Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

03 October 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

00:05:00 WinXP 60.249.205.93 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 35 of 36
32 of 36
0 of 33 7ca2287333
NEW
95ccd6eb89
NEW
e07c29c4ae
[Firefox:551 hits: 06-19 to 10-02] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

T:00:11:00 WinXP 92.124.163.63 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1227 hits: 12-31 to 10-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:00:15:00 WinXP 65.25.145.77 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COLUMBUS, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.54:80
US:208.111.148.69:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
73f1082158
[Firefox:1365 hits: 06-18 to 10-02] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:00:49:00 Win2K-f 76.89.18.176 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.174:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
a08f3b74a4
[Firefox:966 hits: 06-18 to 10-02] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:00:54:00 Win2K-f 75.36.121.141 (SBCGLOBAL.NET):
IRIS MFG INC,
PLANO, TEXAS, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.152:80
US:208.111.148.174:80 135 pcap raw alerts
ruleset other
74 lines Yeah : 1.3
profile none summary
tarball 1 of 33
33 of 33 4ca3056804
[Firefox: 5 hits: 06-18 to 09-30]
53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02] 4ca3056804 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

T:01:07:00 WinXP 122.146.243.45 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80
US:208.111.148.23:80 135 pcap raw alerts
ruleset other
199 lines Yeah : 1.3
profile none summary
tarball 34 of 36
31 of 36 58da508e93
NEW
b6e3df9fe9
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

01:15:00 WinXP 193.248.48.145 (ABO.WANADOO.FR):
WANADOO FRANCE,
MONTPELLIER, LANGUEDOC-ROUSSILLON, FR. n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 27 of 36 7dc200670b
NEW none[none] none:none
none|none none none

01:16:00 WinXP 92.112.172.95 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 36 2bf8f809de
NEW none[none] none:none
none|none none none

01:39:00 WinXP 217.184.65.242 (MEDIAWAYS.NET):
VARIOUS ONLINE SERVICES,
DE. n/a 445 pcap raw alerts
ruleset ftp
13 lines Yeah : 0.8
profile none summary
tarball 32 of 32 03f912899b
[Firefox:149 hits: 01-08 to 10-02] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

01:45:00 Win2K-f 70.182.165.214 (COX.NET):
COX COMMUNICATIONS,
FAYETTEVILLE, ARKANSAS, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
a08f3b74a4
[Firefox:966 hits: 06-18 to 10-02]
b5919931fe
[Firefox:727 hits: 06-20 to 10-02] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:01:48:00 WinXP 210.3.74.210 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 f276ec9a79
NEW none[none] none:none
none|none none none

02:13:00 WinXP 74.75.234.231 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:131 hits: 01-03 to 10-02] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

02:21:00 WinXP 118.216.26.27 (-):
. n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.247:80 135 pcap raw alerts
ruleset http
98 lines Yeah : 1.3
profile none summary
tarball 30 of 32
0 of 33
30 of 32 475d9a7753
[Firefox: 5 hits: 06-22 to 10-01]
e07c29c4ae
[Firefox:551 hits: 06-19 to 10-02]
e9a7fa27d5
[Firefox: 5 hits: 06-22 to 10-01] none[4]
e07c29c4ae[1]
e9a7fa27d5[1] none:none
ASM:Graph
ASM:Graph
tElock|
FSG|
Armadillo| none
lines=92
lines=82 trace
trace
trace

02:50:00 WinXP 118.86.72.36 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.231:80
US:208.111.153.236:80 135 pcap raw alerts
ruleset other
123 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 0b951c2832
[Firefox: 2 hits: 08-19 to 09-23]
e4ed4df0f0
[Firefox: 2 hits: 08-19 to 09-23] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

02:52:00 WinXP 58.237.174.89 (-):
THRUNET-INFRA-DAEGU11,
SEOUL, KYONGGI-DO, KR. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.153.231:80
US:208.111.153.236:80 135 pcap raw alerts
ruleset other
114 lines Yeah : 1.3
profile none summary
tarball 30 of 33
28 of 33 533d15b5ce
[Firefox:30 hits: 06-21 to 10-01]
58c343a8d8
[Firefox:33 hits: 06-21 to 10-01] none[4]
58c343a8d8[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=82 trace
trace

03:05:00 WinXP 85.85.66.197 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 8b3bea4baf
NEW none[none] none:none
none|none none none

T:03:05:00 WinXP 85.85.66.197 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 8b3bea4baf
NEW none[none] none:none
none|none none none

03:15:00 Win2K-f 4.179.134.240 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WALNUT CREEK, CALIFORNIA, US. (DIAL) n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:192.221.96.126:80
US:207.123.46.125:80
US:207.123.47.126:80 135 pcap raw alerts
ruleset other
263 lines Yeah : 1.3
profile none summary
tarball 35 of 36
32 of 36 31dbe08df8
NEW
78a1dce44a
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:03:16:00 WinXP 88.172.38.87 (PROXAD.NET):
PROXAD / FREE SAS,
FR. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none f9d832dfd2
NEW none[none] none:none
none|none none none

03:18:00 WinXP 222.237.114.222 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.96.126:80
US:207.123.46.125:80
US:207.123.47.126:80 135 pcap raw alerts
ruleset other
105 lines Yeah : 1.3
profile none summary
tarball 30 of 33
2 of 36 2e04b06527
[Firefox:10 hits: 06-18 to 09-29]
514265be41
NEW none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

03:21:00 WinXP 41.210.217.57 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 36 of 36 b872c76081
[Firefox:36 hits: 09-13 to 10-02] none[none] none:none
none|none none none

T:03:50:00 WinXP 125.231.3.30 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 ca47a36342
[Firefox:11 hits: 02-16 to 10-02] c3a58f69c6 [0] ASM:Graph
PolyEnE| lines=89
embedded dns trace

04:07:00 Win2K-f 4.137.79.91 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CHARLOTTE, NORTH CAROLINA, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
176 lines Yeah : 1.3
profile none summary
tarball 32 of 36 4bc6ee3dbb
NEW none[none] none:none
none|none none none

T:04:11:00 WinXP 219.107.204.51 (MESH.AD.JP):
BIGLOBE-CIDR-BLK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:578 hits: 01-01 to 10-02] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:04:24:00 WinXP 92.96.60.37 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset ftp
13 lines Yeah : 0.8
profile none summary
tarball 32 of 32 03f912899b
[Firefox:149 hits: 01-08 to 10-02] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

04:40:00 WinXP 213.22.71.117 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
LISBON, LISBOA, PT. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 22999be88c
[Firefox:29 hits: 04-05 to 10-02] eda2056971 [0] ASM:Graph
PolyEnE| lines=154
embedded dns trace

04:42:00 WinXP 41.214.168.128 (-):
. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:663 hits: 12-31 to 10-02] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

04:48:00 WinXP 59.103.69.118 (-):
. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 e4157a2cc3
[Firefox: 6 hits: 08-23 to 09-12] none[none] none:none
none|none none none

05:09:00 WinXP 70.184.102.222 (COX.NET):
COX COMMUNICATIONS,
CHANDLER, ARIZONA, US. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:192.221.110.125:80
US:198.78.201.126:80
US:204.160.126.124:80 135 pcap raw alerts
ruleset other
114 lines Yeah : 1.3
profile none summary
tarball 32 of 36
35 of 36 bea8cb1865
[Firefox:23 hits: 08-11 to 10-02]
fac78fde16
[Firefox: 6 hits: 09-13 to 09-29] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:05:10:00 Win2K-f 58.225.16.179 (HANANET.NET):
HANARO TELECOM INC,
KR. n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com 135 pcap raw alerts
ruleset http
125 lines Yeah : 1.3
profile none summary
tarball 27 of 33
31 of 33 1951eee0cd
[Firefox:11 hits: 06-18 to 09-28]
e5e0dbde57
[Firefox:11 hits: 06-18 to 09-28] 1951eee0cd [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=82
none trace
trace

T:05:11:00 WinXP 88.174.215.242 (PROXAD.NET):
PROXAD / FREE SAS,
FR. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 d2548a0bf5
NEW none[none] none:none
none|none none none

05:24:00 WinXP 124.100.12.206 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:578 hits: 01-01 to 10-02] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

05:39:00 Win2K-f 218.188.3.82 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. 72.10.172.211:8080 CA:xx.ka3ek.com
CA:zonetech.info
US:130.107.132.218:64213 135 pcap raw alerts
ruleset irc
http
304 lines Yeah : 1.8
profile none summary
tarball 22 of 36
21 of 36
21 of 36
10 of 36
26 of 36 1868867d02
NEW
3e01fb69e1
NEW
6b997bcb17
NEW
c025f08a76
[Firefox: 5 hits: 09-15 to 09-29]
d184a8ac3c
NEW none[none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none none
none
none
none
none

T:05:41:00 WinXP 87.252.138.147 (-):
T-MOBILE,
RIJEKA, PRIMORSKO-GORANSKA, HR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 eda98e1cd6
NEW none[none] none:none
none|none none none

05:47:00 WinXP 87.252.138.147 (-):
T-MOBILE,
RIJEKA, PRIMORSKO-GORANSKA, HR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 eda98e1cd6
NEW none[none] none:none
none|none none none

05:53:00 WinXP 220.144.143.188 (MESH.AD.JP):
NEC CORPORATION,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:434 hits: 01-05 to 10-02] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

06:32:00 Win2K-f 24.234.224.139 (COX.NET):
COX COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.96.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
a08f3b74a4
[Firefox:966 hits: 06-18 to 10-02] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:06:33:00 WinXP 213.168.35.75 (-):
JSC SZKTI,
RU. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1227 hits: 12-31 to 10-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:06:40:00 WinXP 92.41.130.13 (IKBCC.COM):
EU-ZZ,
UK. n/a :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 27 of 31 b82d9bcbfc
[Firefox: 3 hits: 04-08 to 09-26] 076c58f365 [0] ASM:Graph
ASPack| lines=294
embedded dns trace

06:53:00 WinXP 61.46.128.115 (ZAQ.NE.JP):
HIGASHI-OSAKA CABLE TELEVISION CO. LTD,
OSAKA, OSAKA, JP. n/a 135 pcap raw alerts
ruleset other
616 lines Yeah : 1.3
profile none summary
tarball 25 of 36 364cb81fee
NEW none[none] none:none
none|none none none

07:06:00 WinXP 76.161.225.191 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:07:16:00 WinXP 125.198.71.167 (MESH.AD.JP):
NEC CORPORATION,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:434 hits: 01-05 to 10-02] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

07:35:00 WinXP 116.121.133.5 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80
US:208.111.173.16:80 135 pcap raw alerts
ruleset other
144 lines Yeah : 1.3
profile none summary
tarball 31 of 33
24 of 33 6e2eaa0359
[Firefox:11 hits: 07-10 to 09-26]
740e3bffe0
[Firefox:12 hits: 06-25 to 09-26] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

07:40:00 WinXP 70.44.38.136 (PTD.NET):
PENTELEDATA INC. - CABLE,
DINGMANS FERRY, PENNSYLVANIA, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 71b183b0c8
[Firefox:10 hits: 09-17 to 10-01] none[none] none:none
none|none none none

07:50:00 Win2K-f 207.5.231.101 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
73f1082158
[Firefox:1365 hits: 06-18 to 10-02]
b5919931fe
[Firefox:727 hits: 06-20 to 10-02] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:07:52:00 WinXP 206.246.6.111 (ANDERSONMO.ORG):
MCDONALD COUNTY INTERNET,
US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1227 hits: 12-31 to 10-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

08:02:00 WinXP 4.252.134.209 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SYCAMORE, ILLINOIS, US. (DIAL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1227 hits: 12-31 to 10-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:04:00 WinXP 24.28.164.15 (RR.COM):
ROAD RUNNER HOLDCO LLC,
EL PASO, TEXAS, US. (100Mbps) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 1fcc146d70
[Firefox:51 hits: 01-02 to 09-28] 258fafe892 [0] ASM:Graph
PolyEnE| lines=68 trace

08:11:00 WinXP 67.0.37.25 (QWEST.NET):
QWEST COMMUNICATIONS CORPORATION,
OMAHA, NEBRASKA, US. (DIAL) n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
SE:kavkazcenter.com
SE:kavkazcenter.net
FI:kavkazchat.com
US:chechenpress.info
GB:chechenpress.co.uk
:shaheeds.org
US:daymohk.info
:chripress.org
:marsho.dk
US:www.jamaatshariat.com
GB:www.chechenpress.co.uk
FI:imgs2.kavkazcenter.com
FI:static.kavkazchat.com
US:72.29.65.216:80 445 pcap raw alerts
ruleset http
http
150 lines Yeah : 0.8
profile none summary
tarball 29 of 29 ab5e47bf8d
[Firefox:43 hits: 01-02 to 10-02] none[3] none:none
ASPack| none trace

09:02:00 WinXP 118.174.76.30 (-):
. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 34 of 36 2e9f4c97cc
[Firefox: 2 hits: 09-24 to 09-30] none[none] none:none
none|none none none

T:09:03:00 WinXP 118.174.76.30 (-):
. n/a :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 34 of 36 2e9f4c97cc
[Firefox: 2 hits: 09-24 to 09-30] none[none] none:none
none|none none none

09:35:00 WinXP 24.88.237.70 (RR.COM):
ROAD RUNNER HOLDCO LLC,
FAYETTEVILLE, NORTH CAROLINA, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 d42c1cc7c0
[Firefox:140 hits: 01-01 to 09-30] af9ca5bed1 [0] ASM:Graph
PolyEnE| lines=54 trace

09:43:00 WinXP 41.214.174.70 (-):
. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 35 of 36 c9d01112a8
[Firefox:11 hits: 08-06 to 09-18] none[none] none:none
none|none none none

09:46:00 Win2K-f 70.184.153.71 (COX.NET):
COX COMMUNICATIONS,
PHOENIX, ARIZONA, US. n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 32 of 36
35 of 36 bea8cb1865
[Firefox:23 hits: 08-11 to 10-02]
fac78fde16
[Firefox: 6 hits: 09-13 to 09-29] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:09:59:00 WinXP 209.214.201.61 (BELLSOUTH.NET):
BELLSOUTH.NET INC,
GREENVILLE, SOUTH CAROLINA, US. n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:www.proxy-socks.net
:wpad 445 pcap raw alerts
ruleset http
http
http
19 lines Yeah : 0.8
profile none summary
tarball 0 of 36
29 of 29 911b634a4d
NEW
a12cab51ef
[Firefox:555 hits: 01-01 to 10-02] none[none]
40f7f463c4[0] none:none
ASM:Graph
none|none
ASPack| none
lines=281
embedded dns none
trace

10:01:00 WinXP 4.143.104.115 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
FERGUS FALLS, MINNESOTA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
99 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
b7082104e4
[Firefox:163 hits: 06-18 to 10-02]
e07c29c4ae
[Firefox:551 hits: 06-19 to 10-02] none[4]
none [4]
e07c29c4ae[1] none:none
none:none
ASM:Graph
tElock|
tElock|
FSG| none
none
lines=92 trace
trace
trace

T:10:05:00 WinXP 75.177.17.155 (RR.COM):
ROAD RUNNER HOLDCO LLC,
GREENSBORO, NORTH CAROLINA, US. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:663 hits: 12-31 to 10-02] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:10:08:00 WinXP 201.172.244.48 (INTERCABLE.NET):
TELEVISION INTERNACIONAL S.A. DE C.V,
MONTERREY, NUEVO LEON, MX. n/a 445 pcap raw alerts
ruleset http
1 line Argh : 0.3
profile none summary
tarball none none none none none none none

10:12:00 WinXP 92.20.219.10 (-):
CARPHONE WAREHOUSE BROADBAND SERVICES,
UK. n/a :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 35 of 36 b632266bbd
[Firefox: 5 hits: 09-21 to 09-29] none[none] none:none
none|none none none

10:19:00 WinXP 212.72.19.151 (OMANTEL.NET.OM):
OMAN TELECOMMUNICATIONS COMPANY,
MUSCAT, MASQAT, OM. n/a DE:siliconfireware.ru
US:searchportal.information.com
RU:www.bbin.ru
RU:www.binbank.ru
:wpad
DE:217.11.54.126:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
http
http
26 lines Yeah : 0.8
profile none summary
tarball 0 of 36
29 of 29 40e14e3ac3
NEW
a12cab51ef
[Firefox:555 hits: 01-01 to 10-02] none[none]
40f7f463c4[0] none:none
ASM:Graph
none|none
ASPack| none
lines=281
embedded dns none
trace

T:10:39:00 WinXP 77.198.63.214 (GAOLAND.NET):
DYNAMIC POOLS,
FR. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 b872c76081
[Firefox:36 hits: 09-13 to 10-02] none[none] none:none
none|none none none

10:42:00 WinXP 207.5.188.162 (GWI.NET):
GREAT WORKS INTERNET,
SHAPLEIGH, MAINE, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
96 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
73f1082158
[Firefox:1365 hits: 06-18 to 10-02]
e07c29c4ae
[Firefox:551 hits: 06-19 to 10-02] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:10:51:00 Win2K-f 220.130.54.114 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.15:80 135 pcap raw alerts
ruleset http
96 lines Yeah : 1.3
profile none summary
tarball 0 of 33
29 of 32 57ce4acac2
[Firefox:223 hits: 06-17 to 10-02]
83f26f5044
[Firefox:23 hits: 06-20 to 09-30] 57ce4acac2 [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

T:11:00:00 WinXP 117.99.20.202 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:663 hits: 12-31 to 10-02] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:11:22:00 WinXP 92.96.204.21 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:149 hits: 01-08 to 10-02] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

11:24:00 WinXP 24.80.122.119 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
BURNABY, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80
US:208.111.148.43:80 135 pcap raw alerts
ruleset other
96 lines Yeah : 1.3
profile none summary
tarball 31 of 32
2 of 32 607b60ad51
[Firefox:39 hits: 06-20 to 09-28]
e5c7bce70e
[Firefox:38 hits: 06-20 to 09-28] none[4]
e5c7bce70e[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

11:38:00 WinXP 189.48.206.213 (BRASILTELECOM.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1227 hits: 12-31 to 10-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

11:38:00 WinXP 165.29.122.25 (AR.US):
ARKANSAS PUBLIC SCHOOL COMPUTER NETWORK,
MONTICELLO, ARKANSAS, US. n/a RU:moscow-advokat.ru
NL:london.uk.eu.undernet.org
SE:coins.dal.net
:los-angeles.ca.us.undernet.org
AT:graz.at.eu.undernet.org
SE:qis.md.us.dal.net
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:663 hits: 12-31 to 10-02] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:11:40:00 WinXP 165.29.122.25 (AR.US):
ARKANSAS PUBLIC SCHOOL COMPUTER NETWORK,
MONTICELLO, ARKANSAS, US. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:663 hits: 12-31 to 10-02] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:11:49:00 WinXP 89.41.89.106 (HOST-89-41-64-10.MOLDTELECOM.MD):
JSC MOLDTELECOM SA,
CHISINAU, CHISINAU, MD. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 36 8dbc2b2f86
NEW none[none] none:none
none|none none none

11:49:00 WinXP 89.41.89.106 (HOST-89-41-64-10.MOLDTELECOM.MD):
JSC MOLDTELECOM SA,
CHISINAU, CHISINAU, MD. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 35 of 36 8dbc2b2f86
NEW none[none] none:none
none|none none none

T:11:51:00 Win2K-f 24.213.224.230 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AMSTERDAM, NEW YORK, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.231:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
a08f3b74a4
[Firefox:966 hits: 06-18 to 10-02] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

12:02:00 WinXP 94.137.6.126 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 b872c76081
[Firefox:36 hits: 09-13 to 10-02] none[none] none:none
none|none none none

12:04:00 Win2K-f 61.218.193.250 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.52:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
57ce4acac2
[Firefox:223 hits: 06-17 to 10-02] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

12:08:00 WinXP 76.78.49.225 (APOGEENET.NET):
APOGEE TELECOM INC,
AUSTIN, TEXAS, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 2d6c8c447f
[Firefox: 8 hits: 09-16 to 09-30] none[none] none:none
none|none none none

T:12:08:00 WinXP 76.78.49.225 (APOGEENET.NET):
APOGEE TELECOM INC,
AUSTIN, TEXAS, US. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 2d6c8c447f
[Firefox: 8 hits: 09-16 to 09-30] none[none] none:none
none|none none none

12:29:00 WinXP 75.79.45.73 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80
US:208.111.148.69:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
a08f3b74a4
[Firefox:966 hits: 06-18 to 10-02] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:12:31:00 WinXP 74.70.250.73 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AVERILL PARK, NEW YORK, US. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball 29 of 29 492957db81
[Firefox:20 hits: 01-01 to 09-29] 064e4d7742 [0] ASM:Graph
PolyEnE| lines=69
embedded dns trace

12:31:00 WinXP 74.70.250.73 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AVERILL PARK, NEW YORK, US. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball 29 of 29 492957db81
[Firefox:20 hits: 01-01 to 09-29] 064e4d7742 [0] ASM:Graph
PolyEnE| lines=69
embedded dns trace

12:37:00 WinXP 67.10.218.137 (RR.COM):
ROAD RUNNER HOLDCO LLC,
SUGAR LAND, TEXAS, US. n/a RU:moscow-advokat.ru
:caen.fr.eu.undernet.org
:gaspode.zanet.org.za
SE:coins.dal.net
SE:viking.dal.net
US:lia.zanet.net
:los-angeles.ca.us.undernet.org
:lulea.se.eu.undernet.org
:brussels.be.eu.undernet.org
AT:graz.at.eu.undernet.org
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:663 hits: 12-31 to 10-02] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

12:41:00 WinXP 92.96.221.15 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 71b183b0c8
[Firefox:10 hits: 09-17 to 10-01] none[none] none:none
none|none none none

12:58:00 WinXP 83.132.235.126 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
CASCAIS, LISBOA, PT. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 a85b7b6e78
NEW none[none] none:none
none|none none none

T:13:08:00 WinXP 12.218.179.223 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
COLUMBUS, GEORGIA, US. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball 29 of 29 d175bad0e6
[Firefox: 6 hits: 04-05 to 08-27] dfb15f5463 [0] ASM:Graph
tElock| lines=81
embedded dns trace

T:13:13:00 WinXP 88.175.93.243 (PROXAD.NET):
PROXAD / FREE SAS,
FR. n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 36 of 36 e98a5fa83f
NEW none[none] none:none
none|none none none

13:21:00 WinXP 212.27.28.219 (-):
MLIFENET,
RU. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball 35 of 36 9bd024b012
NEW none[none] none:none
none|none none none

13:27:00 WinXP 85.86.105.245 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 f5ab9763ea
NEW none[none] none:none
none|none none none

T:13:27:00 WinXP 85.86.105.245 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 35 of 36 f5ab9763ea
NEW none[none] none:none
none|none none none

13:41:00 Win2K-f 4.238.16.226 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
ORLANDO, FLORIDA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
b7082104e4
[Firefox:163 hits: 06-18 to 10-02] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

13:47:00 WinXP 98.141.162.124 (-):
. n/a 135 pcap raw alerts
ruleset other
19 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:14:02:00 WinXP 88.164.107.11 (PROXAD.NET):
PROXAD / FREE SAS,
FR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 ea096a2bdf
[Firefox:18 hits: 07-12 to 09-30] none[none] none:none
none|none none none

T:14:04:00 WinXP 92.96.80.208 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:149 hits: 01-08 to 10-02] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

14:07:00 WinXP 208.222.46.228 (WHEATSTATE.COM):
NETWORK TOOL AND DIE COMPANY,
UDALL, KANSAS, US. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 393d3a40db
[Firefox: 6 hits: 02-14 to 08-19] 8a0ff8065a [0] ASM:Graph
PolyEnE| lines=76 trace

T:14:07:00 WinXP 208.222.46.228 (WHEATSTATE.COM):
NETWORK TOOL AND DIE COMPANY,
UDALL, KANSAS, US. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 31 of 32 393d3a40db
[Firefox: 6 hits: 02-14 to 08-19] 8a0ff8065a [0] ASM:Graph
PolyEnE| lines=76 trace

14:17:00 Win2K-f 71.100.5.153 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
BRANDON, FLORIDA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
a08f3b74a4
[Firefox:966 hits: 06-18 to 10-02]
b5919931fe
[Firefox:727 hits: 06-20 to 10-02] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:14:24:00 Win2K-f 70.168.7.39 (COX.NET):
COX COMMUNICATIONS,
BRISTOL, RHODE ISLAND, US. n/a US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
73f1082158
[Firefox:1365 hits: 06-18 to 10-02]
b5919931fe
[Firefox:727 hits: 06-20 to 10-02] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:14:34:00 WinXP 85.85.112.29 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 3f61da26e7
NEW none[none] none:none
none|none none none

T:14:34:00 Win2K-f 24.77.23.207 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VICTORIA, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:204.160.126.124:80 135 pcap raw alerts
ruleset other
133 lines Yeah : 1.3
profile none summary
tarball none
none 40870345c3
[Firefox: 6 hits: 09-22 to 10-02]
6c539a9f23
[Firefox: 6 hits: 09-22 to 10-02] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:14:45:00 WinXP 151.118.210.161 (QWEST.NET):
QWEST BROADBAND,
LITTLETON, COLORADO, US. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

14:49:00 Win2K-f 4.225.21.109 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
KOKOMO, INDIANA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:207.123.46.126:80 135 pcap raw alerts
ruleset other
90 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
a08f3b74a4
[Firefox:966 hits: 06-18 to 10-02] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

14:49:00 WinXP 70.253.240.163 (SWBELL.NET):
PPPOX POOL - RBACK2 WACOTX 081004-1919,
US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 25 of 36 9c1f1407f9
NEW none[none] none:none
none|none none none

T:14:51:00 WinXP 70.253.240.163 (SWBELL.NET):
PPPOX POOL - RBACK2 WACOTX 081004-1919,
US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 25 of 36 9c1f1407f9
NEW none[none] none:none
none|none none none

T:15:12:00 WinXP 92.96.248.12 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:149 hits: 01-08 to 10-02] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

15:32:00 Win2K-f 211.119.72.250 (BORA.NET):
BORANET-NET,
KR. n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:207.123.37.124:80 135 pcap raw alerts
ruleset other
222 lines Yeah : 1.3
profile none summary
tarball 30 of 34
34 of 36 3060fff5c0
NEW
a7d11d75cd
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

15:38:00 Win2K-f 75.6.244.159 (SBCGLOBAL.NET):
RBACK5.PLTNCA,
SAN JOSE, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
73f1082158
[Firefox:1365 hits: 06-18 to 10-02] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

15:39:00 WinXP 190.188.207.42 (NET.AR):
PRIMA S.A,
AR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 cdf36e1cce
NEW none[none] none:none
none|none none none

T:16:20:00 WinXP 88.31.140.118 (RIMA-TDE.NET):
TELEFONICA MOVILES ESPANA (NCC#2007041930),
ES. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1227 hits: 12-31 to 10-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

16:23:00 WinXP 75.138.118.93 (CHARTER.COM):
CHARTER COMMUNICATIONS,
HICKORY, NORTH CAROLINA, US. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 35 of 36 632e315db2
NEW none[none] none:none
none|none none none

16:28:00 Win2K-f 75.136.138.238 (CHARTER.COM):
CHARTER COMMUNICATIONS,
HICKORY, NORTH CAROLINA, US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:16:46:00 Win2K-f 211.20.205.89 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.104.126:80
US:204.160.126.124:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
57ce4acac2
[Firefox:223 hits: 06-17 to 10-02]
b5919931fe
[Firefox:727 hits: 06-20 to 10-02] none[4]
57ce4acac2[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

16:59:00 WinXP 86.99.88.234 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:434 hits: 01-05 to 10-02] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

17:00:00 Win2K-f 98.135.213.252 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:198.78.201.126:80
US:199.93.44.126:80 135 pcap raw alerts
ruleset http
135 lines Yeah : 1.3
profile none summary
tarball 31 of 33
29 of 34 0bfa79dc19
[Firefox:18 hits: 07-22 to 10-02]
8dfb3b619f
[Firefox:19 hits: 07-22 to 10-02] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:17:08:00 WinXP 118.174.78.67 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1227 hits: 12-31 to 10-02] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

17:16:00 Win2K-f 24.76.160.169 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80
US:208.111.148.115:80 135 pcap raw alerts
ruleset other
94 lines Yeah : 1.3
profile none summary
tarball 33 of 33
25 of 34 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
b6cf789b7d
[Firefox: 4 hits: 07-22 to 09-22] none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

18:03:00 WinXP 119.128.114.5, 76.78.48.61 (INVALID IPV4 ADDRESS):
INVALID IPV4 ADDRESS,
INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS. (INVALID IPV4 ADDRESS) 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 2d6c8c447f
[Firefox: 8 hits: 09-16 to 09-30] none[none] none:none
none|none none none

18:22:00 WinXP 170.51.33.39 (COM.AR):
CTI COMPANIA DE TELEFONAS DEL INTERIOR S.A,
AR. n/a 445 pcap raw alerts
ruleset other
0 lines Argh : 0.3
profile none summary
tarball none none none none none none none

18:34:00 WinXP 98.134.180.157 (-):
. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 5aeb4265bf
NEW none[none] none:none
none|none none none

18:37:00 WinXP 63.246.120.141 (SPEAKEASY.NET):
US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

18:37:00 Win2K-f 75.79.45.118 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.226:80 135 pcap raw alerts
ruleset http
37 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
b5919931fe
[Firefox:727 hits: 06-20 to 10-02] none[4]
b5919931fe[1] none:none
ASM:Graph
tElock|
ASProtect| none
lines=90 trace
trace

T:18:52:00 WinXP 67.150.120.147 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
LOS ANGELES, CALIFORNIA, US. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

18:57:00 Win2K-f 68.146.99.214 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

18:58:00 WinXP 211.18.90.31 (DION.NE.JP):
DION (KDDI CORPORATION),
JP. (DIAL) n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
GB:welcome3.smile.co.uk
:wpad
GB:195.92.84.198:80
DE:212.227.111.29:80
EU:78.47.200.154:80 445 pcap raw alerts
ruleset http
http
9 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:555 hits: 01-01 to 10-02] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

18:58:00 Win2K-f 211.22.172.147 (E-LEAD.COM.TW):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.16:80 135 pcap raw alerts
ruleset other
124 lines Yeah : 1.3
profile none summary
tarball 33 of 36
34 of 36 269540d8b6
NEW
9b272b04ec
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:18:59:00 WinXP 122.53.63.189 (PLDT.NET):
IPG,
PH. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 eb961a2d02
NEW none[none] none:none
none|none none none

T:19:42:00 WinXP 24.144.43.190 (CONWAYCORP.NET):
CONWAY CORPORATION,
CONWAY, ARKANSAS, US. (DSL) n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 f3aadc574a
NEW none[none] none:none
none|none none none

T:20:02:00 Win2K-f 99.146.195.180 (-):
. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
73f1082158
[Firefox:1365 hits: 06-18 to 10-02]
b5919931fe
[Firefox:727 hits: 06-20 to 10-02] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:20:25:00 Win2K-f 117.195.33.57 (-):
. 84.244.6.253:2345 :qtas.net
SE:dzuc.net 445 pcap raw alerts
ruleset http
irc
34 lines Yeah : 1.3
profile none summary
tarball 4 of 36 e52b187d6d
NEW none[none] none:none
none|none none none

21:05:00 Win2K-f 72.67.130.47 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
LOS ANGELES, CALIFORNIA, US. (DSL) n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
US:198.78.201.126:80
US:207.123.42.126:80 135 pcap raw alerts
ruleset http
114 lines Yeah : 1.3
profile none summary
tarball 33 of 36
35 of 36
0 of 32 5706f2fc14
[Firefox: 2 hits: 09-14 to 09-17]
68c7a1f625
[Firefox: 2 hits: 09-14 to 09-17]
b5919931fe
[Firefox:727 hits: 06-20 to 10-02] none[none]
none [none]
b5919931fe[1] none:none
none:none
ASM:Graph
none|none
none|none
ASProtect| none
none
lines=90 none
none
trace

T:21:24:00 Win2K-f 68.149.151.223 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
EDMONTON, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.219:80
US:208.111.148.226:80 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 31 of 36
33 of 36 0e394ae1b6
[Firefox: 2 hits: 09-26 to 09-26]
9365593ebb
[Firefox: 2 hits: 09-26 to 09-26] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:21:36:00 Win2K-f 208.125.77.239 (RR.COM):
ROAD RUNNER HOLDCO LLC,
SYRACUSE, NEW YORK, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
73f1082158
[Firefox:1365 hits: 06-18 to 10-02] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

21:53:00 Win2K-f 4.176.33.56 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
APACHE JUNCTION, ARIZONA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.46:80 135 pcap raw alerts
ruleset other
82 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
a08f3b74a4
[Firefox:966 hits: 06-18 to 10-02] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:22:05:00 WinXP 24.143.21.99 (COMMUNICOMM.COM):
JAMES CABLE,
TOLEDO, OHIO, US. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 35 of 36 f576060641
NEW none[none] none:none
none|none none none

T:22:18:00 WinXP 4.137.195.97 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CHARLOTTE, NORTH CAROLINA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80 135 pcap raw alerts
ruleset http
73 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33
0 of 33 53bfe15e91
[Firefox:2745 hits: 06-17 to 10-02]
b7082104e4
[Firefox:163 hits: 06-18 to 10-02]
e07c29c4ae
[Firefox:551 hits: 06-19 to 10-02] none[4]
none [4]
e07c29c4ae[1] none:none
none:none
ASM:Graph
tElock|
tElock|
FSG| none
none
lines=92 trace
trace
trace

22:50:00 Win2K-f 121.125.21.190 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. n/a US:microsoft.com
:proxima.ircgalaxy.pl
US:download.microsoft.com
US:207.123.42.126:80 135 pcap raw alerts
ruleset other
86 lines Yeah : 1.3
profile none summary
tarball 31 of 33
0 of 33 168aab35a3
[Firefox:152 hits: 06-17 to 10-02]
4c3df24b32
[Firefox:207 hits: 06-17 to 10-02] none[4]
4c3df24b32[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace