Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

11 January 2011
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

T:00:07:00 Win2K-f 71.98.196.212 (VERIZON.NET):
VERIZON INTERNET SERVICES INC,
CLEARWATER, FLORIDA, US. (DSL) n/a US:gg.arrancar.org
US:69.43.160.145:555 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 40 of 41 459d2bddeb
NEW 10fac04dd2 [0] ASM:Graph
none|none lines=546 trace

T:01:06:00 WinXP 211.40.96.220 (BORA.NET):
BORANET-NET,
SUWON, KYONGGI-DO, KR. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 0 of 33
33 of 33 4c3df24b32
NEW
53bfe15e91
NEW none[0]
1473091351[0] none:none
ASM:Graph
Armadillo|
tElock| lines=90
lines=75
embedded dns trace
trace

01:19:00 Win2K-f 121.120.201.240 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a US:www.maxmind.com
:checkip.dyndns.org
:www.getmyip.org
EU:getmyip.co.uk
US:www.vouchercodes.net
US:208.43.124.51:80
EU:91.198.22.70:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 0.8
profile none summary
tarball 0 of 41
3 of 37 8ffc473a14
NEW
d9cb288f31
NEW none[none]
45603a001c[0] none:none
ASM:Graph
none|none
UPX| none
lines=174
embedded dns none
trace

T:01:35:00 WinXP 109.52.186.191 (JWS.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 95d1a78f0d
NEW none[none] none:none
none|none none none

T:01:39:00 WinXP 24.79.204.255 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 41 of 43
38 of 43 965cac2fb0
NEW
a26d336ff2
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:02:13:00 WinXP 188.176.71.228 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:02:22:00 WinXP 115.83.7.120 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 40 of 41 1096ba143e
NEW none[none] none:none
none|none none none

T:02:57:00 WinXP 27.54.30.102 (-):
. 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 42 of 43 88f3393e20
NEW none[none] none:none
none|none none none

03:51:00 Win2K-f 113.210.12.73 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
MY. (DSL) n/a US:www.maxmind.com
:www.getmyip.org
EU:checkip.dyndns.org
EU:getmyip.co.uk
US:208.43.124.51:80
EU:78.40.35.134:80
EU:91.198.22.70:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 2 of 37 223d8089f8
NEW none[3] none:none
StarForce| none trace

T:04:52:00 WinXP 27.248.211.73 (-):
. n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

04:55:00 WinXP 27.248.211.73 (-):
. 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:05:04:00 Win2K-f 110.11.99.240 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 83.133.119.197:65520 DE:proxima.ircgalaxy.pl
US:microsoft.com
EU:ii.derquda.com
CN:lb.perfectexe.com
EU:www.derquda.com
CN:exe4.perfectexe.com
EU:justnewleft.ru
CN:hn.yigeyuming.com
:a.95622.com
EU:91.193.194.98:80
EU:91.217.162.97:80 135 pcap raw alerts
ruleset irc
http
140 lines Yeah : 1.8
profile none summary
tarball 30 of 43
28 of 42
34 of 36
29 of 32
29 of 43
21 of 42
23 of 42
22 of 42 1b8d9f2929
NEW
8809b6417c
NEW
99b248336f
NEW
9d677c3f70
NEW
b34e640329
NEW
bff5fecfbb
NEW
e77c10db8c
NEW
fe100c25d4
NEW none[none]
none [none]
c64bd1a776[0]
77e75ff10f[0]
none [none]
none [none]
none [none]
none [none] none:none
none:none
ASM:Graph
ASM:Graph
none:none
none:none
none:none
none:none
none|none
none|none
Armadillo|
tElock|
none|none
none|none
none|none
none|none none
none
lines=91
lines=120
embedded dns
none
none
none
none none
none
trace
trace
none
none
none
none

T:05:11:00 WinXP 110.11.169.220 (-):
HANARO TELECOM,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
113 lines Yeah : 1.3
profile none summary
tarball 40 of 41
5 of 41 14f47ffd1e
NEW
50437008d9
NEW 90bf4b99ff [0]
c1b09ac5d7[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=56
embedded dns
lines=90 trace
trace

T:05:28:00 Win2K-f 94.248.224.34 (-):
PORION-DIGITAL KFT,
BUDAPEST, BUDAPEST, HU. (DSL) n/a :1.95622.com
US:microsoft.com 445 pcap raw alerts
ruleset http
21 lines Argh : 0.3
profile none summary
tarball 30 of 42 267f6b4afc
NEW none[none] none:none
none|none none none

T:05:46:00 Win2K-f 125.165.126.218 (TELKOM.NET.ID):
TLKM_D1_BB_SPEEDY_BTM,
JAKARTA, JAKARTA RAYA, ID. (DSL) 60.190.222.139:65520 US:microsoft.com
:a.95622.com
:1.95622.com
EU:justnewleft.ru
CN:exe4.perfectexe.com
DE:proxima.ircgalaxy.pl
EU:ii.derquda.com
CN:lb.perfectexe.com
EU:www.derquda.com
CN:sb.perfectexe.com
EU:91.193.194.98:80 445 pcap raw alerts
ruleset http
irc
26 lines Yeah : 1.3
profile none summary
tarball 30 of 42
21 of 42
22 of 42 267f6b4afc
NEW
bff5fecfbb
NEW
fe100c25d4
NEW none[none]
none [none]
none [none] none:none
none:none
none:none
none|none
none|none
none|none none
none
none none
none
none

T:06:21:00 WinXP 189.64.237.97 (TIMBRASIL.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:06:25:00 Win2K-f 122.147.237.4 (SPARQNET.NET):
NEW CENTURY INFOCOMM TECH. CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
57ce4acac2
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:06:30:00 Win2K-f 98.175.173.224 (COX.NET):
COX COMMUNICATIONS,
OKLAHOMA CITY, OKLAHOMA, US. (DSL) 91.193.194.67:65520 US:microsoft.com
EU:proxim.ircgalaxy.pl
EU:ii.derquda.com
CN:lb.perfectexe.com
EU:www.derquda.com
CN:exe4.perfectexe.com
EU:justnewleft.ru
CN:hn.yigeyuming.com
:a.95622.com
EU:91.193.194.98:80
EU:91.217.162.97:80 135 pcap raw alerts
ruleset irc
http
166 lines Yeah : 1.8
profile none summary
tarball 23 of 43
39 of 42
none
28 of 42
29 of 43
21 of 42
23 of 42
22 of 42 18d5ebebab
NEW
220c0b183d
NEW
40a82f045f
NEW
8809b6417c
NEW
b34e640329
NEW
bff5fecfbb
NEW
e77c10db8c
NEW
fe100c25d4
NEW none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none
none
none none
none
none
none
none
none
none
none

T:06:31:00 Win2K-f 194.165.138.32 (-):
ORANGE - JORDAN,
AMMAN, AMMAN, JO. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
141 lines Yeah : 1.3
profile none summary
tarball 38 of 41
39 of 41 10759405e0
NEW
d08e00dfaf
NEW 292d343248 [0]
854c49d8c4[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:06:42:00 Win2K-f 99.184.49.32 (SBCGLOBAL.NET):
AT&T INTERNET SERVICES,
MINNEAPOLIS, MINNESOTA, US. (DSL) 83.133.119.197:65520 :a.95622.com
CN:exe4.perfectexe.com
EU:justnewleft.ru
EU:proxim.ircgalaxy.pl
EU:ii.derquda.com
CN:lb.perfectexe.com
EU:www.derquda.com
EU:91.193.194.98:80
EU:91.217.162.97:80 445 pcap raw alerts
ruleset http
irc
43 lines Yeah : 1.3
profile none summary
tarball 23 of 43
24 of 42
21 of 42
5 of 43
23 of 42
22 of 42 18d5ebebab
NEW
9faba82560
NEW
bff5fecfbb
NEW
e41e5e38a5
NEW
e77c10db8c
NEW
fe100c25d4
NEW none[none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none none
none
none
none
none
none

T:07:01:00 WinXP 180.210.22.221 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:07:26:00 WinXP 12.64.216.220 (PRSERV.NET):
AT&T GLOBAL SERVICES,
IRVING, TEXAS, US. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
3 lines Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:08:07:00 WinXP 174.42.131.150 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - WARRENSVILLE HEIGHTS,
CHARLOTTE, NORTH CAROLINA, US. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 42 of 43 95d1a78f0d
NEW none[none] none:none
none|none none none

T:08:23:00 WinXP 59.103.210.62 (PIE.NET.PK):
PAKISTAN TELECOMMUNICATION COMPANY LIMITED,
ISLAMABAD, ISLAMABAD, PK. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 37 of 41 1f6bcbaaef
NEW none[none] none:none
none|none none none

T:08:32:00 WinXP 109.82.244.140 (JWS.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 43 of 43 820ca7d7bd
NEW none[none] none:none
none|none none none

T:08:37:00 Win2K-f 96.8.144.220 (GVTC.COM):
GUADALUPE VALLEY TELEPHONE COOPERATIVE INC,
NEW BRAUNFELS, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:09:28:00 WinXP 92.86.71.163 (TELELINK-RO.COM):
ARTELECOM,
BUCHAREST, BUCURESTI, RO. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 41 of 41 2a10075051
NEW none[none] none:none
none|none none none

T:10:03:00 WinXP 121.121.30.164 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a :moscow-advokat.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 1511a3f219
NEW none[none] none:none
none|none none none

T:10:10:00 WinXP 96.14.50.99 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - PHOENIX,
ALBUQUERQUE, NEW MEXICO, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 42 of 43 aad01847fa
NEW none[none] none:none
none|none none none

10:12:00 WinXP 121.121.30.164 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a RU:moscow-advokat.ru
RU:194.85.61.78:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 1511a3f219
NEW none[none] none:none
none|none none none

T:10:30:00 WinXP 70.169.52.86 (COX.NET):
COX COMMUNICATIONS,
TULSA, OKLAHOMA, US. (DSL) 91.193.194.67:65520 EU:proxim.ircgalaxy.pl
US:gg.arrancar.org
EU:ii.derquda.com
CN:lb.perfectexe.com
EU:www.derquda.com
CN:exe4.perfectexe.com
EU:justnewleft.ru
CN:hn.yigeyuming.com
US:get.whitesmoke.com
US:63.236.35.30:80
US:69.43.160.145:555
EU:91.193.194.67:65520 135 pcap raw alerts
ruleset irc
http
452 lines Yeah : 1.8
profile none summary
tarball 23 of 43
12 of 42
28 of 42
39 of 42
2 of 43
21 of 42
5 of 43
23 of 42
22 of 42 18d5ebebab
NEW
5763c14e86
NEW
8809b6417c
NEW
abc24c052d
NEW
b2c1ecbb4e
NEW
bff5fecfbb
NEW
e41e5e38a5
NEW
e77c10db8c
NEW
fe100c25d4
NEW none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none
none
none
none none
none
none
none
none
none
none
none
none

T:10:41:00 WinXP 109.52.211.243 (JWS.COM):
EU-ZZ,
UK. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.8
profile none summary
tarball 42 of 43 b269b15ffd
NEW none[none] none:none
none|none none none

T:11:30:00 Win2K-f 66.90.140.192 (GRANDENETWORKS.NET):
GRANDE COMMUNICATIONS SAN MARCOS,
SAN MARCOS, TEXAS, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 d031b42d3f
NEW
fa14802705
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:11:41:00 WinXP 79.163.7.107 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
WARSAW, WARSZAWA, PL. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 41 of 41 5c6df5141d
NEW none[none] none:none
none|none none none

T:12:31:00 Win2K-f 4.224.180.147 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
DRESDEN, OHIO, US. (DSL) n/a 135 pcap raw alerts
ruleset other
4 lines Yeah : 0.8
profile none summary
tarball none none none none none none none

T:13:00:00 WinXP 84.3.140.104 (T-ONLINE.HU):
HUNGARIAN TELECOM,
BUDAPEST, BUDAPEST, HU. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 38 of 40 75ec267a9b
NEW none[none] none:none
none|none none none

T:13:14:00 WinXP 77.253.41.140 (INETIA.PL):
INTERNETIA,
KATOWICE, SLASKIE, PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 420b1a76c4
NEW none[none] none:none
none|none none none

13:46:00 WinXP 84.3.140.104 (T-ONLINE.HU):
HUNGARIAN TELECOM,
BUDAPEST, BUDAPEST, HU. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 38 of 40 75ec267a9b
NEW none[none] none:none
none|none none none

T:14:02:00 Win2K-f 71.153.27.71 (PACBELL.NET):
AT&T INTERNET SERVICES,
DALLAS, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:14:43:00 WinXP 187.46.166.135 (VELOXZONE.COM.BR):
COMITE GESTOR DA INTERNET NO BRASIL,
SãO PAULO, SAO PAULO, BR. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:15:07:00 WinXP 186.25.170.200 (-):
. 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:15:31:00 Win2K-f 114.74.235.98 (OPTUSNET.COM.AU):
OPTUS INTERNET - RETAIL,
MELBOURNE, VICTORIA, AU. (DSL) n/a 135 pcap raw alerts
ruleset other
11 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:15:39:00 WinXP 188.192.130.104 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
DE. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.8
profile none summary
tarball 39 of 43 f3d217396b
NEW none[none] none:none
none|none none none

T:18:02:00 WinXP 204.111.187.60 (SHENTEL.NET):
SHENTEL SERVICE COMPANY,
BLACKSBURG, VIRGINIA, US. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 41 1096ba143e
NEW none[none] none:none
none|none none none

T:18:23:00 Win2K-f 208.88.70.103 (-):
BBW 4 ACES TOWER CUSTOMER SUBNET,
SHREVEPORT, LOUISIANA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
77 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:19:38:00 WinXP 65.163.204.130 (NETWORKS.COM):
NETWORKS ONLINE INC,
GIRARD, OHIO, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 37 of 42
39 of 41 359d245014
NEW
f078462163
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:19:46:00 Win2K-f 175.113.174.215 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 3 of 41
33 of 33 8b41cb7a41
NEW
97fef473b9
NEW ef18d720f3 [0]
ff4e7d6992[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=90
lines=64
embedded dns trace
trace

T:21:14:00 WinXP 114.198.164.239 (-):
GLOBALVIEW CATV CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 42 of 43 ef96217736
NEW none[none] none:none
none|none none none

T:21:37:00 WinXP 219.110.209.153 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
TOKYO, TOKYO, JP. (DSL) n/a RU:siliconfireware.ru
RU:auction.nic.ru
:www.google-analytics.com
RU:domain-parking.ru
US:new.egg.com
:wpad 445 pcap raw alerts
ruleset http
http
http
http
61 lines Yeah : 0.8
profile none summary
tarball 29 of 29 a12cab51ef
NEW none[0] none:none
ASPack| lines=281
embedded dns trace

T:21:55:00 WinXP 175.112.215.206 (-):
. 60.190.222.139:65520 EU:proxim.ircgalaxy.pl
US:microsoft.com
EU:ii.derquda.com
CN:lb.perfectexe.com
CN:exe4.perfectexe.com
CN:hn.yigeyuming.com
EU:www.derquda.com
EU:justnewleft.ru
:a.95622.com
:1.95622.com
US:stockstaxes.com
US:searchportal.information.com
:pagead2.googlesyndication.com
:googleads.g.doubleclick.net
:cdn.dsultra.com
208.93.137.180:80
CN:60.190.222.139:65520
EU:91.193.194.98:80 135 pcap raw alerts
ruleset irc
http
170 lines Yeah : 1.8
profile none summary
tarball 28 of 42
40 of 43
29 of 43
21 of 42
40 of 43
22 of 42 8809b6417c
NEW
92b7f99e20
NEW
b34e640329
NEW
bff5fecfbb
NEW
ec7cec691c
NEW
fe100c25d4
NEW none[none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none none
none
none
none
none
none

T:22:11:00 WinXP 92.251.184.70 (-):
H3G IRELAND SUBSCRIBERS,
IE. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none

T:22:30:00 Win2K-f 24.79.82.75 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
WINNIPEG, MANITOBA, CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
123 lines Yeah : 1.3
profile none summary
tarball 36 of 41
38 of 41 34cbe7a593
NEW
3e83a2d4d7
NEW d38cb78003 [0]
b97fd63d29[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:23:31:00 Win2K-f 66.66.9.80 (RR.COM):
ROAD RUNNER HOLDCO LLC,
ROCHESTER, NEW YORK, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
59 lines Yeah : 1.3
profile none summary
tarball 33 of 33
8 of 33 53bfe15e91
NEW
b7082104e4
NEW 1473091351 [0]
c5b49e7b82[0] ASM:Graph
ASM:Graph
tElock|
tElock| lines=75
embedded dns
lines=41 trace
trace

23:55:00 WinXP 223.16.37.202 (-):
. n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none none none none none none none