Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

16 June 2010
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:06:00 Win2K-f 77.255.45.89 (COM.PL):
NETIA,
PL. (DSL) n/a 139 pcap raw alerts
ruleset ftp
13 lines Yeah : 0.8
profile none summary
tarball 41 of 41 29a3030e16
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:00:07:00 Win2K-f 218.191.14.185 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a 139 pcap raw alerts
ruleset ftp
13 lines Yeah : 0.8
profile none summary
tarball 38 of 41 053e25e2e4
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:00:07:00 Win2K-f 113.253.57.174 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HK. (DSL) n/a PR:m.drd3h.com
PR:207.166.122.72:6668 139 pcap raw alerts
ruleset ftp
irc
19 lines Yeah : 0.8
profile none summary
tarball 40 of 41 00c4fc2fd0
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:00:15:00 WinXP 117.254.171.143 (STERLINGSTUDENTS.NET):
NIB (NATIONAL INTERNET BACKBONE),
NEW DELHI, DELHI, IN. (DSL) n/a DE:citi-bank.ru
:parex-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:00:32:00 WinXP 213.138.224.85 (NETMADEIRA.COM):
CABO TV MADEIRENSE S.A,
FUNCHAL, MADEIRA, PT. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
19 lines Yeah : 0.8
profile none summary
tarball 37 of 40 4dd4197eb4
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:00:34:00 Win2K-f 113.255.186.10 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HK. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 41 1b3d8e9fe7
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:00:38:00 WinXP 113.252.86.49 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.72:6668 139 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 0.8
profile none summary
tarball 30 of 39 1a6c7da535
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:00:41:00 Win2K-f 70.73.120.71 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 40 379a6daa0d
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:00:51:00 Win2K-f 96.48.116.48 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
MAPLE RIDGE, BRITISH COLUMBIA, CA. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 e3faefa56a
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:00:55:00 WinXP 59.115.207.197 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.72:6668 139 pcap raw alerts
ruleset ftp
irc
19 lines Yeah : 0.8
profile none summary
tarball 40 of 40 013a5ba10e
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:00:57:00 WinXP 113.252.91.154 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.72:6668 139 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 0.8
profile none summary
tarball 37 of 40 d8e60db98a
NEW 6991257f56 [0] ASM:Graph
pex| lines=42 trace

T:01:02:00 Win2K-f 112.197.188.5 (-):
SAIGON TOURIST CABLE TELEVISION,
VN. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
21 lines Yeah : 0.8
profile none summary
tarball 40 of 40 013a5ba10e
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:01:09:00 Win2K-f 86.52.59.92 (REV.STOFANET.DK):
STOFANET-INET-CIDR,
ÅRHUS, ARHUS, DK. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
19 lines Yeah : 0.8
profile none summary
tarball 40 of 41 ffbb6cbe61
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:01:17:00 WinXP 174.1.89.149 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VANCOUVER, BRITISH COLUMBIA, CA. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
27 lines Yeah : 0.8
profile none summary
tarball 40 of 41 c4f4cf6afa
NEW none[none] none:none
none|none none none

T:01:19:00 WinXP 111.255.181.37 (-):
. n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
19 lines Yeah : 0.8
profile none summary
tarball 33 of 38 b7aedf34b2
NEW none[none] none:none
none|none none none

T:01:31:00 WinXP 115.165.82.92 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
KAWASAKI, KANAGAWA, JP. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 31 of 32 741e3b03b3
NEW none[0] none:none
none|none lines=61 trace

T:01:41:00 Win2K-f 125.231.34.27 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 00c4fc2fd0
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:01:55:00 WinXP 113.253.8.141 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
19 lines Yeah : 0.8
profile none summary
tarball 37 of 40 4dd4197eb4
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:01:55:00 WinXP 113.254.29.43 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
27 lines Yeah : 0.8
profile none summary
tarball 39 of 40 379a6daa0d
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:02:03:00 Win2K-f 114.38.224.5 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 207.166.122.72:6668 PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
34 lines Yeah : 1.3
profile none summary
tarball 40 of 41 8128405d8c
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:02:06:00 WinXP 118.232.220.124 (KBRONET.COM.TW):
TUNG HO MULTIMEDIA CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.72:6668 139 pcap raw alerts
ruleset ftp
irc
23 lines Yeah : 0.8
profile none summary
tarball 40 of 40 0629d7fc42
NEW none[none] none:none
none|none none none

T:02:09:00 Win2K-f 113.252.206.251 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 41 1b3d8e9fe7
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:02:12:00 WinXP 81.219.230.141 (FUTURO.PL):
CONNECTED THROUGH FUTURO POLAND,
WROCLAW, DOLNOSLASKIE, PL. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.72:6668 139 pcap raw alerts
ruleset ftp
irc
37 lines Yeah : 0.8
profile none summary
tarball 39 of 41 6704922c65
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:02:28:00 Win2K-f 84.3.54.162 (T-ONLINE.HU):
HUNGARIAN TELECOM,
BUDAPEST, BUDAPEST, HU. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 40 b0bd34666f
NEW none[none] none:none
none|none none none

T:02:30:00 WinXP 113.253.151.21 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
35 lines Yeah : 0.8
profile none summary
tarball 39 of 41 1b3d8e9fe7
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:02:39:00 Win2K-f 92.80.115.180 (ROMTELECOM.NET):
ROMTELECOM DATA NETWORK,
BUCHAREST, BUCURESTI, RO. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 e3faefa56a
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:02:39:00 Win2K-f 87.205.46.234 (INETIA.PL):
INTERNETIA,
KATOWICE, SLASKIE, PL. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 41 6704922c65
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:03:00:00 Win2K-f 82.247.17.153 (PROXAD.NET):
PROXAD / FREE SAS,
PARIS, ILE-DE-FRANCE, FR. (DSL) 207.166.122.72:6668 PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
35 lines Yeah : 1.3
profile none summary
tarball 38 of 41 80563974df
NEW afaf06d6cd [0] ASM:Graph
pex| lines=42 trace

T:03:23:00 Win2K-f 113.252.232.165 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 38 of 41 80563974df
NEW afaf06d6cd [0] ASM:Graph
pex| lines=42 trace

T:03:27:00 WinXP 61.228.150.110 (PRESTONAUTO.COM):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 3ae357d17b
NEW none[0] none:none
PolyEnE| lines=73 trace

T:03:37:00 WinXP 211.40.96.220 (BORA.NET):
BORANET-NET,
SUWON, KYONGGI-DO, KR. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
120 lines Yeah : 1.3
profile none summary
tarball 39 of 40
39 of 40 be73b69b9d
NEW
da8b2534a9
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:03:45:00 Win2K-f 88.156.23.49 (VECTRANET.PL):
VECTRA S.A,
OLSZTYN, WARMINSKO-MAZURSKIE, PL. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 38 of 41 8e8c7fc3c9
NEW none[none] none:none
none|none none none

T:03:46:00 Win2K-f 122.105.213.132 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
MELBOURNE, VICTORIA, AU. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

04:07:00 Win2K-f 61.185.85.13 (163DATA.COM.CN):
CHINANET SHANXI(SN) PROVINCE NETWORK,
SHANGHAI, SHANGHAI, CN. (DSL) n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
EU:getmyip.co.uk
DE:131.220.6.26:80
208.78.70.70:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
5 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:04:13:00 WinXP 70.67.236.249 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
DUNCAN, BRITISH COLUMBIA, CA. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
25 lines Yeah : 0.8
profile none summary
tarball 40 of 41 c13a6c3da5
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:04:19:00 Win2K-f 115.82.133.187 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
25 lines Yeah : 0.8
profile none summary
tarball 39 of 41 c45a01fbcc
NEW afaf06d6cd [0] ASM:Graph
pex| lines=42 trace

T:04:35:00 WinXP 117.254.219.162 (STERLINGSTUDENTS.NET):
NIB (NATIONAL INTERNET BACKBONE),
NEW DELHI, DELHI, IN. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:04:45:00 WinXP 180.177.39.196 (-):
. n/a PR:m.DRD3H.COM
PR:207.166.122.72:6668 139 pcap raw alerts
ruleset ftp
irc
31 lines Yeah : 0.8
profile none summary
tarball 41 of 41 e25842bcd6
NEW none[none] none:none
none|none none none

T:04:52:00 WinXP 114.51.95.5 (E-MOBILE.NE.JP):
EMOBILE LTD,
TOKYO, TOKYO, JP. (DSL) n/a 445 pcap raw alerts
ruleset ftp
13 lines Yeah : 0.8
profile none summary
tarball 37 of 40 5285741560
NEW 60590b8b67 [0] ASM:Graph
none|none lines=59 trace

T:05:08:00 Win2K-f 4.182.164.249 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NEW YORK, NEW YORK, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
74 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
NEW
b7082104e4
NEW 1473091351 [0]
c5b49e7b82[0] ASM:Graph
ASM:Graph
tElock|
tElock| lines=75
embedded dns
lines=41 trace
trace

T:05:12:00 WinXP 151.83.184.67 (SER-PR2-MAX.IUNET.IT):
INFOSTRADA,
IT. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 d8040f84d4
NEW d683995e84 [0] ASM:Graph
PolyEnE| lines=73 trace

T:05:47:00 WinXP 24.59.7.44 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MASSENA, NEW YORK, US. (DSL) n/a EU:siliconfireware.ru
US:searchportal.information.com
US:spi.domainsponsor.com
:wpad
RU:ebookfinaltrash.ru 445 pcap raw alerts
ruleset http
http
http
http
31 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
NEW none[0] none:none
ASPack| lines=298
embedded dns trace

06:16:00 Win2K-f 168.187.86.190 (ALDEASASALASIL.COM.KW):
KUWAIT ELECTRONIC AND MESSAGING SERVICES COMPANY,
KUWAIT, AL KUWAYT, KW. (DSL) n/a US:www.maxmind.com
US:www.getmyip.org
:checkip.dyndns.org
EU:getmyip.co.uk
208.78.70.70:80
US:67.15.94.80:80
US:75.126.138.202:80
EU:78.40.35.134:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:06:23:00 WinXP 99.244.61.113 (ROGERS.COM):
ROGERS CABLE INC. MTMC,
SCARBOROUGH, ONTARIO, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:06:34:00 WinXP 114.200.187.244 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
95 lines Yeah : 1.3
profile none summary
tarball 40 of 41
38 of 41 3dc6500eb1
NEW
ff3843f312
NEW none[none]
30a7e641cf[0] none:none
ASM:Graph
none|none
Armadillo| none
lines=90 none
trace

T:06:35:00 Win2K-f 88.173.187.85 (PROXAD.NET):
PROXAD / FREE SAS,
PARIS, ILE-DE-FRANCE, FR. (100Mbps) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 41 of 41 31cc8b59ff
NEW none[none] none:none
none|none none none

T:07:43:00 WinXP 188.176.70.35 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:07:49:00 WinXP 121.121.33.159 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 40 5e8ccc4190
NEW 8d5f86583f [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:43:00 Win2K-f 209.152.128.36 (-):
KLM TELEPHONE,
KANSAS CITY, MISSOURI, US. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 37 of 41 7c40b7f0e0
NEW none[none] none:none
none|none none none

T:09:10:00 WinXP 211.74.113.157 (SEED.NET.TW):
SEEDNET-NANTODP-S,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 36 of 38 bccef82c90
NEW none[none] none:none
none|none none none

T:09:31:00 WinXP 110.227.109.70 (59.AIRTELBROADBAND.IN):
BHARTI AIRTEL LTD,
GURGAON, HARYANA, IN. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 40 5e8ccc4190
NEW 8d5f86583f [0] ASM:Graph
PolyEnE| lines=68 trace

T:10:00:00 WinXP 219.105.92.161 (ADACHI.NE.JP):
CABLE TELEVISION ADACHI CORP,
TOKYO, TOKYO, JP. (DSL) n/a 445 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
NEW none[0] none:none
none|none lines=61 trace

T:11:34:00 WinXP 193.248.182.40 (ABO.WANADOO.FR):
WANADOO FRANCE,
AMIENS, PICARDIE, FR. (DSL) n/a 445 pcap raw alerts
ruleset ftp
13 lines Yeah : 0.8
profile none summary
tarball 32 of 32 03f912899b
NEW none[0] none:none
none|none lines=64 trace

T:11:42:00 WinXP 98.175.164.44 (COX.NET):
COX COMMUNICATIONS,
ANNANDALE, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:12:55:00 Win2K-f 204.17.41.99 (AZFREQCOORD.ORG):
LOGIN INC,
TUCSON, ARIZONA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:14:13:00 Win2K-f 99.38.141.144 (PACBELL.NET):
AT&T INTERNET SERVICES,
NORTH LITTLE ROCK, ARKANSAS, US. (DSL) n/a 135 pcap raw alerts
ruleset other
693 lines Yeah : 1.3
profile none summary
tarball 38 of 41 ecfbf321d3
NEW none[none] none:none
none|none none none

T:14:37:00 WinXP 93.102.219.214 (REV.OPTIMUS.PT):
OPTIMUS PORTUGAL,
PT. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 40 5e8ccc4190
NEW 8d5f86583f [0] ASM:Graph
PolyEnE| lines=68 trace

T:15:09:00 Win2K-f 72.187.106.67 (RR.COM):
ROAD RUNNER HOLDCO LLC,
NEW PORT RICHEY, FLORIDA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 40
37 of 39 1da4193446
NEW
6278c9374a
NEW 8a97c8536a [none]
cc7aaf6ea9[none] none:none
none:none
none|none
none|none none
none none
none

T:17:02:00 WinXP 189.48.241.205 (VELOXZONE.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
PETRóPOLIS, RIO DE JANEIRO, BR. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:17:27:00 WinXP 67.127.244.194 (PACBELL.NET):
APW KNOX SEEMAN,
PLANO, TEXAS, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:17:38:00 WinXP 4.244.114.46 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
KANSAS CITY, MISSOURI, US. (DIAL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:17:45:00 Win2K-f 173.20.39.198 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
SPRINGFIELD, MISSOURI, US. (DSL) n/a 135 pcap raw alerts
ruleset other
10 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:19:27:00 WinXP 4.248.68.110 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
MILLBURN, NEW JERSEY, US. (DIAL) n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
NEW none[0] none:none
none|none lines=61 trace

T:19:38:00 Win2K-f 4.137.83.126 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
COCHRAN, GEORGIA, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
174 lines Yeah : 1.3
profile none summary
tarball 38 of 41
36 of 41 97d5230e3f
NEW
dfb19bde14
NEW 2deaf62cb7 [0]
7d7d4ab834[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:20:11:00 WinXP 114.51.39.125 (E-MOBILE.NE.JP):
EMOBILE LTD,
TOKYO, TOKYO, JP. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 37 of 40 5285741560
NEW 60590b8b67 [0] ASM:Graph
none|none lines=59 trace

T:21:02:00 Win2K-f 76.189.184.16 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CLEVELAND, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:21:46:00 Win2K-f 75.15.235.239 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
BAKERSFIELD, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
40 of 41 1e12f5145a
NEW
f208493e65
NEW 617af909de [0]
5100adb4f9[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace