Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

17 October 2010
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:10:00 WinXP 119.154.120.32 (PIE.NET.PK):
PAKISTAN TELECOMMUNICATION COMPANY LIMITED,
ISLAMABAD, ISLAMABAD, PK. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:00:43:00 WinXP 74.160.161.144 (BELLSOUTH.NET):
BELLSOUTH.NET INC,
LAWRENCEVILLE, GEORGIA, US. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:00:56:00 WinXP 79.163.156.92 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
WROCLAW, DOLNOSLASKIE, PL. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 41 5c6df5141d
NEW none[none] none:none
none|none none none

T:01:17:00 Win2K-f 125.4.2.239 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 71e6f60517
NEW
ab4e3226c4
NEW 1ef1781501 [0]
c2d0313e73[0] ASM:Graph
none:none
Armadillo|
tElock| lines=91
none trace
trace

01:46:00 WinXP 79.162.139.78 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
WARSAW, WARSZAWA, PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:01:52:00 Win2K-f 110.93.110.149 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 5bbb57c115
NEW
75ac189d9e
NEW 03e5cb3c4a [0]
705dbaa801[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:02:20:00 WinXP 121.120.227.171 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:02:20:00 Win2K-f 211.23.226.98 (-):
LIOU-TZUNG-YI-TC,
TAIPEI, T'AI-PEI, TW. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
37 of 40 5d445c59d8
NEW
8a54950abb
NEW 892e12db7b [0]
f6b9e43917[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:02:25:00 WinXP 75.57.51.129 (-):
DENNIS LEGERE DBA,
PLANO, TEXAS, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:02:37:00 WinXP 111.88.48.25 (HOSTS-WORLDCALL.NET.PK):
WORLDCALL TELECOM LTD,
PK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 37 of 41 ca163c3b7b
NEW none[none] none:none
none|none none none

T:02:53:00 WinXP 117.99.183.193 (59.AIRTELBROADBAND.IN):
BHARTI AIRTEL LTD,
NEW DELHI, DELHI, IN. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 aad01847fa
NEW none[none] none:none
none|none none none

T:03:05:00 WinXP 79.16.22.146 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA NET,
VENICE, VENETO, IT. (DSL) n/a RU:siliconfireware.ru
RU:auction.nic.ru
:www.google-analytics.com
RU:domain-parking.ru
RU:www.bbin.ru
RU:www.binbank.ru
:wpad
:www.proxy-socks.net 445 pcap raw alerts
ruleset http
http
http
http
58 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
NEW none[0] none:none
ASPack| lines=281
embedded dns trace

03:15:00 WinXP 93.177.182.162 (CAUCASUS.NET):
CAUCASUS ONLINE BROADBAND NETWORK,
GE. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:03:22:00 WinXP 59.113.166.235 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 29 of 29 986b59708d
NEW none[0] none:none
PolyEnE| lines=57 trace

T:03:30:00 WinXP 212.5.13.117 (-):
HOTZONE-BERLIN-NET,
BERLIN, BERLIN, DE. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:03:36:00 WinXP 115.81.181.39 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:04:12:00 WinXP 94.54.49.23 (-):
TURKSAT UYDU-NET INTERNET,
ANKARA, ANKARA, TR. (100Mbps) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 d1b3b1de91
NEW none[none] none:none
none|none none none

T:04:19:00 WinXP 122.196.29.128 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 71e6f60517
NEW
ab4e3226c4
NEW 1ef1781501 [0]
c2d0313e73[0] ASM:Graph
none:none
Armadillo|
tElock| lines=91
none trace
trace

T:04:48:00 WinXP 24.213.224.249 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AMSTERDAM, NOORD-HOLLAND, NL. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:05:02:00 Win2K-f 216.211.244.134 (NORWOODLIGHT.COM):
NORWOOD LIGHT BROADBAND,
NORWOOD, MASSACHUSETTS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 40 of 41
37 of 41 c89b154681
NEW
d2b40c91a1
NEW 58d02dbffa [0]
fbaa414397[0] ASM:Graph
ASM:Graph
StarForce|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:05:14:00 WinXP 112.78.72.146 (-):
VIBO TELECOM INC,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 40 of 41 cf346981b5
NEW 2eb6c94f0a [0] ASM:Graph
PolyEnE| lines=73 trace

T:05:18:00 Win2K-f 76.189.184.16 (RR.COM):
ROAD RUNNER HOLDCO LLC,
CLEVELAND, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:05:29:00 Win2K-f 122.196.27.155 (ZAQ.NE.JP):
J:COM WEST CO. LTD,
OSAKA, OSAKA, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 71e6f60517
NEW
ab4e3226c4
NEW 1ef1781501 [0]
c2d0313e73[0] ASM:Graph
none:none
Armadillo|
tElock| lines=91
none trace
trace

T:05:35:00 WinXP 112.78.83.151 (-):
VIBO TELECOM INC,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:05:42:00 WinXP 188.28.167.230 (THREE.CO.UK):
HUTCHISON 3G UK LIMITED,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 d8040f84d4
NEW d683995e84 [0] ASM:Graph
PolyEnE| lines=73 trace

T:05:52:00 WinXP 118.7.6.235 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. (DSL) n/a 445 pcap raw alerts
ruleset ftp
15 lines Yeah : 0.8
profile none summary
tarball 41 of 42 b3f4c6eb3f
NEW none[none] none:none
none|none none none

05:54:00 WinXP 188.28.167.230 (THREE.CO.UK):
HUTCHISON 3G UK LIMITED,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 d8040f84d4
NEW d683995e84 [0] ASM:Graph
PolyEnE| lines=73 trace

T:05:55:00 Win2K-f 180.230.149.127 (-):
. 83.133.119.206:65520 CN:proxim.ircgalaxy.pl
US:microsoft.com
:bb.iwillhavebigdick.com
LV:nemerk.com
173.192.153.178:80
DE:83.133.119.206:65520 135 pcap raw alerts
ruleset irc
http
170 lines Yeah : 1.8
profile none summary
tarball 30 of 33
35 of 43
31 of 33 87bd0a062f
NEW
c29e9cd87a
NEW
c7d6018f97
NEW dc70d9623a [0]
none [none]
5c1d8bbd5b[0] ASM:Graph
none:none
ASM:Graph
Armadillo|
none|none
tElock| lines=91
none
lines=125
embedded dns trace
none
trace

T:06:28:00 Win2K-f 76.177.149.174 (RR.COM):
ROAD RUNNER HOLDCO LLC,
LONDON, KENTUCKY, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:06:28:00 WinXP 92.227.29.222 (ALICEDSL.DE):
HANSENET-ADSL,
BERLIN, BERLIN, DE. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:06:33:00 Win2K-f 173.29.138.95 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
CHANHASSEN, MINNESOTA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:07:01:00 Win2K-f 67.206.208.216 (CENTENNIALPR.NET):
CENTENNIAL DE PUERTO RICO,
SAN JUAN, PUERTO RICO, PR. (DSL) n/a 135 pcap raw alerts
ruleset other
301 lines Yeah : 1.3
profile none summary
tarball 41 of 43 216c61ac3d
NEW none[none] none:none
none|none none none

T:07:10:00 WinXP 71.21.78.197 (CLEARWIRE-DNS.NET):
CLEARWIRE US LLC,
KIRKLAND, WASHINGTON, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:07:18:00 WinXP 121.120.109.156 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:07:34:00 Win2K-f 61.215.146.218 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 10c560fc02
NEW
1b8d146832
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:07:37:00 WinXP 178.167.170.12 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a 445 pcap raw alerts
ruleset ftp
14 lines Yeah : 0.8
profile none summary
tarball 39 of 43 a47c6c159a
NEW none[none] none:none
none|none none none

T:07:38:00 WinXP 115.82.75.71 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 fb486908b0
NEW none[none] none:none
none|none none none

T:07:50:00 WinXP 84.40.86.42 (NACKSYSTEM.NET):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:23:00 WinXP 121.123.45.91 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:08:34:00 WinXP 208.88.70.103 (-):
BBW 4 ACES TOWER CUSTOMER SUBNET,
SHREVEPORT, LOUISIANA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:08:48:00 WinXP 188.176.71.20 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:09:04:00 WinXP 46.109.42.64 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 42 9b285231fe
NEW a9a8f0a26f [0] none:none
PolyEnE| none trace

T:09:06:00 WinXP 189.117.139.169 (TIMBRASIL.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
NEW none[0] none:none
PolyEnE| lines=57 trace

T:09:11:00 Win2K-f 66.90.217.228 (GRANDENETWORKS.NET):
GRANDE COMMUNICATIONS AUSTIN HUB,
AUSTIN, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 d031b42d3f
NEW
fa14802705
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:09:12:00 Win2K-f 67.125.140.230 (PACBELL.NET):
AT&T INTERNET SERVICES,
FRESNO, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:09:28:00 Win2K-f 203.114.106.149 (-):
BAMNETNARONGWITAYAKOMSCHOOL,
BANGKOK, KRUNG THEP, TH. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:09:43:00 WinXP 92.41.131.143 (THREE.CO.UK):
MOBILE BROADBAND SERVICE,
UK. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 42 of 43 cb7a1c872d
NEW none[none] none:none
none|none none none

T:10:48:00 WinXP 111.88.42.246 (HOSTS-WORLDCALL.NET.PK):
WORLDCALL TELECOM LTD,
PK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 42 8081b6b58c
NEW none[none] none:none
none|none none none

T:10:49:00 Win2K-f 203.95.48.106 (THN.NE.JP):
TOKAI CORPORATION,
FUJI, SHIZUOKA, JP. (DSL) 62.193.249.122:3305 KR:cx10man.weedns.com 135 pcap raw alerts
ruleset irc
605 lines Yeah : 1.8
profile none summary
tarball 42 of 42 2b040dd00c
NEW none[none] none:none
none|none none none

T:11:11:00 WinXP 98.134.36.72 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - ATLANTA,
LAKE CITY, FLORIDA, US. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:11:23:00 Win2K-f 64.175.160.91 (PACBELL.NET):
AT&T INTERNET SERVICES,
CARLSBAD, CALIFORNIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:11:33:00 WinXP 79.163.248.57 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
KATOWICE, SLASKIE, PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 42 997e774fb3
NEW none[none] none:none
none|none none none

T:11:40:00 WinXP 174.44.32.24 (BRESNAN.NET):
BRESNAN COMMUNICATIONS LLC,
PURCHASE, NEW YORK, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 53aa804019
NEW
95ddd4a823
NEW 29c6cdbf45 [0]
9e78315a6d[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:12:03:00 WinXP 98.124.111.224 (HOMESC.COM):
HOME TELEPHONE COMPANY INC,
MONCKS CORNER, SOUTH CAROLINA, US. (100Mbps) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:12:09:00 WinXP 79.162.150.110 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
WARSAW, WARSZAWA, PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:12:12:00 Win2K-f 66.19.14.113 (MCLEODUSA.NET):
PAETEC COMMUNICATIONS INC,
ATLANTA, GEORGIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
129 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:12:30:00 WinXP 172.130.229.8 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
96 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:12:51:00 WinXP 4.253.61.189 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
GONZALES, TEXAS, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
79 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:13:01:00 WinXP 119.154.57.5 (PIE.NET.PK):
PAKISTAN TELECOMMUNICATION COMPANY LIMITED,
LAHORE, PUNJAB, PK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 39 of 43 a4eb4cac6b
NEW none[none] none:none
none|none none none

T:13:07:00 WinXP 211.179.63.177, 173.192.153.178 (INVALID IPV4 ADDRESS):
INVALID IPV4 ADDRESS,
INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS. (INVALID IPV4 ADDRESS) 83.133.119.206:65520 DE:proxima.ircgalaxy.pl
US:microsoft.com
LV:ad.ghura.pl
:bb.iwillhavebigdick.com
LV:nemerk.com
CN:exe.perfectexe.com
:sb.perfectexe.com
:streq.cn
CN:sy2.perfectexe.com
173.192.153.178:80
CN:60.190.222.139:65520
US:66.240.171.29:443
LV:91.188.59.199:80 135 pcap raw alerts
ruleset irc
http
150 lines Yeah : 1.8
profile none summary
tarball 24 of 43
26 of 43
39 of 41
10 of 43
41 of 43
35 of 43
31 of 33 4b399e5e4e
NEW
4e924eaa55
NEW
ab9c4b5f21
NEW
b2b8faa685
NEW
b4afa1df1d
NEW
c29e9cd87a
NEW
d789c8d157
NEW none[none]
none [none]
5fe48b2dcc[0]
none [none]
none [none]
none [none]
5f6572479f[0] none:none
none:none
ASM:Graph
none:none
none:none
none:none
ASM:Graph
none|none
none|none
Armadillo|
none|none
none|none
none|none
PolyEnE| none
none
lines=42
none
none
none
lines=113
embedded dns none
none
trace
none
none
none
trace

T:13:18:00 WinXP 24.76.4.241 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SELKIRK, MANITOBA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
1008 lines Yeah : 1.3
profile none summary
tarball 15 of 41 770a04a72c
NEW none[3] none:none
none|none none trace

T:13:23:00 WinXP 93.86.11.214 (-):
TELEKOM SRBIJA ADSL USERS,
RS. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 986b59708d
NEW none[0] none:none
PolyEnE| lines=57 trace

T:13:29:00 WinXP 75.18.154.82 (SBCGLOBAL.NET):
KS CHANDI & SONS INC,
PLANO, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
40 of 41 1e12f5145a
NEW
f208493e65
NEW 617af909de [0]
5100adb4f9[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:13:46:00 WinXP 203.114.106.150 (-):
BAMNETNARONGWITAYAKOMSCHOOL,
BANGKOK, KRUNG THEP, TH. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:13:49:00 WinXP 98.134.36.72 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - ATLANTA,
LAKE CITY, FLORIDA, US. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:14:23:00 Win2K-f 70.63.94.161 (RR.COM):
ROAD RUNNER HOLDCO LLC,
JACKSONVILLE, NORTH CAROLINA, US. (DSL) 62.193.249.122:3305 IT:cx10man.weedns.com 135 pcap raw alerts
ruleset irc
603 lines Yeah : 1.8
profile none summary
tarball 39 of 42 0283c4b569
NEW none[none] none:none
none|none none none

T:14:30:00 Win2K-f 113.254.168.121 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HONG KONG, HONG KONG (SAR), HK. (DSL) 62.193.249.122:3305 EU:cx10man.weedns.com 135 pcap raw alerts
ruleset irc
696 lines Yeah : 1.8
profile none summary
tarball 38 of 41 ecfbf321d3
NEW none[none] none:none
none|none none none

T:14:46:00 WinXP 95.93.245.29 (-):
TVCABO PORTUGAL S.A,
LISBON, LISBOA, PT. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 a3c82ff952
NEW none[none] none:none
none|none none none

15:27:00 WinXP 119.154.57.5 (PIE.NET.PK):
PAKISTAN TELECOMMUNICATION COMPANY LIMITED,
LAHORE, PUNJAB, PK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 43 a4eb4cac6b
NEW none[none] none:none
none|none none none

T:15:57:00 Win2K-f 174.5.73.4 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CA. (DSL) 210.127.253.90:3305 FR:cx10man.weedns.com
EU:fx010413.whyI.org
JP:gynoman.weedns.com
KR:g.0x20.biz
:c010x1.co.cc
:commgr.co.cc
KR:telephone.dd.blueline.be
114.207.244.143:3305
FR:62.193.249.122:3305 135 pcap raw alerts
ruleset irc
696 lines Yeah : 1.8
profile none summary
tarball 38 of 41 ecfbf321d3
NEW none[none] none:none
none|none none none

T:16:07:00 Win2K-f 184.76.252.164 (-):
. n/a JP:cx10man.weedns.com
FR:fx010413.whyI.org
KR:gynoman.weedns.com
:c010x1.co.cc
:commgr.co.cc
FR:g.0x20.biz
KR:telephone.dd.blueline.be
114.207.244.146:3305
FR:62.193.249.122:3305 135 pcap raw alerts
ruleset irc
606 lines Yeah : 1.3
profile none summary
tarball 39 of 41 e6c5ed5f5b
NEW none[none] none:none
none|none none none

T:16:43:00 Win2K-f 184.80.69.109 (-):
. n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:17:54:00 WinXP 174.39.242.109 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - OMAHA,
YORK, NEBRASKA, US. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:17:58:00 Win2K-f 66.216.206.53 (NEWNANUTILITIES.ORG):
NEWNAN UTILITIES,
NEWNAN, GEORGIA, US. (DSL) 210.127.253.90:3305 KR:cx10man.weedns.com
JP:fx010413.whyI.org
IT:gynoman.weedns.com
JP:g.0x20.biz
KR:telephone.dd.blueline.be
FR:62.193.249.122:3305 135 pcap raw alerts
ruleset irc
607 lines Yeah : 1.8
profile none summary
tarball 40 of 42 e30eff4db6
NEW none[none] none:none
none|none none none

T:18:01:00 Win2K-f 173.211.170.85 (-):
. n/a 135 pcap raw alerts
ruleset other
574 lines Yeah : 1.3
profile none summary
tarball 41 of 43 216c61ac3d
NEW none[none] none:none
none|none none none

T:18:02:00 WinXP 50.15.6.194 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 35 9716d7995a
NEW c3a5354b6f [0] ASM:Graph
PolyEnE| lines=68 trace

T:18:22:00 WinXP 69.193.78.147 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:18:32:00 WinXP 187.60.101.253 (VELOXZONE.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 acdb1903eb
NEW none[none] none:none
none|none none none

T:19:23:00 WinXP 175.112.216.44 (-):
. n/a DE:irc.zief.pl
US:microsoft.com
LV:ad.ghura.pl
:bb.iwillhavebigdick.com
LV:nemerk.com
:streq.cn
173.192.153.178:80
CN:60.190.222.139:80
LV:91.188.59.199:80 135 pcap raw alerts
ruleset irc
http
464 lines Yeah : 1.3
profile none summary
tarball 37 of 41
40 of 41
24 of 43
10 of 43
35 of 43 34cd9e2f76
NEW
376a6b6ecd
NEW
4b399e5e4e
NEW
b2b8faa685
NEW
c29e9cd87a
NEW none[none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none none
none
none
none
none

T:19:47:00 Win2K-f 24.88.67.217 (RR.COM):
ROAD RUNNER HOLDCO LLC,
COLUMBIA, SOUTH CAROLINA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 38 of 41
37 of 41 5c39773b13
NEW
a1acc403a2
NEW c64405f2e9 [0]
54ef26c2f9[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:19:49:00 Win2K-f 72.184.203.91 (RR.COM):
ROAD RUNNER HOLDCO LLC,
BRANDON, FLORIDA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 40
37 of 39 1da4193446
NEW
6278c9374a
NEW 8a97c8536a [none]
cc7aaf6ea9[none] none:none
none:none
none|none
none|none none
none none
none

T:20:03:00 WinXP 119.26.171.6 (ZAQ.NE.JP):
KANSAI MULTIMEDIA SERVICE COMPANY,
JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32
33 of 33 07fabc79ef
NEW
53bfe15e91
NEW none[0]
1473091351[0] none:none
ASM:Graph
Armadillo|
tElock| lines=90
lines=75
embedded dns trace
trace

T:20:13:00 Win2K-f 65.31.126.51 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HARTLAND, WISCONSIN, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 5af05bec2e
NEW
ff34a1caa4
NEW ec2138d5b2 [0]
979a6569d4[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:20:22:00 WinXP 121.120.34.232 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 42 of 43 84821fbed6
NEW none[none] none:none
none|none none none

T:20:35:00 Win2K-f 110.93.110.149 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 5bbb57c115
NEW
75ac189d9e
NEW 03e5cb3c4a [0]
705dbaa801[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:21:14:00 WinXP 175.112.214.19 (-):
. 83.133.119.206:65520 CN:proxim.ircgalaxy.pl
US:microsoft.com
LV:ad.ghura.pl
:bb.iwillhavebigdick.com
LV:nemerk.com
:streq.cn
173.192.153.178:80
173.224.212.93:443
184.82.18.196:443
US:63.223.117.12:443
CA:74.117.63.232:443
LV:91.188.59.199:80 135 pcap raw alerts
ruleset irc
http
147 lines Yeah : 1.8
profile none summary
tarball 24 of 43
30 of 33
28 of 33
10 of 43
35 of 43 4b399e5e4e
NEW
533d15b5ce
NEW
58c343a8d8
NEW
b2b8faa685
NEW
c29e9cd87a
NEW none[none]
c67adf46e2[0]
none [0]
none [none]
none [none] none:none
ASM:Graph
none:none
none:none
none:none
none|none
tElock|
Armadillo|
none|none
none|none none
lines=126
embedded dns
lines=91
none
none none
trace
trace
none
none

T:21:44:00 WinXP 174.39.141.15 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - OMAHA,
NORTH PLATTE, NEBRASKA, US. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:22:25:00 WinXP 210.4.119.40 (CCTLL.COM):
COMCLARK-BROADBAND-NETWORK,
MANILA, MANILA, PH. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 aad01847fa
NEW none[none] none:none
none|none none none

T:22:35:00 Win2K-f 173.31.87.182 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
MIDDLETOWN, NEW YORK, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
78 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:22:41:00 WinXP 69.193.68.239 (RR.COM):
ROAD RUNNER HOLDCO LLC,
HERNDON, VIRGINIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:23:37:00 Win2K-f 110.93.110.140 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 5bbb57c115
NEW
75ac189d9e
NEW 03e5cb3c4a [0]
705dbaa801[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:23:40:00 WinXP 121.121.149.129 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 0.8
profile none summary
tarball 40 of 42 d74b8d6c6b
NEW none[none] none:none
none|none none none