Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

02 June 2010
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
T:01:10:00 WinXP 70.184.154.68 (COX.NET):
COX COMMUNICATIONS,
YUKON, OKLAHOMA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
89 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
38 of 41		 53bfe15e91
NEW
97437a0627
NEW 		1473091351 [0]
none [none] 		ASM:Graph
none:none
 tElock|
none|none 		lines=75
embedded dns
none 		trace
none
T:01:46:00 Win2K-f 174.6.21.151 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:02:09:00 WinXP 99.129.102.190 (PACBELL.NET):
AT&T INTERNET SERVICES,
WATERBURY, CONNECTICUT, US. (DSL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
NEW 		none[0] none:none
 none|none lines=60 trace
T:02:31:00 Win2K-f 219.234.80.181 (IAPCM.AC.CN):
BEIJING TELETRON TELECOM ENGINEERING CO. LTD,
BEIJING, BEIJING, CN. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:02:41:00 WinXP 92.246.221.75 (NACKSYSTEM.NET):
EU-ZZ,
UK. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41 ccf5d5d19e
NEW 		none[none] none:none
 none|none none none
T:02:52:00 WinXP 120.138.134.229 (STARCAT.NE.JP):
KMN CORPORATION,
TOKYO, TOKYO, JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
112 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 40
39 of 39		 b8e6f4caf7
NEW
fb92b91fe7
NEW 		f81eac6379 [0]
fe88ab8768[0] 		none:none
none:none
 tElock|
Armadillo| 		none
none 		trace
trace
T:02:56:00 Win2K-f 24.213.224.238 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AMSTERDAM, NOORD-HOLLAND, NL. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:03:08:00 Win2K-f 96.11.222.89 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MIDDLETOWN, OHIO, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
1010 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:03:17:00 WinXP 173.169.57.241 (RR.COM):
ROAD RUNNER HOLDCO LLC,
TAMPA, FLORIDA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:03:56:00 WinXP 66.72.68.55 (AMERITECH.NET):
AT&T INTERNET SERVICES,
NASHVILLE, INDIANA, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 1a2c0e6130
NEW 		none[0] none:none
 none|none lines=60 trace
T:03:57:00 Win2K-f 67.127.244.194 (PACBELL.NET):
APW KNOX SEEMAN,
PLANO, TEXAS, US. (100Mbps) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:04:08:00 WinXP 174.116.49.56 (ROGERS.COM):
ROGERS CABLE COMMUNICATIONS INC,
ST. JOHN'S, NEWFOUNDLAND AND LABRADOR, CA. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:04:26:00 WinXP 70.184.104.142 (COX.NET):
COX COMMUNICATIONS,
CHANDLER, ARIZONA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 41
40 of 41		 3b3a6d7615
NEW
b7a694b220
NEW 		ed7beb96f5 [0]
9f0354af30[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
T:04:28:00 WinXP 203.90.121.150 (AKAMAITECHNOLOGIES.COM):
HCL INFINET LIMITED,
BANGALORE, KARNATAKA, IN. (100Mbps) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:04:49:00 Win2K-f 24.234.237.108 (COX.NET):
COX COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:04:50:00 Win2K-f 116.125.0.214 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 		60.190.222.139:65520 CN:proxim.ircgalaxy.pl
US:microsoft.com
LV:ad.ghura.pl
CN:ku.perfectexe.com
CN:mm.perfectexe.com
US:sendinvest.com
:findhobbits.com
US:search.toptravellingtips.com
CN:122.224.4.121:250
US:208.43.250.167:80
US:64.120.176.66:8392 		135 pcap raw alerts
ruleset 		irc
http
223 lines 		Yeah : 1.8
profile 		none summary
tarball 		26 of 41
26 of 40
none
39 of 41
0 of 40
17 of 41
25 of 41
38 of 41		 1e8d2d2ded
NEW
305cfdda68
NEW
401d2a0cff
NEW
49c38009fe
NEW
b353900e95
NEW
bc46417a2c
NEW
c19d441417
NEW
f14b110f95
NEW 		none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none] 		none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
 none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none 		none
none
none
none
none
none
none
none 		none
none
none
none
none
none
none
none
T:05:14:00 Win2K-f 95.27.4.82 (CORBINA.NET):
INVESTELEKTROSVIAZ LTD,
RU. (DSL) 		83.133.119.206:65520 :www.fiftpose.com
US:7465.377.discover-facts.com
US:www.advertise.com
CN:mm.perfectexe.com
CN:proxim.ircgalaxy.pl
LV:ad.ghura.pl
CN:ku.perfectexe.com
CN:122.224.4.121:250 		445 pcap raw alerts
ruleset 		http
irc
26 lines 		Yeah : 1.3
profile 		none summary
tarball 		none
17 of 41
25 of 41
13 of 41		 401d2a0cff
NEW
bc46417a2c
NEW
c19d441417
NEW
ceb9fe30e6
NEW 		none[none]
none [none]
none [none]
none [none] 		none:none
none:none
none:none
none:none
 none|none
none|none
none|none
none|none 		none
none
none
none 		none
none
none
none
05:40:00 Win2K-f 113.253.207.224 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:05:42:00 WinXP 88.130.188.34 (VERSANET.DE):
VERSATEL DEUTSCHLAND,
GERA, THURINGEN, DE. (DSL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
NEW 		none[0] none:none
 none|none lines=61 trace
T:06:03:00 WinXP 70.169.52.29 (COX.NET):
COX COMMUNICATIONS,
TULSA, OKLAHOMA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
1008 lines 		Yeah : 1.3
profile 		none summary
tarball 		19 of 41 aebf0a1c1d
NEW 		none[none] none:none
 none|none none none
T:07:25:00 Win2K-f 70.183.2.6 (COX.NET):
COX COMMUNICATIONS,
FAIRFAX, VIRGINIA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:07:29:00 WinXP 110.225.248.103 (59.AIRTELBROADBAND.IN):
BHARTI AIRTEL LTD,
GURGAON, HARYANA, IN. (DSL) 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:07:42:00 Win2K-f 113.252.100.75 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
101 lines 		Yeah : 1.3
profile 		none summary
tarball 		37 of 41
37 of 41		 568b9e866c
NEW
5c20c3472e
NEW 		6dfc90ff94 [0]
9ca7a71763[0] 		ASM:Graph
ASM:Graph
 tElock|
tElock| 		lines=42
lines=64
embedded dns 		trace
trace
08:48:00 WinXP 211.76.55.149 (UBBN.NET):
UNION BROADBAND NETWORK,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
57ce4acac2
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:09:53:00 Win2K-f 59.104.200.171 (SEED.NET.TW):
SEEDNET-KAOHSIUNGDP-S,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		41 of 42
40 of 42		 3d80e053d7
NEW
efbe674ffe
NEW 		40c3dbf25c [0]
e8c9eae1dc[0] 		none:none
none:none
 tElock|
Armadillo| 		none
none 		trace
trace
T:10:02:00 WinXP 24.43.182.116 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41 bf7dd68059
NEW 		none[none] none:none
 none|none none none
T:10:28:00 Win2K-f 152.48.222.12 (UNC.EDU):
NORTH CAROLINA RESEARCH AND EDUCATION NETWORK,
DURHAM, NORTH CAROLINA, US. (100Mbps) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:10:42:00 Win2K-f 203.118.238.245 (-):
GRAND TAINAN TECHNOLOGY CO.LTD,
TAINAN, T'AI-WAN, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41
40 of 41		 5fae5f1583
NEW
a3395c110a
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:11:08:00 Win2K-f 125.4.24.244 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 32
33 of 33		 07fabc79ef
NEW
53bfe15e91
NEW 		none[0]
1473091351[0] 		none:none
ASM:Graph
 Armadillo|
tElock| 		lines=90
lines=75
embedded dns 		trace
trace
T:12:18:00 Win2K-f 24.213.224.238 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AMSTERDAM, NOORD-HOLLAND, NL. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:12:53:00 WinXP 69.193.78.147 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
13:16:00 Win2K-f 218.63.69.77 (163DATA.COM.CN):
CHINANET YUNNAN PROVINCE NETWORK,
BEIJING, BEIJING, CN. (DIAL) 		n/a US:www.maxmind.com
EU:getmyip.co.uk
GB:www.vouchercodez.com
US:www.getmyip.org
:checkip.dyndns.org
US:67.15.94.80:80
GB:80.82.121.239:80 		445 pcap raw alerts
ruleset 		http
4 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:13:24:00 Win2K-f 218.63.69.77 (163DATA.COM.CN):
CHINANET YUNNAN PROVINCE NETWORK,
BEIJING, BEIJING, CN. (DIAL) 		n/a US:www.maxmind.com
:checkip.dyndns.org
DE:131.220.6.26:80 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:14:13:00 WinXP 109.86.135.183 (JWS.COM):
EU-ZZ,
UK. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:14:29:00 Win2K-f 61.7.240.163 (CULTURE.GO.TH):
CAT-ISP-NET,
BANGKOK, KRUNG THEP, TH. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
10 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:14:48:00 WinXP 222.239.73.30 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 		60.190.222.139:65520 CN:proxima.ircgalaxy.pl
US:microsoft.com
LV:ad.ghura.pl
CN:ku.perfectexe.com
CN:mm.perfectexe.com
US:sendinvest.com
:findhobbits.com
CN:pic.iwillhavesexygirls.com
US:search.toptravellingtips.com
173.45.70.226:80 		135 pcap raw alerts
ruleset 		irc
http
191 lines 		Yeah : 1.8
profile 		none summary
tarball 		13 of 41
17 of 41
40 of 40
0 of 40
25 of 41
28 of 41
31 of 33
23 of 40		 17ad929104
NEW
5c6b6c4581
NEW
b481cc65f6
NEW
b6638af232
NEW
c19d441417
NEW
c88f1a3028
NEW
d789c8d157
NEW
da9d2c34d9
NEW 		none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
5f6572479f[0]
none [none] 		none:none
none:none
none:none
none:none
none:none
none:none
ASM:Graph
none:none
 none|none
none|none
none|none
none|none
none|none
none|none
PolyEnE|
none|none 		none
none
none
none
none
none
lines=113
embedded dns
none 		none
none
none
none
none
none
trace
none
T:14:48:00 Win2K-f 203.118.238.245 (-):
GRAND TAINAN TECHNOLOGY CO.LTD,
TAINAN, T'AI-WAN, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41
40 of 41		 5fae5f1583
NEW
a3395c110a
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:15:04:00 WinXP 174.97.165.247 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
1041 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 41 43b8f21924
NEW 		none[3] none:none
 none|none none trace
T:15:08:00 Win2K-f 69.193.74.22 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:15:21:00 WinXP 66.81.185.43 (O1.COM):
O1 DIALUP SERVICES,
CITRUS HEIGHTS, CALIFORNIA, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		other
0 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
15:24:00 WinXP 66.81.185.43 (O1.COM):
O1 DIALUP SERVICES,
CITRUS HEIGHTS, CALIFORNIA, US. (DIAL) 		n/a   445 pcap raw alerts
ruleset 		other
0 lines 		Yeah : 0.8
profile 		none summary
tarball 		none none none none none none none
T:15:27:00 Win2K-f 67.253.44.98 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:15:28:00 WinXP 4.244.114.252 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
KANSAS CITY, MISSOURI, US. (DIAL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 41
39 of 41		 53bcb942c4
NEW
6d4ed181c0
NEW 		0455077c19 [0]
ecfe391a4c[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
17:49:00 WinXP 186.9.49.66 (IMOVIL.ENTELPCS.CL):
ENTEL PCS TELECOMUNICACIONES S.A,
SANTIAGO, REGION METROPOLITANA, CL. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
18:33:00 Win2K-f 91.98.133.173 (PARSONLINE.NET):
POOL FOR BROADBAND CUSTOMERS,
TEHRAN, ESFAHAN, IR. (DSL) 		n/a US:www.maxmind.com
EU:getmyip.co.uk
US:www.getmyip.org
:checkip.dyndns.org
US:67.15.94.80:80
EU:78.40.35.134:80 		445 pcap raw alerts
ruleset 		http
3 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:18:37:00 Win2K-f 60.250.241.177 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 39
35 of 38		 2205443cc8
NEW
b9297745a1
NEW 		04ce1ed773 [none]
4294884d84[0] 		none:none
ASM:Graph
 none|none
tElock| 		none
lines=64
embedded dns 		none
trace
T:18:39:00 Win2K-f 123.163.139.84 (163DATA.COM.CN):
CHINANET HENAN PROVINCE NETWORK,
BEIJING, BEIJING, CN. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
76 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
a08f3b74a4
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:19:00:00 WinXP 76.186.81.125 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ARLINGTON, TEXAS, US. (100Mbps) 		n/a   135 pcap raw alerts
ruleset 		other
1007 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 41 0f8abb24d9
NEW 		none[3] none:none
 none|none none trace
T:19:24:00 WinXP 118.222.174.179 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 		60.190.222.139:65520 CN:proxima.ircgalaxy.pl
US:microsoft.com
LV:ad.ghura.pl
CN:ku.perfectexe.com
CN:mm.perfectexe.com
US:sendinvest.com
:findhobbits.com
CN:pic.iwillhavesexygirls.com
US:search.toptravellingtips.com
CN:122.224.4.121:250
US:208.43.250.167:80 		135 pcap raw alerts
ruleset 		irc
http
203 lines 		Yeah : 1.8
profile 		none summary
tarball 		17 of 41
25 of 41
none
34 of 36
29 of 32
17 of 41
25 of 41
28 of 41		 5c6b6c4581
NEW
6331520e7a
NEW
97e86bc03f
NEW
99b248336f
NEW
9d677c3f70
NEW
bc46417a2c
NEW
c19d441417
NEW
c88f1a3028
NEW 		none[none]
none [none]
none [none]
c64bd1a776[0]
77e75ff10f[0]
none [none]
none [none]
none [none] 		none:none
none:none
none:none
ASM:Graph
ASM:Graph
none:none
none:none
none:none
 none|none
none|none
none|none
Armadillo|
tElock|
none|none
none|none
none|none 		none
none
none
lines=91
lines=120
embedded dns
none
none
none 		none
none
none
trace
trace
none
none
none
T:20:03:00 Win2K-f 122.146.243.176 (SPARQNET.NET):
NEW CENTRY INFOCOM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:22:16:00 Win2K-f 59.120.228.224 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
52 lines 		Yeah : 1.3
profile 		none summary
tarball 		0 of 33 57ce4acac2
NEW 		none[0] none:none
 Armadillo| lines=90 trace
T:22:59:00 WinXP 193.219.117.147 (-):
S.C. GLIN SERVICE TURISM SRL,
BUCHAREST, BUCURESTI, RO. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace