Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

19 June 2009
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
T:03:25:00 WinXP 173.29.206.174 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
111 lines 		Yeah : 1.3
profile 		none summary
tarball 		37 of 41
38 of 41		 692f9bb8df
NEW
d482a2bec3
NEW 		2bf6f4e9f0 [0]
50a83c6b54[0] 		none:none
none:none
 Armadillo|
tElock| 		none
none 		trace
trace
03:55:00 Win2K-f 93.124.36.202 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a US:www.maxmind.com
US:www.getmyip.org
EU:checkip.dyndns.org
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:04:05:00 Win2K-f 93.124.36.202 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a US:www.maxmind.com
:getmyip.co.uk
:checkip.dyndns.org
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:04:12:00 WinXP 174.6.21.151 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:04:16:00 WinXP 4.130.93.253 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
FT. WORTH, TEXAS, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
130 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
04:21:00 Win2K-f 200.71.103.63 (TELESAT.COM.CO):
COLDECON,
CALI, VALLE DEL CAUCA, CO. 		n/a US:www.maxmind.com
:checkip.dyndns.org
US:www.getmyip.org
208.78.68.70:80
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:04:37:00 Win2K-f 114.204.24.15 (-):
. 		n/a   135 pcap raw alerts
ruleset 		other
6 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:04:40:00 WinXP 114.48.44.103 (-):
. 		n/a   445 pcap raw alerts
ruleset 		shell
3 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:06:20:00 Win2K-f 113.255.120.124 (-):
. 		n/a   135 pcap raw alerts
ruleset 		other
6 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
07:30:00 Win2K-f 212.174.151.196 (-):
KUMTEL DAYANIKLI TUKETIM MALLARI PLASTIK SANAYI TIC. A.S,
ANKARA, ANKARA, TR. (100Mbps) 		n/a US:www.maxmind.com
:getmyip.co.uk
US:checkip.dyndns.org
US:www.getmyip.org
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		7 of 37 7587773eea
NEW 		none[3] none:none
 StarForce| none trace
T:08:12:00 WinXP 70.138.28.11 (SBCGLOBAL.NET):
PPPOX POOL - BRAS12 MRDNCT,
SEYMOUR, CONNECTICUT, US. (DSL) 		n/a US:www.yahoo.com
:jbeegvia.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		32 of 32 bb7681eca8
NEW 		none[3] none:none
 tElock| none trace
T:08:20:00 WinXP 218.210.80.111 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
57ce4acac2
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:08:39:00 WinXP 124.195.152.78 (-):
. 		61.120.62.28:3305 JP:cx10man.weedns.com
KR:fx010413.whyI.org
JP:61.120.62.28:3305 		135 pcap raw alerts
ruleset 		irc
577 lines 		Yeah : 1.8
profile 		none summary
tarball 		37 of 41 aafd96fe57
NEW 		9d4029abac [0] none:none
 StarForce| none trace
08:49:00 Win2K-f 69.39.225.43 (GIGENET.NET):
ECOMDEVEL LLC,
OAK BROOK, ILLINOIS, US. 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
EU:checkip.dyndns.org
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:08:58:00 Win2K-f 69.39.225.43 (GIGENET.NET):
ECOMDEVEL LLC,
OAK BROOK, ILLINOIS, US. 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
:checkip.dyndns.org
US:64.246.48.99:666 		445 pcap raw alerts
ruleset 		http
9 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:09:14:00 WinXP 121.124.28.107 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		121.12.116.142:65520 CN:proxim.ircgalaxy.pl
US:microsoft.com
DE:dl2.guarddog2009.com
:www.google.com
:upr15may.com
GB:zz-dns.com 		135 pcap raw alerts
ruleset 		irc
http
http
http
140 lines 		Yeah : 1.8
profile 		none summary
tarball 		29 of 32
28 of 32
12 of 30
25 of 41		 8a75955033
NEW
9276c8b36b
NEW
ca557e7460
NEW
def0132311
NEW 		2bf3e548b9 [0]
none [0]
42d57774ef[0]
7a31307d90[0] 		ASM:Graph
ASM:Graph
none:none
none:none
 tElock|
Armadillo|
none|none
ASProtect| 		lines=126
embedded dns
lines=81
none
none 		trace
trace
trace
trace
09:45:00 Win2K-f 91.64.100.185 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
DE. 		n/a US:www.maxmind.com
:checkip.dyndns.org
US:www.getmyip.org
:getmyip.co.uk
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:10:55:00 WinXP 83.93.68.181 (ADSL-DHCP.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
COPENHAGEN, COPENHAGEN, DK. (DSL) 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 3ae357d17b
NEW 		none[0] ASM:Graph
 PolyEnE| lines=73 trace
10:57:00 Win2K-f 122.34.131.10 (-):
POWERCOMM,
KR. 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
US:checkip.dyndns.org
US:67.15.94.80:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:11:05:00 Win2K-f 122.34.131.10 (-):
POWERCOMM,
KR. 		n/a US:www.maxmind.com
:getmyip.co.uk
EU:checkip.dyndns.org
US:64.246.48.99:666 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:11:13:00 WinXP 84.140.194.88 (T-IPCONNECT.DE):
DEUTSCHE TELEKOM AG,
HAMBURG, HAMBURG, DE. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 32 03f912899b
NEW 		none[0] none:none
 none|none lines=64 trace
T:11:33:00 Win2K-f 211.124.136.152 (ZAQ.NE.JP):
KITAKAWACHI CABLE NET CO LTD,
OSAKA, OSAKA, JP. 		n/a :japan.youngpeyatech.info
CN:italian.swiifatecihno.com 		135 pcap raw alerts
ruleset 		irc
http
591 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 40 d8b652221d
NEW 		edfa4116ba [0] none:none
 ASPack| none trace
12:14:00 Win2K-f 87.14.130.90 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
MILANO, LOMBARDIA, IT. 		n/a US:www.maxmind.com
:getmyip.co.uk
US:www.getmyip.org
:checkip.dyndns.org
US:67.15.94.80:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:12:50:00 WinXP 173.20.140.66 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
12:54:00 Win2K-f 219.81.233.7 (TFN.NET.TW):
TAIWAN FIXED NETWORK CO. LTD,
TW. 		n/a US:www.maxmind.com
:checkip.dyndns.org
US:www.getmyip.org
:getmyip.co.uk
208.78.69.70:80
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:13:02:00 Win2K-f 219.81.233.7 (TFN.NET.TW):
TAIWAN FIXED NETWORK CO. LTD,
TW. 		n/a US:www.maxmind.com
US:www.getmyip.org
US:checkip.dyndns.org
US:64.246.48.99:666 		445 pcap raw alerts
ruleset 		http
6 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:13:14:00 Win2K-f 4.255.51.77 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
VANCOUVER, WASHINGTON, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:14:14:00 Win2K-f 24.103.188.185 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
15:03:00 Win2K-f 85.47.250.60 (BUSINESS.TELECOMITALIA.IT):
INTERBUSINESS,
ROME, LAZIO, IT. (100Mbps) 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
EU:checkip.dyndns.org
US:67.15.94.80:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:15:22:00 WinXP 97.76.65.27 (-):
. 		n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
NEW 		none[0] none:none
 PolyEnE| lines=93
embedded dns 		trace
15:28:00 Win2K-f 115.178.61.90 (-):
. 		n/a US:www.maxmind.com
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:15:30:00 WinXP 69.232.18.154 (PACBELL.NET):
HI STYLES FASHIONS INC,
PLANO, TEXAS, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:15:41:00 Win2K-f 207.5.209.117 (GWI.NET):
GREAT WORKS INTERNET,
ROCHESTER, NEW HAMPSHIRE, US. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:15:46:00 Win2K-f 98.175.155.89 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
16:21:00 Win2K-f 190.105.33.144 (-):
. 		n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
:getmyip.co.uk
US:67.15.94.80:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		7 of 37 7587773eea
NEW 		none[3] none:none
 StarForce| none trace
T:16:52:00 WinXP 67.0.8.172 (QWEST.NET):
QWEST COMMUNICATIONS CORPORATION,
OMAHA, NEBRASKA, US. 		n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
SE:kavkazcenter.com
SE:kavkazcenter.net
FI:kavkazchat.com
US:chechenpress.info
GB:chechenpress.co.uk
:shaheeds.org
US:daymohk.info
:chripress.org
:marsho.dk
US:www.chechenpress.org
FI:imgs2.kavkazcenter.com
:www.google.com
GB:www.chechenpress.co.uk
FI:static.kavkazchat.com
:www.google-analytics.com
:widget-62.slide.com
:www.youtube.com
74.125.19.100:80 		445 pcap raw alerts
ruleset 		http
http
97 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 ab5e47bf8d
NEW 		67fb5eff61 [0] none:none
 ASPack| none trace
T:16:54:00 WinXP 76.240.86.226 (SBCGLOBAL.NET):
PPPOX POOL - BRAS3.LSAN,
US. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
16 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
NEW 		none[0] none:none
 none|none lines=60 trace
T:17:17:00 WinXP 189.54.165.249 (BRASILTELECOM.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. 		213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 41 58f016311a
NEW 		99e6d4fa8d [0] none:none
 PolyEnE| none trace
T:17:50:00 Win2K-f 113.252.254.123 (-):
. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
22 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 41 61a9127875
NEW 		61a9127875 [1] ASM:Graph
 pex| lines=19 trace
T:17:50:00 Win2K-f 76.11.232.207 (-):
. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
24 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 ec007c5df1
NEW 		18ff3687ad [0] none:none
 ASPack| none trace
T:17:51:00 WinXP 67.204.206.209 (-):
. 		n/a RU:m.drd3h.com 139 pcap raw alerts
ruleset 		ftp
irc
28 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 84b1b363a1
NEW 		1e4ad6cdb1 [0] none:none
 ASPack| none trace
T:17:53:00 Win2K-f 113.255.9.179 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 8128405d8c
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
17:57:00 Win2K-f 190.90.111.190 (EQUITEL.COM.CO):
INTERNEXA S.A. E.S.P,
CO. 		n/a US:www.maxmind.com
:checkip.dyndns.org
:getmyip.co.uk
US:www.getmyip.org
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		2 of 37 d60e538e72
NEW 		none[3] none:none
 UPX| none trace
T:18:00:00 WinXP 64.130.161.29 (SCRTC.COM):
SOUTH CENTRAL RURAL TELEPHONE CO,
SAN JOSE, CALIFORNIA, US. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
32 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 ec007c5df1
NEW 		18ff3687ad [0] none:none
 ASPack| none trace
T:18:06:00 Win2K-f 190.90.111.190 (EQUITEL.COM.CO):
INTERNEXA S.A. E.S.P,
CO. 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:18:12:00 WinXP 81.213.237.93 (TTNET.NET.TR):
ADSL-ALC-DIYARBAKIR-DYNAMIC POOL,
DIYARBAKIR, DIYARBAKIR, TR. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
26 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 41 6af2277cd2
NEW 		6ac8587a1c [0] none:none
 ASPack| none trace
T:18:13:00 Win2K-f 59.104.2.202 (SEED.NET.TW):
DIGITAL UNITED I,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
28 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 b7a2732226
NEW 		4fadf3fb74 [0] none:none
 ASPack| none trace
T:18:22:00 Win2K-f 218.168.132.100 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 8128405d8c
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:18:27:00 WinXP 70.60.77.101 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MIDDLETOWN, OHIO, US. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
30 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 8128405d8c
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:18:31:00 Win2K-f 94.176.45.165 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		33 of 41 8c9b5f32e6
NEW 		1e4ad6cdb1 [0] none:none
 ASPack| none trace
T:18:32:00 WinXP 195.93.135.108 (IPAPER.COM):
BLOCK FOR PI ASSIGNMENTS,
UK. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
30 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 41 90c63ae197
NEW 		08bd24eb68 [0] none:none
 ASPack| none trace
T:18:38:00 Win2K-f 190.245.124.20 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		30 of 39 1a6c7da535
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:18:39:00 WinXP 218.191.92.37 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
33 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:18:50:00 Win2K-f 221.125.16.109 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:18:52:00 Win2K-f 114.38.110.68 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 41 fe87c62b51
NEW 		fe87c62b51 [1] ASM:Graph
 pex| lines=19 trace
T:18:52:00 WinXP 88.185.125.104 (PROXAD.NET):
PROXAD / FREE SAS,
FR. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
36 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 c13a6c3da5
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:18:57:00 WinXP 87.205.150.45 (INETIA.PL):
NETIA,
PL. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
30 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 8bdfceaf84
NEW 		8a510bc571 [0] none:none
 ASPack| none trace
T:19:09:00 WinXP 78.227.84.234 (PRESTONAUTO.COM):
PROXAD INTERNET SERVICE PROVIDER IN FRANCE,
PARIS, ILE-DE-FRANCE, FR. 		66.252.13.212:16667 US:bbs.moiservice.com 135 pcap raw alerts
ruleset 		irc
389 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41 9c681fb3f5
NEW 		93d1cdff9e [0] none:none
 Stranik| none trace
T:19:11:00 Win2K-f 92.225.151.67 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		203.146.251.62:3305 TH:cx10man.weedns.com
GB:fx010413.whyI.org
KR:gynoman.weedns.com
GB:c010x1.co.cc
JP:commgr.co.cc
JP:g.0x20.biz
:telephone.dd.blueline.be
:phonewire.dd.blueline.be
:phonelogin.dd.blueline.be
TH:ufospace.etowns.net
JP:61.120.62.28:3305 		135 pcap raw alerts
ruleset 		irc
962 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 41 9fb269d669
NEW 		1599a3de5f [0] none:none
 StarForce| none trace
19:24:00 Win2K-f 186.9.128.236 (-):
. 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
US:checkip.dyndns.org
US:67.15.94.80:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		8 of 37 4f88618d4f
NEW 		none[3] none:none
 UPX| none trace
T:19:27:00 WinXP 114.46.106.163 (-):
. 		n/a RU:m.drd3h.com 139 pcap raw alerts
ruleset 		ftp
irc
26 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 41 9b2c7d1c22
NEW 		1e4ad6cdb1 [0] none:none
 ASPack| none trace
T:19:29:00 Win2K-f 122.55.187.5 (PLDT.NET):
IPG,
PH. 		66.252.13.212:16667 US:bbs.moiservice.com 135 pcap raw alerts
ruleset 		irc
324 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41 3539b0aaf8
NEW 		e7124c9b61 [0] none:none
 Stranik| none trace
T:19:30:00 Win2K-f 79.64.118.135 (AS9105.COM):
TELINCO,
UK. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
29 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 50cdd5c6cf
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:19:32:00 WinXP 85.152.242.135 (CM-85-152-242-10.TELECABLE.ES):
TELECABLE,
ES. (DSL) 		66.252.13.212:16667 RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
30 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41 6a7b38897f
NEW 		6ac8587a1c [0] none:none
 ASPack| none trace
T:19:37:00 WinXP 86.96.0.183 (NET.AE):
EMIRATES TELECOMMUNICATIONS CORPORATION,
DUBAI, DUBAI, AE. 		n/a CN:irc.zief.pl
:moscow-advokat.ru
NL:diemen.nl.eu.undernet.org
:brussels.be.eu.undernet.org
:washington.dc.us.undernet.org
:caen.fr.eu.undernet.org
:lulea.se.eu.undernet.org
CN:proxim.ircgalaxy.pl
SE:coins.dal.net
SE:viking.dal.net
:los-angeles.ca.us.undernet.org
NO:london.uk.eu.undernet.org
SE:ozbytes.dal.net
AT:graz.at.eu.undernet.org
SE:ced.dal.net
:gaspode.zanet.org.za
SE:broadway.ny.us.dal.net
SE:qis.md.us.dal.net
114.80.101.21:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		31 of 41 a2edb8f907
NEW 		da04648dc3 [0] none:none
 PolyEnE| none trace
T:19:52:00 WinXP 70.72.156.95 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
19 lines 		Yeah : 0.8
profile 		none summary
tarball 		34 of 41 a82464d8f8
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:19:56:00 WinXP 24.83.196.252 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 25ef2f5f6d
NEW 		9399e2ac48 [0] none:none
 ASPack| none trace
T:19:59:00 Win2K-f 67.204.155.217 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:19:59:00 Win2K-f 218.63.195.36 (-):
QUJING CITY TRAFFIC POLICE BUREAU,
CN. (100Mbps) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
22 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:20:03:00 Win2K-f 125.225.68.20 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 50cdd5c6cf
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:20:08:00 WinXP 116.44.212.100 (-):
LG POWERCOMM,
SEOUL, KYONGGI-DO, KR. 		n/a RU:m.drd3h.com
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 41 053e25e2e4
NEW 		1e4ad6cdb1 [0] none:none
 ASPack| none trace
T:20:12:00 WinXP 118.87.0.133 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
123 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 36
34 of 36		 0b951c2832
NEW
e4ed4df0f0
NEW 		5fe761661a [0]
de471fc380[0] 		none:none
none:none
 Armadillo|
tElock| 		none
none 		trace
trace
T:20:13:00 WinXP 174.1.82.246 (-):
. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 41 ea9291e34b
NEW 		9399e2ac48 [0] none:none
 ASPack| none trace
T:20:17:00 Win2K-f 61.216.151.12 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 8128405d8c
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:20:27:00 Win2K-f 24.87.2.110 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 644e3df1d9
NEW 		28e4c0f083 [0] none:none
 ASPack| none trace
T:20:28:00 Win2K-f 64.130.181.204 (SCRTC.COM):
SOUTH CENTRAL RURAL TELEPHONE CO,
SAN JOSE, CALIFORNIA, US. (DSL) 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 9810215e67
NEW 		18ff3687ad [0] none:none
 ASPack| none trace
T:20:39:00 Win2K-f 119.149.52.159 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 40 013a5ba10e
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:20:42:00 WinXP 113.253.12.221 (-):
. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
20:43:00 Win2K-f 117.23.127.61 (163DATA.COM.CN):
CHINANET SHANXI(SN) PROVINCE NETWORK,
BEIJING, BEIJING, CN. 		n/a US:www.maxmind.com
:getmyip.co.uk
EU:checkip.dyndns.org
US:www.getmyip.org
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		7 of 37 7587773eea
NEW 		none[3] none:none
 StarForce| none trace
T:20:43:00 WinXP 70.72.153.247 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
19 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 379a6daa0d
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:20:48:00 WinXP 85.122.56.21 (RNC.RO):
RNC,
RO. 		67.43.236.66:8080 72.10.172.211:8080 CA:xx.ka3ek.com
CA:xx.nadnadzz.info
:xx.enterhere.biz
NL:xx.sqlteam.info
:zone2tech.info
CA:tx.mostafaaljaafari.net
CA:67.43.226.242:8080
CA:67.43.236.66:10324
CA:67.43.236.66:8080
NL:83.68.16.6:5190 		139 pcap raw alerts
ruleset 		ftp
irc
http
25 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 39 367ce61cff
NEW 		48128671a8 [0] ASM:Graph
 StarForce| lines=52 trace
T:20:56:00 Win2K-f 199.120.116.154 (PIONET.NET):
LONG LINES INTERNET,
SERGEANT BLUFF, IOWA, US. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 b68d420d61
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
20:56:00 Win2K-f 81.28.112.11 (NS2.SAMA.JO):
INTERNET USERS (DSL DIALUP),
JO. (DSL) 		n/a US:www.maxmind.com
:checkip.dyndns.org
US:www.getmyip.org
:getmyip.co.uk
208.78.69.70:80
US:64.246.48.99:666
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
4 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 dc331fb791
NEW 		none[3] none:none
 UPX| none trace
T:21:11:00 Win2K-f 64.130.186.174 (SCRTC.COM):
SOUTH CENTRAL RURAL TELEPHONE CO,
SAN JOSE, CALIFORNIA, US. (DSL) 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 a7cb25c023
NEW 		18ff3687ad [0] none:none
 ASPack| none trace
T:21:17:00 Win2K-f 72.51.243.154 (NEWWAVECOMM.NET):
NEW WAVE COMMUNICATIONS,
SPARTA, ILLINOIS, US. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 ae7a5cd8b1
NEW 		18ff3687ad [0] none:none
 ASPack| none trace
T:21:22:00 WinXP 77.254.155.205 (COM.PL):
NETIA,
PL. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 6306024fe3
NEW 		4fadf3fb74 [0] none:none
 ASPack| none trace
T:21:22:00 Win2K-f 125.225.143.176 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 50cdd5c6cf
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:21:33:00 Win2K-f 123.204.245.176 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:21:36:00 Win2K-f 89.155.42.182 (-):
TVCABO PORTUGAL S.A,
LISBON, LISBOA, PT. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 41 7b9a48dc79
NEW 		d76340a7cd [0] none:none
 ASPack| none trace
T:21:44:00 WinXP 66.76.165.145 (COX-INTERNET.COM):
SUDDENLINK COMMUNICATIONS,
TYLER, TEXAS, US. 		67.43.236.66:10324 NL:xx.sqlteam.info
CA:xx.nadnadzz.info
:zone2tech.info
CA:tx.mostafaaljaafari.net
NL:83.68.16.6:5190 		139 pcap raw alerts
ruleset 		ftp
irc
http
26 lines 		Yeah : 1.3
profile 		none summary
tarball 		25 of 39 367ce61cff
NEW 		48128671a8 [0] ASM:Graph
 StarForce| lines=52 trace
T:21:50:00 WinXP 61.217.28.122 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a RU:m.drd3h.com
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 84b1b363a1
NEW 		1e4ad6cdb1 [0] none:none
 ASPack| none trace
T:21:53:00 Win2K-f 118.160.199.72 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 f14fd68756
NEW 		f14fd68756 [1] ASM:Graph
 pex| lines=19 trace
T:21:54:00 Win2K-f 113.254.166.160 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:22:01:00 Win2K-f 67.204.196.196 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 50cdd5c6cf
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:22:04:00 WinXP 70.183.96.125 (COX.NET):
COX COMMUNICATIONS,
OCEANSIDE, CALIFORNIA, US. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:22:08:00 WinXP 59.63.63.2 (163DATA.COM.CN):
CHINANET JIANGXI PROVINCE NETWORK,
BEIJING, BEIJING, CN. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
26 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:22:15:00 Win2K-f 113.254.133.231 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		36 of 41 f75c895158
NEW 		afaf06d6cd [0] none:none
 pex| none trace
T:22:21:00 Win2K-f 78.84.58.237 (MICROLINK.LV):
TELEKOM,
RIGA, RIGA, LV. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		33 of 41 c386426b7e
NEW 		b4b3d9fd14 [0] none:none
 PENinja S| none trace
T:22:25:00 Win2K-f 83.199.46.47 (ABO.WANADOO.FR):
IP2000-ADSL-BAS,
PARIS, ILE-DE-FRANCE, FR. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 6639fffb75
NEW 		631ae2f910 [0] none:none
 ASPack| none trace
T:22:26:00 WinXP 61.216.174.20 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
KAOHSIUNG, KAO-HSIUNG, TW. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
21 lines 		Yeah : 0.8
profile 		none summary
tarball 		36 of 41 f75c895158
NEW 		afaf06d6cd [0] none:none
 pex| none trace
T:22:31:00 WinXP 4.191.206.199 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
YUKON, OKLAHOMA, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
79 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:22:45:00 Win2K-f 122.126.140.4 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:22:51:00 Win2K-f 211.74.51.71 (SEED.NET.TW):
DIGITAL UNITED INC,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 379a6daa0d
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:22:54:00 WinXP 219.255.45.214 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		114.80.101.21:65520 121.12.116.142:65520 CN:proxim.ircgalaxy.pl
US:microsoft.com
114.80.101.21:65520 		135 pcap raw alerts
ruleset 		irc
229 lines 		Yeah : 1.8
profile 		none summary
tarball 		35 of 38
38 of 41		 43f1afcbda
NEW
d0fe1a8e21
NEW 		1a83fc6fb4 [0]
4a3bf4c8e1[0] 		none:none
none:none
 Armadillo|
tElock| 		none
none 		trace
trace
23:04:00 Win2K-f 190.26.209.14 (-):
. 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
:checkip.dyndns.org
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:23:14:00 Win2K-f 96.52.179.95 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 c13a6c3da5
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:23:14:00 Win2K-f 24.83.212.237 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 40 a8c8cef5bf
NEW 		069c47bc36 [0] none:none
 ASPack| none trace
23:17:00 Win2K-f 173.45.97.147 (-):
. 		n/a US:www.maxmind.com
:getmyip.co.uk
US:checkip.dyndns.org
US:www.getmyip.org
208.78.69.70:80
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:23:33:00 WinXP 83.222.162.239 (-):
SUBSCRIBER NETWORK IN RUSSE,
RUSE, RAZGRAD, BG. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
22 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 8128405d8c
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:23:38:00 WinXP 218.165.180.234 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAINAN, KAO-HSIUNG, TW. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 41 61a9127875
NEW 		61a9127875 [1] ASM:Graph
 pex| lines=19 trace
T:23:39:00 WinXP 217.162.167.216 (HISPEED.CH):
CABLECOMMAIN-NET,
ZURICH, ZURICH, CH. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 41 7bbf2f5acb
NEW 		1701831bae [0] none:none
 ASPack| none trace
T:23:44:00 Win2K-f 93.105.77.170 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
21 lines 		Yeah : 0.8
profile 		none summary
tarball 		30 of 39 1a6c7da535
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:23:54:00 Win2K-f 81.34.113.48 (RIMA-TDE.NET):
TELEFONICA DE ESPANA SAU,
ES. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none