Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

07 January 2011
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:09:00 Win2K-f 112.205.115.43 (PLDT.NET):
IPG,
PH. (DSL) 70.107.249.167:7000 US:dns.aswend.com 135 pcap raw alerts
ruleset irc
437 lines Yeah : 1.8
profile none summary
tarball 40 of 43 b55df243e2
NEW none[none] none:none
none|none none none

T:00:24:00 WinXP 87.49.245.187 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
COPENHAGEN, KOBENHAVN, DK. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
13 lines Yeah : 0.8
profile none summary
tarball 31 of 32 741e3b03b3
NEW none[0] none:none
none|none lines=61 trace

00:35:00 WinXP 94.51.254.100 (PERMONLINE.RU):
DYNAMIC DISTRIBUTION IP'S FOR BROADBAND SERVICES,
MOSCOW, MOSCOW CITY, RU. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

01:26:00 WinXP 210.209.141.72 (TCOL.COM.TW):
MONAD DIGITNAMIC CORP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 41 866ac9b262
NEW none[none] none:none
none|none none none

T:01:41:00 WinXP 87.57.17.255 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
AALBORG, NORDJYLLAND, DK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:02:31:00 WinXP 178.88.46.230 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:02:51:00 WinXP 61.218.205.52 (HINET.NET):
TAIWAN PROVINCE TAP-WATER CO. LTD,
KAOHSIUNG, T'AI-WAN, TW. (100Mbps) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:02:57:00 Win2K-f 46.162.237.167 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
142 lines Yeah : 1.3
profile none summary
tarball 40 of 43
41 of 42 41c4e767de
NEW
e46acdf784
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:03:07:00 Win2K-f 114.26.30.124 (HINET.NET):
CHTD CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 40 of 41
41 of 43 2bc8f15054
NEW
9956124c58
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

03:24:00 WinXP 95.58.99.146 (METRO.ONLINE.KZ):
JSC KAZAKHTELECOM ATYRAU AFFILIATE,
ALMATY, ALMATY CITY, KZ. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:03:27:00 Win2K-f 24.156.111.123 (NPGCO.COM):
CABLEVISION OF KINGMAN,
TORONTO, ONTARIO, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
1009 lines Yeah : 1.3
profile none summary
tarball 31 of 41 682a384fe9
NEW none[3] none:none
none|none none trace

T:03:30:00 WinXP 87.8.174.205 (RETAIL.TELECOMITALIA.IT):
TELECOM ITALIA S.P.A. TIN EASY LITE,
PADOVA, VENETO, IT. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 bcf30127be
NEW none[none] none:none
none|none none none

T:03:58:00 WinXP 117.254.4.21 (STERLINGSTUDENTS.NET):
NIB (NATIONAL INTERNET BACKBONE),
NEW DELHI, DELHI, IN. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:04:45:00 Win2K-f 203.180.24.181 (HI-HO.NE.JP):
HI-HO INC,
JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 41 of 42
40 of 43 c49ada611f
NEW
e9a389fd5b
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:04:52:00 WinXP 78.55.209.28 (ALICEDSL.DE):
HANSENET-ADSL,
BERLIN, BERLIN, DE. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 500518ab72
NEW none[none] none:none
none|none none none

T:05:34:00 Win2K-f 118.219.28.206 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 60.190.222.139:65520 CN:proxima.ircgalaxy.pl
US:microsoft.com
EU:ii.derquda.com
CN:60.190.222.139:65520 135 pcap raw alerts
ruleset irc
http
120 lines Yeah : 1.8
profile none summary
tarball 34 of 36
29 of 32
13 of 43 99b248336f
NEW
9d677c3f70
NEW
9f59b22e8a
NEW c64bd1a776 [0]
77e75ff10f[0]
none [none] ASM:Graph
ASM:Graph
none:none
Armadillo|
tElock|
none|none lines=91
lines=120
embedded dns
none trace
trace
none

T:05:36:00 WinXP 110.227.183.183 (59.AIRTELBROADBAND.IN):
BHARTI AIRTEL LTD,
GURGAON, HARYANA, IN. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 38 of 42 8a2553433c
NEW none[none] none:none
none|none none none

05:56:00 WinXP 117.20.154.103 (-):
STARHUB HSPA,
SINGAPORE, SINGAPORE, SG. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:06:03:00 Win2K-f 70.184.154.87 (COX.NET):
COX COMMUNICATIONS,
YUKON, OKLAHOMA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
89 lines Yeah : 1.3
profile none summary
tarball 33 of 33
38 of 41 53bfe15e91
NEW
97437a0627
NEW 1473091351 [0]
none [none] ASM:Graph
none:none
tElock|
none|none lines=75
embedded dns
none trace
none

T:06:10:00 WinXP 203.91.174.188 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:06:21:00 Win2K-f 70.66.83.174 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
NANAIMO, BRITISH COLUMBIA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 34 of 39 ce28648035
NEW 126d2f4655 [0] ASM:Graph
none|none lines=546 trace

T:06:30:00 WinXP 87.116.197.64 (TNP.PL):
NETWORK OF INTERNET SERVICE PROVIDER,
WARSAW, WARSZAWA, PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 32 of 32 5818023061
NEW none[0] none:none
PolyEnE| lines=68 trace

06:36:00 WinXP 87.116.197.64 (TNP.PL):
NETWORK OF INTERNET SERVICE PROVIDER,
WARSAW, WARSZAWA, PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 32 5818023061
NEW none[0] none:none
PolyEnE| lines=68 trace

T:06:43:00 WinXP 46.134.228.233 (-):
. 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 42 of 43 c19c8a2776
NEW none[none] none:none
none|none none none

T:08:11:00 Win2K-f 120.138.177.85 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 40
39 of 39 b8e6f4caf7
NEW
fb92b91fe7
NEW f81eac6379 [0]
fe88ab8768[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

T:08:26:00 WinXP 178.88.63.82 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 33 of 35 e9fcd6f257
NEW 2e05bc2272 [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:33:00 WinXP 180.70.143.194 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 91.193.194.67:65520 CN:proxima.ircgalaxy.pl
US:microsoft.com
EU:ii.derquda.com
DE:83.133.119.197:65520 135 pcap raw alerts
ruleset irc
http
164 lines Yeah : 1.8
profile none summary
tarball 13 of 43
39 of 41
31 of 33 9f59b22e8a
NEW
ab9c4b5f21
NEW
d789c8d157
NEW none[none]
5fe48b2dcc[0]
5f6572479f[0] none:none
ASM:Graph
ASM:Graph
none|none
Armadillo|
PolyEnE| none
lines=42
lines=113
embedded dns none
trace
trace

T:09:07:00 WinXP 189.127.99.1 (UNOTEL.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 42 of 42 4aa9b2104a
NEW none[none] none:none
none|none none none

09:39:00 WinXP 189.117.158.202 (TIMBRASIL.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:09:43:00 Win2K-f 75.16.120.218 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
CORPUS CHRISTI, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:09:58:00 Win2K-f 202.162.219.218 (ICONPLN.NET.ID):
PT INDONESIA COMNETS PLUS,
SEMARANG, JAWA TENGAH, ID. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:10:31:00 Win2K-f 70.62.5.169 (RR.COM):
ROAD RUNNER HOLDCO LLC,
GAHANNA, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 41
39 of 41 0563ea7af7
NEW
7e1532574f
NEW bc2e11a802 [0]
e6930769d0[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=65
embedded dns
lines=91 trace
trace

T:10:36:00 WinXP 62.11.43.249 (CUST-ADSL.TISCALI.IT):
TISCALI ITALIA SPA,
TRIESTE, FRIULI-VENEZIA GIULIA, IT. (DSL) n/a RU:siliconfireware.ru
RU:auction.nic.ru
:www.google-analytics.com
RU:domain-parking.ru
:wpad 445 pcap raw alerts
ruleset http
http
http
38 lines Yeah : 0.8
profile none summary
tarball 29 of 29 df17a625ee
NEW none[0] none:none
ASPack| lines=298
embedded dns trace

T:11:45:00 Win2K-f 1.227.98.78 (-):
. n/a US:microsoft.com
DE:irc.zief.pl
EU:ii.derquda.com 135 pcap raw alerts
ruleset irc
http
319 lines Yeah : 1.3
profile none summary
tarball 37 of 41
40 of 41
13 of 43 34cd9e2f76
NEW
376a6b6ecd
NEW
9f59b22e8a
NEW none[none]
none [none]
none [none] none:none
none:none
none:none
none|none
none|none
none|none none
none
none none
none
none

T:12:00:00 WinXP 81.81.141.73 (WWW.E-COW.IT):
WIND TELECOMUNICAZIONI S.P.A,
ROME, LAZIO, IT. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 40 of 41 d11b1f56f9
NEW none[none] none:none
none|none none none

T:12:10:00 Win2K-f 178.126.129.214 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a DE:irc.zief.pl
US:microsoft.com 445 pcap raw alerts
ruleset irc
14 lines Argh : 0.3
profile none summary
tarball none none none none none none none

T:12:14:00 WinXP 89.232.195.83 (ISURGUT.RU):
OPEN JOINT-STOCK COMPANY URALSVIAZINFORM BRANCH OF THE KHANTYMANSIYSK REGION,
RU. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:12:28:00 Win2K-f 173.169.151.13 (RR.COM):
ROAD RUNNER HOLDCO LLC,
TAMPA, FLORIDA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
1002 lines Yeah : 1.3
profile none summary
tarball 32 of 41 43b8f21924
NEW none[3] none:none
none|none none trace

T:13:02:00 Win2K-f 59.161.2.9 (VSNL.NET.IN):
INTERNET SERVICE PROVIDER,
LUCKNOW, UTTAR PRADESH, IN. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:13:24:00 Win2K-f 211.124.230.118 (ZAQ.NE.JP):
K CABLE TELEVISION CORPORATION INC,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 32
33 of 33 07fabc79ef
NEW
53bfe15e91
NEW none[0]
1473091351[0] none:none
ASM:Graph
Armadillo|
tElock| lines=90
lines=75
embedded dns trace
trace

T:13:43:00 Win2K-f 114.73.124.109 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
WINDSOR, NEW SOUTH WALES, AU. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
99 lines Yeah : 1.3
profile none summary
tarball 39 of 40
41 of 43 20b49c1408
NEW
d486fafc6f
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:14:38:00 WinXP 187.80.145.233 (CAMPUSEAI.ORG):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball none 7b57508def
NEW none[none] none:none
none|none none none

T:15:03:00 WinXP 211.23.226.98 (-):
LIOU-TZUNG-YI-TC,
TAIPEI, T'AI-PEI, TW. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
112 lines Yeah : 1.3
profile none summary
tarball 39 of 41
37 of 40 5d445c59d8
NEW
8a54950abb
NEW 892e12db7b [0]
f6b9e43917[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:15:32:00 Win2K-f 24.246.154.147 (-):
MORRIS BROADBAND LLC,
CAMERON, MISSOURI, US. (DSL) n/a 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 41 of 43 0afff56a4c
NEW none[none] none:none
none|none none none

T:15:41:00 Win2K-f 72.45.58.202 (ATLANTICBB.NET):
ATLANTIC BROADBAND,
MIDDLETOWN, DELAWARE, US. (DSL) n/a 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 40 of 41 0b095f0cef
NEW none[none] none:none
none|none none none

T:15:56:00 Win2K-f 65.36.21.193 (GRANDENETWORKS.NET):
GRANDE COMMUNICATIONS ODESSA HUB,
SAN MARCOS, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:16:13:00 Win2K-f 173.211.172.38 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
125 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 68b5e580f0
NEW
b475ce7c0b
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:17:07:00 Win2K-f 60.250.246.160 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 34 of 38
35 of 38 38ed850a0e
NEW
b9297745a1
NEW 46990f37cd [0]
4294884d84[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:17:42:00 WinXP 151.82.46.42 (51-151.NET24.IT):
IUNET-BNET,
MILANO, LOMBARDIA, IT. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 8530ce5693
NEW none[none] none:none
none|none none none

T:18:48:00 Win2K-f 61.215.147.97 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 10c560fc02
NEW
1b8d146832
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:18:52:00 Win2K-f 211.133.222.84 (THN.NE.JP):
TOKAI CORPORATION,
JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 41 71e6f60517
NEW
ab4e3226c4
NEW 1ef1781501 [0]
c2d0313e73[0] ASM:Graph
none:none
Armadillo|
tElock| lines=91
none trace
trace

T:18:55:00 WinXP 216.209.183.140 (BELL.CA):
SYMPATICO (BELL NEXXIA),
CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
81 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:19:08:00 WinXP 189.65.11.182 (TIMBRASIL.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

19:08:00 WinXP 189.65.11.182 (TIMBRASIL.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

19:41:00 Win2K-f 199.15.197.107 (-):
. n/a US:www.maxmind.com
US:checkip.dyndns.org
EU:getmyip.co.uk
:www.getmyip.org
DE:131.220.6.26:80
EU:78.40.35.134:80
EU:91.198.22.70:80 445 pcap raw alerts
ruleset http
4 lines Yeah : 0.8
profile none summary
tarball 2 of 37 216ec67841
NEW none[3] none:none
StarForce| none trace

T:20:03:00 WinXP 178.167.205.117 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:20:03:00 WinXP 112.210.248.66 (PLDT.NET):
IPG,
PH. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
14 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
NEW none[0] none:none
none|none lines=60 trace

T:20:15:00 Win2K-f 203.91.161.39 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:22:08:00 WinXP 178.179.174.64 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a RU:moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 43 4410d5ed68
NEW none[none] none:none
none|none none none

T:22:23:00 WinXP 119.152.246.76 (PIE.NET.PK):
PAKISTAN TELECOMMUNICATION COMPANY LIMITED,
PESHAWAR, NORTH-WEST FRONTIER, PK. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:22:25:00 Win2K-f 66.60.106.38 (FIRSTDIGITAL.COM):
FIRSTDIGITAL COMMUNICATIONS LLC,
ROSEVILLE, CALIFORNIA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 40 of 41
39 of 40 d08635ca20
NEW
e2479cbb98
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:22:27:00 WinXP 115.80.189.143 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
NEW none[0] none:none
none|none lines=60 trace

T:22:59:00 Win2K-f 96.8.244.76 (GVTC.COM):
GUADALUPE VALLEY TELEPHONE COOPERATIVE INC,
NEW BRAUNFELS, TEXAS, US. (DSL) n/a 135 pcap raw alerts
ruleset other
29 lines Yeah : 1.3
profile none summary
tarball 2 of 43 af98e8e637
NEW none[none] none:none
none|none none none

T:23:52:00 Win2K-f 184.74.84.108 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 18 of 35
0 of 33 218ce30f5c
NEW
a08f3b74a4
NEW none[3]
none [0] none:none
none:none
none|none
Armadillo| none
lines=90 trace
trace