Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

21 October 2008
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

00:12:00 Win2K-f 211.207.251.34 (FRONTIEROIL.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 31 of 36 ea39b7911d
[Firefox: 6 hits: 08-15 to 10-20] none[none] none:none
none|none none none

T:00:13:00 Win2K-f 61.34.194.118 (BORA.NET):
DACOM CORP,
SEOUL, KYONGGI-DO, KR. (100Mbps) n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:207.123.37.125:80 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 32 of 33
30 of 33 3690b64ca2
[Firefox: 7 hits: 06-18 to 08-30]
a6fb77fd26
[Firefox: 7 hits: 06-18 to 08-30] none[4]
a6fb77fd26[1] none:none
ASM:Graph
PolyEnE|
Armadillo| none
lines=82 trace
trace

00:18:00 WinXP 120.143.167.181 (-):
. 63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 1.3
profile none summary
tarball 25 of 35 1be9d03a2b
[Firefox:12 hits: 07-29 to 10-20] none[none] none:none
none|none none none

T:00:22:00 WinXP 203.184.0.170 (CALLPLUS.NET.NZ):
CALLPLUS SERVICES LIMITED,
HAMILTON, WAIKATO, NZ. n/a 445 pcap raw alerts
ruleset ftp
13 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:476 hits: 12-31 to 10-20] 048df78048 [0] ASM:Graph
none|none lines=61 trace

T:00:24:00 WinXP 82.225.252.117 (PROXAD.NET):
PROXAD / FREE SAS,
BOULOGNE-BILLANCOURT, ILE-DE-FRANCE, FR. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:80
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 35 75347e3aaf
[Firefox: 3 hits: 10-11 to 10-13] none[none] none:none
none|none none none

T:00:25:00 WinXP 24.85.166.206 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COQUITLAM, BRITISH COLUMBIA, CA. (DSL) 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
26 lines Yeah : 1.3
profile none summary
tarball 29 of 34 e362f1c062
[Firefox: 6 hits: 08-15 to 10-20] none[none] none:none
none|none none none

T:00:30:00 WinXP 86.96.96.150 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 4ed031d88c
NEW none[none] none:none
none|none none none

00:30:00 Win2K-f 61.216.244.115 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 29 of 34 e362f1c062
[Firefox: 6 hits: 08-15 to 10-20] none[none] none:none
none|none none none

T:00:35:00 WinXP 115.88.2.118 (-):
. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 1.3
profile none summary
tarball 34 of 36 5b70b1f892
NEW none[none] none:none
none|none none none

00:40:00 Win2K-f 67.223.137.107 (-):
. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 25 of 36 7c2b50c774
[Firefox:13 hits: 08-01 to 09-26] none[none] none:none
none|none none none

00:43:00 WinXP 82.67.140.222 (PROXAD.NET):
PROXAD / FREE SAS,
NANTES, PAYS DE LA LOIRE, FR. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:00:54:00 Win2K-f 118.223.149.80 (-):
. 63.173.172.98:6668 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 1.3
profile none summary
tarball 30 of 36 2d146934f1
NEW none[none] none:none
none|none none none

00:57:00 WinXP 218.237.183.58 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 1.3
profile none summary
tarball 34 of 36 3a322fdf34
[Firefox: 2 hits: 09-26 to 10-20] none[none] none:none
none|none none none

00:59:00 Win2K-f 83.215.2.19 (SALZBURG-ONLINE.AT):
SALZBURG AG PROVIDES INTERNET-SERVICES,
SALZBURG, SALZBURG, AT. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 23 of 36 b3ce57c019
[Firefox: 3 hits: 08-15 to 08-15] none[none] none:none
none|none none none

01:00:00 Win2K-f 120.143.161.26 (-):
. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 1.3
profile none summary
tarball 31 of 34 aa268ff3a9
[Firefox: 5 hits: 08-15 to 10-20] none[none] none:none
none|none none none

T:01:02:00 WinXP 123.30.6.103 (-):
VIETNAM DATA COMMUNICATION COMPANY (VDC),
VN. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

01:07:00 Win2K-f 219.254.221.184 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 1.3
profile none summary
tarball 30 of 35 d142a982d2
[Firefox: 5 hits: 08-15 to 10-20] none[none] none:none
none|none none none

01:20:00 WinXP 213.45.147.222 (POOL21345.INTERBUSINESS.IT):
TELECOM ITALIA S.P.A,
FLORENCE, TOSCANA, IT. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:173 hits: 01-08 to 10-20] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

01:22:00 Win2K-f 211.25.135.159 (TIME.NET.MY):
TIME TELECOMMUNICATIONS SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 25 of 35 1be9d03a2b
[Firefox:12 hits: 07-29 to 10-20] none[none] none:none
none|none none none

T:01:24:00 WinXP 218.167.167.30 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
26 lines Yeah : 1.3
profile none summary
tarball 35 of 36 1d988e57e4
[Firefox: 6 hits: 09-26 to 10-20] none[none] none:none
none|none none none

01:26:00 WinXP 222.232.50.246 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 63.173.172.98:6668
US:63.173.172.98:6668 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 1.3
profile none summary
tarball 29 of 36 5daac7f4a5
NEW none[none] none:none
none|none none none

01:37:00 Win2K-f 211.203.122.27 (HANANET.NET):
HANARO TELECOM INC,
KR. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 29 of 35 ac25ac39b4
NEW none[none] none:none
none|none none none

T:01:42:00 Win2K-f 211.243.196.138 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 30 of 35 d142a982d2
[Firefox: 5 hits: 08-15 to 10-20] none[none] none:none
none|none none none

T:01:47:00 WinXP 211.207.251.34 (FRONTIEROIL.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 1.3
profile none summary
tarball 31 of 36 ea39b7911d
[Firefox: 6 hits: 08-15 to 10-20] none[none] none:none
none|none none none

T:01:49:00 WinXP 211.25.135.159 (TIME.NET.MY):
TIME TELECOMMUNICATIONS SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
26 lines Yeah : 1.3
profile none summary
tarball 25 of 35 1be9d03a2b
[Firefox:12 hits: 07-29 to 10-20] none[none] none:none
none|none none none

01:49:00 WinXP 211.186.2.31 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 1.3
profile none summary
tarball none af222ae6db
[Firefox: 2 hits: 08-15 to 08-15] none[none] none:none
none|none none none

T:01:49:00 WinXP 90.3.76.166 (ABO.WANADOO.FR):
IP2000-ADSL-BAS,
FR. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 1.3
profile none summary
tarball 29 of 34 e362f1c062
[Firefox: 6 hits: 08-15 to 10-20] none[none] none:none
none|none none none

01:52:00 Win2K-f 24.85.166.206 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COQUITLAM, BRITISH COLUMBIA, CA. (DSL) 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 29 of 34 e362f1c062
[Firefox: 6 hits: 08-15 to 10-20] none[none] none:none
none|none none none

01:54:00 WinXP 122.235.0.234 (HZ.ZJ.CN):
CHINANET ZHEJIANG PROVINCE NETWORK,
BEIJING, BEIJING, CN. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
115.126.2.121:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 65dac37941
NEW none[none] none:none
none|none none none

T:02:13:00 Win2K-f 120.143.161.26 (-):
. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 31 of 34 aa268ff3a9
[Firefox: 5 hits: 08-15 to 10-20] none[none] none:none
none|none none none

02:13:00 Win2K-f 202.40.179.22 (RANKSITT.NET):
INTERNET AND WAN SERVICE PROVIDER,
DHAKA, DHAKA, BD. n/a 135 pcap raw alerts
ruleset other
104 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:02:19:00 WinXP 122.118.134.33 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 c0e2e2d5ee
[Firefox: 5 hits: 10-12 to 10-20] none[none] none:none
none|none none none

02:22:00 WinXP 70.77.56.69 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:207.123.37.126:80 135 pcap raw alerts
ruleset http
115 lines Yeah : 1.3
profile none summary
tarball 31 of 32
0 of 33
23 of 33 bca9e0fb5f
[Firefox:37 hits: 06-18 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20]
e53a9ea82e
[Firefox:36 hits: 06-18 to 10-12] none[4]
e07c29c4ae[1]
e53a9ea82e[1] none:none
ASM:Graph
ASM:Graph
PolyEnE|
FSG|
Armadillo| none
lines=92
lines=81 trace
trace
trace

02:27:00 Win2K-f 86.218.91.11 (ABO.WANADOO.FR):
IP2000-ADSL-BAS,
PARIS, ILE-DE-FRANCE, FR. n/a 139 pcap raw alerts
ruleset ftp
26 lines Yeah : 0.8
profile none summary
tarball 32 of 36 c3868918c1
NEW none[none] none:none
none|none none none

02:34:00 WinXP 211.243.246.21 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 1.3
profile none summary
tarball 29 of 34 e362f1c062
[Firefox: 6 hits: 08-15 to 10-20] none[none] none:none
none|none none none

T:02:46:00 Win2K-f 61.17.42.36 (ETH.NET):
VIDESH SANCHAR NIGAM LTD - INDIA,
TRIVANDRUM, KERALA, IN. (DSL) n/a 139 pcap raw alerts
ruleset ftp
10 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

02:46:00 Win2K-f 218.167.167.30 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 35 of 36 1d988e57e4
[Firefox: 6 hits: 09-26 to 10-20] none[none] none:none
none|none none none

02:49:00 WinXP 75.34.107.250 (SBCGLOBAL.NET):
MOHSEN KHAZIRI DBA,
PLANO, TEXAS, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.247:80
US:208.111.148.254:80 135 pcap raw alerts
ruleset other
60 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
b7082104e4
[Firefox:216 hits: 06-18 to 10-20] none[4]
none [4] none:none
none:none
tElock|
tElock| none
none trace
trace

T:02:55:00 Win2K-f 211.203.122.27 (HANANET.NET):
HANARO TELECOM INC,
KR. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
41 lines Yeah : 1.3
profile none summary
tarball 29 of 35 ac25ac39b4
NEW none[none] none:none
none|none none none

02:59:00 WinXP 220.128.107.202 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
96 lines Yeah : 1.3
profile none summary
tarball 0 of 33
29 of 32
0 of 33 57ce4acac2
[Firefox:279 hits: 06-17 to 10-20]
83f26f5044
[Firefox:29 hits: 06-20 to 10-15]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] 57ce4acac2 [1]
none [4]
e07c29c4ae[1] ASM:Graph
none:none
ASM:Graph
Armadillo|
tElock|
FSG| lines=81
none
lines=92 trace
trace
trace

T:03:04:00 WinXP 119.95.115.83 (-):
. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 590e860fa7
NEW none[none] none:none
none|none none none

T:03:08:00 Win2K-f 70.248.127.149 (SWBELL.NET):
PPPOX POOL - BRAS14 RCSNTX,
DALLAS, TEXAS, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.137:80
US:208.111.148.174:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

03:11:00 Win2K-f 88.173.232.224 (PROXAD.NET):
PROXAD / FREE SAS,
FR. 63.173.172.98:6668
US:63.173.172.98:6668 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 1.3
profile none summary
tarball 30 of 36 9d31d168bd
NEW none[none] none:none
none|none none none

T:03:16:00 WinXP 58.233.18.182 (-):
THRUNET-INFRA-SEOUL14,
SEOUL, KYONGGI-DO, KR. 63.173.172.98:6668
US:63.173.172.98:6668 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 1.3
profile none summary
tarball 30 of 36 44ea4d3c7c
[Firefox: 4 hits: 09-26 to 10-20] none[none] none:none
none|none none none

T:03:21:00 Win2K-f 85.67.101.174 (-):
FIBERNET,
HU. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 31 of 36 28b1bbe949
NEW none[none] none:none
none|none none none

T:03:27:00 WinXP 79.163.182.87 (-):
IDEA,
PL. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 6b3beaea1a
NEW none[none] none:none
none|none none none

03:28:00 WinXP 79.163.182.87 (-):
IDEA,
PL. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 6b3beaea1a
NEW none[none] none:none
none|none none none

03:32:00 WinXP 125.231.4.148 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 26 of 28 ca47a36342
[Firefox:21 hits: 02-16 to 10-13] c3a58f69c6 [0] ASM:Graph
PolyEnE| lines=89
embedded dns trace

03:34:00 Win2K-f 140.239.42.144 (XO.NET):
XO COMMUNICATIONS,
HOPKINTON, MASSACHUSETTS, US. n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.126:80 135 pcap raw alerts
ruleset other
85 lines Yeah : 1.3
profile none summary
tarball 3 of 33
33 of 33 73ce2b74da
[Firefox:23 hits: 06-18 to 10-09]
79c01ec060
[Firefox:54 hits: 06-18 to 10-09] 73ce2b74da [1]
none [4] ASM:Graph
none:none
Armadillo|
tElock| lines=81
none trace
trace

03:34:00 WinXP 115.88.2.118 (-):
. 63.173.172.98:6668
US:63.173.172.98:6668 139 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 1.3
profile none summary
tarball 34 of 36 5b70b1f892
NEW none[none] none:none
none|none none none

T:03:47:00 WinXP 120.143.167.181 (-):
. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 1.3
profile none summary
tarball 25 of 35 1be9d03a2b
[Firefox:12 hits: 07-29 to 10-20] none[none] none:none
none|none none none

T:03:59:00 WinXP 218.51.100.36 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 1.3
profile none summary
tarball 29 of 35 ac25ac39b4
NEW none[none] none:none
none|none none none

04:01:00 WinXP 82.224.176.83 (PROXAD.NET):
PROXAD / FREE SAS,
MARSEILLE, PROVENCE-ALPES-COTE D'AZUR, FR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 f53f6ea4f8
NEW none[none] none:none
none|none none none

04:05:00 WinXP 79.138.197.241 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:168 hits: 01-03 to 10-20] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

T:04:06:00 WinXP 79.138.197.241 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:168 hits: 01-03 to 10-20] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

T:04:25:00 Win2K-f 211.186.2.31 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball none af222ae6db
[Firefox: 2 hits: 08-15 to 08-15] none[none] none:none
none|none none none

T:04:28:00 WinXP 124.86.71.146 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
TOKYO, TOKYO, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:485 hits: 01-05 to 10-20] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

04:32:00 WinXP 122.25.131.218 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:615 hits: 01-01 to 10-20] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:04:33:00 Win2K-f 203.73.84.106 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:207.123.42.126:80
US:4.23.60.126:80 135 pcap raw alerts
ruleset http
78 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
57ce4acac2
[Firefox:279 hits: 06-17 to 10-20]
b5919931fe
[Firefox:870 hits: 06-20 to 10-20] none[4]
57ce4acac2[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

05:00:00 WinXP 65.185.123.119 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LIMA, OHIO, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

05:13:00 WinXP 118.240.191.9 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:485 hits: 01-05 to 10-20] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

05:29:00 Win2K-f 123.213.246.134 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. 115.126.2.121:65520 US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com 135 pcap raw alerts
ruleset irc
http
128 lines Yeah : 1.8
profile none summary
tarball 30 of 33
2 of 36 2e04b06527
[Firefox:13 hits: 06-18 to 10-12]
514265be41
[Firefox: 3 hits: 09-24 to 10-04] none[4]
none [none] none:none
none:none
tElock|
none|none none
none trace
none

T:05:33:00 Win2K-f 119.94.236.39 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20]
b5919931fe
[Firefox:870 hits: 06-20 to 10-20] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:05:45:00 WinXP 210.18.50.126 (SIFY.NET):
ROSY BLUE (INDIA) PVT LTD,
IN. (100Mbps) n/a 135 pcap raw alerts
ruleset other
19 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

05:46:00 Win2K-f 84.216.36.121 (TELENOR.SE):
SPRAY NETWORKS AB,
STOCKHOLM, STOCKHOLM, SE. (DSL) 115.126.2.121:65520 :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset irc
11 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:05:47:00 Win2K-f 173.16.128.165 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
60 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
8 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
b5919931fe
[Firefox:870 hits: 06-20 to 10-20]
b7082104e4
[Firefox:216 hits: 06-18 to 10-20] none[4]
b5919931fe[1]
none [4] none:none
ASM:Graph
none:none
tElock|
ASProtect|
tElock| none
lines=90
none trace
trace
trace

05:50:00 WinXP 204.193.216.186 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
DENVER, COLORADO, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 33 of 34 a7003c5a33
NEW none[none] none:none
none|none none none

T:05:52:00 WinXP 121.254.82.181 (TCOL.COM.TW):
MONAD DIGITNAMIC CORP,
TW. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:06:17:00 WinXP 117.97.70.230 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. 115.126.2.121:65520 :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
irc
4 lines Yeah : 1.3
profile none summary
tarball 36 of 36 a0012f058f
NEW none[none] none:none
none|none none none

T:06:40:00 Win2K-f 123.238.145.53 (-):
RELIANCE INFOCOMM LIMITED,
MUMBAI, MAHARASHTRA, IN. n/a 135 pcap raw alerts
ruleset other
224 lines Yeah : 1.3
profile none summary
tarball 35 of 36 a7747c1662
NEW none[none] none:none
none|none none none

06:48:00 WinXP 92.113.73.252 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 b52d214d08
[Firefox: 8 hits: 10-05 to 10-20] none[none] none:none
none|none none none

06:55:00 WinXP 70.44.46.196 (PTD.NET):
PENTELEDATA INC. - CABLE,
DINGMANS FERRY, PENNSYLVANIA, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 632e315db2
[Firefox:18 hits: 10-03 to 10-20] none[none] none:none
none|none none none

T:07:03:00 WinXP 4.233.194.142 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NEW HAMPSHIRE, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
16 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:476 hits: 12-31 to 10-20] 048df78048 [0] ASM:Graph
none|none lines=61 trace

07:09:00 WinXP 115.165.63.153 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:485 hits: 01-05 to 10-20] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

07:17:00 WinXP 201.213.34.105 (NET.AR):
PRIMA S.A,
BUENOS AIRES, BUENOS AIRES, AR. (DSL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 33 of 36 25d31b9561
NEW none[none] none:none
none|none none none

07:34:00 WinXP 219.97.165.174 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:485 hits: 01-05 to 10-20] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:07:40:00 WinXP 64.184.89.30 (SWAYZEE.COM):
SWAYZEE TELEPHONE CO,
SWAYZEE, INDIANA, US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 49d6cdaab4
[Firefox:11 hits: 09-13 to 10-14] none[none] none:none
none|none none none

07:42:00 Win2K-f 118.222.82.117 (-):
. 115.126.2.121:65520 US:microsoft.com
:proxima.ircgalaxy.pl
US:download.microsoft.com
115.126.2.121:65520
US:208.111.173.45:80 135 pcap raw alerts
ruleset irc
140 lines Yeah : 1.8
profile none summary
tarball 34 of 36
34 of 36 79aff12cdd
NEW
f789de6c3b
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

07:59:00 Win2K-f 78.0.233.102 (T-COM.HR):
HPTNET,
HR. (DSL) 115.126.2.121:65520 :proxima.ircgalaxy.pl
115.126.2.121:65520 445 pcap raw alerts
ruleset irc
5 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:08:05:00 WinXP 67.223.137.107 (-):
. 63.173.172.98:6667
US:63.173.172.98:6667 139 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 1.3
profile none summary
tarball 25 of 36 7c2b50c774
[Firefox:13 hits: 08-01 to 09-26] none[none] none:none
none|none none none

08:12:00 Win2K-f 70.182.83.78 (COX.NET):
COX COMMUNICATIONS,
MUSKOGEE, OKLAHOMA, US. 115.126.2.121:65520 US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
115.126.2.121:65520
US:208.111.148.115:80 135 pcap raw alerts
ruleset irc
118 lines Yeah : 1.8
profile none summary
tarball 32 of 33
29 of 33 87e1117f2a
[Firefox:16 hits: 07-18 to 10-20]
b4fe4581c3
[Firefox:16 hits: 07-18 to 10-20] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:08:16:00 WinXP 190.137.93.244 (NET.AR):
TELECOM ARGENTINA S.A,
AR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 71b183b0c8
[Firefox:31 hits: 09-17 to 10-20] none[none] none:none
none|none none none

08:16:00 WinXP 78.156.223.194 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 b52d214d08
[Firefox: 8 hits: 10-05 to 10-20] none[none] none:none
none|none none none

T:08:17:00 WinXP 78.156.223.194 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 35 of 36 b52d214d08
[Firefox: 8 hits: 10-05 to 10-20] none[none] none:none
none|none none none

08:30:00 Win2K-f 98.25.101.80 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

08:46:00 WinXP 63.17.192.82 (UU.NET):
UUNET TECHNOLOGIES INC,
US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.96.126:80
US:198.78.201.126:80
US:207.123.37.123:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:08:49:00 Win2K-f 24.85.166.206 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COQUITLAM, BRITISH COLUMBIA, CA. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 29 of 34 e362f1c062
[Firefox: 6 hits: 08-15 to 10-20] none[none] none:none
none|none none none

T:08:51:00 WinXP 117.99.9.239 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
[Firefox:168 hits: 01-03 to 10-20] d9e9662db1 [0] ASM:Graph
PolyEnE| lines=68 trace

08:52:00 WinXP 88.29.95.196 (RIMA-TDE.NET):
TELEFONICA MOVILES ESPANA (NCC#2007041930),
ES. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 35 25799a17b4
NEW none[none] none:none
none|none none none

T:08:57:00 WinXP 81.84.13.7 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
MATOSINHOS, PORTO, PT. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 35 1e27b7c6ee
NEW none[none] none:none
none|none none none

08:57:00 WinXP 61.218.193.250 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.115:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
57ce4acac2
[Firefox:279 hits: 06-17 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
57ce4acac2[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:09:02:00 WinXP 76.244.176.42 (PACBELL.NET):
AT&T INTERNET SERVICES,
US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.47:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:09:05:00 WinXP 155.207.251.70 (AUTH.GR):
ARISTOTLE UNIVERSITY OF THESSALONIKI,
THESSALONIKI, THESSALONIKI, GR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

09:10:00 WinXP 211.200.251.102 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 115.126.2.121:65520 :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
:fleshkatera.cn
115.126.2.110:80
US:207.123.37.124:80 135 pcap raw alerts
ruleset http
irc
119 lines Yeah : 1.8
profile none summary
tarball 31 of 33
31 of 33
0 of 33 776985f561
[Firefox:20 hits: 06-24 to 10-16]
8ec6129efe
[Firefox:19 hits: 06-24 to 10-16]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] 776985f561 [1]
none [4]
e07c29c4ae[1] ASM:Graph
none:none
ASM:Graph
Armadillo|
tElock|
FSG| lines=82
none
lines=92 trace
trace
trace

T:09:19:00 Win2K-f 68.123.225.28 (PACBELL.NET):
PPPOX POOL - RBACK4 IRVNCA,
LOS ANGELES, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:69.28.178.10:80 135 pcap raw alerts
ruleset http
79 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:09:24:00 WinXP 94.191.241.33 (-):
. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
115.126.2.121:65520
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 142c0d8e6f
NEW none[none] none:none
none|none none none

T:09:25:00 WinXP 92.99.7.1 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 34 of 35 2f8e21d7f8
NEW none[none] none:none
none|none none none

T:09:40:00 WinXP 117.99.30.227 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

09:41:00 WinXP 117.99.30.227 (XLRI.AC.IN):
BHARTI AIRTEL LTD,
DELHI, DELHI, IN. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

09:46:00 Win2K-f 63.16.197.169 (UU.NET):
UUNET TECHNOLOGIES INC,
US. n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80 135 pcap raw alerts
ruleset http
109 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20]
b5919931fe
[Firefox:870 hits: 06-20 to 10-20] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

09:57:00 Win2K-f 211.203.31.25 (HANANET.NET):
HANARO TELECOM INC,
KR. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.51:80 135 pcap raw alerts
ruleset other
348 lines Yeah : 1.3
profile none summary
tarball 32 of 36
34 of 36 7f89b38665
[Firefox:27 hits: 08-02 to 10-20]
a51a50404e
[Firefox:27 hits: 08-02 to 10-20] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

09:58:00 WinXP 84.46.156.177 (ERDVES.LT):
POINT TO POINT CLIENT NETWORKS,
LT. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
115.126.2.121:65520
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 c6059fcbd5
[Firefox: 6 hits: 09-23 to 10-20] none[none] none:none
none|none none none

T:10:11:00 WinXP 82.66.234.94 (PROXAD.NET):
PROXAD / FREE SAS,
PARIS, ILE-DE-FRANCE, FR. (DSL) n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 35 5236b742ce
NEW none[none] none:none
none|none none none

10:12:00 WinXP 116.126.249.246 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. 115.126.2.121:65520 :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520 135 pcap raw alerts
ruleset http
irc
107 lines Yeah : 1.8
profile none summary
tarball 30 of 33
2 of 35
0 of 33 6ec2a8994b
[Firefox:27 hits: 06-18 to 10-11]
bcf66a38c8
[Firefox:14 hits: 07-30 to 10-14]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
tElock|
none|none
FSG| none
none
lines=92 trace
none
trace

T:10:15:00 WinXP 24.86.178.8 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
LANGLEY, BRITISH COLUMBIA, CA. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 34 of 36 45d3b6bd28
NEW none[none] none:none
none|none none none

T:10:22:00 WinXP 97.93.215.6 (-):
. n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 2785aaadc6
NEW none[none] none:none
none|none none none

T:10:22:00 WinXP 166.165.159.213 (MYVZW.COM):
SERVICE PROVIDER CORPORATION,
BEDMINSTER, NEW JERSEY, US. (DIAL) n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 5e4f6ad9dc
[Firefox: 2 hits: 10-20 to 10-20] none[none] none:none
none|none none none

10:25:00 WinXP 166.165.159.213 (MYVZW.COM):
SERVICE PROVIDER CORPORATION,
BEDMINSTER, NEW JERSEY, US. (DIAL) 194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 36 of 36 5e4f6ad9dc
[Firefox: 2 hits: 10-20 to 10-20] none[none] none:none
none|none none none

10:48:00 WinXP 67.122.209.178 (PACBELL.NET):
RBACK1.SNFC,
SAN FRANCISCO, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.174:80
US:208.111.148.219:80 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:10:52:00 WinXP 77.37.132.217 (NCNET.RU):
NCN-INFRA,
RU. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 35 f364930915
NEW none[none] none:none
none|none none none

11:05:00 WinXP 24.88.228.231 (RR.COM):
ROAD RUNNER HOLDCO LLC,
FAYETTEVILLE, NORTH CAROLINA, US. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
[Firefox:476 hits: 12-31 to 10-20] 048df78048 [0] ASM:Graph
none|none lines=61 trace

11:17:00 WinXP 151.67.20.178 (38-151.NET24.IT):
IUNET-BNET,
IT. 194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:11:18:00 WinXP 151.67.20.178 (38-151.NET24.IT):
IUNET-BNET,
IT. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:11:19:00 WinXP 87.247.107.199 (-):
MIKROVISATA,
KAUNAS, KAUNO APSKRITIS, LT. 115.126.2.121:65520 :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
:flanders.be.eu.undernet.org
:gaspode.zanet.org.za
SE:broadway.ny.us.dal.net
SE:coins.dal.net
:caen.fr.eu.undernet.org
US:lia.zanet.net 445 pcap raw alerts
ruleset http
irc
9 lines Yeah : 1.3
profile none summary
tarball 34 of 36 e01661b93e
NEW none[none] none:none
none|none none none

11:20:00 WinXP 87.247.107.199 (-):
MIKROVISATA,
KAUNAS, KAUNO APSKRITIS, LT. 115.126.2.121:65520 :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
irc
6 lines Yeah : 1.3
profile none summary
tarball 34 of 36 e01661b93e
NEW none[none] none:none
none|none none none

T:11:24:00 WinXP 77.37.134.194 (NCNET.RU):
NCN-INFRA,
RU. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 2d6c8c447f
[Firefox:22 hits: 09-16 to 10-20] none[none] none:none
none|none none none

T:11:53:00 WinXP 213.22.230.161 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
LISBON, LISBOA, PT. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 35 f75c383301
NEW none[none] none:none
none|none none none

12:01:00 Win2K-f 76.243.226.214 (PACBELL.NET):
AT&T INTERNET SERVICES,
US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.96.126:80
US:199.93.44.124:80 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20]
b5919931fe
[Firefox:870 hits: 06-20 to 10-20] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:12:31:00 WinXP 41.210.206.11 (-):
. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 87bf2f533f
[Firefox: 4 hits: 10-02 to 10-10] none[none] none:none
none|none none none

12:33:00 WinXP 190.226.106.60 (-):
. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 ca47a36342
[Firefox:21 hits: 02-16 to 10-13] c3a58f69c6 [0] ASM:Graph
PolyEnE| lines=89
embedded dns trace

12:34:00 WinXP 92.96.108.170 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 0.8
profile none summary
tarball 32 of 32 03f912899b
[Firefox:173 hits: 01-08 to 10-20] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

12:38:00 WinXP 24.76.172.201 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
124 lines Yeah : 1.3
profile none summary
tarball 33 of 36
31 of 36
0 of 33 0115338c8b
[Firefox:18 hits: 09-12 to 10-20]
321f4fc27d
[Firefox:18 hits: 09-12 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[none]
none [none]
e07c29c4ae[1] none:none
none:none
ASM:Graph
none|none
none|none
FSG| none
none
lines=92 none
none
trace

12:41:00 WinXP 79.138.237.177 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 370490ea31
[Firefox: 3 hits: 10-13 to 10-14] none[none] none:none
none|none none none

12:52:00 WinXP 201.88.89.59 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 6c9f31fee4
NEW none[none] none:none
none|none none none

T:13:13:00 WinXP 92.96.108.170 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 32 of 32 03f912899b
[Firefox:173 hits: 01-08 to 10-20] 83893bd25d [0] ASM:Graph
none|none lines=65 trace

T:13:20:00 Win2K-f 70.182.83.78 (COX.NET):
COX COMMUNICATIONS,
MUSKOGEE, OKLAHOMA, US. 115.126.2.121:65520 :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
:fleshkatera.cn
:lolika.cn
:www.upononjob.cn
:mulfika.cn 135 pcap raw alerts
ruleset irc
http
136 lines Yeah : 1.8
profile none summary
tarball 6 of 36
32 of 33
8 of 36
29 of 33 0b82addbc4
[Firefox: 2 hits: 10-20 to 10-20]
87e1117f2a
[Firefox:16 hits: 07-18 to 10-20]
ac9e444ce0
[Firefox:16 hits: 10-13 to 10-20]
b4fe4581c3
[Firefox:16 hits: 07-18 to 10-20] none[none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none none
none
none
none none
none
none
none

13:22:00 WinXP 72.2.240.27 (SPEAKEASY.NET):
US. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

13:31:00 WinXP 83.255.32.189 (COMHEM.SE):
COMHEM,
SE. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 b52d214d08
[Firefox: 8 hits: 10-05 to 10-20] none[none] none:none
none|none none none

T:13:31:00 WinXP 83.255.32.189 (COMHEM.SE):
COMHEM,
SE. 115.126.2.121:65520 :proxim.ircgalaxy.pl
UA:citi-bank.ru
:wpad
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
irc
7 lines Yeah : 1.3
profile none summary
tarball 35 of 36 b52d214d08
[Firefox: 8 hits: 10-05 to 10-20] none[none] none:none
none|none none none

T:13:34:00 WinXP 190.208.111.237 (-):
. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 2d815d2be3
[Firefox: 3 hits: 09-25 to 10-11] none[none] none:none
none|none none none

T:13:41:00 WinXP 190.5.203.49 (EMTEL.NET.CO):
EMTEL S.A. E.S.P,
CO. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 31238aa568
NEW none[none] none:none
none|none none none

T:13:42:00 Win2K-f 79.139.136.196 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 115.126.2.121:65520 :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com 445 pcap raw alerts
ruleset irc
17 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:13:50:00 Win2K-f 123.111.141.5 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. 115.126.2.121:65520 :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
US:208.111.148.247:80
US:208.111.148.254:80 135 pcap raw alerts
ruleset irc
148 lines Yeah : 1.8
profile none summary
tarball 32 of 36
34 of 36 0c3d1ec2df
[Firefox:11 hits: 08-11 to 10-04]
8de905030e
[Firefox:11 hits: 08-11 to 10-04] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

13:58:00 WinXP 92.96.70.45 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 0.8
profile none summary
tarball 34 of 35 2f8e21d7f8
NEW none[none] none:none
none|none none none

14:01:00 Win2K-f 98.25.101.80 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20]
b5919931fe
[Firefox:870 hits: 06-20 to 10-20] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

T:14:05:00 WinXP 89.254.133.28 (-):
OSTKOM,
LV. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 34 of 36 96d089e522
[Firefox:20 hits: 10-08 to 10-20] none[none] none:none
none|none none none

T:14:09:00 Win2K-f 213.22.133.233 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
BRAGA, BRAGA, PT. 115.126.2.121:65520 445 pcap raw alerts
ruleset irc
18 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:14:24:00 Win2K-f 219.174.36.53 (BBTEC.NET):
JAPAN NATION-WIDE NETWORK OF SOFTBANK BB CORP,
TOKYO, TOKYO, JP. 115.126.2.121:65520 135 pcap raw alerts
ruleset irc
22 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

14:48:00 WinXP 216.45.89.22 (GVEC.NET):
GVEC.NET,
ARNOLD, MARYLAND, US. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 d6df3972a0
[Firefox:33 hits: 01-07 to 10-09] 39eeef52a4 [0] ASM:Graph
PolyEnE| lines=65 trace

T:14:53:00 WinXP 63.200.198.199 (VALROCK.COM):
RANDYYS TV AND ELECTRONICS,
EL CENTRO, CALIFORNIA, US. n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 33 of 36 1c8b439ba5
[Firefox: 2 hits: 10-20 to 10-20] none[none] none:none
none|none none none

15:23:00 WinXP 201.253.255.163 (NET.AR):
APOLO -GOLD-TELECOM-PER,
BUENOS AIRES, BUENOS AIRES, AR. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 f5ab9763ea
[Firefox:11 hits: 10-03 to 10-20] none[none] none:none
none|none none none

15:51:00 WinXP 71.131.139.132 (SBCGLOBAL.NET):
DOMINO'S PIZZA,
PLANO, TEXAS, US. (100Mbps) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

15:59:00 WinXP 204.212.10.149 (-):
AAFES/BARRACKS,
HERNDON, VIRGINIA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

16:13:00 Win2K-f 98.141.160.84 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:16:19:00 WinXP 210.197.190.21 (ODN.AD.JP):
OPEN DATA NETWORK(JAPAN TELECOM CO. LTD.),
NAHA, OKINAWA, JP. n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:615 hits: 01-01 to 10-20] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

T:16:38:00 WinXP 190.139.87.101 (NET.AR):
TELECOM ARGENTINA S.A,
AR. n/a 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

16:50:00 Win2K-f 98.174.80.235 (-):
. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20]
b5919931fe
[Firefox:870 hits: 06-20 to 10-20] none[4]
73f1082158[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

16:56:00 WinXP 89.204.204.94 (O2.IE):
O2 IRELAND MOBILE PHONE OPERATOR,
IE. 115.126.2.121:65520 :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset http
irc
27 lines Yeah : 1.3
profile none summary
tarball 34 of 36 7e6e770f9e
NEW none[none] none:none
none|none none none

T:16:57:00 WinXP 89.204.204.94 (O2.IE):
O2 IRELAND MOBILE PHONE OPERATOR,
IE. 115.126.2.121:65520 :proxim.ircgalaxy.pl
115.126.2.121:65520 445 pcap raw alerts
ruleset http
irc
18 lines Yeah : 1.3
profile none summary
tarball 34 of 36 7e6e770f9e
NEW none[none] none:none
none|none none none

T:17:13:00 WinXP 208.94.181.165 (-):
. n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
[Firefox:768 hits: 12-31 to 10-20] 1aad8e4632 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

17:19:00 WinXP 70.65.204.6 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
RU:194.6.222.11:6667 445 pcap raw alerts
ruleset http
irc
3 lines Yeah : 0.8
profile none summary
tarball 35 of 36 a8d74af6d5
[Firefox: 2 hits: 10-04 to 10-20] none[none] none:none
none|none none none

17:19:00 WinXP 208.126.11.15 (NETINS.NET):
ROCKWELL COOPERATIVE TELEPHONE ASSN,
SUTHERLAND, IOWA, US. (DSL) 115.126.2.121:65520 :proxim.ircgalaxy.pl
115.126.2.121:65520 445 pcap raw alerts
ruleset http
irc
18 lines Yeah : 1.3
profile none summary
tarball 34 of 36 644ab77c01
NEW none[none] none:none
none|none none none

17:31:00 WinXP 114.48.128.89 (-):
. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 33 of 36 64d359864b
NEW none[none] none:none
none|none none none

17:37:00 WinXP 124.102.143.53 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
[Firefox:615 hits: 01-01 to 10-20] eb7546c600 [0] ASM:Graph
none|none lines=61 trace

18:04:00 WinXP 4.155.18.187 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BALTIMORE, MARYLAND, US. (DIAL) n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
[Firefox:485 hits: 01-05 to 10-20] e0197e8a64 [0] ASM:Graph
none|none lines=62 trace

T:18:07:00 WinXP 91.66.189.52 (SUPERKABEL.DE):
KABEL DEUTSCHLAND BREITBAND SERVICE GMBH,
DE. 115.126.2.121:65520 :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
irc
3 lines Yeah : 1.3
profile none summary
tarball 35 of 36 b52d214d08
[Firefox: 8 hits: 10-05 to 10-20] none[none] none:none
none|none none none

18:08:00 WinXP 91.66.189.52 (SUPERKABEL.DE):
KABEL DEUTSCHLAND BREITBAND SERVICE GMBH,
DE. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 b52d214d08
[Firefox: 8 hits: 10-05 to 10-20] none[none] none:none
none|none none none

18:30:00 WinXP 69.218.209.130 (AMERITECH.NET):
PPPOX POOL - RBACK5 WOTNOH,
COLUMBUS, OHIO, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:18:33:00 WinXP 200.100.220.160 (TELESP.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DIAL) n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 883db84495
NEW none[none] none:none
none|none none none

18:40:00 Win2K-f 210.18.50.126 (SIFY.NET):
ROSY BLUE (INDIA) PVT LTD,
IN. (100Mbps) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:18:53:00 WinXP 4.245.140.229 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NAUGATUCK, CONNECTICUT, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.54:80 135 pcap raw alerts
ruleset http
80 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
73f1082158[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

T:18:56:00 Win2K-f 172.191.3.90 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DIAL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20]
b5919931fe
[Firefox:870 hits: 06-20 to 10-20] none[4]
a08f3b74a4[1]
b5919931fe[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
ASProtect| none
lines=81
lines=90 trace
trace
trace

18:57:00 WinXP 66.69.75.193 (RR.COM):
ROAD RUNNER HOLDCO LLC,
SAN ANTONIO, TEXAS, US. (100Mbps) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:18:58:00 WinXP 89.109.27.57 (MTS-NN.RU):
NETWORK FOR VPDN SESSION TERMINATIONS ON UAC`S FOR,
RU. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

T:19:12:00 WinXP 24.115.234.31 (PTD.NET):
PENTELEDATA INC. - CABLE,
MILFORD, PENNSYLVANIA, US. 115.126.2.121:65520 :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
irc
6 lines Yeah : 1.3
profile none summary
tarball 35 of 36 b52d214d08
[Firefox: 8 hits: 10-05 to 10-20] none[none] none:none
none|none none none

19:24:00 WinXP 61.220.201.220 (HINET.NET):
DATA COMMUNICATION BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
57ce4acac2
[Firefox:279 hits: 06-17 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
57ce4acac2[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

19:34:00 WinXP 61.222.240.150 (HINET.NET):
DATA COMMUNICATION BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
KAOHSIUNG, KAO-HSIUNG, TW. n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.123:80 135 pcap raw alerts
ruleset http
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
57ce4acac2
[Firefox:279 hits: 06-17 to 10-20] none[4]
57ce4acac2[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:19:47:00 WinXP 70.70.54.71 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
irc
3 lines Yeah : 0.8
profile none summary
tarball none 13003605cc
[Firefox: 5 hits: 09-15 to 10-02] none[none] none:none
none|none none none

19:50:00 WinXP 71.36.10.251 (QWEST.NET):
QWEST COMMUNICATIONS CORPORATION,
BOISE, IDAHO, US. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
79 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:19:54:00 WinXP 71.137.247.124 (PACBELL.NET):
RBACK32.IRVNCA,
AKRON, OHIO, US. (DSL) n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:www.proxy-socks.net
:wpad
DE:ebookfinaltrash.ru 445 pcap raw alerts
ruleset http
http
http
http
22 lines Yeah : 0.8
profile none summary
tarball 29 of 29
0 of 36 a12cab51ef
[Firefox:585 hits: 01-01 to 10-20]
dbea341d9b
NEW 40f7f463c4 [0]
none [none] ASM:Graph
none:none
ASPack|
none|none lines=281
embedded dns
none trace
none

19:57:00 Win2K-f 98.190.176.159 (-):
. 115.126.2.121:65520 :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:208.111.173.47:80 135 pcap raw alerts
ruleset http
irc
127 lines Yeah : 1.8
profile none summary
tarball 35 of 36
0 of 32
32 of 36 6d0afb2b54
[Firefox: 4 hits: 08-06 to 08-17]
b5919931fe
[Firefox:870 hits: 06-20 to 10-20]
fbd87f4eaa
[Firefox: 4 hits: 08-06 to 08-17] none[none]
b5919931fe[1]
none [none] none:none
ASM:Graph
none:none
none|none
ASProtect|
none|none none
lines=90
none none
trace
none

20:09:00 WinXP 98.140.228.220 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

20:12:00 Win2K-f 124.100.11.136 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 115.126.2.121:65520 139 pcap raw alerts
ruleset irc
26 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:20:15:00 WinXP 96.15.222.110 (-):
. n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
RU:www.bbin.ru
RU:www.binbank.ru
:wpad 445 pcap raw alerts
ruleset http
http
http
http
33 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
[Firefox:585 hits: 01-01 to 10-20] 40f7f463c4 [0] ASM:Graph
ASPack| lines=281
embedded dns trace

T:20:33:00 WinXP 24.79.156.180 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
RICHMOND, BRITISH COLUMBIA, CA. (DSL) 115.126.2.121:65520 :proxim.ircgalaxy.pl
UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
irc
3 lines Yeah : 1.3
profile none summary
tarball 33 of 35 e50d19ea22
NEW none[none] none:none
none|none none none

20:34:00 WinXP 173.16.61.171 (-):
. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
[Firefox:1348 hits: 12-31 to 10-20] 7a70e1b592 [0] ASM:Graph
PolyEnE| lines=68 trace

20:47:00 WinXP 208.105.171.90 (-):
. 115.126.2.121:65520 :proxim.ircgalaxy.pl 445 pcap raw alerts
ruleset http
irc
3 lines Yeah : 1.8
profile none summary
tarball 36 of 36 f665a37b6c
NEW none[none] none:none
none|none none none

20:49:00 Win2K-f 24.79.77.166 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) 115.126.2.121:65520 :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:208.111.153.236:80 135 pcap raw alerts
ruleset irc
152 lines Yeah : 1.8
profile none summary
tarball 34 of 36
32 of 36 57c095a73a
[Firefox: 2 hits: 09-18 to 10-20]
71feff97fb
[Firefox: 2 hits: 09-18 to 10-20] none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

20:49:00 WinXP 82.66.212.131 (PROXAD.NET):
PROXAD / FREE SAS,
PARIS, ILE-DE-FRANCE, FR. n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 49d6cdaab4
[Firefox:11 hits: 09-13 to 10-14] none[none] none:none
none|none none none

20:53:00 WinXP 64.187.44.133 (PORCHLIGHT.CA):
BELL CANADA,
LONDON, ONTARIO, CA. (DIAL) n/a 135 pcap raw alerts
ruleset other
6 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

21:04:00 Win2K-f 68.236.218.137 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
KEARNY, NEW JERSEY, US. 115.126.2.121:65520 135 pcap raw alerts
ruleset irc
24 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:21:36:00 WinXP 69.111.195.105 (SBCGLOBAL.NET):
PPPOX POOL RBACK1.SNFC21,
SAN FRANCISCO, CALIFORNIA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com
US:192.221.96.126:80
US:192.221.99.124:80
US:205.128.73.126:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

21:39:00 Win2K-f 123.64.22.192 (JWS.COM):
CHINA TIETONG TELECOMMUNICATIONS CORPORATION,
BEIJING, BEIJING, CN. 115.126.2.121:65520 :proxim.ircgalaxy.pl
115.126.2.121:65520 445 pcap raw alerts
ruleset irc
11 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:21:46:00 Win2K-f 60.248.45.145 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. n/a 135 pcap raw alerts
ruleset other
91 lines Yeah : 1.3
profile none summary
tarball 33 of 35
33 of 33 50765eef8f
NEW
53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20] none[none]
none [4] none:none
none:none
none|none
tElock| none
none none
trace

T:22:01:00 Win2K-f 216.158.118.222 (EGYPTIAN.NET):
EGYPTIAN TELEPHONE,
STEELEVILLE, ILLINOIS, US. n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80
US:207.123.37.126:80
US:4.23.60.125:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
73f1082158
[Firefox:1610 hits: 06-18 to 10-20] none[4]
73f1082158[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

T:22:09:00 WinXP 213.55.70.158 (TELECOM.NET.ET):
ETHIOPIAN TELECOMMUNICATION CORPORATION,
ADDIS ABABA, ADDIS ABABA, ET. n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:80
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 36 b072dd40a7
NEW none[none] none:none
none|none none none

T:22:11:00 Win2K-f 24.234.84.231 (COX.NET):
COX COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.219:80 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20] none[4]
a08f3b74a4[1] none:none
ASM:Graph
tElock|
Armadillo| none
lines=81 trace
trace

22:31:00 WinXP 218.210.227.68 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 135 pcap raw alerts
ruleset other
7 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

23:01:00 WinXP 75.16.254.18 (SBCGLOBAL.NET):
PPPOX POOL - RBACK3.KNTPIN,
EVANSVILLE, INDIANA, US. (DSL) n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33
0 of 33 53bfe15e91
[Firefox:3259 hits: 06-17 to 10-20]
a08f3b74a4
[Firefox:1171 hits: 06-18 to 10-20]
e07c29c4ae
[Firefox:647 hits: 06-19 to 10-20] none[4]
a08f3b74a4[1]
e07c29c4ae[1] none:none
ASM:Graph
ASM:Graph
tElock|
Armadillo|
FSG| none
lines=81
lines=92 trace
trace
trace

23:16:00 WinXP 88.28.96.194 (RIMA-TDE.NET):
TELEFONICA MOVILES ESPANA (NCC#2007041930),
ES. n/a RU:moscow-advokat.ru
NL:diemen.nl.eu.undernet.org 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 35 of 36 f5ab9763ea
[Firefox:11 hits: 10-03 to 10-20] none[none] none:none
none|none none none

23:28:00 WinXP 196.2.12.39 (-):
AFRINIC,
BI. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:23:29:00 Win2K-f 218.211.83.49 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TW. n/a US:microsoft.com
US:download.microsoft.com 135 pcap raw alerts
ruleset http
255 lines Yeah : 1.3
profile none summary
tarball 0 of 32
29 of 33
31 of 33 b5919931fe
[Firefox:870 hits: 06-20 to 10-20]
dd98c3c108
[Firefox: 9 hits: 06-24 to 10-20]
e98746deb1
[Firefox: 8 hits: 06-24 to 10-20] b5919931fe [1]
dd98c3c108[1]
none [4] ASM:Graph
ASM:Graph
none:none
ASProtect|
Armadillo|
tElock| lines=90
lines=82
none trace
trace
trace

T:23:53:00 WinXP 68.151.226.127 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
EDMONTON, ALBERTA, CA. (DSL) n/a UA:citi-bank.ru
UA:194.54.90.246:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 92ff7d574b
NEW none[none] none:none
none|none none none