Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

31 October 2008
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
01:03:00 WinXP 82.237.8.86 (PROXAD.NET):
PROXAD / FREE SAS,
NICE, PROVENCE-ALPES-COTE D'AZUR, FR. (DSL) 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 2afd89521c
NEW 		none[none] none:none
 none|none none none
01:08:00 WinXP 125.58.101.228 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
60 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
8 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
b7082104e4
[Firefox:241 hits: 06-18 to 10-30]
e07c29c4ae
[Firefox:755 hits: 06-19 to 10-30] 		none[4]
none [4]
e07c29c4ae[1] 		none:none
none:none
ASM:Graph
 tElock|
tElock|
FSG| 		none
none
lines=92 		trace
trace
trace
01:32:00 WinXP 218.211.81.233 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TW. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.153.236:80 		135 pcap raw alerts
ruleset 		http
163 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 36
34 of 36		 173e1e68dd
NEW
675fe7e281
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
01:39:00 WinXP 194.125.237.242 (-):
DELTACOM COMPANY,
RU. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:493 hits: 12-31 to 10-30] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
02:13:00 Win2K-f 96.247.59.250 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:207.123.42.126:80
US:207.123.47.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
02:21:00 WinXP 81.154.148.68 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
LONDON, ENGLAND, UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:493 hits: 12-31 to 10-30] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
02:39:00 WinXP 83.255.34.160 (COMHEM.SE):
COMHEM,
SE. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 b52d214d08
[Firefox:42 hits: 10-05 to 10-30] 		none[none] none:none
 none|none none none
02:50:00 WinXP 86.155.80.6 (BTCENTRALPLUS.COM):
BT-CENTRAL-PLUS,
UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:640 hits: 01-01 to 10-30] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
03:02:00 WinXP 64.130.101.5 (ANDYCABLE.COM):
TV CABLE COMPANY OF ANDALUSIA INC,
KENNER, LOUISIANA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
424 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 35
32 of 36		 807a20a1a5
NEW
ac158f83b3
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
03:13:00 Win2K-f 99.152.70.85 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.115:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:03:28:00 WinXP 70.71.77.214 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:80
US:192.221.110.125:80
US:192.221.96.126:80 		135 pcap raw alerts
ruleset 		http
127 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36
33 of 36
0 of 33		 8d120c1a24
NEW
c3dcd2ca7c
NEW
e07c29c4ae
[Firefox:755 hits: 06-19 to 10-30] 		none[none]
none [none]
e07c29c4ae[1] 		none:none
none:none
ASM:Graph
 none|none
none|none
FSG| 		none
none
lines=92 		none
none
trace
T:03:33:00 WinXP 92.98.54.66 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 6b1c6d0395
[Firefox: 8 hits: 09-18 to 10-04] 		none[none] none:none
 none|none none none
T:03:41:00 WinXP 89.50.105.78 (PPPOOL.DE):
FREENET CITYLINE GMBH,
DE. (DIAL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 3d32d90c1e
NEW 		none[none] none:none
 none|none none none
03:43:00 WinXP 89.50.105.78 (PPPOOL.DE):
FREENET CITYLINE GMBH,
DE. (DIAL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 3d32d90c1e
NEW 		none[none] none:none
 none|none none none
03:53:00 WinXP 79.163.166.202 (-):
IDEA,
PL. 		n/a   445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:03:59:00 WinXP 79.163.166.202 (-):
IDEA,
PL. 		n/a   445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:04:02:00 WinXP 61.224.133.86 (HINET.NET):
DATA COMMUNICATION BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
KAOHSIUNG, KAO-HSIUNG, TW. 		n/a   445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
04:13:00 WinXP 41.214.160.40 (-):
. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 eca9a5fa95
[Firefox:54 hits: 08-09 to 10-26] 		none[none] none:none
 none|none none none
T:04:14:00 WinXP 41.214.160.40 (-):
. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 eca9a5fa95
[Firefox:54 hits: 08-09 to 10-26] 		none[none] none:none
 none|none none none
04:15:00 Win2K-f 61.254.122.48 (HAEDONGTEK.CO.KR):
THRUNET CO. LTD,
SEOUL, KYONGGI-DO, KR. 		n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:208.111.173.49:80
US:208.111.173.51:80 		135 pcap raw alerts
ruleset 		other
154 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
34 of 36		 6e2eaa0359
[Firefox:19 hits: 07-10 to 10-28]
cfeed1c3e4
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:04:27:00 WinXP 77.56.198.199 (SOLPA.NET):
CABLECOM,
ZURICH, ZURICH, CH. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 eaa9422755
NEW 		none[none] none:none
 none|none none none
04:50:00 Win2K-f 125.58.90.19 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[4]
73f1082158[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
T:04:53:00 WinXP 93.148.28.99 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 b27d73bfcb
[Firefox:17 hits: 10-10 to 10-30] 		none[none] none:none
 none|none none none
T:05:09:00 WinXP 130.13.64.59 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36 2231eb8648
NEW 		none[none] none:none
 none|none none none
05:21:00 WinXP 213.22.134.22 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
BRAGA, BRAGA, PT. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 6c22914ec1
NEW 		none[none] none:none
 none|none none none
05:30:00 WinXP 66.50.120.31 (PRTC.NET):
PUERTO RICO TELEPHONE COMPANY,
SAN JUAN, PUERTO RICO, PR. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 35 e6cfd91cbc
NEW 		none[none] none:none
 none|none none none
05:37:00 WinXP 219.107.210.47 (MESH.AD.JP):
BIGLOBE-CIDR-BLK,
JP. 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:640 hits: 01-01 to 10-30] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
05:39:00 Win2K-f 221.142.94.113 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:208.111.173.45:80 		135 pcap raw alerts
ruleset 		other
102 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36
30 of 33		 24e59ab043
NEW
ff2150aa95
[Firefox: 5 hits: 07-03 to 10-25] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
06:01:00 WinXP 94.191.162.143 (-):
. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a0139d7ad8
[Firefox:194 hits: 01-03 to 10-30] 		d9e9662db1 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:06:02:00 WinXP 4.226.228.141 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
WACO, TEXAS, US. (DIAL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 f502585714
[Firefox:50 hits: 01-02 to 10-27] 		ae590430c5 [0] ASM:Graph
 PolyEnE| lines=63 trace
T:06:11:00 WinXP 203.91.165.20 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. 		n/a US:microsoft.com
US:download.microsoft.com
US:4.23.60.125:80 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
06:16:00 WinXP 79.138.156.3 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 2d6c8c447f
[Firefox:26 hits: 09-16 to 10-29] 		none[none] none:none
 none|none none none
T:06:17:00 WinXP 79.138.156.3 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 2d6c8c447f
[Firefox:26 hits: 09-16 to 10-29] 		none[none] none:none
 none|none none none
06:24:00 Win2K-f 203.73.84.151 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.108:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
57ce4acac2
[Firefox:312 hits: 06-17 to 10-30] 		none[4]
57ce4acac2[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
06:38:00 WinXP 213.22.63.91 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
BRAGA, BRAGA, PT. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 35 c439e59be9
NEW 		none[none] none:none
 none|none none none
06:38:00 Win2K-f 130.234.176.176 (JYU.FI):
UNIVERSITY OF JYVASKYLA NETWORK,
JYVäSKYLä, LANSI-SUOMEN LAANI, FI. 		n/a   445 pcap raw alerts
ruleset 		other
1 line 		Yeah : 0.8
profile 		none summary
tarball 		17 of 36 f36f19b885
[Firefox: 4 hits: 10-30 to 10-30] 		none[none] none:none
 none|none none none
06:51:00 Win2K-f 71.113.167.57 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
BLOOMINGTON, ILLINOIS, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:07:04:00 Win2K-f 130.234.176.176 (JYU.FI):
UNIVERSITY OF JYVASKYLA NETWORK,
JYVäSKYLä, LANSI-SUOMEN LAANI, FI. 		n/a   445 pcap raw alerts
ruleset 		other
1 line 		Yeah : 0.8
profile 		none summary
tarball 		17 of 36 f36f19b885
[Firefox: 4 hits: 10-30 to 10-30] 		none[none] none:none
 none|none none none
T:07:13:00 WinXP 68.187.200.195 (CHARTER.COM):
CHARTER COMMUNICATIONS,
GREENVILLE, SOUTH CAROLINA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.41.124:80 		135 pcap raw alerts
ruleset 		http
77 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30]
e07c29c4ae
[Firefox:755 hits: 06-19 to 10-30] 		none[4]
a08f3b74a4[1]
e07c29c4ae[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
FSG| 		none
lines=81
lines=92 		trace
trace
trace
07:14:00 WinXP 193.69.35.206 (BLUECOM.NO):
CATCH COMMUNCIATIONS ASA,
NO. 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:493 hits: 12-31 to 10-30] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
T:07:20:00 Win2K-f 119.94.124.1 (-):
. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		135 pcap raw alerts
ruleset 		other
299 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33 39afe3d48a
NEW 		none[none] none:none
 none|none none none
07:26:00 WinXP 130.13.242.120 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 35 096364e2c4
NEW 		none[none] none:none
 none|none none none
T:07:26:00 WinXP 130.13.242.120 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 35 096364e2c4
NEW 		none[none] none:none
 none|none none none
07:27:00 Win2K-f 70.44.37.188 (PTD.NET):
PENTELEDATA INC. - CABLE,
DINGMANS FERRY, PENNSYLVANIA, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:07:36:00 WinXP 70.44.37.188 (PTD.NET):
PENTELEDATA INC. - CABLE,
DINGMANS FERRY, PENNSYLVANIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.50:80
US:208.111.148.54:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
07:42:00 WinXP 114.137.151.49 (-):
. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 d42c1cc7c0
[Firefox:146 hits: 01-01 to 10-30] 		af9ca5bed1 [0] ASM:Graph
 PolyEnE| lines=54 trace
T:07:43:00 WinXP 114.137.151.49 (-):
. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 d42c1cc7c0
[Firefox:146 hits: 01-01 to 10-30] 		af9ca5bed1 [0] ASM:Graph
 PolyEnE| lines=54 trace
T:08:01:00 WinXP 190.31.88.241 (NET.AR):
APOLO -GOLD-TELECOM-PER,
BUENOS AIRES, BUENOS AIRES, AR. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 fcd4bae1af
[Firefox: 3 hits: 10-27 to 10-30] 		none[none] none:none
 none|none none none
08:08:00 WinXP 87.110.32.208 (-):
ADDRESS POOL FOR LTC-HOME CUSTOMERS,
RIGA, RIGA, LV. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 2881209768
[Firefox: 7 hits: 10-22 to 10-29] 		none[none] none:none
 none|none none none
T:08:08:00 WinXP 87.110.32.208 (-):
ADDRESS POOL FOR LTC-HOME CUSTOMERS,
RIGA, RIGA, LV. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 2881209768
[Firefox: 7 hits: 10-22 to 10-29] 		none[none] none:none
 none|none none none
T:08:10:00 WinXP 4.172.111.41 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BRONX, NEW YORK, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80 		135 pcap raw alerts
ruleset 		http
89 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
08:20:00 Win2K-f 64.130.166.8 (SCRTC.COM):
SOUTH CENTRAL RURAL TELEPHONE CO,
SAN JOSE, CALIFORNIA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
969 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 36 2c7f79bd11
NEW 		none[none] none:none
 none|none none none
08:23:00 WinXP 85.139.99.137 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
LISBON, LISBOA, PT. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 35 77ae91b868
[Firefox: 2 hits: 10-25 to 10-26] 		none[none] none:none
 none|none none none
08:40:00 Win2K-f 24.162.204.36 (RR.COM):
ROAD RUNNER HOLDCO LLC,
EL PASO, TEXAS, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[4]
73f1082158[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
08:56:00 WinXP 190.30.49.33 (NET.AR):
APOLO -GOLD-TELECOM-PER,
ROSARIO, SANTA FE, AR. 		n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:813 hits: 12-31 to 10-30] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:09:26:00 WinXP 71.104.209.229 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
YUCAIPA, CALIFORNIA, US. (DSL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36 b1c85cee4b
[Firefox: 5 hits: 10-27 to 10-29] 		none[none] none:none
 none|none none none
T:09:31:00 WinXP 93.163.57.69 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 c05385e600
[Firefox:27 hits: 01-20 to 10-30] 		6a383b021d [0] ASM:Graph
 PolyEnE| lines=68 trace
09:39:00 WinXP 208.105.186.90 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30]
e07c29c4ae
[Firefox:755 hits: 06-19 to 10-30] 		none[4]
73f1082158[1]
e07c29c4ae[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
FSG| 		none
lines=81
lines=92 		trace
trace
trace
T:09:48:00 WinXP 200.164.117.237 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36 49d6cdaab4
[Firefox:13 hits: 09-13 to 10-21] 		none[none] none:none
 none|none none none
T:10:02:00 WinXP 203.180.16.104 (BMOBILE.NE.JP):
JAPAN COMMUNICATION INC,
JP. 		n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
GB:welcome3.smile.co.uk
:wpad
GB:195.92.84.198:80 		445 pcap raw alerts
ruleset 		http
http
http
19 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a12cab51ef
[Firefox:599 hits: 01-01 to 10-30] 		40f7f463c4 [0] ASM:Graph
 ASPack| lines=281
embedded dns 		trace
10:02:00 WinXP 62.11.25.229 (DIALUP.TISCALI.IT):
TISCALI ITALIA SPA,
VERONA, VENETO, IT. (DIAL) 		n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:wpad
DE:ebookfinaltrash.ru 		445 pcap raw alerts
ruleset 		http
http
http
17 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 df17a625ee
[Firefox:292 hits: 01-01 to 10-30] 		9bbdd086c5 [0] ASM:Graph
 ASPack| lines=186
embedded dns 		trace
T:10:04:00 WinXP 190.208.69.100 (-):
. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 2d815d2be3
[Firefox: 4 hits: 09-25 to 10-21] 		none[none] none:none
 none|none none none
T:10:10:00 WinXP 4.159.74.132 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CLEVELAND, OHIO, US. (DIAL) 		n/a US:www.altavista.com
:jbeegvia.ru
US:www.worldbank.org
DE:kavkaz.co.uk
:yoiayoi.ru
:wcqahzhzn.ru
:iirpryry.ru
:rihafvu.ru
:ryryodokm.ru
:wpad
:uvjiis.ru
:gwvwka.ru
:jqsbnyzkp.ru
:pvygdo.ru
:fxkyagpnw.ru
:knclvdz.ru
:trsqeigw.ru
:odokeqy.ru
:kelmpsjp.ru
:edjiesp.ru
:vllcdvv.ru
:nuksdln.ru
:tmmeno.ru
:zoxdgqx.ru
:pwvbfz.ru
:nuzbcp.ru
:bqpuqt.ru
:okskyyn.ru
:pnlkria.ru
US:crime-research.ru
:kargai.ru
:kfwfceki.ru
RU:alfabank.ru
:nhuwxyuw.ru
US:prodexteam.net
:udluzuq.ru
:fiazpvnne.ru
:ppxuub.ru
:lvwgdhwlj.ru
GB:www.candidateverifier.com
:raxeqajrf.ru
:dhagunb.ru
:zpwmktjv.ru
:aadqca.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 17028f1eda
[Firefox:51 hits: 04-18 to 10-22] 		none[3] none:none
 tElock| none trace
T:10:10:00 WinXP 93.120.149.59 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a RU:moscow-advokat.ru
RU:194.6.222.11:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 042c2c6b76
NEW 		none[none] none:none
 none|none none none
10:11:00 WinXP 4.159.74.132 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
CLEVELAND, OHIO, US. (DIAL) 		n/a :www.google.com.au
:jbeegvia.ru 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 17028f1eda
[Firefox:51 hits: 04-18 to 10-22] 		none[3] none:none
 tElock| none trace
T:10:15:00 WinXP 82.207.16.48 (UKRTEL.NET):
UKRTELECOM IP ACCESS NETWORK IN KIEV,
UA. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 2f981a2988
[Firefox: 4 hits: 10-27 to 10-28] 		none[none] none:none
 none|none none none
10:16:00 Win2K-f 130.13.181.91 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a   135 pcap raw alerts
ruleset 		other
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 36 bbf3f3b76e
[Firefox: 2 hits: 10-30 to 10-30] 		none[none] none:none
 none|none none none
10:19:00 Win2K-f 24.80.178.213 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.137:80 		135 pcap raw alerts
ruleset 		other
95 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32
2 of 32		 607b60ad51
[Firefox:44 hits: 06-20 to 10-26]
e5c7bce70e
[Firefox:42 hits: 06-20 to 10-26] 		none[4]
e5c7bce70e[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
10:22:00 Win2K-f 122.53.194.64 (PLDT.NET):
IPG,
PH. 		n/a US:microsoft.com
US:download.microsoft.com
:proxim.ircgalaxy.pl 		135 pcap raw alerts
ruleset 		http
127 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 33
33 of 33
0 of 32		 16874933ea
[Firefox:57 hits: 06-18 to 10-20]
76ee340669
[Firefox:57 hits: 06-18 to 10-20]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		16874933ea [1]
none [4]
b5919931fe[1] 		ASM:Graph
none:none
ASM:Graph
 Armadillo|
PolyEnE|
ASProtect| 		lines=82
none
lines=90 		trace
trace
trace
T:10:23:00 WinXP 130.13.181.91 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a   135 pcap raw alerts
ruleset 		other
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 36 bbf3f3b76e
[Firefox: 2 hits: 10-30 to 10-30] 		none[none] none:none
 none|none none none
10:36:00 WinXP 82.207.11.0 (UKRTEL.NET):
UKRTELNET,
UA. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 2f981a2988
[Firefox: 4 hits: 10-27 to 10-28] 		none[none] none:none
 none|none none none
T:10:36:00 WinXP 82.207.11.0 (UKRTEL.NET):
UKRTELNET,
UA. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 2f981a2988
[Firefox: 4 hits: 10-27 to 10-28] 		none[none] none:none
 none|none none none
T:10:46:00 Win2K-f 70.60.205.20 (RR.COM):
ROAD RUNNER HOLDCO LLC,
FAYETTEVILLE, NORTH CAROLINA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.96.126:80
US:199.93.41.124:80
US:207.123.37.125:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
10:56:00 WinXP 173.21.153.0 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80 		135 pcap raw alerts
ruleset 		http
77 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30]
e07c29c4ae
[Firefox:755 hits: 06-19 to 10-30] 		none[4]
a08f3b74a4[1]
e07c29c4ae[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
FSG| 		none
lines=81
lines=92 		trace
trace
trace
10:58:00 WinXP 24.80.167.73 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
614 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 36 738eb92db2
[Firefox: 5 hits: 10-06 to 10-30] 		none[none] none:none
 none|none none none
T:11:02:00 WinXP 212.152.99.244 (-):
TIM HELLAS TELECOMMUNICATIONS S.A,
GR. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 703ad78900
[Firefox: 5 hits: 10-22 to 10-30] 		none[none] none:none
 none|none none none
11:30:00 WinXP 79.163.7.139 (-):
IDEA,
PL. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:11:36:00 WinXP 117.195.1.125 (-):
. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 28f541b1b3
NEW 		none[none] none:none
 none|none none none
T:11:47:00 WinXP 88.8.180.12 (RIMA-TDE.NET):
TELEFONICA DE ESPANA,
ES. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 d28bf8aa1a
[Firefox:11 hits: 09-12 to 10-28] 		none[none] none:none
 none|none none none
11:53:00 WinXP 190.128.47.138 (-):
EMPRESA DE TELECOMUNICACIONES DE PEREIRA S.A. E.S.P,
MANIZALES, CALDAS, CO. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1408 hits: 12-31 to 10-30] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
11:57:00 WinXP 82.249.15.17 (PROXAD.NET):
PROXAD / FREE SAS,
NICE, PROVENCE-ALPES-COTE D'AZUR, FR. (DSL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 5d7c7f2ec8
[Firefox: 3 hits: 10-25 to 10-29] 		none[none] none:none
 none|none none none
12:00:00 WinXP 98.133.41.40 (-):
ALLTEL MIP CUSTOMERS - LITTLE ROCK,
LITTLE ROCK, ARKANSAS, US. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 8f7a9a1200
NEW 		none[none] none:none
 none|none none none
T:12:07:00 Win2K-f 130.13.54.186 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		other
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 36 6a423f9994
[Firefox: 4 hits: 10-30 to 10-30] 		none[none] none:none
 none|none none none
T:12:14:00 WinXP 92.40.108.64 (IKBCC.COM):
EU-ZZ,
UK. 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 05fdbaf328
NEW 		none[none] none:none
 none|none none none
12:19:00 WinXP 59.104.255.111 (SEED.NET.TW):
DIGITAL UNITED I,
TAIPEI, T'AI-PEI, TW. (DSL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 35 50ac3b7e6d
NEW 		none[none] none:none
 none|none none none
12:19:00 Win2K-f 90.57.147.111 (IKBCC.COM):
IP2000-ADSL-BAS,
FR. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		32 of 36 d2af6753cc
[Firefox: 4 hits: 10-26 to 10-29] 		none[none] none:none
 none|none none none
T:12:19:00 WinXP 41.214.166.187 (-):
. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		36 of 36 eca9a5fa95
[Firefox:54 hits: 08-09 to 10-26] 		none[none] none:none
 none|none none none
12:24:00 WinXP 130.234.176.176 (JYU.FI):
UNIVERSITY OF JYVASKYLA NETWORK,
JYVäSKYLä, LANSI-SUOMEN LAANI, FI. 		n/a   445 pcap raw alerts
ruleset 		other
1 line 		Yeah : 0.8
profile 		none summary
tarball 		17 of 36 f36f19b885
[Firefox: 4 hits: 10-30 to 10-30] 		none[none] none:none
 none|none none none
T:12:26:00 WinXP 83.132.131.90 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
VILA FRANCA DE XIRA, LISBOA, PT. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 b27d73bfcb
[Firefox:17 hits: 10-10 to 10-30] 		none[none] none:none
 none|none none none
12:26:00 WinXP 83.132.131.90 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
VILA FRANCA DE XIRA, LISBOA, PT. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 b27d73bfcb
[Firefox:17 hits: 10-10 to 10-30] 		none[none] none:none
 none|none none none
T:12:48:00 WinXP 213.22.198.231 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
ALMADA, SETUBAL, PT. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 b5e71fd698
NEW 		none[none] none:none
 none|none none none
T:12:53:00 Win2K-f 76.77.231.48 (MADISONTELCO.COM):
MADISON TELEPHONE COMPANY,
HAMEL, ILLINOIS, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[4]
73f1082158[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
12:56:00 WinXP 86.55.83.238 (OPTINET.RO):
SC OPTINET SRL,
RO. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 4c934f9489
[Firefox:12 hits: 10-07 to 10-27] 		none[none] none:none
 none|none none none
13:01:00 WinXP 98.172.138.101 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.126:80
US:204.160.126.126:80
US:207.123.42.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
13:03:00 WinXP 89.152.109.232 (-):
TVCABO PORTUGAL S.A,
OEIRAS, LISBOA, PT. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1408 hits: 12-31 to 10-30] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:13:03:00 WinXP 89.152.109.232 (-):
TVCABO PORTUGAL S.A,
OEIRAS, LISBOA, PT. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1408 hits: 12-31 to 10-30] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
13:31:00 Win2K-f 130.13.55.51 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		115.126.2.121:65520 :proxim.ircgalaxy.pl
:ntkrnlpa.cn
IL:wrsnav.wwlax.com 		445 pcap raw alerts
ruleset 		irc
http
7 lines 		Yeah : 1.3
profile 		none summary
tarball 		23 of 36
33 of 36		 188a76e028
[Firefox: 6 hits: 10-30 to 10-30]
6a423f9994
[Firefox: 4 hits: 10-30 to 10-30] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
13:39:00 WinXP 203.180.17.192 (BMOBILE.NE.JP):
JAPAN COMMUNICATION INC,
JP. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 3ae357d17b
[Firefox:188 hits: 01-01 to 10-26] 		462a7be171 [0] ASM:Graph
 PolyEnE| lines=73 trace
13:44:00 WinXP 193.248.41.76 (STATIC-IP.OLEANE.FR):
TELECOM,
MONTPELLIER, LANGUEDOC-ROUSSILLON, FR. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:493 hits: 12-31 to 10-30] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
T:13:44:00 WinXP 67.205.208.123 (-):
. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 4f1299acc0
[Firefox: 7 hits: 10-07 to 10-28] 		none[none] none:none
 none|none none none
13:53:00 WinXP 82.225.163.87 (PROXAD.NET):
PROXAD / FREE SAS,
PARIS, ILE-DE-FRANCE, FR. 		n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36 96d089e522
[Firefox:36 hits: 10-08 to 10-30] 		none[none] none:none
 none|none none none
T:14:15:00 WinXP 85.138.240.151 (CPE.NETCABO.PT):
TVCABO-PORTUGAL CABLE MODEM NETWORK,
ALMADA, SETUBAL, PT. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 8df76b0d35
[Firefox: 3 hits: 10-26 to 10-30] 		none[none] none:none
 none|none none none
14:29:00 WinXP 87.63.11.32 (ADSL-DHCP.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. 		n/a DE:siliconfireware.ru
US:searchportal.information.com
RU:www.bbin.ru
RU:www.binbank.ru
:wpad
US:spi.domainsponsor.com
US:208.73.210.121:80 		445 pcap raw alerts
ruleset 		http
http
http
http
27 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a12cab51ef
[Firefox:599 hits: 01-01 to 10-30] 		40f7f463c4 [0] ASM:Graph
 ASPack| lines=281
embedded dns 		trace
T:14:32:00 WinXP 89.44.43.7 (PINET.RO):
SC PI NET SRL,
TIMISOARA, TIMIS, RO. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 0fe6a497e1
NEW 		none[none] none:none
 none|none none none
14:37:00 Win2K-f 70.66.218.213 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.219:80 		135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36
32 of 36		 14a7f9598a
NEW
348b47e27f
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
14:49:00 WinXP 72.188.109.151 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ORLANDO, FLORIDA, US. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1408 hits: 12-31 to 10-30] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:14:51:00 WinXP 217.201.81.75 (-):
TELECOM ITALIA MOBILE,
ROME, LAZIO, IT. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36 97afa4f2dc
[Firefox: 4 hits: 10-11 to 10-27] 		none[none] none:none
 none|none none none
T:14:53:00 Win2K-f 4.137.184.6 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
VIRGINIA BEACH, VIRGINIA, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.254:80 		135 pcap raw alerts
ruleset 		http
89 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[4]
a08f3b74a4[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
14:56:00 Win2K-f 24.76.172.201 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
124 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 36
31 of 36
0 of 32		 0115338c8b
[Firefox:28 hits: 09-12 to 10-29]
321f4fc27d
[Firefox:28 hits: 09-12 to 10-29]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[none]
none [none]
b5919931fe[1] 		none:none
none:none
ASM:Graph
 none|none
none|none
ASProtect| 		none
none
lines=90 		none
none
trace
14:57:00 WinXP 85.85.52.143 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 7098b3eebf
NEW 		none[none] none:none
 none|none none none
T:14:57:00 WinXP 85.85.52.143 (CLIENTES.EUSKALTEL.ES):
EUSKALTEL,
ES. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 7098b3eebf
NEW 		none[none] none:none
 none|none none none
T:14:58:00 WinXP 124.66.253.15 (FCH.NE.JP):
FUREAI CHANNEL INC,
HIROSHIMA, HIROSHIMA, JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:509 hits: 01-05 to 10-30] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:15:07:00 Win2K-f 130.13.114.10 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		115.126.2.121:65520 :proxim.ircgalaxy.pl
:fleshkatera.cn
115.126.2.110:80 		445 pcap raw alerts
ruleset 		irc
4 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36 98a4fc7e8e
NEW 		none[none] none:none
 none|none none none
15:07:00 Win2K-f 130.13.114.10 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		other
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 98a4fc7e8e
NEW 		none[none] none:none
 none|none none none
T:15:10:00 WinXP 119.72.26.10 (-):
. 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 36a475b4c7
NEW 		none[none] none:none
 none|none none none
T:15:15:00 WinXP 219.107.210.47 (MESH.AD.JP):
BIGLOBE-CIDR-BLK,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
[Firefox:640 hits: 01-01 to 10-30] 		eb7546c600 [0] ASM:Graph
 none|none lines=61 trace
15:31:00 Win2K-f 140.239.43.66 (XO.NET):
XO COMMUNICATIONS,
HOPKINTON, MASSACHUSETTS, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.173.49:80 		135 pcap raw alerts
ruleset 		other
85 lines 		Yeah : 1.3
profile 		none summary
tarball 		3 of 33
33 of 33		 73ce2b74da
[Firefox:29 hits: 06-18 to 10-29]
79c01ec060
[Firefox:65 hits: 06-18 to 10-29] 		73ce2b74da [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
tElock| 		lines=81
none 		trace
trace
15:43:00 WinXP 41.214.128.84 (-):
. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 643584ef4b
NEW 		none[none] none:none
 none|none none none
15:44:00 Win2K-f 172.129.149.139 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.219:80 		135 pcap raw alerts
ruleset 		http
111 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33
0 of 32
29 of 33		 3373948767
[Firefox:37 hits: 07-03 to 10-28]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30]
c73f738c30
[Firefox:37 hits: 07-03 to 10-28] 		none[none]
b5919931fe[1]
none [none] 		none:none
ASM:Graph
none:none
 none|none
ASProtect|
none|none 		none
lines=90
none 		none
trace
none
15:48:00 WinXP 67.150.253.145 (MDSG-PACWEST.COM):
PAC-WEST MANAGED MODEM NAS POOL,
SAN JOSE, CALIFORNIA, US. 		n/a UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		32 of 32 d1377a8b90
[Firefox: 3 hits: 03-25 to 07-14] 		ad56da3672 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:15:53:00 WinXP 218.211.81.233 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TW. 		n/a   135 pcap raw alerts
ruleset 		other
149 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 36
34 of 36		 173e1e68dd
NEW
675fe7e281
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
16:00:00 Win2K-f 75.36.121.141 (SBCGLOBAL.NET):
IRIS MFG INC,
PLANO, TEXAS, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80
US:208.111.148.50:80 		135 pcap raw alerts
ruleset 		other
74 lines 		Yeah : 1.3
profile 		none summary
tarball 		1 of 33
33 of 33		 4ca3056804
[Firefox: 9 hits: 06-18 to 10-30]
53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30] 		4ca3056804 [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
tElock| 		lines=81
none 		trace
trace
16:01:00 WinXP 76.177.79.226 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LONDON, KENTUCKY, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:208.111.148.23:80
US:208.111.148.50:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
16:06:00 WinXP 78.130.81.184 (REV.OPTIMUS.PT):
OPTIMUS TELECOMUNICAGUES S.A,
PT. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 6b3beaea1a
[Firefox:16 hits: 10-21 to 10-30] 		none[none] none:none
 none|none none none
16:10:00 WinXP 208.105.186.90 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.96.126:80 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:16:14:00 WinXP 70.184.153.39 (COX.NET):
COX COMMUNICATIONS,
PHOENIX, ARIZONA, US. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:192.221.96.126:80
US:198.78.220.124:80 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 36
35 of 36		 bea8cb1865
[Firefox:34 hits: 08-11 to 10-30]
fac78fde16
[Firefox:13 hits: 09-13 to 10-29] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
16:32:00 Win2K-f 24.170.56.77 (RR.COM):
ROAD RUNNER HOLDCO LLC,
INGLESIDE, TEXAS, US. 		n/a   135 pcap raw alerts
ruleset 		other
84 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33 a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		a08f3b74a4 [1] ASM:Graph
 Armadillo| lines=81 trace
16:58:00 Win2K-f 70.123.121.224 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HOUSTON, TEXAS, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[4]
a08f3b74a4[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
17:00:00 WinXP 70.68.30.183 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COQUITLAM, BRITISH COLUMBIA, CA. 		n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.124:80
US:207.123.37.126:80 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30]
e07c29c4ae
[Firefox:755 hits: 06-19 to 10-30] 		none[4]
73f1082158[1]
e07c29c4ae[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
FSG| 		none
lines=81
lines=92 		trace
trace
trace
17:19:00 WinXP 222.1.235.37 (DION.NE.JP):
DION (KDDI CORPORATION),
TOKYO, TOKYO, JP. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:509 hits: 01-05 to 10-30] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
17:23:00 WinXP 24.109.218.128 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
THUNDER BAY, ONTARIO, CA. (DSL) 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 a9800f880f
NEW 		none[none] none:none
 none|none none none
17:32:00 WinXP 94.50.218.219 (-):
. 		n/a RU:moscow-advokat.ru
:caen.fr.eu.undernet.org
:brussels.be.eu.undernet.org
SE:viking.dal.net
:gaspode.zanet.org.za
SE:broadway.ny.us.dal.net
AT:graz.at.eu.undernet.org
SE:ozbytes.dal.net
SE:qis.md.us.dal.net 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 25 7f60162c2c
[Firefox:813 hits: 12-31 to 10-30] 		1aad8e4632 [0] ASM:Graph
 PolyEnE| lines=93
embedded dns 		trace
T:17:37:00 Win2K-f 12.73.67.23 (ATT.NET):
AT&T WORLDNET SERVICES,
AUSTIN, TEXAS, US. (DIAL) 		n/a US:microsoft.com
US:download.microsoft.com
US:204.160.126.126:80
US:207.123.37.125:80
US:207.123.37.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:17:42:00 Win2K-f 76.177.79.226 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LONDON, KENTUCKY, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80 		135 pcap raw alerts
ruleset 		http
77 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[4]
a08f3b74a4[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
T:17:54:00 WinXP 124.43.143.201 (-):
INTERNET SERVICE PROVIDER IN SRI LANKA,
LK. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 b27d73bfcb
[Firefox:17 hits: 10-10 to 10-30] 		none[none] none:none
 none|none none none
T:17:57:00 Win2K-f 98.174.80.235 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[4]
73f1082158[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
T:18:07:00 WinXP 70.184.216.118 (COX.NET):
COX COMMUNICATIONS,
OMAHA, NEBRASKA, US. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 039d82e2db
[Firefox: 3 hits: 10-28 to 10-29] 		none[none] none:none
 none|none none none
T:18:19:00 WinXP 88.176.188.153 (PROXAD.NET):
PROXAD / FREE SAS,
FR. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 31a5a51653
NEW 		none[none] none:none
 none|none none none
18:25:00 Win2K-f 130.13.147.245 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		135 pcap raw alerts
ruleset 		other
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 36 22b648d99d
[Firefox: 2 hits: 10-30 to 10-30] 		none[none] none:none
 none|none none none
18:25:00 Win2K-f 76.89.18.176 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:18:29:00 Win2K-f 130.13.147.245 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		other
1 line 		Yeah : 0.8
profile 		none summary
tarball 		33 of 36 22b648d99d
[Firefox: 2 hits: 10-30 to 10-30] 		none[none] none:none
 none|none none none
18:32:00 WinXP 97.106.159.203 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.53.125:80 		135 pcap raw alerts
ruleset 		http
77 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30]
e07c29c4ae
[Firefox:755 hits: 06-19 to 10-30] 		none[4]
73f1082158[1]
e07c29c4ae[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
FSG| 		none
lines=81
lines=92 		trace
trace
trace
T:18:34:00 WinXP 202.150.114.242 (-):
KOL-DIAL,
AUCKLAND, AUCKLAND, NZ. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		34 of 35 017f3b2704
[Firefox: 3 hits: 10-26 to 10-28] 		none[none] none:none
 none|none none none
T:18:38:00 WinXP 173.18.182.189 (-):
. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
[Firefox:1408 hits: 12-31 to 10-30] 		7a70e1b592 [0] ASM:Graph
 PolyEnE| lines=68 trace
18:52:00 Win2K-f 68.151.232.60 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
EDMONTON, ALBERTA, CA. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
585 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:18:55:00 Win2K-f 4.87.93.82 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
HILLIARD, FLORIDA, US. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520 		135 pcap raw alerts
ruleset 		http
174 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 36
0 of 32
35 of 36		 9335b705d0
[Firefox: 2 hits: 09-15 to 10-08]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30]
d43a1e42d2
[Firefox: 2 hits: 09-15 to 10-08] 		none[none]
b5919931fe[1]
none [none] 		none:none
ASM:Graph
none:none
 none|none
ASProtect|
none|none 		none
lines=90
none 		none
trace
none
18:59:00 Win2K-f 97.90.139.230 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com
US:207.123.37.124:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:19:07:00 WinXP 212.27.2.5 (-):
MLIFENET,
RU. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		35 of 36 c0e2e2d5ee
[Firefox: 6 hits: 10-12 to 10-21] 		none[none] none:none
 none|none none none
T:19:13:00 WinXP 222.1.235.37 (DION.NE.JP):
DION (KDDI CORPORATION),
TOKYO, TOKYO, JP. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:509 hits: 01-05 to 10-30] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
T:19:17:00 WinXP 4.225.137.66 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
LAWRENCEBURG, INDIANA, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
4 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
19:27:00 WinXP 219.254.242.215 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:199.93.44.126:80
US:206.33.45.125:80
US:4.23.60.125:80 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 33
28 of 33		 533d15b5ce
[Firefox:37 hits: 06-21 to 10-30]
58c343a8d8
[Firefox:41 hits: 06-21 to 10-30] 		none[4]
58c343a8d8[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=82 		trace
trace
19:28:00 WinXP 12.73.239.2 (ATT.NET):
AT&T WORLDNET SERVICES,
CHICAGO, ILLINOIS, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 1a2c0e6130
[Firefox:493 hits: 12-31 to 10-30] 		048df78048 [0] ASM:Graph
 none|none lines=61 trace
T:19:38:00 WinXP 75.82.184.100 (RR.COM):
ROAD RUNNER HOLDCO LLC,
THOUSAND OAKS, CALIFORNIA, US. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 32 03f912899b
[Firefox:188 hits: 01-08 to 10-29] 		83893bd25d [0] ASM:Graph
 none|none lines=65 trace
19:44:00 Win2K-f 130.13.219.76 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a US:mail.fucuzzy.com
DE:www.proxy.us.pl 		135 pcap raw alerts
ruleset 		irc
http
39 lines 		Yeah : 0.8
profile 		none summary
tarball 		5 of 36 fd419eefad
NEW 		none[none] none:none
 none|none none none
T:19:45:00 WinXP 60.179.160.200 (163DATA.COM.CN):
CHINANET-ZJ NINGBO NODE NETWORK,
NINGBO, ZHEJIANG, CN. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36 b7ba8daae1
[Firefox: 9 hits: 10-15 to 10-29] 		none[none] none:none
 none|none none none
T:19:48:00 WinXP 130.13.219.76 (QWEST.NET):
QWEST BROADBAND SERVICES INC,
PHOENIX, ARIZONA, US. 		n/a US:mail.fucuzzy.com
DE:www.proxy.us.pl 		445 pcap raw alerts
ruleset 		irc
http
33 lines 		Yeah : 0.8
profile 		none summary
tarball 		5 of 36 fd419eefad
NEW 		none[none] none:none
 none|none none none
19:50:00 Win2K-f 70.77.56.69 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 32
31 of 32
23 of 33		 b5919931fe
[Firefox:1000 hits: 06-20 to 10-30]
bca9e0fb5f
[Firefox:39 hits: 06-18 to 10-28]
e53a9ea82e
[Firefox:38 hits: 06-18 to 10-28] 		b5919931fe [1]
none [4]
e53a9ea82e[1] 		ASM:Graph
none:none
ASM:Graph
 ASProtect|
PolyEnE|
Armadillo| 		lines=90
none
lines=81 		trace
trace
trace
T:19:52:00 WinXP 121.84.20.183 (EONET.NE.JP):
K-OPTICOM CORPORATION,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 36 1bfebad740
NEW 		none[none] none:none
 none|none none none
19:58:00 Win2K-f 75.49.15.10 (SBCGLOBAL.NET):
PPPOX POOL - SE1.WOTNOH 101906-1259,
US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[4]
73f1082158[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
20:05:00 WinXP 121.84.20.183 (EONET.NE.JP):
K-OPTICOM CORPORATION,
JP. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 36 1bfebad740
NEW 		none[none] none:none
 none|none none none
T:20:15:00 WinXP 71.104.203.30 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
YUCAIPA, CALIFORNIA, US. (DSL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 b1c85cee4b
[Firefox: 5 hits: 10-27 to 10-29] 		none[none] none:none
 none|none none none
20:34:00 WinXP 59.105.27.203 (SEED.NET.TW):
DIGITAL UNITED I,
TAIPEI, T'AI-PEI, TW. (DSL) 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36 1595515522
[Firefox: 4 hits: 10-09 to 10-29] 		none[none] none:none
 none|none none none
T:20:34:00 WinXP 59.105.27.203 (SEED.NET.TW):
DIGITAL UNITED I,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a UA:citi-bank.ru
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 1595515522
[Firefox: 4 hits: 10-09 to 10-29] 		none[none] none:none
 none|none none none
20:38:00 Win2K-f 24.29.83.90 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ALBANY, NEW YORK, US. 		n/a US:microsoft.com
US:download.microsoft.com
US:198.78.220.126:80 		135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
a08f3b74a4
[Firefox:1275 hits: 06-18 to 10-30] 		none[4]
a08f3b74a4[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
T:20:38:00 WinXP 98.133.106.231 (-):
ALLTEL MIP CUSTOMERS - LITTLE ROCK,
LITTLE ROCK, ARKANSAS, US. 		194.54.90.246:80 :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 a84ffdf670
[Firefox:20 hits: 09-14 to 10-25] 		none[none] none:none
 none|none none none
T:20:41:00 WinXP 172.130.38.197 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.99.124:80
US:192.221.99.126:80
US:199.93.44.126:80 		135 pcap raw alerts
ruleset 		other
154 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36
29 of 33		 0474b4b09f
[Firefox:11 hits: 09-24 to 10-29]
1c3210698a
[Firefox:13 hits: 07-13 to 10-29] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:20:49:00 WinXP 67.205.208.123 (-):
. 		n/a :proxim.ircgalaxy.pl
UA:citi-bank.ru
115.126.2.121:65520
UA:194.54.90.246:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 4f1299acc0
[Firefox: 7 hits: 10-07 to 10-28] 		none[none] none:none
 none|none none none
20:58:00 WinXP 70.184.102.222 (COX.NET):
COX COMMUNICATIONS,
CHANDLER, ARIZONA, US. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520 		135 pcap raw alerts
ruleset 		http
114 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 36
35 of 36		 bea8cb1865
[Firefox:34 hits: 08-11 to 10-30]
fac78fde16
[Firefox:13 hits: 09-13 to 10-29] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
21:01:00 Win2K-f 70.182.94.50 (COX.NET):
COX COMMUNICATIONS,
OKLAHOMA CITY, OKLAHOMA, US. 		n/a :proxim.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:207.123.42.126:80 		135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 33
29 of 33		 87e1117f2a
[Firefox:28 hits: 07-18 to 10-29]
b4fe4581c3
[Firefox:28 hits: 07-18 to 10-29] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
21:01:00 Win2K-f 65.212.111.245 (HARTCOM.NET):
HART TELECOM,
HARTWELL, GEORGIA, US. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30] 		none[4]
73f1082158[1] 		none:none
ASM:Graph
 tElock|
Armadillo| 		none
lines=81 		trace
trace
21:07:00 Win2K-f 218.220.174.202 (ZAQ.NE.JP):
TOYONAKA IKEDA CABLENET CO. LTD,
TOYONAKA, OSAKA, JP. 		n/a   135 pcap raw alerts
ruleset 		other
238 lines 		Yeah : 1.3
profile 		none summary
tarball 		24 of 32 fbacdd87c0
[Firefox: 4 hits: 06-06 to 10-30] 		none[4] none:none
 none|none none trace
21:09:00 WinXP 222.1.235.32 (DION.NE.JP):
DION (KDDI CORPORATION),
TOKYO, TOKYO, JP. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:509 hits: 01-05 to 10-30] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
21:18:00 Win2K-f 98.141.163.233 (-):
. 		n/a  
115.126.2.121:65520 		135 pcap raw alerts
ruleset 		other
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
21:20:00 WinXP 68.146.119.219 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:199.93.44.124:80
US:207.123.37.124:80 		135 pcap raw alerts
ruleset 		http
112 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 35
33 of 36		 6df8da6fb7
NEW
d5c7b042b7
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
21:22:00 WinXP 211.203.31.16 (HANANET.NET):
HANARO TELECOM INC,
KR. 		n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:199.93.44.124:80
US:207.123.37.124:80
US:207.123.46.125:80 		135 pcap raw alerts
ruleset 		other
86 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
2 of 36		 8ec6129efe
[Firefox:20 hits: 06-24 to 10-21]
d9766a3162
NEW 		none[4]
none [none] 		none:none
none:none
 tElock|
none|none 		none
none 		trace
none
21:33:00 WinXP 78.92.179.61 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a :proxim.ircgalaxy.pl
115.126.2.121:65520 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		35 of 36 7fd7475c63
[Firefox: 2 hits: 10-29 to 10-30] 		none[none] none:none
 none|none none none
T:21:47:00 Win2K-f 118.86.74.219 (-):
. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
123 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 36
0 of 32
34 of 36		 0b951c2832
[Firefox: 7 hits: 08-19 to 10-22]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30]
e4ed4df0f0
[Firefox: 7 hits: 08-19 to 10-22] 		none[none]
b5919931fe[1]
none [none] 		none:none
ASM:Graph
none:none
 none|none
ASProtect|
none|none 		none
lines=90
none 		none
trace
none
22:08:00 WinXP 210.233.204.126 (MEDIATTI.NET):
MEDIATTI COMMUNICATIONS INC,
OKINAWA, OKINAWA, JP. 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
98 lines 		Yeah : 1.3
profile 		none summary
tarball 		3 of 33
33 of 33
0 of 33		 3ed16ae12d
[Firefox:28 hits: 06-19 to 10-29]
79c01ec060
[Firefox:65 hits: 06-18 to 10-29]
e07c29c4ae
[Firefox:755 hits: 06-19 to 10-30] 		3ed16ae12d [1]
none [4]
e07c29c4ae[1] 		ASM:Graph
none:none
ASM:Graph
 Armadillo|
tElock|
FSG| 		lines=81
none
lines=92 		trace
trace
trace
22:34:00 Win2K-f 24.65.249.105 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com
US:192.221.108.126:80
US:198.78.201.126:80 		135 pcap raw alerts
ruleset 		http
111 lines 		Yeah : 1.3
profile 		none summary
tarball 		30 of 34
32 of 34		 13a5c7ce0d
NEW
54c19812f4
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:22:39:00 Win2K-f 116.127.164.194 (-):
HANARO TELECOM,
SEOUL, KYONGGI-DO, KR. 		n/a :proxima.ircgalaxy.pl
US:microsoft.com
US:download.microsoft.com
115.126.2.121:65520
US:192.221.110.126:80
US:207.123.37.124:80
US:207.123.37.126:80 		135 pcap raw alerts
ruleset 		other
99 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 33
31 of 33		 776985f561
[Firefox:21 hits: 06-24 to 10-21]
8ec6129efe
[Firefox:20 hits: 06-24 to 10-21] 		776985f561 [1]
none [4] 		ASM:Graph
none:none
 Armadillo|
tElock| 		lines=82
none 		trace
trace
T:22:40:00 WinXP 222.1.235.32 (DION.NE.JP):
DION (KDDI CORPORATION),
TOKYO, TOKYO, JP. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
[Firefox:509 hits: 01-05 to 10-30] 		e0197e8a64 [0] ASM:Graph
 none|none lines=62 trace
22:42:00 Win2K-f 70.65.17.97 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
RED DEER, ALBERTA, CA. (DSL) 		n/a US:microsoft.com
US:download.microsoft.com 		135 pcap raw alerts
ruleset 		http
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32
0 of 32		 53bfe15e91
[Firefox:3576 hits: 06-17 to 10-30]
73f1082158
[Firefox:1774 hits: 06-18 to 10-30]
b5919931fe
[Firefox:1000 hits: 06-20 to 10-30] 		none[4]
73f1082158[1]
b5919931fe[1] 		none:none
ASM:Graph
ASM:Graph
 tElock|
Armadillo|
ASProtect| 		none
lines=81
lines=90 		trace
trace
trace
23:03:00 Win2K-f 70.71.13.190 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
NEW WESTMINSTER, BRITISH COLUMBIA, CA. (DSL) 		n/a US:microsoft.com
:proxim.ircgalaxy.pl
US:download.microsoft.com
115.126.2.121:80
US:205.128.73.126:80
US:206.33.45.125:80
US:207.123.37.123:80 		135 pcap raw alerts
ruleset 		other
254 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 36
28 of 36		 5d0e642ee3
NEW
836f82f058
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
23:08:00 WinXP 24.67.140.181 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
COMOX, BRITISH COLUMBIA, CA. 		72.10.172.218:7382 :proxim.ircgalaxy.pl
:done.blacktiehsbdcs.com
CA:italian.swiifatecihno.com
115.126.2.121:65520 		135 pcap raw alerts
ruleset 		irc
http
837 lines 		Yeah : 1.8
profile 		none summary
tarball 		19 of 36
34 of 36		 03d5bf43b7
[Firefox: 6 hits: 09-18 to 10-26]
d3be2c7a88
[Firefox: 3 hits: 09-30 to 10-13] 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
23:13:00 WinXP 218.223.218.213 (CTT.NE.JP):
CABLE TELEVISION TOYAMA INCORPORETED,
TOKYO, TOKYO, JP. 		194.54.90.246:80 UA:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 36 1d84ca0934
[Firefox: 2 hits: 10-29 to 10-30] 		none[none] none:none
 none|none none none
23:16:00 Win2K-f 70.62.226.28 (RR.COM):
ROAD RUNNER HOLDCO LLC,
FAIRFIELD, OHIO, US. 		n/a  
115.126.2.121:80 		135 pcap raw alerts
ruleset 		other
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
23:22:00 WinXP 74.219.195.48 (-):
. 		n/a :proxim.ircgalaxy.pl
RU:moscow-advokat.ru
:flanders.be.eu.undernet.org
SE:viking.dal.net
:caen.fr.eu.undernet.org
:los-angeles.ca.us.undernet.org
SE:coins.dal.net
AT:graz.at.eu.undernet.org
:washington.dc.us.undernet.org
NL:diemen.nl.eu.undernet.org
:lulea.se.eu.undernet.org
:brussels.be.eu.undernet.org
SE:ozbytes.dal.net
115.126.2.121:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 36 805afbac09
NEW 		none[none] none:none
 none|none none none