Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

02 October 2010
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:16:00 Win2K-f 115.165.31.166 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
TOKYO, TOKYO, JP. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:00:46:00 WinXP 178.92.162.214 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 38 of 43 831f91b1fb
NEW none[none] none:none
none|none none none

T:00:51:00 Win2K-f 174.5.73.4 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CA. (DSL) 62.193.249.122:3305 FR:cx10man.weedns.com 135 pcap raw alerts
ruleset irc
695 lines Yeah : 1.8
profile none summary
tarball 38 of 41 ecfbf321d3
NEW none[none] none:none
none|none none none

T:00:57:00 WinXP 195.2.219.81 (-):
SC FOX COMPUTERS SRL,
RO. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 37 of 39 fa0b828ca9
NEW none[none] none:none
none|none none none

T:01:08:00 WinXP 4.153.2.98 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
NORTH AUGUSTA, SOUTH CAROLINA, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:02:45:00 Win2K-f 114.74.217.4 (JWS.COM):
OPTUS INTERNET - RETAIL,
MELBOURNE, VICTORIA, AU. (DSL) n/a 135 pcap raw alerts
ruleset other
1011 lines Yeah : 1.3
profile none summary
tarball 7 of 41 b1f58ef783
NEW none[3] none:none
none|none none trace

T:02:48:00 WinXP 188.109.12.88 (ARCOR-IP.NET):
ARCOR AG & CO. KG,
DE. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 0.8
profile none summary
tarball 40 of 40 013a5ba10e
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:03:30:00 Win2K-f 113.252.210.108 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
26 lines Yeah : 0.8
profile none summary
tarball 38 of 41 8887d42f5c
NEW afaf06d6cd [0] ASM:Graph
pex| lines=42 trace

T:04:12:00 WinXP 203.81.214.111 (WORLDCALL.NET.PK):
WORLDCALL MULTIMEDIA LTD,
KARACHI, SINDH, PK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 a3c82ff952
NEW none[none] none:none
none|none none none

T:04:38:00 WinXP 151.81.188.143 (51-151.NET24.IT):
IUNET-BNET,
IT. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 41 of 43 8d649f854f
NEW none[none] none:none
none|none none none

T:05:01:00 WinXP 221.126.240.85 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:05:13:00 WinXP 202.107.247.8 (CNINFO.NET):
CHINANET-ZJ QUZHOU NODE NETWORK,
QUZHOU, ZHEJIANG, CN. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:05:17:00 Win2K-f 67.48.116.164 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LEES SUMMIT, MISSOURI, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:05:22:00 WinXP 46.109.58.122 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 42 9b285231fe
NEW a9a8f0a26f [0] none:none
PolyEnE| none trace

05:44:00 Win2K-f 186.19.56.71 (-):
. n/a US:www.maxmind.com
EU:checkip.dyndns.org
:www.getmyip.org
:getmyip.co.uk
US:67.15.94.80:80
EU:91.198.22.70:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:05:45:00 WinXP 70.128.20.170 (PARAGOULD.NET):
PARAGOULD CITY LIGHT & WATER,
PARAGOULD, ARKANSAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 42
41 of 42 4d91db06f4
NEW
80ad2a0006
NEW 67419c8838 [0]
06729732e0[0] none:none
none:none
Armadillo|
tElock| none
none trace
trace

T:05:53:00 Win2K-f 186.19.56.71 (-):
. n/a US:www.maxmind.com
:getmyip.co.uk
:checkip.dyndns.org
DE:131.220.6.26:80 445 pcap raw alerts
ruleset http
5 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:06:51:00 WinXP 117.99.8.21 (-):
GPRS-SUBSCRIBERS-IN-EAST,
NEW DELHI, DELHI, IN. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:06:57:00 WinXP 220.216.63.78 (THN.NE.JP):
TOKAI CORPORATION,
SHIZUOKA, SHIZUOKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 6b315f5dbc
NEW
7938865f8c
NEW 7604b94520 [0]
a9b9e4904b[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:07:24:00 WinXP 117.20.170.221 (-):
STARHUB HSPA,
SINGAPORE, SINGAPORE, SG. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:07:56:00 Win2K-f 180.188.217.151 (-):
. 62.193.249.122:3305 JP:cx10man.weedns.com 135 pcap raw alerts
ruleset irc
698 lines Yeah : 1.8
profile none summary
tarball 38 of 41 ecfbf321d3
NEW none[none] none:none
none|none none none

T:07:59:00 WinXP 75.36.134.233 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
HAYWARD, CALIFORNIA, US. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 1.3
profile none summary
tarball 29 of 29 1a2c0e6130
NEW none[0] none:none
none|none lines=60 trace

08:11:00 WinXP 151.82.140.146 (51-151.NET24.IT):
IUNET-BNET,
ROME, LAZIO, IT. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 8d649f854f
NEW none[none] none:none
none|none none none

T:08:27:00 WinXP 84.3.104.119 (T-ONLINE.HU):
HUNGARIAN TELECOM,
BUDAPEST, BUDAPEST, HU. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 0.8
profile none summary
tarball 42 of 43 49c5a946bf
NEW none[none] none:none
none|none none none

T:08:27:00 Win2K-f 112.200.103.57 (PLDT.NET):
IPG,
LAS PINAS CITY, MANILA, PH. (DSL) n/a PR:m.drd3h.com 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 39 of 41 450ad1b683
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:08:31:00 WinXP 77.255.60.180 (COM.PL):
NETIA,
PL. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 0.8
profile none summary
tarball 41 of 41 c03793a035
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:08:31:00 Win2K-f 186.22.30.22 (-):
. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 34 of 40 0448650359
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:08:33:00 WinXP 88.31.234.72 (RIMA-TDE.NET):
TELEFONICA MOVILES ESPANA (NCC#2007041930),
PUERTO DE LA CRUZ, CANARIAS, ES. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
13 lines Yeah : 0.8
profile none summary
tarball 39 of 40 b91423b944
NEW none[none] none:none
none|none none none

T:08:33:00 Win2K-f 85.255.174.217 (-):
SATNET-NETWORK,
SOFIA, GRAD SOFIYA, BG. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 38 of 40 3490e2ea15
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:08:34:00 WinXP 24.32.85.236 (CEBRIDGE.NET):
CEBRIDGE CONNECTIONS,
BURKBURNETT, TEXAS, US. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 42 of 43 eb496da7e1
NEW none[none] none:none
none|none none none

T:08:37:00 Win2K-f 188.173.227.195 (RIPE.NET):
EUROPEAN REGIONAL REGISTRY,
UK. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 43 531a598a70
NEW none[none] none:none
none|none none none

T:08:58:00 Win2K-f 88.106.228.167 (AS9105.COM):
TISCALI UK LTD,
LONDON, ENGLAND, UK. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 0.8
profile none summary
tarball 41 of 43 87a0bacc47
NEW none[none] none:none
none|none none none

T:09:02:00 WinXP 115.170.210.98 (-):
CHINANET CDMA NETWORK,
BEIJING, BEIJING, CN. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 40 of 43 0e186d31c8
NEW none[none] none:none
none|none none none

T:09:03:00 Win2K-f 87.110.201.154 (-):
NETWORK OF SIA TECHNONET,
RIGA, RIGA, LV. (DSL) n/a 139 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 38 of 39 87851c6c0b
NEW none[none] none:none
none|none none none

T:09:03:00 WinXP 88.215.97.48 (CABLESURF.DE):
FAKS-FFO-DHCP-SPACE,
BERLIN, BERLIN, DE. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 39 of 41 6704922c65
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:09:09:00 Win2K-f 77.254.217.68 (INETIA.PL):
NETIA,
KRAKOW, MALOPOLSKIE, PL. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 39 of 41 6704922c65
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:09:13:00 WinXP 87.205.249.154 (INETIA.PL):
INTERNETIA,
WARSAW, WARSZAWA, PL. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 37 of 40 82e755f5d3
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:09:28:00 Win2K-f 123.193.84.39 (KBRONET.COM.TW):
TUNG HO MULTIMEDIA CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 37 of 39 556f9a4368
NEW none[none] none:none
none|none none none

T:09:31:00 WinXP 180.218.242.23 (-):
. n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:09:32:00 Win2K-f 95.93.110.5 (-):
TVCABO PORTUGAL S.A,
PT. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 37 of 40 50cdd5c6cf
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:09:35:00 Win2K-f 122.124.103.106 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 e0dc02ee4b
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:09:37:00 WinXP 24.76.44.212 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 41 of 43 fa913f2b22
NEW none[none] none:none
none|none none none

T:09:37:00 WinXP 71.42.133.191 (RR.COM):
ROAD RUNNER HOLDCO LLC,
MCALLEN, TEXAS, US. (DSL) n/a PR:m.drd3h.com
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 bedf29b824
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:10:03:00 WinXP 92.82.165.45 (ROMTELECOM.NET):
ROMTELECOM DATA NETWORK,
BUZAU, BUZAU, RO. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
26 lines Yeah : 0.8
profile none summary
tarball 36 of 40 9363d60262
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:06:00 Win2K-f 98.26.243.78 (RR.COM):
ROAD RUNNER HOLDCO LLC,
GREENSBORO, NORTH CAROLINA, US. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 e0dc02ee4b
NEW 1e4ad6cdb1 [0] ASM:Graph
ASPack| lines=3065
embedded dns trace

T:10:17:00 WinXP 77.254.27.218 (INETIA.PL):
INTERNETIA,
WARSAW, WARSZAWA, PL. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 0.8
profile none summary
tarball 36 of 40 9363d60262
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:25:00 Win2K-f 178.36.72.157 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 ffbb6cbe61
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:28:00 Win2K-f 95.154.50.123 (-):
ESS BREDBAAND A/S,
DK. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 40 of 40 0629d7fc42
NEW none[none] none:none
none|none none none

T:10:29:00 WinXP 122.120.131.227 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 40 of 41 8128405d8c
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:30:00 WinXP 123.194.184.26 (KBRONET.COM.TW):
TUNG HO MULTIMEDIA CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 41 of 41 5ed2885224
NEW none[none] none:none
none|none none none

T:10:39:00 Win2K-f 95.76.232.190 (-):
ASTRAL MIGRARE,
BUCHAREST, BUCURESTI, RO. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 39 of 41 46bf358cc3
NEW afaf06d6cd [0] ASM:Graph
pex| lines=42 trace

T:10:40:00 Win2K-f 109.68.130.1 (JWS.COM):
EU-ZZ,
UK. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 41 of 41 c03793a035
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:41:00 WinXP 89.32.216.215 (-):
SC MONDO-BYTE SRL,
IASI, IASI, RO. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
20 lines Yeah : 0.8
profile none summary
tarball 40 of 41 f534041536
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:49:00 WinXP 85.67.157.251 (BACS-NET.HU):
FIBERNET COMMUNICATION CO,
BUDAPEST, BUDAPEST, HU. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
24 lines Yeah : 0.8
profile none summary
tarball 39 of 40 379a6daa0d
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:10:55:00 Win2K-f 91.120.108.114 (DATANET.HU):
ORG_UNIT_EN: GTS-DATANET TELECOMMUNICATION CO. LTD,
BUDAPEST, BUDAPEST, HU. (DSL) n/a 139 pcap raw alerts
ruleset other
0 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:11:00:00 WinXP 92.86.70.247 (TELELINK-RO.COM):
ARTELECOM,
BUCHAREST, BUCURESTI, RO. (DSL) 213.155.0.224:80 DE:citi-bank.ru
:adult-empire.com 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 34 of 36 1595515522
NEW none[none] none:none
none|none none none

T:11:03:00 Win2K-f 178.37.35.17 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 40 of 43 68ad9e2975
NEW none[none] none:none
none|none none none

T:11:06:00 Win2K-f 24.83.101.110 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
RICHMOND, BRITISH COLUMBIA, CA. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 41 of 43 57a0c6b729
NEW none[none] none:none
none|none none none

T:11:15:00 Win2K-f 75.38.87.130 (-):
HAVANA HOUSE,
BAKERSFIELD, CALIFORNIA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:11:23:00 WinXP 61.19.22.227 (-):
PITSANULOK-NET,
BANGKOK, KRUNG THEP, TH. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:11:31:00 WinXP 88.29.117.129 (RIMA-TDE.NET):
TELEFONICA MOVILES ESPANA (NCC#2007041930),
MADRID, MADRID, ES. (DSL) 213.155.0.224:80 DE:citi-bank.ru
:parex-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:11:33:00 Win2K-f 88.156.36.229 (VECTRANET.PL):
VECTRA S.A,
OLSZTYN, WARMINSKO-MAZURSKIE, PL. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
25 lines Yeah : 0.8
profile none summary
tarball 41 of 43 4e88df6f8d
NEW none[none] none:none
none|none none none

T:11:36:00 WinXP 93.86.10.55 (-):
TELEKOM SRBIJA ADSL USERS,
RS. (DSL) 213.155.0.224:80 DE:citi-bank.ru
DE:kidos-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 986b59708d
NEW none[0] none:none
PolyEnE| lines=57 trace

T:11:51:00 Win2K-f 78.84.184.167 (-):
ADDRESS POOL FOR LTC-HOME CUSTOMERS,
RIGA, RIGA, LV. (DSL) n/a PR:m.DRD3H.COM
PR:207.166.122.75:6668 139 pcap raw alerts
ruleset ftp
irc
18 lines Yeah : 0.8
profile none summary
tarball 37 of 40 4dd4197eb4
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:11:52:00 WinXP 151.81.206.250 (51-151.NET24.IT):
IUNET-BNET,
IT. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 1595515522
NEW none[none] none:none
none|none none none

T:12:05:00 Win2K-f 86.52.134.233 (REV.STOFANET.DK):
STOFANET-INET-CIDR,
HELSINGøR, FREDERIKSBORG, DK. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 39 of 40 b91423b944
NEW none[none] none:none
none|none none none

T:12:14:00 WinXP 186.97.162.130 (-):
. 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:12:20:00 WinXP 186.198.208.108 (-):
. 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:12:35:00 WinXP 77.254.175.52 (INETIA.PL):
INTERNETIA,
GDANSK, POMORSKIE, PL. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 0.8
profile none summary
tarball 41 of 41 c03793a035
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:13:16:00 WinXP 174.39.142.150 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - OMAHA,
NORTH PLATTE, NEBRASKA, US. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:13:17:00 Win2K-f 91.82.241.202 (INVITEL.HU):
ADSL POOL,
BUDAPEST, BUDAPEST, HU. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 37 of 40 d8e60db98a
NEW 6991257f56 [0] ASM:Graph
pex| lines=42 trace

T:13:23:00 Win2K-f 180.66.213.43 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 3 of 41
33 of 33 8b41cb7a41
NEW
97fef473b9
NEW ef18d720f3 [0]
ff4e7d6992[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=90
lines=64
embedded dns trace
trace

T:13:25:00 Win2K-f 27.98.34.63 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:13:37:00 WinXP 122.152.82.103 (OCT-NET.NE.JP):
OITA CABLE TELECOM CO. LTD,
OITA, OITA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:14:24:00 WinXP 86.63.140.93 (NET.PL):
PRONET,
LUBLIN, LUBELSKIE, PL. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
26 lines Yeah : 0.8
profile none summary
tarball 40 of 41 e3faefa56a
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:15:20:00 Win2K-f 76.11.215.133 (NEWWAVECOMM.NET):
NEW WAVE COMMUNICATIONS,
DEXTER, MISSOURI, US. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 ae7a5cd8b1
NEW 18ff3687ad [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:15:20:00 Win2K-f 96.55.147.92 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CALGARY, ALBERTA, CA. (DSL) n/a 139 pcap raw alerts
ruleset ftp
12 lines Yeah : 0.8
profile none summary
tarball 40 of 41 b68d420d61
NEW 1d04d6dc84 [0] ASM:Graph
ASPack| lines=3292
embedded dns trace

T:15:38:00 WinXP 119.154.123.7 (PIE.NET.PK):
PAKISTAN TELECOMMUNICATION COMPANY LIMITED,
ISLAMABAD, ISLAMABAD, PK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
NEW none[0] none:none
PolyEnE| lines=57 trace

T:15:49:00 Win2K-f 78.61.72.107 (ZEBRA.LT):
LIETUVOS-TELEKOMAS,
KAUNAS, KAUNO APSKRITIS, LT. (DSL) n/a PR:m.DRD3H.COM 139 pcap raw alerts
ruleset ftp
irc
22 lines Yeah : 0.8
profile none summary
tarball 37 of 39 3ae841bfda
NEW none[none] none:none
none|none none none

T:15:53:00 WinXP 77.54.158.52 (REV.VODAFONE.PT):
VODAFONE PORTUGAL,
PT. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:16:25:00 Win2K-f 24.67.40.171 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
VERNON, BRITISH COLUMBIA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
187 lines Yeah : 1.3
profile none summary
tarball 42 of 43 5c222c3925
NEW none[none] none:none
none|none none none

T:16:34:00 Win2K-f 63.17.219.197 (UU.NET):
UUNET TECHNOLOGIES INC,
CLARKSTON, GEORGIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
2 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:16:43:00 WinXP 96.15.192.129 (-):
ALLTEL SIP CUSTOMERS - LITTLE ROCK,
LITTLE ROCK, ARKANSAS, US. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 42 of 43 d1b3b1de91
NEW none[none] none:none
none|none none none

T:16:52:00 WinXP 173.29.250.187 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
CHANHASSEN, MINNESOTA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 36 of 41
38 of 40 067917e07b
NEW
d764c1dcb2
NEW dae35b319c [0]
3d2bc60c5d[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:17:05:00 Win2K-f 24.234.237.249 (COX.NET):
COX COMMUNICATIONS INC,
LAS VEGAS, NEVADA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:17:11:00 WinXP 189.48.189.81 (VELOXZONE.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
RIO DE JANEIRO, RIO DE JANEIRO, BR. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 eb07c59faa
NEW e7d4027969 [0] ASM:Graph
PolyEnE| lines=93
embedded dns trace

T:17:20:00 WinXP 184.80.69.109 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:17:34:00 Win2K-f 173.28.208.210 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
CHANHASSEN, MINNESOTA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
108 lines Yeah : 1.3
profile none summary
tarball 38 of 41
40 of 43 10759405e0
NEW
ef84336a47
NEW 292d343248 [0]
none [none] ASM:Graph
none:none
Armadillo|
none|none lines=91
none trace
none

T:17:55:00 WinXP 79.42.254.16 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA NET,
IT. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 d8040f84d4
NEW d683995e84 [0] ASM:Graph
PolyEnE| lines=73 trace

T:18:13:00 WinXP 12.73.44.100 (ATT.NET):
AT&T WORLDNET SERVICES,
HOUSTON, TEXAS, US. (DIAL) n/a 445 pcap raw alerts
ruleset ftp
13 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:18:20:00 Win2K-f 173.31.87.182 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
MIDDLETOWN, NEW YORK, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:19:25:00 Win2K-f 125.58.112.37 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, TOKYO, JP. (DSL) 62.193.249.122:3305 KR:cx10man.weedns.com
FR:fx010413.whyI.org
FR:62.193.249.122:3305 135 pcap raw alerts
ruleset irc
573 lines Yeah : 1.8
profile none summary
tarball 39 of 40 70ec5c4b3f
NEW f697adabdd [0] none:none
StarForce| none trace

T:19:41:00 Win2K-f 123.50.228.130 (KCN-TV.NE.JP):
KUMAMOTO CABLE NETWORK CORPORATION,
KUMAMOTO, KUMAMOTO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 41 of 43
41 of 43 d83a495103
NEW
f8ed84f5bc
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

19:53:00 Win2K-f 190.128.47.6 (-):
EMPRESA DE TELECOMUNICACIONES DE PEREIRA S.A. E.S.P,
CO. (DSL) n/a US:www.maxmind.com
:getmyip.co.uk
US:checkip.dyndns.org
:www.getmyip.org
US:67.15.94.80:80
EU:91.198.22.70:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 8 of 37 4f88618d4f
NEW none[3] none:none
UPX| none trace

T:20:01:00 Win2K-f 190.128.47.6 (-):
EMPRESA DE TELECOMUNICACIONES DE PEREIRA S.A. E.S.P,
CO. (DSL) n/a US:www.maxmind.com
:getmyip.co.uk
EU:checkip.dyndns.org
DE:131.220.6.26:80 445 pcap raw alerts
ruleset http
5 lines Yeah : 0.8
profile none summary
tarball 8 of 37 4f88618d4f
NEW none[3] none:none
UPX| none trace

T:20:43:00 Win2K-f 175.124.137.147 (-):
. n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:22:04:00 Win2K-f 98.103.2.96 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) 62.193.249.122:3305 EU:cx10man.weedns.com 135 pcap raw alerts
ruleset irc
607 lines Yeah : 1.8
profile none summary
tarball 40 of 43 435e5e1bba
NEW none[none] none:none
none|none none none

T:22:16:00 WinXP 187.27.17.165 (VELOXZONE.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO GONçALO, RIO DE JANEIRO, BR. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
NEW none[0] none:none
PolyEnE| lines=57 trace

22:17:00 WinXP 174.39.245.253 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - OMAHA,
NORTH PLATTE, NEBRASKA, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:22:39:00 WinXP 121.121.124.160 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:22:50:00 WinXP 121.121.42.110 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace