Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

21 June 2009
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
T:00:12:00 WinXP 95.74.55.176 (-):
. 		n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		39 of 41 c91c60dd02
NEW 		acfce17a48 [0] none:none
 PolyEnE| none trace
T:00:22:00 Win2K-f 203.91.186.120 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, AICHI, JP. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:01:16:00 Win2K-f 63.16.76.221 (UU.NET):
UUNET TECHNOLOGIES INC,
ROANOKE, VIRGINIA, US. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
135 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:02:01:00 WinXP 93.102.7.94 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a RU:citi-bank.ru
RU:213.219.245.212:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 449e681a46
NEW 		a9ed9b3845 [0] none:none
 PolyEnE| none trace
02:10:00 Win2K-f 203.144.177.174 (ASIANET.CO.TH):
TRUE INTERNET CO. LTD,
BANGKOK, KRUNG THEP MAHANAKHON, TH. 		n/a US:www.maxmind.com
:getmyip.co.uk
:checkip.dyndns.org
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		2 of 37 223d8089f8
NEW 		none[3] none:none
 StarForce| none trace
T:02:16:00 WinXP 72.64.30.16 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
CHARLESTON, WEST VIRGINIA, US. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:02:17:00 Win2K-f 173.22.160.39 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:02:19:00 Win2K-f 203.144.177.174 (ASIANET.CO.TH):
TRUE INTERNET CO. LTD,
BANGKOK, KRUNG THEP MAHANAKHON, TH. 		n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
US:64.246.48.99:666
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
4 lines 		Yeah : 0.8
profile 		none summary
tarball 		2 of 37 223d8089f8
NEW 		none[3] none:none
 StarForce| none trace
T:02:30:00 Win2K-f 122.49.241.192 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
120 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 32
33 of 33		 07fabc79ef
NEW
53bfe15e91
NEW 		none[0]
1473091351[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=81
lines=75
embedded dns 		trace
trace
T:02:52:00 WinXP 211.202.194.35 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, KYONGGI-DO, KR. 		121.12.116.142:65520 CN:proxim.ircgalaxy.pl
US:microsoft.com
CN:brenz.pl
CN:211.95.79.6:80 		135 pcap raw alerts
ruleset 		irc
133 lines 		Yeah : 1.8
profile 		none summary
tarball 		31 of 41
38 of 41		 c61078e573
NEW
d80521c9d9
NEW 		670955f966 [0]
6d39f1a62e[0] 		none:none
none:none
 Armadillo|
tElock| 		none
none 		trace
trace
03:51:00 Win2K-f 200.62.27.133 (IFXNETWORKS.NET.VE):
INTERNET CORO,
VE. (100Mbps) 		n/a US:www.maxmind.com
US:checkip.dyndns.org
:getmyip.co.uk
US:www.getmyip.org
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:03:59:00 WinXP 4.167.174.252 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
LOS ANGELES, CALIFORNIA, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:04:19:00 WinXP 114.45.133.187 (-):
. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
19 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 f14fd68756
NEW 		f14fd68756 [1] ASM:Graph
 pex| lines=19 trace
T:04:19:00 Win2K-f 59.104.1.132 (SEED.NET.TW):
DIGITAL UNITED I,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 b7a2732226
NEW 		4fadf3fb74 [0] none:none
 ASPack| none trace
T:04:21:00 Win2K-f 78.131.40.149 (-):
EMKTV BUDAPEST VLAN 06 DOCSIS,
BUDAPEST, BUDAPEST, HU. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
22 lines 		Yeah : 0.8
profile 		none summary
tarball 		30 of 39 1a6c7da535
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:04:31:00 WinXP 87.205.41.117 (INETIA.PL):
INTERNETIA,
PL. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 40 d7265c89b6
NEW 		4fadf3fb74 [0] none:none
 ASPack| none trace
T:04:32:00 Win2K-f 72.51.209.245 (NEWWAVECOMM.NET):
NEW WAVE COMMUNICATIONS,
CORBIN, KENTUCKY, US. 		67.43.236.66:10324 CA:xx.nadnadzz.info
:zone2tech.info
67.215.1.206:80 		139 pcap raw alerts
ruleset 		ftp
irc
28 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 40 05cfbe0bc5
NEW 		6e704f13e9 [0] ASM:Graph
 FSG| lines=48 trace
T:04:33:00 Win2K-f 118.166.223.219 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:04:38:00 Win2K-f 89.47.136.185 (KT471MAILER.COM):
JUMP NETWORK SERVICES S.R.L,
RO. 		n/a   139 pcap raw alerts
ruleset 		other
0 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:04:43:00 Win2K-f 88.171.220.20 (PROXAD.NET):
PROXAD / FREE SAS,
FR. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
19 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 dcbed1ebef
NEW 		1f5958f55f [0] none:none
 ASPack| none trace
T:04:47:00 WinXP 90.163.197.225 (DYNAMIC.ORANGE.ES):
UNI2 - LINCE TELECOMUNICACIONES,
ES. 		n/a RU:m.drd3h.com
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 41 450ad1b683
NEW 		1e4ad6cdb1 [0] none:none
 ASPack| none trace
T:04:48:00 WinXP 85.67.39.104 (-):
FIBERNET,
HU. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
19 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 40 013a5ba10e
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:05:01:00 Win2K-f 151.33.38.139 (14-151.IOL.IT):
ITALIA ONLINE S.P.A,
IT. 		n/a   139 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 f534041536
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:05:08:00 Win2K-f 83.199.105.145 (ABO.WANADOO.FR):
IP2000-ADSL-BAS,
PARIS, ILE-DE-FRANCE, FR. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 6639fffb75
NEW 		631ae2f910 [0] none:none
 ASPack| none trace
T:05:10:00 WinXP 70.39.12.193 (-):
. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
32 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 41 1b3d8e9fe7
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:05:13:00 WinXP 80.72.74.121 (NETVISIO.NET):
VVDNET,
PLOVDIV, PLOVDIV, BG. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:05:19:00 WinXP 92.80.45.30 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 40 013a5ba10e
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:05:28:00 Win2K-f 85.241.174.98 (DSL.TELEPAC.PT):
PT.COM - COMUNICACOES INTERACTIVAS S.A,
AVEIRO, AVEIRO, PT. (DSL) 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 379a6daa0d
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:05:29:00 Win2K-f 85.67.202.8 (-):
FIBERNET,
HU. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 40 013a5ba10e
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:05:32:00 Win2K-f 218.175.39.171 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 41 1b3d8e9fe7
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:05:38:00 WinXP 218.169.185.166 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 4dd4197eb4
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
05:57:00 Win2K-f 85.27.139.5 (-):
NETWORK FOR CONNECTED CUSTOMERS,
DK. 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
EU:checkip.dyndns.org
US:64.246.48.99:666
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:05:59:00 Win2K-f 212.10.145.13 (REV.STOFANET.DK):
TELIA STOFA A/S,
AALBORG, NORDJYLLAND, DK. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 8128405d8c
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:06:00:00 WinXP 80.108.139.44 (SURFER.AT):
UPC TELEKABEL,
VIENNA, WIEN, AT. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
28 lines 		Yeah : 0.8
profile 		none summary
tarball 		30 of 39 1a6c7da535
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:06:00:00 Win2K-f 59.117.187.152 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
22 lines 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 3490e2ea15
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:06:17:00 Win2K-f 85.106.115.153 (TTNET.NET.TR):
PROVIDER LOCAL REGISTRY,
ANKARA, ANKARA, TR. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
21 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 41 68180361d9
NEW 		b905f36581 [0] none:none
 ASPack| none trace
T:06:23:00 WinXP 124.87.197.77 (OCN.NE.JP):
NTT COMMUNICATIONS CORPORATION,
TOKYO, TOKYO, JP. 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 831f4ee0a7
NEW 		none[0] ASM:Graph
 none|none lines=61 trace
T:06:25:00 WinXP 85.66.90.106 (BACS-NET.HU):
FIBERNET COMMUNICATION CO,
BUDAPEST, BUDAPEST, HU. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
26 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 8128405d8c
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:06:53:00 WinXP 77.23.71.93 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
NEW 		none[0] none:none
 none|none lines=61 trace
T:07:48:00 WinXP 60.46.48.68 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. 		n/a   445 pcap raw alerts
ruleset 		ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 831f4ee0a7
NEW 		none[0] ASM:Graph
 none|none lines=61 trace
T:07:50:00 WinXP 95.220.177.141 (-):
. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
NEW 		none[0] none:none
 none|none lines=60 trace
T:07:58:00 Win2K-f 96.49.245.92 (-):
. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 c13a6c3da5
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
08:01:00 Win2K-f 94.102.5.38 (-):
. 		n/a US:www.maxmind.com
:getmyip.co.uk
US:www.getmyip.org
:checkip.dyndns.org
US:67.15.94.80:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
08:08:00 Win2K-f 186.18.158.130 (-):
. 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
:checkip.dyndns.org
208.78.69.70:80
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 dc331fb791
NEW 		none[3] none:none
 UPX| none trace
T:08:16:00 WinXP 208.101.202.185 (BENTONCOUNTYCABLE.NET):
AURORA CABLETV DBA BENTON COUNTY CABLEVISION,
CAMDEN, TENNESSEE, US. (DSL) 		n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
RU:www.bbin.ru
RU:www.binbank.ru
:wpad 		445 pcap raw alerts
ruleset 		http
http
http
http
http
43 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a12cab51ef
NEW 		none[0] none:none
 ASPack| lines=281
embedded dns 		trace
T:08:17:00 WinXP 91.82.63.158 (-):
BOLY POLGARMESTERI HIVATAL,
HU. 		n/a EU:gaz-prom.ru 445 pcap raw alerts
ruleset 		other
0 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 7623c942a9
NEW 		1e7e1e0e5d [0] none:none
 tElock| none trace
T:08:17:00 Win2K-f 186.18.158.130 (-):
. 		n/a US:www.maxmind.com
:getmyip.co.uk
US:www.getmyip.org
US:checkip.dyndns.org
US:64.246.48.99:666
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
3 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 dc331fb791
NEW 		none[3] none:none
 UPX| none trace
T:08:35:00 WinXP 174.6.90.194 (-):
. 		n/a :abc.ihshsd8.com
:jiets.soidudrf.com
:dirty.eiheihre3.com
:munirah.nagitiriheiwu.net 		135 pcap raw alerts
ruleset 		other
606 lines 		Yeah : 1.3
profile 		none summary
tarball 		37 of 41 a3c93c5544
NEW 		010bdb8a13 [0] none:none
 PENinja S| none trace
08:36:00 Win2K-f 190.205.247.209 (CANTV.NET):
CANTV SERVICIOS VENEZUELA,
VE. 		n/a US:www.maxmind.com
:getmyip.co.uk
US:www.getmyip.org
EU:checkip.dyndns.org
US:204.13.249.70:80
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		7 of 37 7587773eea
NEW 		none[3] none:none
 StarForce| none trace
T:08:38:00 Win2K-f 219.70.60.61 (GIGA.NET.TW):
HOSHIN GIGAMEDIA CENTER INC,
TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
129 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 41
37 of 41		 a205366bef
NEW
efaef2451a
NEW 		82bbbe4789 [0]
5382f9a037[0] 		none:none
none:none
 tElock|
Armadillo| 		none
none 		trace
trace
T:08:42:00 Win2K-f 69.121.161.163 (OPTONLINE.NET):
OPTIMUM ONLINE (CABLEVISION SYSTEMS),
STRATFORD, CONNECTICUT, US. 		194.109.11.65:6556 NL:0x80.online-software.org
NL:0x80.martiansong.com
:0xff.memzero.info
:0x80.my-secure.name
NL:0x80.goingformars.com
NL:0x80.my1x1.com 		135 pcap raw alerts
ruleset 		other
264 lines 		Yeah : 1.8
profile 		none summary
tarball 		32 of 32 15d4d85dc0
NEW 		4c95ae4b3d [0] ASM:Graph
 StarForce| lines=212
embedded dns 		trace
T:08:54:00 WinXP 4.153.207.156 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
BIRMINGHAM, ALABAMA, US. (DIAL) 		n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:www.proxy-socks.net
:wpad
GB:welcome3.smile.co.uk
EU:78.47.200.154:80 		445 pcap raw alerts
ruleset 		http
http
http
17 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 a12cab51ef
NEW 		none[0] none:none
 ASPack| lines=281
embedded dns 		trace
T:08:58:00 WinXP 4.86.59.170 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. 		n/a   135 pcap raw alerts
ruleset 		other
90 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 32
13 of 41		 73f1082158
NEW
cdfb41a2d1
NEW 		none[0]
none [3] 		none:none
none:none
 Armadillo|
none|none 		lines=90
none 		trace
trace
T:09:10:00 Win2K-f 122.146.80.120 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TW. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
57ce4acac2
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
09:23:00 Win2K-f 78.111.96.221 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a US:www.maxmind.com
:checkip.dyndns.org
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		7 of 37 7587773eea
NEW 		none[3] none:none
 StarForce| none trace
T:09:32:00 Win2K-f 78.111.96.221 (APEXCOVANTAGE.COM):
EU-ZZ,
UK. 		n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
US:64.246.48.99:666
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		7 of 37 7587773eea
NEW 		none[3] none:none
 StarForce| none trace
T:09:46:00 Win2K-f 41.250.239.180 (IAM.NET.MA):
AFRINIC,
MA. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 8128405d8c
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:09:55:00 WinXP 4.167.170.173 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
LOS ANGELES, CALIFORNIA, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
92 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:09:57:00 WinXP 84.13.106.129 (84.IN-ADDR.ARPA):
OPAL TELECOM DSL NETWORK,
LONDON, ENGLAND, UK. 		n/a RU:m.DRD3H.COM
RU:89.221.18.86:6668 		139 pcap raw alerts
ruleset 		ftp
irc
18 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 40 013a5ba10e
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
11:05:00 Win2K-f 173.45.97.151 (-):
. 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
US:checkip.dyndns.org
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:11:30:00 WinXP 211.128.167.140 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
TOKYO, TOKYO, JP. 		n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
NEW 		none[0] none:none
 PolyEnE| lines=93
embedded dns 		trace
T:11:32:00 Win2K-f 82.76.235.176 (RDSNET.RO):
ROMANIA DATA SYSTEMS,
BUCHAREST, BUCURESTI, RO. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		30 of 39 1a6c7da535
NEW 		1d04d6dc84 [0] ASM:Graph
 ASPack| lines=3292
embedded dns 		trace
T:11:39:00 Win2K-f 4.182.135.240 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
VISALIA, CALIFORNIA, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
269 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 40
38 of 41		 29b1147e8c
NEW
45d0b04679
NEW 		cb0cdc25cb [0]
d2d218b6e3[0] 		none:none
none:none
 Armadillo|
tElock| 		none
none 		trace
trace
T:11:46:00 WinXP 122.120.98.172 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
NEW 		none[0] ASM:Graph
 none|none lines=61 trace
T:12:09:00 Win2K-f 72.51.209.245 (NEWWAVECOMM.NET):
NEW WAVE COMMUNICATIONS,
CORBIN, KENTUCKY, US. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 05cfbe0bc5
NEW 		6e704f13e9 [0] ASM:Graph
 FSG| lines=48 trace
T:12:22:00 Win2K-f 4.177.18.199 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SAN DIEGO, CALIFORNIA, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		37 of 41
36 of 40		 47d3548e36
NEW
d8722af110
NEW 		ab13346633 [0]
ab30a55931[0] 		none:none
none:none
 Armadillo|
tElock| 		none
none 		trace
trace
T:13:28:00 WinXP 194.126.184.119 (XCLUSIV.RO):
SC EXCLUSIV NETWORK SRL,
RO. 		67.43.236.66:8080 CA:xx.ka3ek.com
:zone2tech.info
67.215.1.206:80
CA:67.43.226.242:8080 		135 pcap raw alerts
ruleset 		irc
347 lines 		Yeah : 1.8
profile 		none summary
tarball 		27 of 32 a1684ab682
NEW 		6d883c8d11 [0] none:none
 eXPressor| none trace
T:13:34:00 WinXP 4.136.156.93 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
LINDEN, TENNESSEE, US. (DIAL) 		n/a   135 pcap raw alerts
ruleset 		other
222 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 41
36 of 41		 97d5230e3f
NEW
dfb19bde14
NEW 		2deaf62cb7 [0]
7d7d4ab834[0] 		none:none
none:none
 tElock|
Armadillo| 		none
none 		trace
trace
T:14:05:00 Win2K-f 77.76.162.51 (-):
OPTILINK,
BG. 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
20 lines 		Yeah : 0.8
profile 		none summary
tarball 		35 of 41 f373adb964
NEW 		4fadf3fb74 [0] none:none
 ASPack| none trace
14:37:00 Win2K-f 81.28.112.11 (NS2.SAMA.JO):
INTERNET USERS (DSL DIALUP),
JO. (DSL) 		n/a US:www.maxmind.com
EU:checkip.dyndns.org
US:www.getmyip.org
:getmyip.co.uk
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 dc331fb791
NEW 		none[3] none:none
 UPX| none trace
T:15:01:00 WinXP 60.249.37.247 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TW. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 38
35 of 38		 38ed850a0e
NEW
b9297745a1
NEW 		46990f37cd [0]
4294884d84[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
T:15:13:00 WinXP 209.216.178.168 (GORGE.NET):
GORGE NETWORKS INC,
HOOD RIVER, OREGON, US. (DIAL) 		n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		25 of 25 7f60162c2c
NEW 		none[0] none:none
 PolyEnE| lines=93
embedded dns 		trace
T:15:46:00 Win2K-f 96.52.132.194 (-):
. 		61.120.62.28:3305 GB:cx10man.weedns.com 135 pcap raw alerts
ruleset 		irc
609 lines 		Yeah : 1.8
profile 		none summary
tarball 		37 of 41 f691b990eb
NEW 		c9c19a2c94 [0] none:none
 StarForce| none trace
16:11:00 Win2K-f 190.55.246.165 (-):
. 		n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 dc331fb791
NEW 		none[3] none:none
 UPX| none trace
T:16:18:00 Win2K-f 76.241.148.201 (-):
SE4.BCVLOH PPPOX,
RICHARDSON, TEXAS, US. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
59 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
8 of 33		 53bfe15e91
NEW
b7082104e4
NEW 		1473091351 [0]
c5b49e7b82[0] 		ASM:Graph
ASM:Graph
 tElock|
tElock| 		lines=75
embedded dns
lines=41 		trace
trace
T:16:20:00 Win2K-f 116.45.15.92 (-):
LG POWERCOMM,
SEOUL, KYONGGI-DO, KR. 		n/a   139 pcap raw alerts
ruleset 		ftp
12 lines 		Yeah : 0.8
profile 		none summary
tarball 		40 of 41 35acca05f7
NEW 		7a644ea4e9 [0] none:none
 ASPack| none trace
T:16:27:00 WinXP 114.48.46.63 (-):
. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
13 lines 		Yeah : 0.8
profile 		none summary
tarball 		37 of 40 5285741560
NEW 		60590b8b67 [0] ASM:Graph
 none|none lines=59 trace
16:34:00 Win2K-f 222.43.35.157 (HERBALQC.COM):
CHINA RAILWAY TELECOMMUNICATIONS CENTER,
BEIJING, BEIJING, CN. 		n/a US:www.maxmind.com
:checkip.dyndns.org
:getmyip.co.uk
US:www.getmyip.org
208.78.69.70:80
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:16:42:00 Win2K-f 222.43.35.157 (HERBALQC.COM):
CHINA RAILWAY TELECOMMUNICATIONS CENTER,
BEIJING, BEIJING, CN. 		n/a US:www.maxmind.com
US:www.getmyip.org
:getmyip.co.uk
US:checkip.dyndns.org
US:64.246.48.99:666 		445 pcap raw alerts
ruleset 		http
6 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:17:06:00 Win2K-f 70.75.84.73 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) 		72.10.172.211:8080 67.43.236.66:8080 CA:xx.ka3ek.com
:zone2tech.info
CA:67.43.226.242:8080
CA:72.10.172.211:8080 		135 pcap raw alerts
ruleset 		irc
http
188 lines 		Yeah : 1.8
profile 		none summary
tarball 		25 of 39
38 of 41		 367ce61cff
NEW
a894e6640a
NEW 		48128671a8 [0]
2a62540340[0] 		ASM:Graph
none:none
 StarForce|
PolyEnE| 		lines=52
none 		trace
trace
T:17:15:00 WinXP 24.80.42.5 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) 		n/a RU:m.DRD3H.COM 139 pcap raw alerts
ruleset 		ftp
irc
35 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 33d254ac09
NEW 		c417b03f6a [0] none:none
 ASPack| none trace
T:17:24:00 Win2K-f 65.34.30.26 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ORLANDO, FLORIDA, US. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:17:32:00 WinXP 81.96.240.254 (NTL.COM):
LEEDS,
DERBY, ENGLAND, UK. (DSL) 		213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41 bfea3ef3ff
NEW 		59e13ba7ac [0] none:none
 PolyEnE| none trace
T:17:39:00 WinXP 118.87.20.135 (-):
. 		67.43.236.66:8080 NL:xx.sqlteam.info
CA:xx.ka3ek.com
:zone2tech.info
NL:83.68.16.6:5190 		135 pcap raw alerts
ruleset 		irc
http
342 lines 		Yeah : 1.8
profile 		none summary
tarball 		25 of 39
38 of 41		 367ce61cff
NEW
820b27d4c6
NEW 		48128671a8 [0]
1102de0215[0] 		ASM:Graph
none:none
 StarForce|
Armadillo| 		lines=52
none 		trace
trace
T:17:47:00 WinXP 70.138.29.191 (SBCGLOBAL.NET):
PPPOX POOL - BRAS12 MRDNCT,
SEYMOUR, CONNECTICUT, US. (DSL) 		n/a US:www.altavista.com
:www.google.com.au
:jbeegvia.ru
:crime-research.ru
US:www.worldbank.org
:yoiayoi.ru
:wcqahzhzn.ru
:iirpryry.ru
:rihafvu.ru
:wpad
:ryryodokm.ru
:uvjiis.ru
:gwvwka.ru
:jqsbnyzkp.ru
:pvygdo.ru
:fxkyagpnw.ru
:knclvdz.ru
:trsqeigw.ru
:odokeqy.ru
:kelmpsjp.ru
:edjiesp.ru
:vllcdvv.ru
:nuksdln.ru 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 1.3
profile 		none summary
tarball 		32 of 32 bb7681eca8
NEW 		none[3] none:none
 tElock| none trace
18:34:00 Win2K-f 186.81.24.94 (-):
. 		n/a US:www.maxmind.com
US:www.getmyip.org
EU:checkip.dyndns.org
:getmyip.co.uk
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
18:43:00 Win2K-f 74.222.2.113 (VRTSERVERS.NET):
VRTSERVERS INC,
LOS ANGELES, CALIFORNIA, US. 		n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
:getmyip.co.uk
208.78.69.70:80
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:18:52:00 Win2K-f 74.222.2.113 (VRTSERVERS.NET):
VRTSERVERS INC,
LOS ANGELES, CALIFORNIA, US. 		n/a US:www.maxmind.com
:checkip.dyndns.org
US:64.246.48.99:666
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:19:24:00 Win2K-f 203.180.132.220 (IIJ4U.OR.JP):
IIJ INTERNET,
JP. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:20:00:00 WinXP 114.121.27.21 (-):
. 		n/a RU:citi-bank.ru
RU:213.219.245.212:80 		445 pcap raw alerts
ruleset 		http
3 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 f502585714
NEW 		none[0] none:none
 PolyEnE| lines=63 trace
T:20:20:00 Win2K-f 72.226.15.208 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ALBANY, NEW YORK, US. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 40
37 of 40		 16b4707df9
NEW
b8607fc9ba
NEW 		7b7781c1c1 [0]
b4d672329d[0] 		none:none
none:none
 Armadillo|
tElock| 		none
none 		trace
trace
20:28:00 Win2K-f 61.56.212.75 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH CO. LTD,
TAIPEI, T'AI-PEI, TW. 		n/a US:www.maxmind.com
US:checkip.dyndns.org
:getmyip.co.uk
US:www.getmyip.org
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
20:36:00 WinXP 71.112.15.191 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
BOTHELL, WASHINGTON, US. (DSL) 		n/a RU:citi-bank.ru
RU:213.219.245.212:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		38 of 41 2d16d63f91
NEW 		27cb26ee14 [0] none:none
 PolyEnE| none trace
20:40:00 Win2K-f 32.113.244.38 (PRSERV.NET):
AT&T GLOBAL NETWORK SERVICES,
LAKE MARY, FLORIDA, US. 		n/a US:www.maxmind.com
EU:checkip.dyndns.org
:getmyip.co.uk
US:www.getmyip.org
208.78.69.70:80
US:67.15.94.80:80
US:75.126.138.202:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
21:32:00 Win2K-f 59.174.66.212 (163DATA.COM.CN):
CHINANET HUBEI PROVINCE NETWORK,
WUHAN, HUBEI, CN. 		n/a US:www.maxmind.com
:getmyip.co.uk
US:www.getmyip.org
:checkip.dyndns.org
US:67.15.94.80:80
US:75.126.138.202:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:21:36:00 WinXP 94.50.185.95 (-):
. 		213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1fcc146d70
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:21:41:00 Win2K-f 59.174.66.212 (163DATA.COM.CN):
CHINANET HUBEI PROVINCE NETWORK,
WUHAN, HUBEI, CN. 		n/a US:www.maxmind.com
:getmyip.co.uk
:checkip.dyndns.org
US:64.246.48.99:666
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:21:51:00 Win2K-f 99.153.106.96 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
59 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
8 of 33		 53bfe15e91
NEW
b7082104e4
NEW 		1473091351 [0]
c5b49e7b82[0] 		ASM:Graph
ASM:Graph
 tElock|
tElock| 		lines=75
embedded dns
lines=41 		trace
trace
T:22:30:00 WinXP 114.163.155.142 (-):
. 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
17 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 40 d5966f5d2c
NEW 		30f4c38c14 [0] none:none
 none|none none trace
T:23:12:00 WinXP 211.210.48.139 (HANANET.NET):
HANARO TELECOM INC,
KR. 		114.80.101.21:65520 121.12.116.142:65520 CN:proxim.ircgalaxy.pl
US:microsoft.com
CN:brenz.pl
CN:211.95.79.6:80 		135 pcap raw alerts
ruleset 		irc
125 lines 		Yeah : 1.8
profile 		none summary
tarball 		29 of 32
28 of 32		 8a75955033
NEW
9276c8b36b
NEW 		2bf3e548b9 [0]
none [0] 		ASM:Graph
ASM:Graph
 tElock|
Armadillo| 		lines=126
embedded dns
lines=81 		trace
trace
T:23:13:00 Win2K-f 4.138.130.3 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
95 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
23:36:00 Win2K-f 58.27.217.74 (-):
NATIONAL WIMAX/IMS ENVIRONMENT,
PK. 		n/a US:www.maxmind.com
US:checkip.dyndns.org
US:67.15.94.80:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		2 of 37 d60e538e72
NEW 		none[3] none:none
 UPX| none trace
T:23:45:00 Win2K-f 58.27.217.74 (-):
NATIONAL WIMAX/IMS ENVIRONMENT,
PK. 		n/a US:www.maxmind.com
:getmyip.co.uk
US:www.getmyip.org
EU:checkip.dyndns.org
US:64.246.48.99:666 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		2 of 37 d60e538e72
NEW 		none[3] none:none
 UPX| none trace