Multiperspective Malware Analysis Page

Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

02 March 2011
<prev> <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.

Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]

Time
Victim
OS
Infection
Source
C&C
Server
DNS Lookups &
Failed Connects Infection
Port
Packet
Trace
Detection
Signatures
Infection
Chatter
BotHunter
Analysis
Behavioral
Cluster
Forensic
Logs
Antivirus
Labels
Packed Malware_Binary Unpacked egg.exe
Unpacked egg.asm
Packer PEID
Data Strings
Syscall Trace

00:05:00 WinXP 67.55.191.148 (NETINS.NET):
CLEAR LAKE INDEPENDANT TEL CO,
MUSCATINE, IOWA, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 43 of 43 6ffc4847e4
NEW none[none] none:none
none|none none none

T:00:33:00 WinXP 46.134.217.100 (-):
. 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 42 of 43 c19c8a2776
NEW none[none] none:none
none|none none none

T:01:43:00 WinXP 94.52.219.154 (-):
NEW COM TELECOMUNICATII SA,
BUCHAREST, BUCURESTI, RO. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:01:56:00 WinXP 124.241.150.81 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:02:48:00 WinXP 115.82.99.113 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 43 of 43 6ffc4847e4
NEW none[none] none:none
none|none none none

T:02:48:00 WinXP 188.176.69.59 (DSL.TELE.DK):
TDC-TELEDANMARK-BREDBAANDSADSL-NET,
DK. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:03:07:00 Win2K-f 98.175.173.224, 222.170.127.203 (INVALID IPV4 ADDRESS):
INVALID IPV4 ADDRESS,
INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS. (INVALID IPV4 ADDRESS) 83.133.119.197:65520 US:microsoft.com
DE:proxim.ircgalaxy.pl
CN:lb.mainpage.cc
EU:www.derquda.com
CN:w.mainpage.cc
EU:justnewleft.ru
CN:2b.mainpage.cc
CN:218.10.17.178:888 135 pcap raw alerts
ruleset irc
http
154 lines Yeah : 1.8
profile none summary
tarball 39 of 42
none
28 of 42
33 of 42
11 of 42
29 of 43
41 of 43
41 of 42
36 of 42
37 of 43 220c0b183d
NEW
40a82f045f
NEW
53ab8b46bc
NEW
a24a4f5ff4
NEW
a784a42dcc
NEW
b34e640329
NEW
b4afa1df1d
NEW
e1a6bbb316
NEW
ec73fe029d
NEW
f283c43596
NEW none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none none
none
none
none
none
none
none
none
none
none none
none
none
none
none
none
none
none
none
none

T:03:09:00 WinXP 123.111.111.32, 222.170.127.203 (INVALID IPV4 ADDRESS):
INVALID IPV4 ADDRESS,
INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS. (INVALID IPV4 ADDRESS) 83.133.119.197:65520 DE:proxim.ircgalaxy.pl
US:microsoft.com
CN:lb.mainpage.cc
CN:w.mainpage.cc
EU:ii.derquda.com
CN:2b.mainpage.cc
CN:hn.yigeyuming.com
:a.95622.com
:1.95622.com
:netspendbalance.com
US:i.nuseek.com
:pagead2.googlesyndication.com
:www.google-analytics.com
:insuranceagentscareer.com
:www.lddwj.com
:pciture.com
:wpad
CN:2b.yigeyuming.com
:www.zkaoo.com 135 pcap raw alerts
ruleset irc
http
212 lines Yeah : 1.8
profile none summary
tarball 31 of 42
28 of 42
38 of 40
38 of 40
33 of 42
29 of 43
41 of 43
41 of 42 4bc7ff96e4
NEW
8809b6417c
NEW
89f410e7cc
NEW
909270c172
NEW
a24a4f5ff4
NEW
b34e640329
NEW
b4afa1df1d
NEW
e1a6bbb316
NEW none[none]
none [none]
2593cbda62[0]
55c25968a5[0]
none [none]
none [none]
none [none]
none [none] none:none
none:none
ASM:Graph
ASM:Graph
none:none
none:none
none:none
none:none
none|none
none|none
Armadillo|
tElock|
none|none
none|none
none|none
none|none none
none
lines=91
lines=125
embedded dns
none
none
none
none none
none
trace
trace
none
none
none
none

T:03:13:00 Win2K-f 120.138.135.36 (STARCAT.NE.JP):
KMN CORPORATION,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 39 of 40
39 of 39 b8e6f4caf7
NEW
fb92b91fe7
NEW f81eac6379 [0]
fe88ab8768[0] none:none
none:none
tElock|
Armadillo| none
none trace
trace

T:03:14:00 Win2K-f 217.21.119.25, 222.170.127.203 (INVALID IPV4 ADDRESS):
INVALID IPV4 ADDRESS,
INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS. (INVALID IPV4 ADDRESS) n/a :a.95622.com
US:boadr.com
CN:2b.yigeyuming.com
CN:w.mainpage.cc
CN:2b.mainpage.cc
CN:s5.perfectexe.com
:capitalcityweekly.net
US:theaterpatent.com
:cdn.dsultra.com
US:p.chango.com
US:domdex.com
US:i.nuseek.com
:www.google-analytics.com
:seomop.com
:datingpocket.com
US:microsoft.com
:techpopular.com
CN:sb.perfectexe.com 135 pcap raw alerts
ruleset http
irc
58 lines Yeah : 0.8
profile none summary
tarball 3 of 41
38 of 43
28 of 42
9 of 42 01805ec3c3
NEW
3ef3c2ad56
NEW
8809b6417c
NEW
e4240d7958
NEW none[none]
none [none]
none [none]
none [none] none:none
none:none
none:none
none:none
none|none
none|none
none|none
none|none none
none
none
none none
none
none
none

T:03:19:00 WinXP 113.210.138.168 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
MY. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 40 of 42 de4624560d
NEW none[none] none:none
none|none none none

T:03:27:00 WinXP 113.210.28.78 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
MY. (DSL) 213.155.0.224:80 DE:citi-bank.ru
:adult-empire.com 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:03:30:00 WinXP 173.31.100.178 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
MIDDLETOWN, NEW YORK, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 38 of 42
40 of 43 1bafff1e61
NEW
8511a51872
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:03:42:00 Win2K-f 60.50.174.25 (TM.NET.MY):
TELEKOM MALAYSIA BERHAD,
KOTA KINABALU, SABAH, MY. (DSL) 60.190.222.139:65520 :higheducation.net
US:i.nuseek.com
:thebeststores.org
:a.95622.com
:webabconline.com
:www.google-analytics.com
EU:justnewleft.ru
CN:w.mainpage.cc
DE:proxim.ircgalaxy.pl
CN:2b.yigeyuming.com
CN:lb.mainpage.cc
:recommendauto.com
EU:www.derquda.com
US:domainbt.bidsystem.com
US:dreamstmie.com
:seofoot.com
:datingpocket.com
US:changinghands.net
:seoenjoy.com 445 pcap raw alerts
ruleset http
irc
112 lines Yeah : 1.3
profile none summary
tarball 33 of 42 a24a4f5ff4
NEW none[none] none:none
none|none none none

T:04:08:00 WinXP 121.121.18.114 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 36 1595515522
NEW none[none] none:none
none|none none none

T:04:28:00 WinXP 118.83.18.163 (HTOJ.J-CNET.JP):
JCN-HTMNET,
HACHIOJI, TOKYO, JP. (DSL) n/a 135 pcap raw alerts
ruleset other
340 lines Yeah : 1.3
profile none summary
tarball 41 of 42 d28246ec52
NEW none[none] none:none
none|none none none

T:04:47:00 WinXP 222.230.153.159 (VECTANT.NE.JP):
SEIKA CORPORATION,
YOKOHAMA, KANAGAWA, JP. (100Mbps) n/a 445 pcap raw alerts
ruleset shell
ftp
15 lines Yeah : 1.3
profile none summary
tarball 29 of 29 831f4ee0a7
NEW none[0] none:none
none|none lines=60 trace

T:05:04:00 Win2K-f 70.74.228.35 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
EDMONTON, ALBERTA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:05:25:00 WinXP 66.249.155.147 (DIGICELBROADBAND.COM):
DIGICEL JAMAICA,
MONTEGO BAY, SAINT JAMES, JM. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
114 lines Yeah : 1.3
profile none summary
tarball 38 of 39
35 of 38 2205443cc8
NEW
b9297745a1
NEW 04ce1ed773 [none]
4294884d84[0] none:none
ASM:Graph
none|none
tElock| none
lines=64
embedded dns none
trace

T:05:34:00 WinXP 14.96.68.147 (-):
. n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 38 of 41 887b302405
NEW none[none] none:none
none|none none none

T:05:35:00 WinXP 151.83.34.28 (SER-PR2-MAX.IUNET.IT):
INFOSTRADA,
ROME, LAZIO, IT. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.8
profile none summary
tarball 32 of 32 ee09957625
NEW e88a3c4b63 [0] ASM:Graph
PolyEnE| lines=68 trace

05:36:00 WinXP 14.96.68.147 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 38 of 41 887b302405
NEW none[none] none:none
none|none none none

T:05:56:00 WinXP 115.80.39.7 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:moscow-advokat.ru
DE:82.98.86.164:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 42 89333786d3
NEW none[none] none:none
none|none none none

T:05:57:00 WinXP 122.120.46.20 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 29 of 29 0cfab99612
NEW none[0] none:none
PolyEnE| lines=68 trace

07:06:00 WinXP 95.68.180.223 (ESOO.RU):
OJSC VOLGATELECOM,
RU. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 41 d11b1f56f9
NEW none[none] none:none
none|none none none

T:07:11:00 Win2K-f 208.88.70.103 (-):
BBW 4 ACES TOWER CUSTOMER SUBNET,
SHREVEPORT, LOUISIANA, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:07:16:00 Win2K-f 96.11.193.131 (RR.COM):
ROAD RUNNER HOLDCO LLC,
WEST CHESTER, OHIO, US. (DSL) n/a 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 40 of 42 45885d17fa
NEW none[none] none:none
none|none none none

T:07:21:00 WinXP 74.60.113.36 (CLEARWIRE-DNS.NET):
CLEARWIRE US LLC,
CHICAGO, ILLINOIS, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:07:23:00 Win2K-f 113.255.135.254 (HUTCHCITY.COM):
HUTCHISON GLOBAL COMMUNICATIONS,
HK. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
76 lines Yeah : 1.3
profile none summary
tarball 33 of 33
36 of 42 53bfe15e91
NEW
708f4ce601
NEW 1473091351 [0]
none [none] ASM:Graph
none:none
tElock|
none|none lines=75
embedded dns
none trace
none

T:07:26:00 WinXP 79.163.55.102 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
WARSAW, WARSZAWA, PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 41 5c6df5141d
NEW none[none] none:none
none|none none none

T:07:53:00 WinXP 83.221.245.147 (KM3.DE):
KM3 TELEDIENST CABLEMODEMS,
BERLIN, BERLIN, DE. (DSL) n/a DE:moscow-advokat.ru
DE:82.98.86.164:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:08:05:00 Win2K-f 218.162.73.90 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:08:14:00 WinXP 49.14.15.57 (-):
. n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 41 of 43 fb486908b0
NEW none[none] none:none
none|none none none

T:08:39:00 WinXP 151.81.19.253 (51-151.NET24.IT):
IUNET-BNET,
IT. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:08:48:00 WinXP 178.150.189.23 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 fb486908b0
NEW none[none] none:none
none|none none none

T:08:53:00 WinXP 83.246.237.77 (NEXCOM.RU):
PROVIDER LOCAL REGISTRY,
RU. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 39 of 40 5e8ccc4190
NEW 8d5f86583f [0] ASM:Graph
PolyEnE| lines=68 trace

T:08:54:00 WinXP 115.83.56.218 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:09:04:00 WinXP 79.163.103.229 (CENTERTEL.PL):
PTK CENTERTEL BROADBAND SERVICES,
WARSAW, WARSZAWA, PL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 35 of 36 b27d73bfcb
NEW 473c6454ce [0] ASM:Graph
PolyEnE| lines=68 trace

T:09:13:00 WinXP 109.60.188.100 (JWS.COM):
EU-ZZ,
UK. (DSL) n/a DE:moscow-advokat.ru
DE:82.98.86.164:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 04d4170d3b
NEW none[none] none:none
none|none none none

T:09:14:00 Win2K-f 173.168.182.128 (RR.COM):
ROAD RUNNER HOLDCO LLC,
OLDSMAR, FLORIDA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 40 of 41
40 of 40 1761e9db94
NEW
d1e83e2d0a
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:09:18:00 WinXP 77.21.168.175 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
BREMEN, BREMEN, DE. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 1.3
profile none summary
tarball 41 of 43 fb486908b0
NEW none[none] none:none
none|none none none

T:09:21:00 WinXP 121.121.219.228 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 29 of 29 6e9e655f3c
NEW none[0] none:none
PolyEnE| lines=68 trace

T:09:38:00 Win2K-f 61.215.131.50 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
TOKYO, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 10eebdc28e
NEW
761a66b891
NEW e2ca2da35d [0]
b469dac5dc[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:10:20:00 WinXP 46.134.237.170 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 c19c8a2776
NEW none[none] none:none
none|none none none

T:10:21:00 Win2K-f 59.120.228.224 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a 135 pcap raw alerts
ruleset other
52 lines Yeah : 1.3
profile none summary
tarball 0 of 33 57ce4acac2
NEW none[0] none:none
Armadillo| lines=90 trace

T:10:34:00 WinXP 98.124.83.249 (HOMESC.COM):
HOME TELEPHONE COMPANY INC,
MONCKS CORNER, SOUTH CAROLINA, US. (100Mbps) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:10:51:00 WinXP 174.42.236.105 (WINDSTREAM.NET):
ALLTEL MIP CUSTOMERS - WARRENSVILLE HEIGHTS,
MONROE, NORTH CAROLINA, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 41 d11b1f56f9
NEW none[none] none:none
none|none none none

T:11:37:00 Win2K-f 24.155.14.234 (GRANDENETWORKS.NET):
GRANDE COMMUNICATIONS WACO,
WOODWAY, TEXAS, US. (100Mbps) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 d031b42d3f
NEW
fa14802705
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

T:12:52:00 WinXP 149.149.122.201 (ASKNOW.COM):
TENNESSEE TECHNOLOGICAL UNIVERSITY,
COOKEVILLE, TENNESSEE, US. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 24 of 42 2978812f76
NEW none[none] none:none
none|none none none

T:13:19:00 WinXP 178.19.143.153 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a DE:moscow-advokat.ru
DE:82.98.86.164:6667 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 25 of 25 7f60162c2c
NEW none[0] none:none
PolyEnE| lines=93
embedded dns trace

T:13:27:00 WinXP 212.129.80.75 (-):
METEOR-GPRS,
DUBLIN, DUBLIN, IE. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 41 01c4a6b3eb
NEW dd524b0259 [0] ASM:Graph
PolyEnE| lines=68 trace

T:14:23:00 WinXP 4.157.68.239 (LEVEL3.NET):
LEVEL 3 COMMUNICATIONS INC,
SCHENECTADY, NEW YORK, US. (DIAL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

14:43:00 WinXP 151.81.55.38 (51-151.NET24.IT):
IUNET-BNET,
MILANO, LOMBARDIA, IT. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 41 of 43 fb486908b0
NEW none[none] none:none
none|none none none

T:15:10:00 WinXP 72.45.25.39 (ATLANTICBB.NET):
ATLANTIC BROADBAND,
SMYRNA, DELAWARE, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 d031b42d3f
NEW
fa14802705
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

15:11:00 Win2K-f 115.178.63.174 (SHEEPLINK.COM):
SHEEPLINK CO. LTD,
TH. (DSL) n/a US:www.maxmind.com
:www.getmyip.org
EU:checkip.dyndns.org
US:208.43.124.51:80 445 pcap raw alerts
ruleset http
3 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:15:21:00 Win2K-f 115.178.63.174 (SHEEPLINK.COM):
SHEEPLINK CO. LTD,
TH. (DSL) n/a US:www.maxmind.com
:checkip.dyndns.org 445 pcap raw alerts
ruleset http
19 lines Yeah : 0.8
profile none summary
tarball 3 of 37 d9cb288f31
NEW 45603a001c [0] ASM:Graph
UPX| lines=174
embedded dns trace

T:15:24:00 Win2K-f 70.70.154.75 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
SURREY, BRITISH COLUMBIA, CA. (DSL) n/a 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 40 of 41 f3932b94a6
NEW 910494cc45 [0] ASM:Graph
none|none lines=546 trace

T:15:29:00 WinXP 84.224.77.164 (PGSM.HU):
PANNON GSM TELECOMMUNICATIONS INC,
BUDAPEST, BUDAPEST, HU. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:15:43:00 Win2K-f 27.98.18.10 (-):
. n/a US:microsoft.com 135 pcap raw alerts
ruleset other
99 lines Yeah : 1.3
profile none summary
tarball 39 of 40
40 of 41 6a6aaa5b73
NEW
8bde6dd126
NEW 63889c9976 [0]
885c68f500[0] ASM:Graph
ASM:Graph
tElock|
tElock| lines=42
lines=64
embedded dns trace
trace

T:16:32:00 WinXP 174.5.73.4 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
CA. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 33 53bfe15e91
NEW
a08f3b74a4
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace

T:16:46:00 Win2K-f 115.165.2.208 (CATV02.ITSCOM.JP):
ITS COMMUNICATIONS INC,
TOKYO, TOKYO, JP. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:17:03:00 WinXP 113.210.65.228 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
MY. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 42 of 43 88f3393e20
NEW none[none] none:none
none|none none none

T:17:18:00 WinXP 178.167.226.1 (FINEBLANK.COM):
EU-ZZ,
UK. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:17:29:00 Win2K-f 65.36.89.94 (GRANDENETWORKS.NET):
GRANDE COMMUNICATIONS NETWORKS INC,
SAN MARCOS, TEXAS, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
110 lines Yeah : 1.3
profile none summary
tarball 38 of 41
38 of 41 d031b42d3f
NEW
fa14802705
NEW none[none]
none [none] none:none
none:none
none|none
none|none none
none none
none

17:58:00 WinXP 46.109.162.200 (-):
. n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 2c94e3fd00
NEW none[none] none:none
none|none none none

T:18:06:00 WinXP 70.45.255.203 (ONELINKPR.NET):
SAN JUAN CABLE LLC,
SAN JUAN, PUERTO RICO, PR. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 34 of 34 d20f157117
NEW 738f555183 [0] ASM:Graph
PolyEnE| lines=68 trace

T:18:40:00 WinXP 190.58.2.153 (TSTT.NET.TT):
TELECOMMUNICATION SERVICES OF TRINIDAD AND TOBAGO,
ARIMA, ARIMA, TT. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
2 lines Yeah : 0.8
profile none summary
tarball 26 of 28 7d99b0e910
NEW none[0] none:none
PolyEnE| lines=68 trace

T:18:47:00 WinXP 109.175.240.196 (STERLINGSTUDENTS.NET):
EU-ZZ,
UK. (DSL) n/a 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 2c94e3fd00
NEW none[none] none:none
none|none none none

T:19:19:00 WinXP 121.121.196.74 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 32 of 32 b502f83a7c
NEW 28f5be93b0 [0] ASM:Graph
PolyEnE| lines=73 trace

T:19:23:00 WinXP 204.111.67.241 (SHENTEL.NET):
SHENTEL SERVICE COMPANY,
WOODSTOCK, VIRGINIA, US. (DSL) 213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset http
2 lines Yeah : 1.3
profile none summary
tarball 40 of 41 1096ba143e
NEW none[none] none:none
none|none none none

T:20:02:00 WinXP 60.251.218.169 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a :gg.arrancar.org 135 pcap raw alerts
ruleset other
186 lines Yeah : 1.3
profile none summary
tarball 39 of 40 0f94963076
NEW 2a573942eb [0] ASM:Graph
none|none lines=546 trace

20:11:00 WinXP 121.120.25.144 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 42 of 43 2c94e3fd00
NEW none[none] none:none
none|none none none

T:20:14:00 WinXP 60.250.36.114 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 34 of 38
35 of 38 38ed850a0e
NEW
b9297745a1
NEW 46990f37cd [0]
4294884d84[0] ASM:Graph
ASM:Graph
Armadillo|
tElock| lines=91
lines=64
embedded dns trace
trace

T:20:27:00 WinXP 27.97.238.113 (-):
. n/a CN:ilo.brenz.pl
DE:citi-bank.ru
CN:lb.mainpage.cc
EU:ii.derquda.com
:mvyioe.com
:zgbtap.com
:sivbhf.com
:gzeeyy.com
:dxetic.com
:cjyzsi.com
:onbnep.com
:yfikkb.com
:ecywaz.com
:dxudbu.com
:djuqey.com
:ouscfr.com
:lomyau.com
:ianmek.com
:krruwx.com
US:barakamediaproduction.com
:accuro.cz
:bay-bee.co.uk
:manayernajd.com 445 pcap raw alerts
ruleset http
7 lines Yeah : 0.8
profile none summary
tarball 39 of 42 31ec203307
NEW none[none] none:none
none|none none none

T:21:47:00 Win2K-f 98.141.163.84 (CAVTEL.NET):
CAVALIER TELEPHONE,
PHILADELPHIA, PENNSYLVANIA, US. (DSL) n/a 135 pcap raw alerts
ruleset other
18 lines Yeah : 1.3
profile none summary
tarball none none none none none none none

T:22:34:00 WinXP 65.50.34.15 (BILTMORECOMMUNICATIONS.NET):
DIRECPATH LLC,
ATLANTA, GEORGIA, US. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
111 lines Yeah : 1.3
profile none summary
tarball 39 of 41
37 of 40 5d445c59d8
NEW
8a54950abb
NEW 892e12db7b [0]
f6b9e43917[0] ASM:Graph
ASM:Graph
tElock|
Armadillo| lines=64
embedded dns
lines=91 trace
trace

T:23:17:00 WinXP 121.121.40.46 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball 40 of 41 d11b1f56f9
NEW none[none] none:none
none|none none none

23:17:00 WinXP 85.64.158.30 (BARAK-ONLINE.NET):
BARAK I.T.C,
TEL AVIV, TEL AVIV, IL. (DSL) n/a DE:citi-bank.ru
DE:213.155.0.224:80 445 pcap raw alerts
ruleset http
1 line Yeah : 0.8
profile none summary
tarball none 408a70e2ee
NEW none[none] none:none
none|none none none

T:23:42:00 Win2K-f 120.138.175.125 (STARCAT.NE.JP):
KMN CORPORATION,
NAGOYA, TOKYO, JP. (DSL) n/a US:microsoft.com 135 pcap raw alerts
ruleset other
75 lines Yeah : 1.3
profile none summary
tarball 33 of 33
0 of 32 53bfe15e91
NEW
73f1082158
NEW 1473091351 [0]
none [0] ASM:Graph
none:none
tElock|
Armadillo| lines=75
embedded dns
lines=90 trace
trace