Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

11 June 2010
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:42:00 WinXP 61.7.240.163 (CULTURE.GO.TH):
CAT-ISP-NET,
BANGKOK, KRUNG THEP, TH. (DSL) n/a 135 pcap raw alerts
ruleset other
10 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:00:43:00 WinXP 63.25.255.246 (UU.NET):
UUNET TECHNOLOGIES INC,
CLEBURNE, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:01:04:00 WinXP 114.206.150.87 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 60.190.222.139:65520 DE:proxim.ircgalaxy.pl
LV:ad.ghura.pl
CN:ku.perfectexe.com
:www.pirateparty.in.ua
BR:loja.tray.com.br
BR:www.imusica.com.br
UA:global-host.com.ua
JP:g105.secure.ne.jp
:www.mlh.co.jp
UA:spooky.cartoons.org.ua
JP:www.jaif.or.jp
UA:isu2.tup.km.ua
BR:www.saredrogarias.com.br
JP:www.science-forum.co.jp
US:www.iknow.co.jp
JP:ir.kagoshima-u.ac.jp
115.125.150.234:443
US:140.177.205.56:443
JP:163.209.180.1:443
JP:164.46.227.120:443
UA:193.178.147.110:443
BR:201.20.45.207:443
JP:202.164.228.11:443
JP:202.191.113.9:443
JP:202.214.40.79:443
JP:203.179.38.26:443
UA:212.111.198.59:443
CN:222.170.127.203:88
US:69.57.128.35:443
UA:77.120.110.76:443
UA:82.193.122.190:443 139 pcap raw alerts
ruleset irc
http
21 lines Yeah : 1.3
profile none summary
tarball 36 of 41
39 of 40 05265022c4
NEW
1a98800673
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:01:11:00 Win2K-f 61.130.137.142 (163DATA.COM.CN):
CHINANET-ZJ NINGBO NODE NETWORK,
NINGBO, ZHEJIANG, CN. (DIAL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

01:11:00 Win2K-f 114.206.150.87 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 83.133.119.206:65520 DE:proxim.ircgalaxy.pl
LV:ad.ghura.pl
JP:v.rentalserver.jp
US:www.wolfram.co.jp
EU:accounts.comodo.od.ua
BR:loja.tray.com.br
JP:www.kajima.co.jp
UA:global-host.com.ua
JP:bookweb.kinokuniya.co.jp
JP:center.umin.ac.jp
UA:bunker.org.ua
CN:ku.perfectexe.com
:vbmcom.com
JP:130.69.92.68:443
US:140.177.205.54:443
UA:195.214.214.53:443
JP:202.214.40.79:443
JP:202.218.170.179:443
US:64.79.197.143:443
US:69.57.128.35:443
UA:77.120.104.50:443
UA:77.120.110.76:443
EU:91.196.95.24:443 139 pcap raw alerts
ruleset irc
http
17 lines Yeah : 1.3
profile none summary
tarball 36 of 41
39 of 40
14 of 40
19 of 41 05265022c4
NEW
1a98800673
NEW
90404d2391
NEW
ff54d9a61b
NEW none[none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none none
none
none
none none
none
none
none

T:01:16:00 WinXP 64.175.160.91 (PACBELL.NET):
AT&T INTERNET SERVICES,
CARLSBAD, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

01:17:00 Win2K-f 76.93.25.157 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LOS ANGELES, CALIFORNIA, US. (DSL) 83.133.119.206:65520 DE:proxim.ircgalaxy.pl
LV:ad.ghura.pl
BR:www.billboxrecords.com.br
JP:direct.ips.co.jp
DE:www.miltenyibiotec.co.jp
UA:opensvit.ua
:www.imagemfolheados.com.br
JP:www.gsec.keio.ac.jp
112.27.137.190:443
112.91.139.190:443
191.132.154.190:443
UA:195.182.192.2:443
BR:200.234.192.141:443
JP:202.214.40.79:443
JP:202.218.13.230:443
US:207.44.220.4:443
JP:210.171.131.16:443
US:65.74.140.3:443
US:69.61.11.226:443
US:69.72.149.166:443
UA:77.120.121.35:443
EU:79.171.122.236:443 445 pcap raw alerts
ruleset irc
http
18 lines Yeah : 0.8
profile none summary
tarball 36 of 41
0 of 41 05265022c4
NEW
fd3df33c95
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

01:27:00 Win2K-f 217.110.204.11 (-):
DE-COLT-1100-59452891-BBDBGH,
DE. (DSL) n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
DE:131.220.6.26:80 445 pcap raw alerts
ruleset http
6 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:01:32:00 WinXP 60.234.105.57 (ORCON.NET.NZ):
ORCON INTERNET LTD SUPPORT,
AUCKLAND, AUCKLAND, NZ. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:01:54:00 Win2K-f 211.207.195.181 (FRONTIEROIL.NET):
HANARO TELECOM INC,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 83.133.119.206:65520 DE:proxima.ircgalaxy.pl
US:microsoft.com
LV:ad.ghura.pl
CN:ku.perfectexe.com
US:sendinvest.com
:vbmcom.com
CN:sky.perfectexe.com
:findhobbits.com
:in.7cy.net
:in1.7cy.net
US:search.toptravellingtips.com
US:64.120.176.66:8392
64.79.86.26:80 135 pcap raw alerts
ruleset irc
http
243 lines Yeah : 1.8
profile none summary
tarball 25 of 41
40 of 41
14 of 40
21 of 41
40 of 41
32 of 41
11 of 41
0 of 41
29 of 40
19 of 41 38283dfa22
NEW
54f6a48ee7
NEW
90404d2391
NEW
b62a4e2597
NEW
bdc4efdb73
NEW
c88071ad1b
NEW
c9e89abb7b
NEW
d75800a7dd
NEW
e8a7694956
NEW
ff54d9a61b
NEW none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none
none
none
none
none none
none
none
none
none
none
none
none
none
none

T:02:06:00 Win2K-f 89.178.22.72 (CORBINA.RU):
BROADBAND CUSTOMERS IN MOSCOW,
MOSCOW, MOSCOW CITY, RU. (DSL) n/a :www.sellbloom.com
:reconginizedstandards.com
US:dsnextgen.com
:redirect.hotkeys.com
US:searchportal.information.com
US:spi.domainsponsor.com
US:ads1.revenue.net
US:panther1.cpxinteractive.com
US:adserving.cpxinteractive.com
:www.registerchannel.com
:resources.infolinks.com
US:www.tqlkg.com
US:www.yceml.net
US:69.22.138.41:80 445 pcap raw alerts
ruleset http
irc
143 lines Argh : 0.3
profile none summary
tarball 26 of 41 52a540dc49
NEW none[none] none:none
none|none none none

T:02:10:00 WinXP 173.200.73.19 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:02:30:00 WinXP 72.187.106.67 (RR.COM):
ROAD RUNNER HOLDCO LLC,
NEW PORT RICHEY, FLORIDA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 40
37 of 39 1da4193446
NEW
6278c9374a
NEW 8a97c8536a [none]
cc7aaf6ea9[none] none:none
none:none
none|none
none|none none
none none
none

T:02:46:00 Win2K-f 115.165.60.6 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
TOKYO, TOKYO, JP. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:02:55:00 WinXP 117.254.221.205 (STERLINGSTUDENTS.NET):
NIB (NATIONAL INTERNET BACKBONE),
NEW DELHI, DELHI, IN. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 32 of 32 d1377a8b90
NEW ad56da3672 [0] ASM:Graph
PolyEnE| lines=68 trace

T:04:27:00 Win2K-f 173.28.206.38 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
CHANHASSEN, MINNESOTA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 40
38 of 40 474acf88e5
NEW
68f0c14692
NEW 1f53944b24 [0]
ccc1b24d53[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:05:20:00 WinXP 70.60.190.135 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MEMPHIS, TENNESSEE, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:05:58:00 WinXP 67.125.140.230 (PACBELL.NET):
AT&T INTERNET SERVICES,
FRESNO, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

06:02:00 Win2K-f 202.152.26.148 (-):
ARTAJASA PEMBAYARAN ELEKTRONIS,
JAKARTA, JAKARTA RAYA, ID. (100Mbps) n/a US:www.maxmind.com
EU:getmyip.co.uk
GB:www.vouchercodez.com
US:www.getmyip.org
:checkip.dyndns.org
US:67.15.94.80:80
US:75.126.138.202:80
GB:80.82.121.239:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:06:11:00 Win2K-f 202.152.26.148 (-):
ARTAJASA PEMBAYARAN ELEKTRONIS,
JAKARTA, JAKARTA RAYA, ID. (100Mbps) n/a US:www.maxmind.com
EU:getmyip.co.uk
GB:www.vouchercodez.com
:checkip.dyndns.org
DE:131.220.6.26:80 445 pcap raw alerts
ruleset http
7 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:06:19:00 Win2K-f 78.62.254.114 (ZEBRA.LT):
LIETUVOS,
VILNIUS, VILNIAUS APSKRITIS, LT. (DSL) n/a US:www.microsoft.com 135 pcap raw alerts
ruleset other
266 lines Yeah : 1.3
profile none summary
tarball 38 of 41 09e044cad2
NEW none[none] none:none
none|none none none

T:06:23:00 Win2K-f 122.196.33.249 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
115 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 71e6f60517
NEW
ab4e3226c4
NEW 1ef1781501 [0]
c2d0313e73[0] ASM:Graph
none:none
Armadillo|
tElock| lines=91
none trace
trace

T:06:25:00 WinXP 122.196.35.216 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 71e6f60517
NEW
ab4e3226c4
NEW 1ef1781501 [0]
c2d0313e73[0] ASM:Graph
none:none
Armadillo|
tElock| lines=91
none trace
trace

T:07:36:00 WinXP 99.164.23.178 (SBCGLOBAL.NET):
RANI PAL LLC,
PLANO, TEXAS, US. (DSL) n/a 135 pcap raw alerts
ruleset other
402 lines Yeah : 1.3
profile none summary
tarball 11 of 36 c4c5a56ffe
NEW 8bef2f9170 [0] ASM:Graph
StarForce| lines=30 trace

T:08:33:00 WinXP 115.165.82.55 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
KAWASAKI, KANAGAWA, JP. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
NEW none[0] none:none
none|none lines=61 trace

T:08:38:00 Win2K-f 173.27.197.140 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
DAVENPORT, IOWA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 38 of 41
39 of 41 10759405e0
NEW
d08e00dfaf
NEW 292d343248 [0]
854c49d8c4[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:08:51:00 Win2K-f 24.87.137.146 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
286 lines Yeah : 1.3
profile none summary
tarball 38 of 41 ec90ec15db
NEW 7b0ab2b387 [0] ASM:Graph
none|none lines=546 trace

T:10:45:00 WinXP 61.205.154.222 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
112 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 71e6f60517
NEW
ab4e3226c4
NEW 1ef1781501 [0]
c2d0313e73[0] ASM:Graph
none:none
Armadillo|
tElock| lines=91
none trace
trace

T:10:55:00 Win2K-f 110.93.96.188 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 5bbb57c115
NEW
75ac189d9e
NEW 03e5cb3c4a [0]
705dbaa801[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:11:12:00 WinXP 174.39.203.89 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - OMAHA,
NORTH PLATTE, NEBRASKA, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 40 be560d19a9
NEW none[none] none:none
none|none none none

T:12:06:00 Win2K-f 70.65.70.36 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
RED DEER, ALBERTA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:12:14:00 WinXP 24.213.224.249 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AMSTERDAM, NOORD-HOLLAND, NL. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:14:06:00 Win2K-f 75.85.41.12 (RR.COM):
ROAD RUNNER HOLDCO LLC,
FULLERTON, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:15:09:00 Win2K-f 161.216.3.110 (-):
BELL MOBILITY CELLULAR,
WELLAND, ONTARIO, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:15:11:00 Win2K-f 60.250.206.50 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 34 of 38
35 of 38 38ed850a0e
NEW
b9297745a1
NEW 46990f37cd [0]
4294884d84[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

15:50:00 WinXP 186.97.25.44 (EMTEL.NET.CO):
COLOMBIA MVIL,
EL CENTRO, SANTANDER, CO. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 38 of 42 dcf68cf1b4
NEW 99c111271e [0] none:none
PolyEnE| none trace

T:16:32:00 Win2K-f 4.229.168.239 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
AKRON, OHIO, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
4 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:16:54:00 Win2K-f 125.4.224.135 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
158 lines Yeah : 1.3
profile none summary
tarball 39 of 41
40 of 41 1b1db1c992
NEW
8a50345c2f
NEW a8036b5105 [0]
585123125f[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

16:57:00 Win2K-f 200.100.163.158 (TELESP.NET.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DIAL) n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
EU:getmyip.co.uk
GB:www.vouchercodez.com
DE:131.220.6.26:80
208.78.70.70:80 445 pcap raw alerts
ruleset http
7 lines Yeah : 0.8
profile none summary
tarball 2 of 37 223d8089f8
NEW none[3] none:none
StarForce| none trace

T:17:21:00 Win2K-f 114.74.156.161 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
MELBOURNE, VICTORIA, AU. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
115 lines Yeah : 1.3
profile none summary
tarball 39 of 41
40 of 41 56703b9d17
NEW
c55e86f7e9
NEW de8764ef05 [0]
c790c10ad1[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:17:34:00 WinXP 220.146.64.226 (INFOWEB.NE.JP):
INFOWEB(FUJITSU LTD.),
KYOTO, KYOTO, JP. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 40 of 41 eb33ccfff8
NEW e732a43be0 [0] ASM:Graph
none|none lines=58 trace

T:17:35:00 WinXP 89.195.66.212 (-):
ORANGE HIGH SPEED INTERNET,
LONDON, ENGLAND, UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 38 of 40 68e76ac69b
NEW none[none] none:none
none|none none none

T:18:40:00 Win2K-f 60.248.250.217 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
116 lines Yeah : 1.3
profile none summary
tarball 34 of 38
35 of 38 38ed850a0e
NEW
b9297745a1
NEW 46990f37cd [0]
4294884d84[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

19:12:00 Win2K-f 190.128.41.113 (-):
EMPRESA DE TELECOMUNICACIONES DE PEREIRA S.A. E.S.P,
CO. (DSL) n/a US:www.maxmind.com
EU:getmyip.co.uk
:checkip.dyndns.org
US:67.15.94.80:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 8 of 37 4f88618d4f
NEW none[3] none:none
UPX| none trace

T:19:16:00 WinXP 66.72.68.97 (AMERITECH.NET):
AT&T INTERNET SERVICES,
NASHVILLE, INDIANA, US. (DIAL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 28 of 33 76e95d966a
NEW none[none] none:none
none|none none none

T:19:27:00 Win2K-f 190.128.41.113 (-):
EMPRESA DE TELECOMUNICACIONES DE PEREIRA S.A. E.S.P,
CO. (DSL) n/a US:www.maxmind.com
US:www.getmyip.org
EU:getmyip.co.uk
GB:www.vouchercodez.com
:checkip.dyndns.org
DE:131.220.6.26:80 445 pcap raw alerts
ruleset http
8 lines Yeah : 0.8
profile none summary
tarball 8 of 37 4f88618d4f
NEW none[3] none:none
UPX| none trace

T:19:46:00 Win2K-f 122.146.243.47 (SPARQNET.NET):
NEW CENTRY INFOCOM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:20:17:00 Win2K-f 221.141.22.194 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 83.133.119.206:65520 US:microsoft.com
DE:proxima.ircgalaxy.pl
LV:ad.ghura.pl
CN:ku.perfectexe.com
:vbmcom.com
US:sendinvest.com
CN:sky.perfectexe.com
:findhobbits.com
US:search.toptravellingtips.com
US:64.120.176.66:8392
64.79.86.26:8392 135 pcap raw alerts
ruleset irc
http
208 lines Yeah : 1.8
profile none summary
tarball 17 of 40
40 of 41
19 of 41
0 of 40
21 of 41
32 of 41
39 of 41
29 of 40
5 of 41
19 of 41 15b4a2d8c2
NEW
1824c59f34
NEW
7415d99e43
NEW
9f69f4aa20
NEW
b62a4e2597
NEW
c88071ad1b
NEW
caaeb70f9f
NEW
e8a7694956
NEW
f636fccb0c
NEW
ff54d9a61b
NEW none[none]
da8a48fc3a[0]
none [none]
none [none]
none [none]
none [none]
fdabb272e7[0]
none [none]
none [none]
none [none] none:none
ASM:Graph
none:none
none:none
none:none
none:none
ASM:Graph
none:none
none:none
none:none
none|none
tElock|
none|none
none|none
none|none
none|none
Armadillo|
none|none
none|none
none|none none
lines=112
embedded dns
none
none
none
none
lines=91
none
none
none none
trace
none
none
none
none
trace
none
none
none

T:20:26:00 Win2K-f 98.71.97.180 (BELLSOUTH.NET):
BELLSOUTH.NET INC,
ATLANTA, GEORGIA, US. (DSL) 83.133.119.206:65520 :antiboycottlaw.com
:in.7cy.net
US:search.musicforher.com
US:empiricaldiscipline.com
US:as.casalemedia.com
US:www.parklogic.com
:landing.hitfarm.com
US:activex.microsoft.com
US:codecs.microsoft.com
:hf.davinci.com
DE:proxima.ircgalaxy.pl
US:searchportal.information.com
US:spi.domainsponsor.com
LV:ad.ghura.pl
US:ads1.revenue.net
US:204.13.160.17:80 445 pcap raw alerts
ruleset http
irc
56 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:20:51:00 WinXP 113.41.182.86 (UCOM.NE.JP):
UCOM CORP,
JP. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 41 of 41 25a4a63c85
NEW none[none] none:none
none|none none none

T:21:06:00 Win2K-f 72.185.228.84 (RR.COM):
ROAD RUNNER HOLDCO LLC,
TAMPA, FLORIDA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 40
37 of 39 1da4193446
NEW
6278c9374a
NEW 8a97c8536a [none]
cc7aaf6ea9[none] none:none
none:none
none|none
none|none none
none none
none

T:21:22:00 Win2K-f 75.79.60.48 (DSLEXTREME.COM):
DSL EXTREME,
LOS ANGELES, CALIFORNIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 40 of 41 cb8ebf02a0
NEW none[none] none:none
none|none none none

T:21:37:00 Win2K-f 71.64.132.22 (OPC.COM):
ROAD RUNNER HOLDCO LLC,
DAYTON, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:21:40:00 WinXP 186.10.152.8 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 a0139d7ad8
NEW none[0] none:none
PolyEnE| lines=68 trace

T:21:51:00 WinXP 70.127.55.156 (RR.COM):
ROAD RUNNER HOLDCO LLC,
DAVENPORT, FLORIDA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:22:24:00 Win2K-f 99.20.135.150 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
MINNEAPOLIS, MINNESOTA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:22:30:00 WinXP 174.100.152.9 (RR.COM):
ROAD RUNNER HOLDCO LLC,
STOW, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace