222.234.234.234 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a US:microsoft.com
:proxima.ircgalaxy.pl
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
98 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 32
31 of 33
31 of 33		 b5919931fe
[Firefox:628 hits: 06-20 to 09-21]
b74e792974
[Firefox: 9 hits: 06-18 to 09-21]
f0e73c39a8
[Firefox:10 hits: 06-18 to 09-21] 		b5919931fe [1]
b74e792974[1]
none [4] 		ASM:Graph
ASM:Graph
none:none
 ASProtect|
Armadillo|
tElock| 		lines=90
lines=82
none 		trace
trace
trace
14:54:00 Win2K-f 203.118.238.245 (-):
GRAND TAINAN TECHNOLOGY CO.LTD,
TAINAN, KAO-HSIUNG, TW. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.124:80 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:15:01:00 WinXP 77.21.181.42 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none 47f8cf336a
NEW 		none[none] none:none
 none|none none none
15:05:00 WinXP 72.251.12.155 (1DIAL.COM):
AD-BASE SYSTEMS INC. (DBA GLOBALPOPS),
PITTSBURGH, PENNSYLVANIA, US. (DIAL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1135 hits: 12-31 to 09-21] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:15:16:00 WinXP 83.97.229.15 (CM-83-97-128-10.TELECABLE.ES):
TELECABLE,
GIJON, ASTURIAS, ES. (DSL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1fcc146d70
[Firefox:46 hits: 01-02 to 09-21] 		258fafe892 [0] ASM:Graph
 PolyEnE| lines=68 trace
15:23:00 WinXP 220.210.233.106 (MEGAEGG.NE.JP):
ENERGIA COMMUNICATIONS INC,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:388 hits: 01-05 to 09-21] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:15:26:00 WinXP 117.99.24.144 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		none 5b30479c4d
NEW 		none[none] none:none
 none|none none none
15:30:00 Win2K-f 69.107.174.37 (PACBELL.NET):
3CIM INC,
SAN JOSE, CALIFORNIA, US. (DSL) 		n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:199.93.53.126:80
US:204.160.104.126:80
US:205.128.73.126:80 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36
29 of 33		 1f59c01aef
[Firefox: 8 hits: 08-01 to 09-19]
dc92683d9a
[Firefox:15 hits: 06-19 to 09-19] 		none[none]
dc92683d9a[1] 		none:none
ASM:Graph
 none|none
Armadillo| 		none
lines=82 		none
trace
T:15:33:00 WinXP 82.10.98.193 (NTL.COM):
NTL INFRASTRUCTURE - OXFORD,
SWINDON, ENGLAND, UK. (DSL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 32 03f912899b
[Firefox:134 hits: 01-08 to 09-21] 		83893bd25d [0] ASM:Graph
 none|none lines=65 trace
15:34:00 Win2K-f 76.77.228.13 (MADISONTELCO.COM):
MADISON TELEPHONE COMPANY,
HAMEL, ILLINOIS, US. 		n/a :proxima.ircgalaxy.pl 135 pcap raw alerts
ruleset 		other
290 lines 		Yeah : 1.3
profile 		none summary
tarball 		none 85c039695d
NEW 		none[none] none:none
 none|none none none
15:55:00 WinXP 92.41.103.22 (IKBCC.COM):
EU-ZZ,
UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
16:00:00 Win2K-f 71.36.11.143 (QWEST.NET):
QWEST COMMUNICATIONS CORPORATION,
BOISE, IDAHO, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
16:06:00 WinXP 24.109.32.76 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none 335cd761e7
NEW 		none[none] none:none
 none|none none none
16:06:00 WinXP 88.156.57.191 (VECTRANET.PL):
VECTRA S.A,
BIALYSTOK, PODLASKIE, PL. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 f353d4eed9
[Firefox: 6 hits: 09-17 to 09-20] 		none[none] none:none
 none|none none none
16:11:00 WinXP 83.132.34.44 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
AMADORA, LISBOA, PT. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
:parex-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 e4ed963a77
[Firefox: 3 hits: 09-18 to 09-20] 		none[none] none:none
 none|none none none
T:16:11:00 WinXP 83.132.34.44 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
AMADORA, LISBOA, PT. 		n/a :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 e4ed963a77
[Firefox: 3 hits: 09-18 to 09-20] 		none[none] none:none
 none|none none none
16:20:00 WinXP 200.59.101.104 (COM.AR):
SINECTIS S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) 		n/a RU:moscow-advokat.ru
HR:london.uk.eu.undernet.org
AT:graz.at.eu.undernet.org
:washington.dc.us.undernet.org
SE:broadway.ny.us.dal.net
SE:qis.md.us.dal.net
:flanders.be.eu.undernet.org
:los-angeles.ca.us.undernet.org
SE:coins.dal.net
SE:viking.dal.net
:caen.fr.eu.undernet.org
:lulea.se.eu.undernet.org
US:lia.zanet.net
NL:diemen.nl.eu.undernet.org
SE:ced.dal.net
:brussels.be.eu.undernet.org
:gaspode.zanet.org.za
SE:vancouver.dal.net
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:602 hits: 12-31 to 09-21] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:16:41:00 Win2K-f 70.168.12.146 (COX.NET):
COX COMMUNICATIONS,
PAWTUCKET, RHODE ISLAND, US. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36
28 of 33		 da00a8e7a1
[Firefox:17 hits: 08-05 to 09-21]
f685f8e027
[Firefox:21 hits: 06-18 to 09-21] 		none[none]
f685f8e027[1] 		none:none
ASM:Graph
 none|none
Armadillo| 		none
lines=82 		none
trace
16:52:00 Win2K-f 4.176.33.219 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
APACHE JUNCTION, ARIZONA, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
104 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
16:53:00 WinXP 88.163.144.110 (PROXAD.NET):
PROXAD / FREE SAS,
FR. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none 61181cf4cb
NEW 		none[none] none:none
 none|none none none
T:16:53:00 WinXP 88.163.144.110 (PROXAD.NET):
PROXAD / FREE SAS,
FR. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none 61181cf4cb
NEW 		none[none] none:none
 none|none none none
T:16:58:00 Win2K-f 98.14.186.87 (-):
. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:209.84.20.126:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:17:06:00 WinXP 201.213.201.133 (NET.AR):
PRIMA S.A,
AR. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none 1437f988ed
NEW 		none[none] none:none
 none|none none none
T:17:10:00 Win2K-f 68.74.117.219 (AMERITECH.NET):
PPPOX POOL - RBACK1 EMHRIL,
CHICAGO, ILLINOIS, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.43:80
US:208.111.148.54:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
17:15:00 WinXP 208.127.97.198 (DSLEXTREME.COM):
DSL EXTREME,
WINNETKA, CALIFORNIA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		lanman
shell
shell
shell
1498 lines 		Yeah : 1.3
profile 		none summary
tarball 		none 834a520346
NEW 		none[none] none:none
 none|none none none
17:22:00 Win2K-f 203.91.181.72 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
US:199.93.41.124:80
US:207.123.37.123:80 		135 pcap raw alerts
ruleset 		other
59 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
8 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
b7082104e4
[Firefox:141 hits: 06-18 to 09-21] 		none[4]
none [4] 		none:none
none:none
 tElock|
tElock| 		none
none 		trace
trace
17:37:00 WinXP 24.109.236.124 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
THUNDER BAY, ONTARIO, CA. (DSL) 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none 0347304e75
NEW 		none[none] none:none
 none|none none none
17:40:00 WinXP 71.111.189.106 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
ALOHA, OREGON, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
17:45:00 WinXP 72.191.163.186 (RR.COM):
ROAD RUNNER HOLDCO LLC,
EL PASO, TEXAS, US. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:602 hits: 12-31 to 09-21] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:17:45:00 WinXP 72.191.163.186 (RR.COM):
ROAD RUNNER HOLDCO LLC,
EL PASO, TEXAS, US. 		n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:602 hits: 12-31 to 09-21] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:17:51:00 Win2K-f 71.122.67.24 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
VENICE, FLORIDA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
53 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33 a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		a08f3b74a4 [1] ASM:Graph
 Armadillo| lines=81 trace
17:52:00 Win2K-f 71.122.67.24 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
VENICE, FLORIDA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
52 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33 a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		a08f3b74a4 [1] ASM:Graph
 Armadillo| lines=81 trace
T:17:53:00 WinXP 24.86.114.232 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BURNABY, BRITISH COLUMBIA, CA. (DSL) 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80
US:208.111.148.43:80 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
none		 05b1ed9c9c
NEW
0c87a74ebe
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
17:55:00 WinXP 203.91.186.82 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80 		135 pcap raw alerts
ruleset 		http
77 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:17:59:00 WinXP 210.79.132.206 (MEDIATTI.NET):
MEDIATTI COMMUNICATIONS INC,
TOKYO, TOKYO, JP. 		n/a   445 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:549 hits: 01-01 to 09-21] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
18:06:00 WinXP 72.251.14.221 (1DIAL.COM):
AD-BASE SYSTEMS INC. (DBA GLOBALPOPS),
PITTSBURGH, PENNSYLVANIA, US. (DIAL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1135 hits: 12-31 to 09-21] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:18:07:00 WinXP 72.251.14.221 (1DIAL.COM):
AD-BASE SYSTEMS INC. (DBA GLOBALPOPS),
PITTSBURGH, PENNSYLVANIA, US. (DIAL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1135 hits: 12-31 to 09-21] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
18:14:00 WinXP 165.123.123.172 (UPENN.EDU):
UNIVERSITY OF PENNSYLVANIA,
PHILADELPHIA, PENNSYLVANIA, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
78 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:18:18:00 WinXP 200.100.70.144 (TELESP.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DIAL) 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
:los-angeles.ca.us.undernet.org
:flanders.be.eu.undernet.org
AT:graz.at.eu.undernet.org
:caen.fr.eu.undernet.org
:washington.dc.us.undernet.org
NL:diemen.nl.eu.undernet.org
SE:vancouver.dal.net
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		none 71a1c77303
NEW 		none[none] none:none
 none|none none none
18:28:00 WinXP 74.67.48.111 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CLIFTON PARK, NEW YORK, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21]
e07c29c4ae
[Firefox:483 hits: 06-19 to 09-21] 		none[4]
73f1082158[1]
e07c29c4ae[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
FSG| 		none
lines=81
lines=92 		trace
trace
trace
18:32:00 Win2K-f 4.159.5.50 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CALEDONIA, MICHIGAN, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
87 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21]
b5919931fe
[Firefox:628 hits: 06-20 to 09-21] 		none[4]
a08f3b74a4[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
T:18:39:00 WinXP 201.229.48.200 (201-229-49-10.CTANET.AW):
SETAR-CABLE-TV,
AW. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a0139d7ad8
[Firefox:107 hits: 01-03 to 09-21] 		d9e9662db1 [0] ASM:Graph
 PolyEnE| lines=68 trace
18:41:00 WinXP 201.212.125.81 (NET.AR):
PRIMA S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:18:53:00 WinXP 61.218.20.107 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:209.84.20.126:80
US:8.12.222.126:80 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		23 of 36
35 of 36		 11cd4bb3ff
NEW
c8c94cc597
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:18:54:00 WinXP 190.226.85.183 (-):
. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 71b183b0c8
[Firefox: 3 hits: 09-17 to 09-20] 		none[none] none:none
 none|none none none
T:19:19:00 WinXP 122.2.242.10 (PLDT.NET):
IPG,
BAGUIO, BAGUIO, PH. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 efeb24872b
[Firefox: 3 hits: 09-19 to 09-19] 		none[none] none:none
 none|none none none
T:19:35:00 WinXP 4.228.225.162 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. (DIAL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 a0139d7ad8
[Firefox:107 hits: 01-03 to 09-21] 		d9e9662db1 [0] ASM:Graph
 PolyEnE| lines=68 trace
19:40:00 WinXP 92.40.105.222 (IKBCC.COM):
EU-ZZ,
UK. 		n/a :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		27 of 32 9c037c69f6
[Firefox: 3 hits: 04-21 to 06-03] 		none[3] none:none
 ASPack| none trace
T:19:47:00 WinXP 114.121.143.216 (-):
. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1135 hits: 12-31 to 09-21] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:19:55:00 WinXP 115.125.36.182 (-):
. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 3ae357d17b
[Firefox:173 hits: 01-01 to 09-15] 		462a7be171 [0] ASM:Graph
 PolyEnE| lines=73 trace
20:13:00 WinXP 208.127.119.154 (DSLEXTREME.COM):
DSL EXTREME,
WINNETKA, CALIFORNIA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
357 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 32 5aeb9abc92
[Firefox:14 hits: 07-15 to 09-19] 		none[none] none:none
 none|none none none
T:20:22:00 Win2K-f 98.141.160.84 (-):
. 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
20:29:00 Win2K-f 124.195.159.113 (-):
. 		n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:208.111.173.41:80
US:208.111.173.42:80 		135 pcap raw alerts
ruleset 		other
118 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
none		 bd36561f92
NEW
daf1667907
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
20:29:00 WinXP 79.133.132.238 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:602 hits: 12-31 to 09-21] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:20:29:00 WinXP 79.133.132.238 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:602 hits: 12-31 to 09-21] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:21:08:00 Win2K-f 68.230.138.208 (COX.NET):
COX COMMUNICATIONS,
PROVIDENCE, RHODE ISLAND, US. 		n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:205.128.73.126:80 		135 pcap raw alerts
ruleset 		http
127 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
none		 d218d71e66
NEW
fc2c568173
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
21:28:00 Win2K-f 69.79.121.139 (NWNNETWORK.NET):
NEW WORLD NETWORK,
MIAMI, FLORIDA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.215:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
21:50:00 Win2K-f 4.183.200.88 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
LAKELAND, FLORIDA, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
21:54:00 Win2K-f 64.183.209.202 (RR.COM):
ROAD RUNNER HOLDCO LLC,
DALLAS, TEXAS, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
60 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
8 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
b5919931fe
[Firefox:628 hits: 06-20 to 09-21]
b7082104e4
[Firefox:141 hits: 06-18 to 09-21] 		none[4]
b5919931fe[1]
none [4] 		none:none
ASM:Graph
none:none
 tElock|
ASProtect|
tElock| 		none
lines=90
none 		trace
trace
trace
21:57:00 WinXP 96.15.124.140 (-):
. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 cdf8cd94a9
[Firefox: 9 hits: 09-14 to 09-20] 		none[none] none:none
 none|none none none
T:21:57:00 WinXP 96.15.124.140 (-):
. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 cdf8cd94a9
[Firefox: 9 hits: 09-14 to 09-20] 		none[none] none:none
 none|none none none
22:07:00 Win2K-f 24.67.53.101 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. 		n/a US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80 		135 pcap raw alerts
ruleset 		other
222 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 36
32 of 36		 c295ae7d97
NEW
dd1fe232e8
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
22:19:00 WinXP 207.5.204.71 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80
US:208.111.148.69:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:22:21:00 Win2K-f 4.224.45.226 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
DELAWARE, OHIO, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.69:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
a08f3b74a4
[Firefox:820 hits: 06-18 to 09-21] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
22:36:00 WinXP 61.12.144.150 (YOURNET.NE.JP):
FREEBIT CO. LTD,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:388 hits: 01-05 to 09-21] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
22:38:00 Win2K-f 144.134.27.139 (TMNS.NET.AU):
TELSTRAINTERNET27,
GOLD COAST, QUEENSLAND, AU. 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:23:06:00 Win2K-f 65.168.153.249 (SKYBEST.COM):
SKYBEST COMMUNICATIONS INC,
NEW BERN, NORTH CAROLINA, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
77 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
23:13:00 WinXP 118.240.118.73 (-):
. 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:549 hits: 01-01 to 09-21] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
T:23:16:00 Win2K-f 63.24.80.249 (UU.NET):
UUNET TECHNOLOGIES INC,
US. 		n/a   135 pcap raw alerts
ruleset 		other
4 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:23:23:00 WinXP 118.237.118.75 (-):
. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 27b945de66
[Firefox:22 hits: 06-20 to 09-21] 		none[4] none:none
 none|none none trace
23:37:00 Win2K-f 65.25.145.77 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COLUMBUS, OHIO, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 32		 53bfe15e91
[Firefox:2354 hits: 06-17 to 09-21]
73f1082158
[Firefox:1168 hits: 06-18 to 09-21]
b5919931fe
[Firefox:628 hits: 06-20 to 09-21] 		none[4]
73f1082158[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace