Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

29 September 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

00:41:00 WinXP 58.127.252.251 (HANANET.NET):
HANARO TELECOM INC,
KR. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:208.111.148.15:80 135 pcap raw alerts
ruleset http
125 lines Yeah : 1.3
profile none summary
tarball 30 of 33
30 of 33
0 of 33 2e04b06527
[Firefox: 9 hits: 06-18 to 09-24]
5c054291de
[Firefox: 8 hits: 06-18 to 09-16]
e07c29c4ae
[Firefox:521 hits: 06-19 to 09-28] none[4]
5c054291de[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=82
lines=92 trace
trace
trace

01:14:00 WinXP 218.86.223.194 (AGENT1.GZ.CN):
CHINANET GUIZHOU PROVINCE NETWORK,
GUIZHOU, GUIZHOU, CN. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

01:40:00 Win2K-f 210.126.212.149 (KRLINE.NET):
KRNIC,
KR. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:01:42:00 WinXP 70.117.151.52 (RR.COM):
ROAD RUNNER HOLDCO LLC,
BEAUMONT, TEXAS, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28]
e07c29c4ae
[Firefox:521 hits: 06-19 to 09-28] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:01:56:00 WinXP 203.221.241.24 (COMINDICO.COM.AU):
COMINDICO AUSTRALIA,
SYDNEY, NEW SOUTH WALES, AU. (DIAL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 3ae357d17b
[Firefox:177 hits: 01-01 to 09-25] 462a7be171 [0] ASM:Graph
PolyEnE| lines=73 trace

02:05:00 WinXP 76.244.176.42 (PACBELL.NET):
AT&T INTERNET SERVICES,
US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.53:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28]
e07c29c4ae
[Firefox:521 hits: 06-19 to 09-28] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

02:10:00 Win2K-f 123.236.43.227 (-):
RELIANCE INFOCOMM LIMITED,
MUMBAI, MAHARASHTRA, IN. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
61 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
8 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28]
b7082104e4
[Firefox:152 hits: 06-18 to 09-28] none[4]
b5919931fe[1]
none [4] none:none
ASM:Graph
none:none
tElock|
ASProtect|
tElock| none
lines=90
none trace
trace
trace

T:02:10:00 WinXP 218.174.37.35 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 115.126.2.121:65520 :proxim.ircgalaxy.pl
IL:wrsavn.flutix.com
IL:bugreport.waverevenue.com
IL:wrsavn.kastora.com
US:dl2.bundlext.com
US:b152.bundlext.com
US:b157.bundlext.com
:www.speed-runner.com
115.126.2.121:65520 445 pcap raw alerts
ruleset http
irc
http
http
http
202 lines Yeah : 1.3
profile none summary
tarball 8 of 33
15 of 36
21 of 33
20 of 36
7 of 36
33 of 35 1ac39aea6b
[Firefox: 4 hits: 06-28 to 08-12]
7085b2c2d6
[Firefox:21 hits: 09-27 to 09-28]
7b1de9d82d
[Firefox: 4 hits: 06-28 to 08-12]
8f419f7558
NEW
e9b5f1306e
NEW
fee215afd0
NEW none[none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none none
none
none
none
none
none

02:12:00 Win2K-f 222.234.141.188 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
:proxima.ircgalaxy.pl
US:download.microsoft.com
115.126.2.121:65520
US:208.111.173.53:80 135 pcap raw alerts
ruleset http
87 lines Yeah : 1.3
profile none summary
tarball 0 of 33
30 of 32
0 of 32 4c3df24b32
[Firefox:201 hits: 06-17 to 09-28]
8390780c27
[Firefox:37 hits: 06-18 to 09-12]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28] 4c3df24b32 [1]
none [4]
b5919931fe[1] ASM:Graph
none:none
ASM:Graph
Armadillo|
tElock|
ASProtect| lines=81
none
lines=90 trace
trace
trace

T:02:13:00 Win2K-f 173.16.103.39 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.152:80
US:208.111.148.174:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:02:14:00 WinXP 88.86.1.154 (HOST-213-178-245-10.ALOOLA.SY):
SCS-NET IS AN ISP BASED IN DAMASCUS SYRIA,
AMMAN, 'AMMAN, JO. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 3ae357d17b
[Firefox:177 hits: 01-01 to 09-25] 462a7be171 [0] ASM:Graph
PolyEnE| lines=73 trace

02:16:00 Win2K-f 76.87.210.98 (G-M-I.NET):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.152:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

02:19:00 WinXP 74.130.243.154 (INSIGHTBB.COM):
INSIGHT COMMUNICATIONS COMPANY L.P,
CARROLLTON, KENTUCKY, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.152:80
US:208.111.148.174:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:02:25:00 WinXP 61.59.148.107 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 34 of 36 71b985b884
NEW none[none] none:none
none|none none none

02:26:00 Win2K-f 71.111.191.229 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
ALOHA, OREGON, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

02:43:00 WinXP 118.241.78.207 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:569 hits: 01-01 to 09-28] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:02:44:00 WinXP 212.106.24.13 (POLBOX.PL):
POLBOX,
PL. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 d9a4f2f314
NEW none[none] none:none
none|none none none

02:54:00 WinXP 79.138.227.201 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:02:55:00 WinXP 79.138.227.201 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

02:58:00 Win2K-f 71.148.35.35 (SBCGLOBAL.NET):
KASSA KASSA,
PLANO, TEXAS, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

03:28:00 WinXP 203.73.84.231 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.126:80 135 pcap raw alerts
ruleset http
79 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
57ce4acac2
[Firefox:211 hits: 06-17 to 09-28]
e07c29c4ae
[Firefox:521 hits: 06-19 to 09-28] none[4]
57ce4acac2[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

03:33:00 Win2K-f 119.64.96.74 (-):
. n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520 135 pcap raw alerts
ruleset http
87 lines Yeah : 1.3
profile none summary
tarball 31 of 33
0 of 33
0 of 32 168aab35a3
[Firefox:145 hits: 06-17 to 09-28]
4c3df24b32
[Firefox:201 hits: 06-17 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28] none[4]
4c3df24b32[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

03:43:00 Win2K-f 68.148.83.216 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
EDMONTON, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

03:52:00 Win2K-f 117.104.30.147 (-):
. 67.43.236.98:5190 CA:xx.sqlteam.info
CA:zonetech.info
CA:ns.ircstyle.net
:aa.enterhere.biz
CA:ns.enterhere.biz
US:130.107.205.246:38698 135 pcap raw alerts
ruleset irc
http
364 lines Yeah : 1.8
profile none summary
tarball 22 of 36
21 of 36
21 of 36
10 of 36
35 of 36 1868867d02
NEW
3e01fb69e1
NEW
6b997bcb17
NEW
c025f08a76
[Firefox: 4 hits: 09-15 to 09-19]
faa8c4cc81
NEW none[none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none none
none
none
none
none

T:04:08:00 WinXP 85.152.210.155 (CM-85-152-232-10.TELECABLE.ES):
TELECABLE,
AVILES, ASTURIAS, ES. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 68a76c215f
[Firefox: 6 hits: 08-14 to 08-25] none[none] none:none
none|none none none

T:04:14:00 WinXP 119.95.74.207 (-):
. n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 445 pcap raw alerts
ruleset http
irc
3 lines Yeah : 0.8
profile none summary
tarball 34 of 35 8ea8715b69
NEW none[none] none:none
none|none none none

04:50:00 WinXP 77.37.193.55 (NCNET.RU):
NCN-INFRA,
RU. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 1cd89685c0
NEW none[none] none:none
none|none none none

04:52:00 Win2K-f 4.171.108.106 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
JACKSONVILLE, FLORIDA, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
6 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:05:44:00 Win2K-f 61.221.250.18 (HINET.NET):
DATA COMMUNICATION BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TW. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80
US:208.111.148.43:80 135 pcap raw alerts
ruleset other
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
57ce4acac2
[Firefox:211 hits: 06-17 to 09-28] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

05:49:00 WinXP 118.1.218.72 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:413 hits: 01-05 to 09-28] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:05:59:00 WinXP 118.237.1.74 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 27b945de66
[Firefox:26 hits: 06-20 to 09-28] none[4] none:none
none|none none trace

06:17:00 WinXP 210.207.98.181 (BORA.NET):
BORANET-NET-210-206/,
KR. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:569 hits: 01-01 to 09-28] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:06:21:00 WinXP 122.52.90.149 (PLDT.NET):
IPG,
PH. 115.126.2.121:65520 US:microsoft.com
US:download.microsoft.com
:proxim.ircgalaxy.pl
:fleshkatera.cn
:lolika.cn
:www.upononjob.cn
:mulfika.cn
US:windowsupdate.microsoft.com
CN:antivirxp.net
115.126.2.121:65520
US:192.221.110.125:80
US:198.78.201.126:80
US:199.93.44.126:80
EU:77.244.220.134:80 135 pcap raw alerts
ruleset irc
http
150 lines Yeah : 1.8
profile none summary
tarball 29 of 33
5 of 36
33 of 33
15 of 36 16874933ea
[Firefox:45 hits: 06-18 to 09-21]
6a7fb64400
NEW
76ee340669
[Firefox:45 hits: 06-18 to 09-21]
91dc355a93
[Firefox:19 hits: 09-25 to 09-28] 16874933ea [1]
none [none]
none [4]
none [none] ASM:Graph
none:none
none:none
none:none
Armadillo|
none|none
PolyEnE|
none|none lines=82
none
none
none trace
none
trace
none

T:06:46:00 Win2K-f 203.73.84.231 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:198.78.201.126:80
US:204.160.126.124:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
57ce4acac2
[Firefox:211 hits: 06-17 to 09-28] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

06:47:00 Win2K-f 61.215.168.4 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
JP. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
57ce4acac2
[Firefox:211 hits: 06-17 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28] none[4]
57ce4acac2[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

06:47:00 WinXP 190.225.86.199 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 71b183b0c8
[Firefox: 7 hits: 09-17 to 09-28] none[none] none:none
none|none none none

06:53:00 WinXP 88.103.15.102 (IOL.CZ):
XDSL NETWORK-ADSL,
CZ. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

07:12:00 Win2K-f 24.164.122.49 (RR.COM):
ROAD RUNNER HOLDCO LLC,
SHELBY, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.137:80
US:208.111.148.152:80 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
b7082104e4
[Firefox:152 hits: 06-18 to 09-28] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

T:07:21:00 Win2K-f 220.57.120.8 (BBTEC.NET):
JAPAN NATION-WIDE NETWORK OF SOFTBANK BB CORP,
TOKYO, TOKYO, JP. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.43:80
US:208.111.148.54:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

07:31:00 Win2K-f 96.247.59.250 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

07:42:00 WinXP 76.213.151.176 (SBCGLOBAL.NET):
PPPOX POOL - BRAS2.OKCYOK,
EDMOND, OKLAHOMA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80
US:207.123.37.123:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28]
e07c29c4ae
[Firefox:521 hits: 06-19 to 09-28] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

07:44:00 WinXP 98.121.132.7 (-):
. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:641 hits: 12-31 to 09-28] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:08:02:00 WinXP 94.191.253.27 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 9145ee7213
NEW none[none] none:none
none|none none none

T:08:02:00 WinXP 83.125.97.106 (SIGN2.DE):
LAMBDANET COMMUNICATIONS,
UK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:124 hits: 01-03 to 09-27] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:16:00 WinXP 122.195.88.208 (MAIL.NEDER.CN):
CNC GROUP JIANGSU PROVINCE NETWORK,
NANJING, JIANGSU, CN. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:641 hits: 12-31 to 09-28] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

08:24:00 WinXP 91.65.233.35 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
DE. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 6063a9fbda
[Firefox: 2 hits: 09-24 to 09-27] none[none] none:none
none|none none none

08:32:00 WinXP 41.214.170.230 (-):
. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
115.126.2.121:65520
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 56023abcf9
NEW none[none] none:none
none|none none none

T:08:51:00 WinXP 186.12.108.251 (-):
. n/a DE:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:08:52:00 Win2K-f 170.51.98.201 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a US:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 33 of 36 30d50bdc3d
[Firefox: 3 hits: 09-12 to 09-12] none[none] none:none
none|none none none

T:08:53:00 WinXP 151.33.192.71 (33-151.IOL.IT):
ITALIA ONLINE S.P.A,
MILANO, LOMBARDIA, IT. (DIAL) n/a DE:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:08:54:00 Win2K-f 170.51.111.60 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 33 of 36 afa3d78300
[Firefox: 2 hits: 09-26 to 09-27] none[none] none:none
none|none none none

T:08:54:00 Win2K-f 186.12.103.222 (-):
. n/a US:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

08:55:00 WinXP 186.12.108.251 (-):
. n/a DE:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

08:55:00 Win2K-f 170.51.129.135 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

08:56:00 Win2K-f 78.56.203.103 (ZEBRA.LT):
LIETUVOS,
LT. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

08:56:00 WinXP 170.51.111.60 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a :proxim.ircgalaxy.pl
US:cookie.roltf.ws
115.126.2.121:65520
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 33 of 36 afa3d78300
[Firefox: 2 hits: 09-26 to 09-27] none[none] none:none
none|none none none

08:57:00 WinXP 186.12.22.233 (-):
. n/a DE:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:09:12:00 WinXP 186.12.124.192 (-):
. 64.85.160.111:5001 US:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
23 lines Yeah : 1.3
profile none summary
tarball 33 of 36 30d50bdc3d
[Firefox: 3 hits: 09-12 to 09-12] none[none] none:none
none|none none none

09:19:00 Win2K-f 201.254.225.151 (COM.AR):
TELEFONICA DE ARGENTINA,
AR. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 21 of 36 5890c597af
NEW none[none] none:none
none|none none none

T:09:28:00 Win2K-f 67.153.139.131 (ALGX.NET):
CONSOLIDATED SMART SYSTEMS LLC,
GARDENA, CALIFORNIA, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:09:29:00 Win2K-f 170.51.66.90 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

09:32:00 Win2K-f 170.51.66.90 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
11 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:09:35:00 Win2K-f 170.51.165.1 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
9 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:09:36:00 WinXP 151.33.194.93 (33-151.IOL.IT):
ITALIA ONLINE S.P.A,
MILANO, LOMBARDIA, IT. (DIAL) 64.85.160.111:5001 DE:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

09:36:00 Win2K-f 151.33.194.93 (33-151.IOL.IT):
ITALIA ONLINE S.P.A,
MILANO, LOMBARDIA, IT. (DIAL) n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

09:43:00 WinXP 4.244.211.73 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WASHINGTON, MISSOURI, US. (DIAL) n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 321052074e
[Firefox:13 hits: 02-23 to 08-26] 1a587de3ca [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:09:45:00 Win2K-f 170.51.48.208 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
11 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

09:58:00 WinXP 200.165.199.35 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 dfdc4b62b3
NEW none[none] none:none
none|none none none

09:59:00 Win2K-f 170.51.50.46 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. 64.85.160.111:5001 US:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:10:03:00 WinXP 170.51.174.121 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
9 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:10:09:00 Win2K-f 91.22.219.246 (T-IPCONNECT.DE):
DEUTSCHE TELEKOM AG,
DE. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

10:09:00 WinXP 91.22.219.246 (T-IPCONNECT.DE):
DEUTSCHE TELEKOM AG,
DE. 64.85.160.111:5001 DE:cookie.roltf.ws
DE:213.239.192.125:5001 445 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:10:13:00 Win2K-f 186.12.52.180 (-):
. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

10:15:00 WinXP 186.12.52.180 (-):
. 64.85.160.111:5001 US:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
27 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

10:25:00 WinXP 87.12.150.130 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
IT. 64.85.160.111:5001 DE:cookie.roltf.ws
DE:213.239.192.125:5001 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:10:26:00 WinXP 87.12.150.130 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
IT. n/a US:cookie.roltf.ws
DE:213.239.192.125:5001 445 pcap raw alerts
ruleset ftp
irc
13 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

10:26:00 Win2K-f 87.252.145.224 (-):
T-MOBILE HRVATSKA D.O.O,
HR. 64.85.160.111:5001 DE:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:10:28:00 WinXP 87.252.145.224 (-):
T-MOBILE HRVATSKA D.O.O,
HR. 64.85.160.111:5001 US:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:10:34:00 Win2K-f 170.51.110.180 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

10:34:00 WinXP 170.51.110.180 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. 64.85.160.111:5001 DE:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

10:57:00 Win2K-f 58.226.28.10 (HANANET.NET):
HANARO TELECOM INC,
KR. 115.126.2.121:65520 US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
IL:wrsavn.flutix.com
IL:bugreport.waverevenue.com
IL:wrsavn.kastora.com
115.126.2.121:65520 135 pcap raw alerts
ruleset irc
http
125 lines Yeah : 1.8
profile none summary
tarball 15 of 36
29 of 32
28 of 32
7 of 36 7085b2c2d6
[Firefox:21 hits: 09-27 to 09-28]
8a75955033
[Firefox:36 hits: 06-20 to 09-23]
9276c8b36b
[Firefox:36 hits: 06-20 to 09-23]
e9b5f1306e
NEW none[none]
none [4]
9276c8b36b[1]
none [none] none:none
none:none
ASM:Graph
none:none
none|none
tElock|
Armadillo|
none|none none
none
lines=81
none none
trace
trace
none

T:10:57:00 Win2K-f 87.0.183.115 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
IT. (DSL) n/a 445 pcap raw alerts
ruleset ftp
9 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:01:00 Win2K-f 170.51.139.97 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

11:04:00 Win2K-f 170.51.173.1 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a US:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
14 lines Yeah : 0.8
profile none summary
tarball 33 of 36 e0f9cd4eb7
NEW none[none] none:none
none|none none none

T:11:06:00 Win2K-f 70.183.164.236 (COX.NET):
COX COMMUNICATIONS,
WARWICK, RHODE ISLAND, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:205.128.73.126:80
US:207.123.37.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

11:07:00 WinXP 186.12.72.169 (-):
. 64.85.160.111:5001 DE:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

11:07:00 WinXP 92.32.14.102 (IKBCC.COM):
EU-ZZ,
UK. n/a RU:moscow-advokat.ru
SE:viking.dal.net
:washington.dc.us.undernet.org
SE:ozbytes.dal.net
SE:coins.dal.net
:caen.fr.eu.undernet.org
SE:ced.dal.net
:diemen.nl.eu.undernet.org
:lulea.se.eu.undernet.org
:flanders.be.eu.undernet.org
NO:london.uk.eu.undernet.org
SE:broadway.ny.us.dal.net
AT:graz.at.eu.undernet.org
SE:vancouver.dal.net 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 35 of 35 b9e6a0c882
[Firefox: 9 hits: 09-12 to 09-27] none[none] none:none
none|none none none

11:08:00 WinXP 60.249.242.178 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
57ce4acac2
[Firefox:211 hits: 06-17 to 09-28] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:11:09:00 WinXP 24.211.204.184 (RR.COM):
ROAD RUNNER HOLDCO LLC,
RALEIGH, NORTH CAROLINA, US. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:438 hits: 12-31 to 09-28] 048df78048 [0] ASM:Graph
none|none lines=61 trace

11:18:00 Win2K-f 168.103.128.47 (ICPC.COM):
QWEST COMMUNICATIONS CORPORATION,
BOISE, IDAHO, US. n/a US:microsoft.com
US:download.microsoft.com
US:209.84.20.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:11:25:00 WinXP 151.33.193.82 (33-151.IOL.IT):
ITALIA ONLINE S.P.A,
MILANO, LOMBARDIA, IT. (DIAL) 64.85.160.111:5001 US:cookie.roltf.ws 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

11:26:00 Win2K-f 151.33.193.82 (33-151.IOL.IT):
ITALIA ONLINE S.P.A,
MILANO, LOMBARDIA, IT. (DIAL) n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

11:32:00 WinXP 200.40.72.184 (ADINET.COM.UY):
ADMINISTRACION NACIONAL DE TELECOMUNICACIONES,
MONTEVIDEO, MONTEVIDEO, UY. (DIAL) n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:35:00 WinXP 116.59.165.64 (-):
MOBILE BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

11:38:00 Win2K-f 186.12.1.20 (-):
. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:11:43:00 Win2K-f 130.15.84.186 (QUEENSU.CA):
QUEEN'S UNIVERSITY,
KINGSTON, ONTARIO, CA. n/a 135 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 29 of 36 71d2b1428a
NEW none[none] none:none
none|none none none

11:48:00 Win2K-f 220.128.180.221 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.123:80
US:207.123.46.126:80
US:8.12.202.125:80 135 pcap raw alerts
ruleset other
95 lines Yeah : 1.3
profile none summary
tarball 0 of 33
29 of 32 57ce4acac2
[Firefox:211 hits: 06-17 to 09-28]
83f26f5044
[Firefox:21 hits: 06-20 to 09-27] 57ce4acac2 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

11:48:00 WinXP 130.15.84.186 (QUEENSU.CA):
QUEEN'S UNIVERSITY,
KINGSTON, ONTARIO, CA. n/a 135 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 29 of 36 71d2b1428a
NEW none[none] none:none
none|none none none

T:11:48:00 Win2K-f 170.51.165.48 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. 64.85.160.111:5001 DE:cookie.roltf.ws
DE:213.239.192.125:5001 445 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 1.3
profile none summary
tarball 33 of 36 30d50bdc3d
[Firefox: 3 hits: 09-12 to 09-12] none[none] none:none
none|none none none

11:48:00 Win2K-f 170.51.165.48 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:50:00 WinXP 68.126.240.192 (PACBELL.NET):
PPPOX POOL - RBACK4 IRVNCA,
LOS ANGELES, CALIFORNIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.123:80
US:8.12.202.125:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:11:54:00 WinXP 186.12.68.131 (-):
. 64.85.160.111:5001 US:cookie.roltf.ws
DE:213.239.192.125:5001 445 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

11:55:00 Win2K-f 186.12.68.131 (-):
. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:12:06:00 WinXP 190.134.4.70 (-):
. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 fbe263609e
NEW none[none] none:none
none|none none none

12:11:00 WinXP 4.245.120.158 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MODESTO, CALIFORNIA, US. (DIAL) n/a RU:www.bbin.ru
EU:siliconfireware.ru
:wpad
RU:195.200.213.54:80
DE:212.227.111.29:80
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:545 hits: 01-01 to 09-28] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

T:12:14:00 WinXP 186.12.16.184 (-):
. 64.85.160.111:5001 DE:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 1.3
profile none summary
tarball 33 of 36 30d50bdc3d
[Firefox: 3 hits: 09-12 to 09-12] none[none] none:none
none|none none none

12:15:00 Win2K-f 200.191.78.52 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:12:16:00 WinXP 200.191.78.52 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 64.85.160.111:5001 US:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:12:32:00 Win2K-f 190.176.160.96 (-):
. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

T:12:32:00 WinXP 63.17.157.25 (UU.NET):
UUNET TECHNOLOGIES INC,
NEW YORK, NEW YORK, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.226:80
US:208.111.148.247:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

12:33:00 Win2K-f 190.176.160.96 (-):
. 64.85.160.111:5001 DE:cookie.roltf.ws
DE:213.239.192.125:5001
US:64.85.160.111:5001 445 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

12:49:00 WinXP 70.104.121.162 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
US. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:143 hits: 01-08 to 09-28] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

12:54:00 Win2K-f 220.57.120.8 (BBTEC.NET):
JAPAN NATION-WIDE NETWORK OF SOFTBANK BB CORP,
TOKYO, TOKYO, JP. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.115:80
US:208.111.148.137:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:12:59:00 Win2K-f 24.234.205.170 (COX.NET):
COX COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.115:80
US:208.111.148.137:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

13:01:00 WinXP 85.84.218.127 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
BILBAO, PAIS VASCO, ES. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none 0f99623be1
[Firefox: 3 hits: 09-22 to 09-26] none[none] none:none
none|none none none

T:13:01:00 WinXP 85.84.218.127 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
BILBAO, PAIS VASCO, ES. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none 0f99623be1
[Firefox: 3 hits: 09-22 to 09-26] none[none] none:none
none|none none none

13:19:00 WinXP 71.109.33.111 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
GLENDORA, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:13:36:00 WinXP 190.137.43.88 (NET.AR):
TELECOM ARGENTINA S.A,
AR. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:641 hits: 12-31 to 09-28] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

13:40:00 WinXP 208.38.75.15 (IZOOM.NET):
SHERBURNE TELE-SYSTEMS INC,
CAMBRIDGE, MINNESOTA, US. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 d42c1cc7c0
[Firefox:138 hits: 01-01 to 09-27] af9ca5bed1 [0] ASM:Graph
PolyEnE| lines=54 trace

T:13:42:00 Win2K-f 75.79.45.205 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
90 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

13:49:00 Win2K-f 24.65.253.120 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 31 of 32
23 of 33 bca9e0fb5f
[Firefox:30 hits: 06-18 to 09-24]
e53a9ea82e
[Firefox:30 hits: 06-18 to 09-24] none[4]
e53a9ea82e[1] none:none
ASM:Graph
PolyEnE|
Armadillo| none
lines=81 trace
trace

T:14:11:00 Win2K-f 200.40.74.81 (ADINET.COM.UY):
ADMINISTRACION NACIONAL DE TELECOMUNICACIONES,
MONTEVIDEO, MONTEVIDEO, UY. (DIAL) n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 19 of 32 382279b44f
[Firefox:225 hits: 05-22 to 09-27] 049e62d55b [0] ASM:Graph
Armadillo| lines=192 trace

14:20:00 WinXP 41.214.174.47 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
[Firefox:86 hits: 01-14 to 09-28] 8a00217866 [0] ASM:Graph
PolyEnE| lines=57 trace

T:14:21:00 WinXP 41.214.174.47 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
[Firefox:86 hits: 01-14 to 09-28] 8a00217866 [0] ASM:Graph
PolyEnE| lines=57 trace

14:30:00 WinXP 92.1.49.223 (-):
CARPHONE WAREHOUSE BROADBAND SERVICES,
UK. n/a :proxim.ircgalaxy.pl
115.126.2.121:80 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 35 of 36 b632266bbd
[Firefox: 4 hits: 09-21 to 09-27] none[none] none:none
none|none none none

14:46:00 WinXP 81.84.9.183 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
PT. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
115.126.2.121:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 22999be88c
[Firefox:24 hits: 04-05 to 09-28] eda2056971 [0] ASM:Graph
PolyEnE| lines=154
embedded dns trace

15:28:00 WinXP 41.214.168.163 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:15:29:00 WinXP 41.214.168.163 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

15:35:00 Win2K-f 24.77.203.25 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
KELOWNA, BRITISH COLUMBIA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
1010 lines Yeah : 1.3
profile none summary
tarball 14 of 36
11 of 36 83c5c9c5c9
NEW
aac2521c5b
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

15:37:00 WinXP 24.144.38.181 (CONWAYCORP.NET):
CONWAY CORPORATION,
CONWAY, ARKANSAS, US. (DSL) n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:641 hits: 12-31 to 09-28] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:15:48:00 Win2K-f 64.183.209.202 (RR.COM):
ROAD RUNNER HOLDCO LLC,
DALLAS, TEXAS, US. n/a US:microsoft.com
US:download.microsoft.com
US:209.84.20.126:80
US:8.12.222.126:80 135 pcap raw alerts
ruleset http
60 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
b7082104e4
[Firefox:152 hits: 06-18 to 09-28] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

15:52:00 Win2K-f 4.137.69.44 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NASHVILLE, TENNESSEE, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
116 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
8 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28]
b7082104e4
[Firefox:152 hits: 06-18 to 09-28] none[4]
b5919931fe[1]
none [4] none:none
ASM:Graph
none:none
tElock|
ASProtect|
tElock| none
lines=90
none trace
trace
trace

16:05:00 Win2K-f 98.134.67.30 (-):
. n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
115.126.2.121:65520
US:192.221.96.126:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 28 of 33
31 of 33 6d86a1ff5a
[Firefox:38 hits: 06-25 to 09-22]
7f6e032fc0
[Firefox:38 hits: 06-25 to 09-22] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

16:11:00 WinXP 4.156.97.124 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BOSTON, MASSACHUSETTS, US. (DIAL) n/a DE:siliconfireware.ru
:wpad
US:searchportal.information.com
US:spi.domainsponsor.com
US:204.13.161.51:80 445 pcap raw alerts
ruleset http
http
11 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:545 hits: 01-01 to 09-28] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

T:16:14:00 WinXP 12.77.212.252 (ATT.NET):
AT&T WORLDNET SERVICES,
MORRISTOWN, NEW JERSEY, US. (DIAL) n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
GB:new.egg.com
:wpad
RU:www.bbin.ru
RU:www.binbank.ru
GB:217.145.225.22:80 445 pcap raw alerts
ruleset http
http
http
http
http
41 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
[Firefox:258 hits: 01-01 to 09-28] 9bbdd086c5 [0] ASM:Graph
ASPack| lines=186
embedded dns trace

16:32:00 WinXP 67.53.5.241 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MILWAUKEE, WISCONSIN, US. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

16:34:00 WinXP 208.83.218.204 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 eca9a5fa95
[Firefox:21 hits: 08-09 to 09-28] none[none] none:none
none|none none none

T:16:37:00 WinXP 99.163.49.26 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
17 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:143 hits: 01-08 to 09-28] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

T:16:41:00 Win2K-f 165.123.123.71 (UPENN.EDU):
UNIVERSITY OF PENNSYLVANIA,
PHILADELPHIA, PENNSYLVANIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.231:80
US:208.111.153.236:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

16:41:00 WinXP 210.139.204.206 (SO-NET.NE.JP):
SO-NET ENTERTAINMENT CORPORATION,
NAHA, OKINAWA, JP. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:16:43:00 WinXP 4.158.198.206 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CHICAGO, ILLINOIS, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.231:80
US:208.111.153.236:80 135 pcap raw alerts
ruleset other
101 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

16:56:00 WinXP 67.150.252.74 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
SAN JOSE, CALIFORNIA, US. n/a 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

17:09:00 WinXP 66.249.175.71 (SPEAKEASY.NET):
US. n/a EU:siliconfireware.ru
US:searchportal.information.com
DE:ebookfinaltrash.ru
:wpad
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
http
4 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:545 hits: 01-01 to 09-28] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

17:12:00 WinXP 65.65.57.143 (SWBELL.NET):
PPPOX POOL - RBACK2 WACOTX 081004-1919,
LORENA, TEXAS, US. (DSL) n/a RU:moscow-advokat.ru
:flanders.be.eu.undernet.org
:gaspode.zanet.org.za
NO:london.uk.eu.undernet.org
:washington.dc.us.undernet.org
:brussels.be.eu.undernet.org
SE:coins.dal.net
NL:diemen.nl.eu.undernet.org 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:641 hits: 12-31 to 09-28] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

17:16:00 Win2K-f 70.71.4.86 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
NEW WESTMINSTER, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
79 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:17:18:00 Win2K-f 4.239.249.106 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WHITEHALL, PENNSYLVANIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
156 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

17:21:00 WinXP 219.110.165.209 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:413 hits: 01-05 to 09-28] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

17:24:00 WinXP 64.141.65.231 (MERCURYSPEED.COM):
BIG PIPE INC,
KAMLOOPS, BRITISH COLUMBIA, CA. n/a 135 pcap raw alerts
ruleset other
5 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:17:26:00 WinXP 71.109.33.111 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
GLENDORA, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80
US:207.123.37.124:80
US:8.12.202.125:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:17:34:00 WinXP 190.137.117.41 (NET.AR):
TELECOM ARGENTINA S.A,
AR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 71b183b0c8
[Firefox: 7 hits: 09-17 to 09-28] none[none] none:none
none|none none none

T:18:04:00 WinXP 68.147.41.25 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.219:80
US:208.111.148.226:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:18:20:00 WinXP 116.126.134.186 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:198.78.201.126:80
US:199.93.44.126:80
US:199.93.53.125:80 135 pcap raw alerts
ruleset other
124 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 0c3d1ec2df
[Firefox: 9 hits: 08-11 to 09-21]
8de905030e
[Firefox: 9 hits: 08-11 to 09-21] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:18:24:00 WinXP 76.178.247.46 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:124 hits: 01-03 to 09-27] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

18:28:00 WinXP 41.214.176.163 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:18:29:00 WinXP 41.214.176.163 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1183 hits: 12-31 to 09-28] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

18:30:00 Win2K-f 4.239.249.106 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WHITEHALL, PENNSYLVANIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.124:80 135 pcap raw alerts
ruleset other
177 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:18:36:00 Win2K-f 4.248.43.126 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) n/a 135 pcap raw alerts
ruleset other
146 lines Yeah : 1.3
profile none summary
tarball 0 of 33 a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] a08f3b74a4 [1] ASM:Graph
Armadillo| lines=81 trace

18:52:00 Win2K-f 4.136.24.187 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
ATLANTA, GEORGIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.115:80 135 pcap raw alerts
ruleset other
127 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

18:58:00 Win2K-f 4.152.111.196 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WINSTON SALEM, NORTH CAROLINA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80 135 pcap raw alerts
ruleset other
169 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

19:05:00 WinXP 24.87.167.55 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
RICHMOND, BRITISH COLUMBIA, CA. (DSL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 34 of 36 68bb55178d
NEW none[none] none:none
none|none none none

T:19:28:00 Win2K-f 4.174.178.38 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CAMDEN, NEW JERSEY, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.174:80
US:208.111.148.219:80 135 pcap raw alerts
ruleset other
124 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:19:42:00 Win2K-f 122.52.75.194 (PLDT.NET):
IPG,
PH. n/a US:microsoft.com
US:download.microsoft.com
:proxim.ircgalaxy.pl
115.126.2.121:65520
US:204.160.126.124:80
US:206.33.45.125:80
US:207.123.42.126:80 135 pcap raw alerts
ruleset other
126 lines Yeah : 1.3
profile none summary
tarball 29 of 33
33 of 33 16874933ea
[Firefox:45 hits: 06-18 to 09-21]
76ee340669
[Firefox:45 hits: 06-18 to 09-21] 16874933ea [1]
none [4] ASM:Graph
none:none
Armadillo|
PolyEnE| lines=82
none trace
trace

19:44:00 WinXP 122.109.212.81 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:206.33.45.125:80
US:207.123.42.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28]
e07c29c4ae
[Firefox:521 hits: 06-19 to 09-28] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

19:47:00 Win2K-f 75.33.93.30 (SBCGLOBAL.NET):
PPPOX POOL - RBACK7 BCVLOH,
CLEVELAND, OHIO, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:207.123.42.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

20:03:00 Win2K-f 67.4.134.242 (QWEST.NET):
QWEST COMMUNICATIONS CORPORATION,
CHANHASSEN, MINNESOTA, US. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520 135 pcap raw alerts
ruleset http
184 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 0617ab2cf7
[Firefox: 2 hits: 08-05 to 08-13]
b33f1ae548
[Firefox: 2 hits: 08-05 to 08-13] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:20:06:00 Win2K-f 172.163.36.61 (AOL.COM):
AMERICA ONLINE,
US. n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

20:33:00 Win2K-f 66.209.131.154 (BRIGHT.NET):
TSC,
AKRON, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.174:80 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 33 of 35
31 of 35 039e3fa376
[Firefox: 5 hits: 07-24 to 09-24]
76f2c59ef8
[Firefox: 5 hits: 07-24 to 09-24] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:20:38:00 WinXP 74.70.56.177 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AVERILL PARK, NEW YORK, US. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball 29 of 29 492957db81
[Firefox:19 hits: 01-01 to 09-14] 064e4d7742 [0] ASM:Graph
PolyEnE| lines=69
embedded dns trace

20:39:00 WinXP 121.125.21.145 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:208.111.148.174:80
US:208.111.148.219:80 135 pcap raw alerts
ruleset other
86 lines Yeah : 1.3
profile none summary
tarball 31 of 33
0 of 33 168aab35a3
[Firefox:145 hits: 06-17 to 09-28]
4c3df24b32
[Firefox:201 hits: 06-17 to 09-28] none[4]
4c3df24b32[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

20:48:00 Win2K-f 4.160.252.178 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
DAYTON, OHIO, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.54:80 135 pcap raw alerts
ruleset other
137 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

20:52:00 WinXP 211.215.38.95 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:208.111.148.54:80
US:208.111.148.69:80 135 pcap raw alerts
ruleset other
119 lines Yeah : 1.3
profile none summary
tarball 30 of 33
28 of 33 533d15b5ce
[Firefox:28 hits: 06-21 to 09-26]
58c343a8d8
[Firefox:31 hits: 06-21 to 09-26] none[4]
58c343a8d8[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

20:57:00 WinXP 98.141.161.158 (-):
. n/a 135 pcap raw alerts
ruleset other
19 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:21:15:00 Win2K-f 96.14.141.138 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.123:80
US:8.12.202.125:80 135 pcap raw alerts
ruleset http
216 lines Yeah : 1.3
profile none summary
tarball 31 of 33
29 of 34
0 of 32 0bfa79dc19
[Firefox:14 hits: 07-22 to 09-26]
8dfb3b619f
[Firefox:15 hits: 07-22 to 09-26]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28] none[none]
none [none]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
none|none
ASProtect| none
none
lines=90 none
none
trace

21:22:00 WinXP 202.125.57.194 (CTT.NE.JP):
CABLE TELEVISION TOYAMA INCORPORETED,
TOKYO, TOKYO, JP. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:641 hits: 12-31 to 09-28] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

22:02:00 WinXP 62.11.87.15 (DIALUP.TISCALI.IT):
TISCALI ITALIA SPA,
GENOA, LIGURIA, IT. (DIAL) n/a DE:siliconfireware.ru
US:searchportal.information.com
:wpad
US:208.73.210.32:80 445 pcap raw alerts
ruleset http
http
http
4 lines Yeah : 0.8
profile none summary
tarball 28 of 29 330eaa2da2
[Firefox:19 hits: 01-28 to 09-17] none[3] none:none
ASPack| none trace

22:14:00 Win2K-f 207.5.188.162 (GWI.NET):
GREAT WORKS INTERNET,
SHAPLEIGH, MAINE, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.226:80
US:208.111.148.247:80 135 pcap raw alerts
ruleset other
89 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:22:00 WinXP 219.174.36.53 (BBTEC.NET):
JAPAN NATION-WIDE NETWORK OF SOFTBANK BB CORP,
TOKYO, TOKYO, JP. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.226:80
US:208.111.148.247:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
a08f3b74a4
[Firefox:909 hits: 06-18 to 09-28] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:28:00 WinXP 24.80.118.202 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BURNABY, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.219:80
US:208.111.148.226:80 135 pcap raw alerts
ruleset other
127 lines Yeah : 1.3
profile none summary
tarball 33 of 36
31 of 36 0115338c8b
[Firefox: 5 hits: 09-12 to 09-26]
321f4fc27d
[Firefox: 5 hits: 09-12 to 09-26] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:22:32:00 WinXP 72.251.92.147 (1DIAL.COM):
AD-BASE SYSTEMS INC. (DBA GLOBALPOPS),
PITTSBURGH, PENNSYLVANIA, US. (DIAL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 ca47a36342
[Firefox: 8 hits: 02-16 to 09-19] c3a58f69c6 [0] ASM:Graph
PolyEnE| lines=89
embedded dns trace

22:39:00 Win2K-f 209.127.71.14 (-):
KINGSVILLE CITY HALL,
KINGSVILLE, TEXAS, US. (100Mbps) n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:208.111.148.226:80
US:208.111.148.247:80 135 pcap raw alerts
ruleset other
115 lines Yeah : 1.3
profile none summary
tarball 34 of 36
32 of 36 a8c074e136
[Firefox: 2 hits: 08-21 to 09-25]
fc22cbd605
[Firefox: 2 hits: 08-21 to 09-25] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

22:42:00 WinXP 124.100.65.114 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:413 hits: 01-05 to 09-28] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

22:45:00 WinXP 85.85.81.138 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 35 of 36 42c8d9a857
NEW none[none] none:none
none|none none none

T:22:48:00 Win2K-f 192.160.7.142 (ALCATEL.COM):
ALCATEL NETWORK SERVICES,
PLANO, TEXAS, US. n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:208.111.173.47:80 135 pcap raw alerts
ruleset http
98 lines Yeah : 1.3
profile none summary
tarball 31 of 33
0 of 32
none 168aab35a3
[Firefox:145 hits: 06-17 to 09-28]
b5919931fe
[Firefox:676 hits: 06-20 to 09-28]
bba5ec5f4d
[Firefox: 2 hits: 09-22 to 09-27] none[4]
b5919931fe[1]
none [none] none:none
ASM:Graph
none:none
tElock|
ASProtect|
none|none none
lines=90
none trace
trace
none

22:52:00 Win2K-f 67.153.139.131 (ALGX.NET):
CONSOLIDATED SMART SYSTEMS LLC,
GARDENA, CALIFORNIA, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.96.126:80
US:207.123.37.126:80
US:207.123.42.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2582 hits: 06-17 to 09-28]
73f1082158
[Firefox:1280 hits: 06-18 to 09-28] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:57:00 WinXP 70.183.164.173 (COX.NET):
COX COMMUNICATIONS,
WARWICK, RHODE ISLAND, US. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:199.93.41.126:80
US:206.33.45.125:80 135 pcap raw alerts
ruleset http
115 lines Yeah : 1.3
profile none summary
tarball 32 of 36
0 of 33
35 of 36 bea8cb1865
[Firefox:19 hits: 08-11 to 09-27]
e07c29c4ae
[Firefox:521 hits: 06-19 to 09-28]
fac78fde16
[Firefox: 5 hits: 09-13 to 09-27] none[none]
e07c29c4ae[1]
none [none] none:none
ASM:Graph
none:none
none|none
FSG|
none|none none
lines=92
none none
trace
none

23:01:00 Win2K-f 218.38.149.240 (KRLINE.NET):
KRNIC,
KR. n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520 135 pcap raw alerts
ruleset http
125 lines Yeah : 1.3
profile none summary
tarball 30 of 33
31 of 33 2ef9098242
[Firefox: 2 hits: 07-05 to 07-19]
d789c8d157
[Firefox: 4 hits: 07-05 to 08-21] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:23:03:00 Win2K-f 96.11.196.93 (-):
. n/a US:microsoft.com
US:download.microsoft.com
:proxim.ircgalaxy.pl
115.126.2.121:65520
US:199.93.44.126:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 31 of 33
29 of 34 0bfa79dc19
[Firefox:14 hits: 07-22 to 09-26]
8dfb3b619f
[Firefox:15 hits: 07-22 to 09-26] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

23:11:00 Win2K-f 24.67.173.53 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
KELOWNA, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.174:80 135 pcap raw alerts
ruleset other
222 lines Yeah : 1.3
profile none summary
tarball 33 of 36
32 of 36 c295ae7d97
[Firefox: 3 hits: 09-21 to 09-28]
dd1fe232e8
[Firefox: 3 hits: 09-21 to 09-28] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:23:15:00 WinXP 151.118.205.32 (QWEST.NET):
QWEST BROADBAND,
LITTLETON, COLORADO, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 e540a70fe0
[Firefox: 4 hits: 09-21 to 09-28] none[none] none:none
none|none none none

23:19:00 WinXP 202.150.125.84 (-):
KOL-DIAL,
AUCKLAND, AUCKLAND, NZ. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520 135 pcap raw alerts
ruleset http
135 lines Yeah : 1.3
profile none summary
tarball 29 of 32
0 of 33
28 of 32 a1a5fa95b9
[Firefox: 3 hits: 06-22 to 08-19]
e07c29c4ae
[Firefox:521 hits: 06-19 to 09-28]
e655846fa1
[Firefox: 3 hits: 06-22 to 08-19] none[4]
e07c29c4ae[1]
e655846fa1[1] none:none
ASM:Graph
ASM:Graph
tElock|
FSG|
Armadillo| none
lines=92
lines=82 trace
trace
trace