Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

03 January 2010
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:14:00 Win2K-f 218.210.68.92 (SPARQNET.NET):
THEFAREASTERNGROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

01:12:00 Win2K-f 77.126.15.91 (012.NET.IL):
012 SMILE COMMUNICATIONS LTD,
TEL AVIV, TEL AVIV, IL. (DSL) 193.104.94.11:65520 US:microsoft.com
CN:av.lometr.pl
CN:down1130.iwillhavesexygirls.com
US:msn.com
204.27.57.154:8392
CN:210.51.36.215:88
GB:212.117.177.140:80
CN:61.235.117.71:80 445 pcap raw alerts
ruleset irc
27 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:01:27:00 Win2K-f 203.118.238.245 (-):
GRAND TAINAN TECHNOLOGY CO.LTD,
TAINAN, T'AI-WAN, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

01:33:00 Win2K-f 114.36.119.200 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 193.104.94.11:65520 :commerceclick.co.uk
US:microsoft.com
US:yahoo.com
DE:proxim.ircgalaxy.pl
CN:122.195.190.197:65520
GB:212.117.177.140:80
US:67.15.94.80:80
69.197.161.10:80 445 pcap raw alerts
ruleset irc
25 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

01:53:00 Win2K-f 89.46.123.127 (-):
SC CABLE NC IMPEX SRL,
BUCHAREST, BUCURESTI, RO. (DSL) 193.104.94.11:65520 US:microsoft.com
CN:down1130.iwillhavesexygirls.com
CN:1130.kfgrtjer.cn
:bfkq.com
:jsactivity.com
US:yahoo.com
US:cnn.com
US:www.maxmind.com
173.45.105.218:8392
204.27.57.154:8392
GB:212.117.177.140:80
US:67.15.94.80:80
69.197.161.10:80 445 pcap raw alerts
ruleset irc
http
26 lines Yeah : 1.3
profile none summary
tarball 22 of 40
15 of 40 21b77bdfb8
NEW
b0b40e7540
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

02:01:00 Win2K-f 78.1.170.172 (T-COM.HR):
T-COM CROATIA INTERNET NETWORK,
HR. (DSL) n/a :google.com
US:www.getmyip.org
:checkip.dyndns.org
EU:getmyip.co.uk
GB:www.vouchercodez.com
DE:proxim.ircgalaxy.pl
US:yahoo.com
CN:122.195.190.197:65520
208.78.70.70:80
GB:212.117.177.140:80
US:75.126.138.202:80
GB:80.82.119.191:80 445 pcap raw alerts
ruleset http
17 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:02:34:00 Win2K-f 122.146.242.32 (SPARQNET.NET):
NEW CENTRY INFOCOM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
57ce4acac2
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:03:01:00 Win2K-f 174.6.21.151 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:03:15:00 Win2K-f 113.255.103.117 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
99 lines Yeah : 1.3
profile none summary
tarball 40 of 41
38 of 41 a5ceb6c29d
NEW
adadfc0e1c
NEW d64cd9d18b [0]
0f57439d82[0] none:none
none:none
tElock|
tElock| none
none trace
trace

03:33:00 WinXP 196.219.191.229 (TEDATA.NET):
GIZA-ZONE-DSL,
CAIRO, AL QAHIRAH, EG. (DSL) n/a :moscow-advokat.ru
SE:qis.md.us.dal.net
:gaspode.zanet.org.za
NL:london.uk.eu.undernet.org
:caen.fr.eu.undernet.org
SE:vancouver.dal.net
:lia.zanet.net
SE:ced.dal.net 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:03:49:00 Win2K-f 74.214.47.11 (METROCAST.NET):
METROCAST COMMUNICATIONS,
KING GEORGE, VIRGINIA, US. (100Mbps) n/a 135 pcap raw alerts
ruleset other
98 lines Yeah : 1.3
profile none summary
tarball 33 of 33 e30fb27bda
NEW 90ee26f451 [0] ASM:Graph
MEW| lines=185
embedded dns trace

03:56:00 Win2K-f 114.47.251.40 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:yahoo.com
:google.com
DE:proxim.ircgalaxy.pl
US:204.152.184.139:80
DE:88.198.228.238:65520 445 pcap raw alerts
ruleset http
20 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:04:36:00 Win2K-f 63.135.4.123 (PERSONA.CA):
PERSONA COMMUNICATIONS INC,
SUDBURY, ONTARIO, CA. (DSL) n/a 139 pcap raw alerts
ruleset ftp
10 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:06:45:00 WinXP 93.126.140.25 (-):
AIRBITES ROMANIA BUCHAREST NETWORK,
BUCHAREST, BUCURESTI, RO. (DSL) n/a RO:www.mantec.utcluj.ro
:d.mx.mail.yahoo.com
US:mailin-01.mx.aol.com
US:spearheadteks.com
RO:mikeevents.go.ro
:www.energetixjewelry.com
US:yucelcavdar.com
VN:123.16.167.53:3702
US:130.107.248.157:5306
US:74.222.1.40:80 445 pcap raw alerts
ruleset shell
ftp
http
55 lines Yeah : 1.3
profile none summary
tarball 32 of 39 f9ecbb85ce
NEW none[none] none:none
none|none none none

T:06:56:00 WinXP 64.138.229.94 (SCCOAST.NET):
HTC CABLE MODEM POOL,
CONWAY, SOUTH CAROLINA, US. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 40 2aee34a1ff
NEW none[none] none:none
none|none none none

T:08:06:00 Win2K-f 70.232.53.154 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
LITTLE ROCK, ARKANSAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:08:32:00 Win2K-f 216.220.92.245 (-):
MCKEAN COUNTY,
SMETHPORT, PENNSYLVANIA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:09:01:00 WinXP 173.170.97.34 (RR.COM):
ROAD RUNNER HOLDCO LLC,
TAMPA, FLORIDA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

09:58:00 Win2K-f 84.108.168.15 (BEZEQINT.NET):
CABLES-CUSTOMERS-CONNECTION,
HOLON, TEL AVIV, IL. (DSL) n/a US:cnn.com
DE:proxim.ircgalaxy.pl
US:yahoo.com
CN:122.195.190.197:65520
US:204.152.184.139:80
GB:212.117.177.140:80 445 pcap raw alerts
ruleset irc
22 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:10:09:00 WinXP 69.193.74.22 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:10:19:00 Win2K-f 63.246.125.39 (ALTUSCGI.NET):
PRIVATE CABLE ISP SUBSCRIBER (GEORGETOWN SC MARKET),
GEORGETOWN, SOUTH CAROLINA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

10:24:00 Win2K-f 78.106.110.129 (CORBINA.RU):
BROADBAND CUSTOMERS IN MOSCOW,
MOSCOW, MOSCOW CITY, RU. (DSL) 88.198.228.238:65520 US:msn.com
US:microsoft.com
US:yahoo.com
:bfkq.com
DE:proxim.ircgalaxy.pl
US:www.maxmind.com
CN:av.lometr.pl
GB:www.businesstomb.com
CN:down1130.iwillhavesexygirls.com
:jsactivity.com
:commerceclick.co.uk
US:204.152.184.139:80
204.27.57.154:8392
GB:212.117.177.140:80
US:67.15.94.80:80 445 pcap raw alerts
ruleset irc
35 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

10:53:00 Win2K-f 82.131.202.114 (INVITEL.HU):
ADSL-PPPOE-(GOD-ADSL2),
BUDAPEST, BUDAPEST, HU. (DSL) 122.195.190.197:65520 :google.com
CN:down1130.iwillhavesexygirls.com
US:msn.com
US:yahoo.com
CN:210.51.36.215:88
GB:212.117.177.140:80 445 pcap raw alerts
ruleset irc
36 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

11:05:00 Win2K-f 85.141.250.242 (MTU.RU):
CJSC COMSTAR-DIRECT,
MOSCOW, MOSCOW CITY, RU. (DSL) 88.198.228.238:65520 US:microsoft.com
:google.com
GB:www.businesstomb.com
DE:proxim.ircgalaxy.pl
US:www.maxmind.com
CN:av.lometr.pl
CN:down1130.iwillhavesexygirls.com
US:msn.com
:commerceclick.co.uk
US:cnn.com
GB:212.117.177.140:80
US:67.15.94.80:80 445 pcap raw alerts
ruleset irc
http
39 lines Yeah : 0.8
profile none summary
tarball 23 of 41 357486dae7
NEW none[none] none:none
none|none none none

11:22:00 Win2K-f 217.203.99.178 (-):
TELECOM ITALIA MOBILE,
IT. (DSL) 88.198.228.238:65520 :google.com
US:microsoft.com
US:msn.com
US:www.maxmind.com
GB:www.businesstomb.com
DE:proxim.ircgalaxy.pl
CN:down1130.iwillhavesexygirls.com
CN:210.51.36.215:88
GB:212.117.177.140:80
US:67.15.94.80:80 445 pcap raw alerts
ruleset irc
34 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:44:00 WinXP 173.18.231.154 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
GULF SHORES, ALABAMA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
39 of 41 10759405e0
NEW
d08e00dfaf
NEW 292d343248 [0]
854c49d8c4[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

11:50:00 Win2K-f 93.80.2.155 (CORBINA.RU):
BROADBAND CUSTOMERS IN MOSCOW,
MOSCOW, MOSCOW CITY, RU. (DSL) n/a US:msn.com
US:yahoo.com
:google.com
US:www.maxmind.com
GB:www.businesstomb.com
CN:210.51.36.215:88
GB:212.117.177.140:80
US:67.15.94.80:80
DE:88.198.228.238:65520 445 pcap raw alerts
ruleset irc
37 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:12:14:00 WinXP 209.33.46.124 (CEBRIDGE.NET):
JASONVILLE IN CUSTOMERS,
JASONVILLE, INDIANA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
97 lines Yeah : 1.3
profile none summary
tarball 39 of 40
0 of 33 7d20fe8724
NEW
a08f3b74a4
NEW a879c90084 [none]
none [0] none:none
none:none
tElock|
Armadillo| none
lines=90 trace
trace

T:12:26:00 Win2K-f 98.141.161.39 (CAVTEL.NET):
CAVALIER TELEPHONE,
PHILADELPHIA, PENNSYLVANIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:12:31:00 WinXP 201.22.96.167 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:wpad 445 pcap raw alerts
ruleset http
http
http
27 lines Yeah : 0.8
profile none summary
tarball 0 of 38
0 of 39
0 of 39
29 of 29 7bf526738a
NEW
7fd041ff9b
NEW
aa34b69542
NEW
df17a625ee
NEW none[none]
none [none]
none [none]
none [0] none:none
none:none
none:none
none:none
none|none
none|none
none|none
ASPack| none
none
none
lines=298
embedded dns none
none
none
trace

T:12:34:00 WinXP 83.21.182.173 (TPNET.PL):
NEOSTRADA PLUS,
POZNAN, WIELKOPOLSKIE, PL. (DSL) n/a DE:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:wpad
GB:welcome3.smile.co.uk
GB:195.92.84.198:80 445 pcap raw alerts
ruleset http
http
http
27 lines Yeah : 0.8
profile none summary
tarball 0 of 40
28 of 29
0 of 40 0a22693433
NEW
330eaa2da2
NEW
478de45bf7
NEW none[none]
none [3]
none [none] none:none
none:none
none:none
none|none
ASPack|
none|none none
none
none none
trace
none

T:12:45:00 Win2K-f 70.168.11.83 (COX.NET):
COX COMMUNICATIONS,
PROVIDENCE, RHODE ISLAND, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

13:47:00 WinXP 97.106.168.178 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LUTZ, FLORIDA, US. (DSL) n/a :moscow-advokat.ru
SE:qis.md.us.dal.net
:gaspode.zanet.org.za
SE:london.uk.eu.undernet.org
:caen.fr.eu.undernet.org
SE:vancouver.dal.net
:lia.zanet.net 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

13:53:00 Win2K-f 189.62.18.12 (VIRTUA.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DSL) n/a US:msn.com
US:microsoft.com
US:trafficconverter.biz
:google.com
US:204.152.184.139:80
204.27.57.154:8392
GB:212.117.177.140:80 445 pcap raw alerts
ruleset http
19 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:14:04:00 Win2K-f 208.127.63.96 (DSLEXTREME.COM):
DSL EXTREME,
VISTA, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:16:06:00 WinXP 79.25.193.135 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA NET,
BOLOGNA, EMILIA-ROMAGNA, IT. (DSL) n/a RU:citi-bank.ru
RU:213.219.245.212:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 38 of 40 cdfc97be37
NEW none[none] none:none
none|none none none

T:16:12:00 WinXP 200.100.173.48 (TELESP.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DIAL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 39 of 39 f95e7bd954
NEW none[none] none:none
none|none none none

16:15:00 Win2K-f 92.227.172.239 (ALICEDSL.DE):
HANSENET-ADSL,
PADERBORN, NORDRHEIN-WESTFALEN, DE. (DSL) n/a US:msn.com
US:yahoo.com
:commerceclick.co.uk
US:cnn.com
US:204.152.184.139:80
204.27.57.154:8392
GB:212.117.177.140:80 445 pcap raw alerts
ruleset http
21 lines Argh : 0.3
profile none summary
tarball none none none none none none none

16:25:00 Win2K-f 217.144.208.102 (NET.PL):
INTERNET SOLUTIONS SP. Z.O.O,
TARNOW, MALOPOLSKIE, PL. (DSL) n/a :google.com
US:microsoft.com
US:trafficconverter.biz
US:msn.com
US:204.152.184.139:80
GB:212.117.177.140:80 445 pcap raw alerts
ruleset http
22 lines Argh : 0.3
profile none summary
tarball none none none none none none none

16:35:00 Win2K-f 187.89.51.25 (CAMPUSEAI.ORG):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a US:yahoo.com
US:microsoft.com
US:cnn.com
:bfkq.com
US:204.152.184.139:80
204.27.57.154:8392
GB:212.117.177.140:80 445 pcap raw alerts
ruleset http
21 lines Argh : 0.3
profile none summary
tarball none none none none none none none

16:45:00 Win2K-f 190.135.158.47 (ANTELDATA.NET.UY):
ADMINISTRACION NACIONAL DE TELECOMUNICACIONES,
UY. (DIAL) n/a US:cnn.com
:google.com
US:yahoo.com
EE:www.starman.ee
EE:www.online.if.ee
FI:194.215.38.3:80
EE:195.50.195.10:443
US:204.152.184.139:80
GB:212.117.177.140:80 445 pcap raw alerts
ruleset http
20 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:16:56:00 WinXP 109.106.255.223 (JWS.COM):
EU-ZZ,
UK. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 24 of 39 4a70919a9d
NEW none[none] none:none
none|none none none

T:17:48:00 Win2K-f 174.1.49.150 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
112 lines Yeah : 1.3
profile none summary
tarball 39 of 41
38 of 41 9850931e93
NEW
e770121662
NEW 443d54cb48 [0]
ac4b533671[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

17:51:00 Win2K-f 211.53.231.75 (BORA.NET):
BORANET-NET,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) n/a US:msn.com
:google.com
US:204.152.184.139:80
204.27.57.154:8392
GB:212.117.177.140:80 445 pcap raw alerts
ruleset http
18 lines Argh : 0.3
profile none summary
tarball none none none none none none none

17:58:00 Win2K-f 190.2.104.107 (COM.AR):
TELEDIFUSORA S.A,
AR. (DSL) n/a US:yahoo.com
US:trafficconverter.biz
US:204.152.184.139:80
204.27.57.154:8392
GB:212.117.177.140:80 445 pcap raw alerts
ruleset http
18 lines Argh : 0.3
profile none summary
tarball none none none none none none none

18:03:00 Win2K-f 125.127.211.74 (163DATA.COM.CN):
CHINANET-ZJ TAIZHOU NODE NETWORK,
BEIJING, BEIJING, CN. (DSL) n/a US:msn.com
US:cnn.com
US:microsoft.com
US:204.152.184.139:80
204.27.57.154:8392
GB:212.117.177.140:80 445 pcap raw alerts
ruleset http
20 lines Argh : 0.3
profile none summary
tarball none none none none none none none

18:13:00 Win2K-f 201.50.130.194 (STERLINGSTUDENTS.NET):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a :google.com
US:yahoo.com
US:microsoft.com
US:204.152.184.139:80
204.27.57.154:8392
GB:212.117.177.140:80 445 pcap raw alerts
ruleset http
17 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:18:40:00 Win2K-f 72.234.149.238 (HAWAIIANTEL.NET):
HAWAIIAN TELCOM SERVICES COMPANY INC,
HONOLULU, HAWAII, US. (DSL) n/a 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 38 of 41 ec90ec15db
NEW 7b0ab2b387 [0] none:none
none|none none trace

T:20:17:00 WinXP 211.20.222.150 (HINET.NET):
XUN HANG TECHNOLOGY CO. LTD,
TAIPEI, T'AI-PEI, TW. (100Mbps) 92.240.234.164:3305 :cx10man.weedns.com
FI:fx010413.whyI.org 135 pcap raw alerts
ruleset irc
697 lines Yeah : 1.8
profile none summary
tarball 28 of 41 b8076e37ae
NEW 52953fed05 [0] none:none
StarForce| none trace

T:20:17:00 Win2K-f 207.5.161.171 (SUSCOM-MAINE.NET):
GREAT WORKS INTERNET,
BRUNSWICK, MAINE, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

20:22:00 Win2K-f 114.39.11.89 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 193.104.94.11:65520 US:microsoft.com
DE:proxim.ircgalaxy.pl
CN:av.lometr.pl
CN:down1130.iwillhavesexygirls.com
CN:1130.kfgrtjer.cn
:google.com
:wws.mobiec.net
US:www.yahoo.com
US:trafficconverter.biz
CN:russia.2288.org
:jccalke.net
:bknmmpz.net
:ukiyg.com
:syhujqepb.net
:youeexjw.org
:pvgrfqk.com
:znvepug.biz
:nugzmbkb.info
:zwgafupebb.org
:jrxgenexevu.org
US:cnn.com
:yfuwgqvtjzt.org
:yhykutl.org
:fdxsbf.org
:audqfgrc.com
:snercki.biz
:obtbfiv.org
:mcdumjsd.net
:jukoozxcia.biz
:wazsrjb.biz
:ffvpksowyfx.com
GB:212.117.177.140:80
DE:88.198.228.238:65520 445 pcap raw alerts
ruleset irc
http
35 lines Yeah : 1.3
profile none summary
tarball 23 of 41
15 of 39 357486dae7
NEW
d4e6c8e430
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:20:38:00 WinXP 116.59.213.16 (HINET.NET):
CHT-MOBILE BUSINESS GROUP CHUNGHWA,
TAIPEI, T'AI-PEI, TW. (DSL) 213.219.245.212:80 RU:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 40 of 41 eda3b7766c
NEW 7556343561 [0] none:none
PolyEnE| none trace

T:20:40:00 Win2K-f 113.252.30.134 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HK. (DSL) n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:20:41:00 Win2K-f 24.213.224.238 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AMSTERDAM, NOORD-HOLLAND, NL. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:20:53:00 Win2K-f 114.206.46.129 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 122.195.190.197:65520 US:microsoft.com
DE:proxim.ircgalaxy.pl
CN:www.liagand.cn
CN:down1130.iwillhavesexygirls.com
CN:210.51.36.215:88 135 pcap raw alerts
ruleset irc
http
128 lines Yeah : 1.8
profile none summary
tarball 29 of 32
28 of 32 8a75955033
NEW
9276c8b36b
NEW 2bf3e548b9 [0]
none [0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=126
embedded dns
lines=81 trace
trace

T:21:57:00 WinXP 115.82.78.50 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 213.219.245.212:80 88.198.228.238:65520 DE:proxim.ircgalaxy.pl
RU:citi-bank.ru 445 pcap raw alerts
ruleset http
irc
4 lines Yeah : 1.3
profile none summary
tarball 34 of 36 9bb68450cd
NEW c2d5ac2315 [0] ASM:Graph
PolyEnE| lines=73
embedded dns trace

T:22:04:00 Win2K-f 70.232.47.77 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
LITTLE ROCK, ARKANSAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

22:15:00 Win2K-f 77.35.146.50 (SAKHALIN.RU):
OPEN JOINT STOCK COMPANY FAR EAST TELECOMMUNICATIONS COMPANY,
VLADIVOSTOK, PRIMOR'YE, RU. (DSL) n/a US:microsoft.com
US:cnn.com
US:msn.com
US:yahoo.com
US:204.152.184.139:80 445 pcap raw alerts
ruleset http
21 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:22:45:00 WinXP 70.123.100.251 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COPPELL, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:23:15:00 Win2K-f 24.83.84.7 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a TW:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 0.8
profile none summary
tarball 38 of 40 4add72e080
NEW none[none] none:none
none|none none none

T:23:18:00 Win2K-f 110.12.66.106 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 193.104.94.11:65520 DE:proxim.ircgalaxy.pl
US:microsoft.com
CN:av.lometr.pl
CN:www.liagand.cn
CN:down1130.iwillhavesexygirls.com
CN:1130.kfgrtjer.cn
:bfkq.com
:jsactivity.com
:wws.mobiec.net
US:search.toptravellingtips.com
CN:russia.2288.org
173.45.105.218:8392
US:208.43.250.167:80 135 pcap raw alerts
ruleset irc
http
221 lines Yeah : 1.8
profile none summary
tarball 2 of 40
23 of 41
0 of 39
37 of 41
15 of 40
38 of 41
15 of 39
26 of 41 006094b6be
NEW
357486dae7
NEW
43cfeb3402
NEW
598636aa73
NEW
a07face99b
NEW
a57ddcdef0
NEW
d4e6c8e430
NEW
dd96e88e03
NEW none[none]
none [none]
none [none]
613af3f9a2[0]
none [none]
none [4]
none [none]
6f87541765[0] none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
Armadillo|
none|none
PolyEnE|
none|none
StarForce| none
none
none
none
none
none
none
none none
none
none
trace
none
trace
none
trace

T:23:27:00 Win2K-f 72.251.78.152 (1DIAL.COM):
AD-BASE SYSTEMS INC. (DBA GLOBALPOPS),
MEDFORD, OREGON, US. (DSL) n/a CA:tvsetupforfree.com
US:search.musicforher.com
:search.creativeblackandwhitephotography.com
US:microsoft.com
:search.traveleuropesecrets.com
EU:www.traveleuropesecrets.com
US:workser.com
:redirects.coldhardcash.com
:images.ddc.com
:s7.addthis.com
US:domdex.com
174.36.138.74:80
US:208.43.250.167:80
EU:77.68.59.22:80 445 pcap raw alerts
ruleset http
irc
105 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:23:29:00 WinXP 60.249.37.106 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 34 of 38
35 of 38 38ed850a0e
NEW
b9297745a1
NEW 46990f37cd [0]
4294884d84[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:23:58:00 Win2K-f 210.147.118.213 (MESH.AD.JP):
BIGLOBE-CIDR-BLK,
CHIBA, CHIBA, JP. (DSL) n/a :pictureor.com
US:microsoft.com
US:xml.titusmedia.com
US:www.findacow.com
:parkadvance.com
US:321.pub.adfirmative.com
US:c.adfirmative.com
US:216.133.243.28:80 135 pcap raw alerts
ruleset http
irc
http
http
http
http
http
http
146 lines Argh : 0.3
profile none summary
tarball 0 of 40 aec87f0506
NEW none[none] none:none
none|none none none