Welcome to the Cyber-TA
SRI's Multiperspective Malware Infection Analysis Page

UNCENSORED PAGE

<Click here: to download BotHunter>

18 April 2011
<prev>   <next>

All data collection and analyses summarized in this page were 100% AUTO-GENERATED.

DEVELOPERS: Vinod Yegneswaran (SRI), Phillip Porras (SRI), Hassen Saidi (SRI)
Monirul Sharif (Georgia-Tech), Arvind Narayanan (University of Texas at Austin)

The data on this website is provided for research purposes only. It is provided
for your personal use only and is supplied AS IS, WITHOUT WARRANTY OF ANY KIND.
Use or reliance on this data is at your own risk.


Daily Summary Files: [DNS Lookups & Failed Connects] [ Attacker IPs ] [C&C Servers] [Binary Digests]
Cumulative Summary Files: [DNS Lookup Log] [Attacker IP Log] [C&C Server Log] [Antivirus Detection] [Code Segment Overlap]
[Behavioral Clusters] [Binary Digest Log]

[See Country Codes ]
Time
 		Victim
OS
 		Infection
Source
 		C&C
Server
 		DNS Lookups &
Failed Connects 		Infection
Port
 		Packet
Trace
 		Detection
Signatures
 		Infection
Chatter
 		BotHunter
Analysis
 		Behavioral
Cluster
 		Forensic
Logs
 		Antivirus
Labels
 		Packed Malware_Binary Unpacked egg.exe
 		Unpacked egg.asm
 		Packer PEID
 		Data Strings
 		Syscall Trace
T:00:11:00 Win2K-f 203.114.106.150 (-):
BAMNETNARONGWITAYAKOMSCHOOL,
BANGKOK, KRUNG THEP, TH. (100Mbps) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
103 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:00:19:00 Win2K-f 202.122.24.10 (CTS.NE.JP):
SOUTH TOKYO CABLE TELEVISION,
TOKYO, TOKYO, JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
123 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 41
38 of 41		 34cbe7a593
NEW
3e83a2d4d7
NEW 		d38cb78003 [0]
b97fd63d29[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
T:00:43:00 WinXP 123.193.140.15 (KBRONET.COM.TW):
TUNG HO MULTIMEDIA CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		38 of 40 c11924f04a
NEW 		none[none] none:none
 none|none none none
T:00:44:00 Win2K-f 70.65.249.149 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
LETHBRIDGE, ALBERTA, CA. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:01:04:00 WinXP 46.134.219.232 (-):
. 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		42 of 43 c19c8a2776
NEW 		none[none] none:none
 none|none none none
T:01:10:00 Win2K-f 121.124.193.79 (HANANET.NET):
HANARO TELECOM INC,
SEOUL, SEOUL-T'UKPYOLSI, KR. (DSL) 		91.193.194.67:65520 CN:proxima.ircgalaxy.pl
US:microsoft.com
CN:88.perfectexe.com
EU:kakgezaebalsha.com
CN:w.nucleardiscover.com
IT:mewgost.com
CN:ck.perfectexe.com
US:lawyerdiamond.com
US:images01.tzimg.com
US:images01.trafficz.com
US:209.59.194.240:80 		135 pcap raw alerts
ruleset 		irc
http
175 lines 		Yeah : 1.8
profile 		none summary
tarball 		23 of 41
29 of 43
33 of 42
39 of 41
31 of 33
21 of 42
9 of 42		 457c53cd9a
NEW
564048b35d
NEW
5d6097956d
NEW
ab9c4b5f21
NEW
d789c8d157
NEW
d8652f98a7
NEW
e4240d7958
NEW 		none[none]
none [none]
none [none]
5fe48b2dcc[0]
5f6572479f[0]
none [none]
none [none] 		none:none
none:none
none:none
ASM:Graph
ASM:Graph
none:none
none:none
 none|none
none|none
none|none
Armadillo|
PolyEnE|
none|none
none|none 		none
none
none
lines=42
lines=113
embedded dns
none
none 		none
none
none
trace
trace
none
none
01:12:00 WinXP 77.23.180.90 (SUPERKABEL.DE):
KABEL-DEUTSCHLAND-CUSTOMER-SERVICES,
BAYREUTH, BAYERN, DE. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		42 of 43 5f186aa322
NEW 		none[none] none:none
 none|none none none
T:01:18:00 Win2K-f 121.120.107.225 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) 		n/a CN:hn.yigeyuming.com
:a.95622.com
:1.95622.com
:acarine.net
US:networkpersonal.com
US:i.nuseek.com
:pagead2.googlesyndication.com
US:209.59.194.20:80 		445 pcap raw alerts
ruleset 		http
irc
lanman
289 lines 		Yeah : 0.8
profile 		none summary
tarball 		18 of 41
7 of 42		 51c413f474
NEW
5fa1852548
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:01:35:00 WinXP 112.110.110.40 (-):
ICL-NET,
DELHI, DELHI, IN. (DIAL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		41 of 43 0f77d6439f
NEW 		none[none] none:none
 none|none none none
T:01:43:00 Win2K-f 109.54.34.109 (JWS.COM):
EU-ZZ,
UK. (DSL) 		83.133.119.197:65520 CN:2b.yigeyuming.com
:a.95622.com
CN:ck.perfectexe.com
CN:w.nucleardiscover.com
IT:mewgost.com
CN:proxima.ircgalaxy.pl
US:porntrucks.com
US:radiotrading.com
US:gounheated.com
CN:88.perfectexe.com
US:images01.tzimg.com
US:i.nuseek.com
:pagead2.googlesyndication.com
EU:kakgezaebalsha.com
US:images01.trafficz.com
US:domdex.com
US:extrainvesting.net
174.133.57.141:80
CN:60.190.223.132:89
CN:60.190.223.75:10167
CN:60.190.223.75:888 		445 pcap raw alerts
ruleset 		irc
http
39 lines 		Yeah : 1.3
profile 		none summary
tarball 		23 of 41 457c53cd9a
NEW 		none[none] none:none
 none|none none none
01:43:00 Win2K-f 27.50.18.21 (-):
. 		n/a US:www.maxmind.com
:www.getmyip.org
EU:getmyip.co.uk
EU:checkip.dyndns.org
DE:131.220.6.26:80
EU:78.40.35.134:80 		445 pcap raw alerts
ruleset 		lanman
http
31 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:01:50:00 Win2K-f 61.206.71.28 (THN.NE.JP):
TOKAI CORPORATION,
SHIZUOKA, SHIZUOKA, JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41
39 of 41		 5799ab6538
NEW
f38e8d97da
NEW 		2713679411 [0]
83f1400243[0] 		ASM:Graph
ASM:Graph
 tElock|
Armadillo| 		lines=64
embedded dns
lines=91 		trace
trace
T:02:06:00 Win2K-f 220.130.190.124 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41
none		 2bc8f15054
NEW
964911406f
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:02:10:00 WinXP 121.121.140.194 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 41 d8040f84d4
NEW 		d683995e84 [0] ASM:Graph
 PolyEnE| lines=73 trace
T:02:17:00 WinXP 203.81.119.231 (KBN.NE.JP):
KAGAWA T.V BROADCAST NETWORK CO .LTD,
TOKYO, TOKYO, JP. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		34 of 34 d20f157117
NEW 		738f555183 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:02:46:00 WinXP 175.123.78.219 (-):
. 		83.133.119.197:65520 DE:proxim.ircgalaxy.pl
US:microsoft.com
EU:ii.kakgezaebalsha.com
EU:adcavern.com
CN:88.perfectexe.com
CN:w.nucleardiscover.com
IT:mewgost.com
IT:194.28.44.213:80
CN:60.190.223.75:888 		135 pcap raw alerts
ruleset 		irc
http
187 lines 		Yeah : 1.8
profile 		none summary
tarball 		23 of 42
23 of 41
30 of 33
29 of 43
33 of 42
14 of 42
36 of 41
21 of 42		 2eb41f338a
NEW
457c53cd9a
NEW
533d15b5ce
NEW
564048b35d
NEW
5d6097956d
NEW
9183f260e2
NEW
a8d5f22a14
NEW
d8652f98a7
NEW 		none[none]
none [none]
c67adf46e2[0]
none [none]
none [none]
none [none]
none [none]
none [none] 		none:none
none:none
ASM:Graph
none:none
none:none
none:none
none:none
none:none
 none|none
none|none
tElock|
none|none
none|none
none|none
none|none
none|none 		none
none
lines=126
embedded dns
none
none
none
none
none 		none
none
trace
none
none
none
none
none
03:47:00 Win2K-f 122.180.127.150 (122.AIRTELBROADBAND.IN):
BHARTI AIRTEL LTD. TELEMEDIA SERVICES,
NEW DELHI, DELHI, IN. (DSL) 		n/a   445 pcap raw alerts
ruleset 		http
1 line 		Argh : 0.3
profile 		none summary
tarball 		none none none none none none none
T:04:28:00 WinXP 112.140.4.167 (T-COM.NE.JP):
TOKAI CORPORATION,
SHIZUOKA, SHIZUOKA, JP. (DSL) 		n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		40 of 40 3a71430c8b
NEW 		none[none] none:none
 none|none none none
T:04:32:00 Win2K-f 1.112.199.15 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
315 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 42
38 of 41		 5267a50de5
NEW
ae54131ec3
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:05:39:00 WinXP 95.58.107.232 (METRO.ONLINE.KZ):
JSC KAZAKHTELECOM ATYRAU AFFILIATE,
ALMATY, ALMATY CITY, KZ. (DSL) 		n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 5e8ccc4190
NEW 		8d5f86583f [0] ASM:Graph
 PolyEnE| lines=68 trace
T:05:56:00 WinXP 82.81.18.132 (BEZEQINT.NET):
ADSL-CUSTOMER-CONNECTION,
TEL AVIV, TEL AVIV, IL. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		41 of 43 fb486908b0
NEW 		none[none] none:none
 none|none none none
T:06:02:00 WinXP 41.132.88.187 (-):
. 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		37 of 41 1f6bcbaaef
NEW 		none[none] none:none
 none|none none none
T:06:46:00 Win2K-f 110.93.109.124 (CABLENET.NE.JP):
CABLENET SAITAMA CO. LTD,
JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 41
39 of 41		 5bbb57c115
NEW
75ac189d9e
NEW 		03e5cb3c4a [0]
705dbaa801[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
T:06:53:00 WinXP 121.121.173.166 (MAXIS.NET.MY):
MAXIS BROADBAND SDN BHD,
KUALA LUMPUR, WILAYAH PERSEKUTUAN, MY. (DSL) 		n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:07:30:00 Win2K-f 63.17.73.21 (UU.NET):
UUNET TECHNOLOGIES INC,
ANACORTES, WASHINGTON, US. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
106 lines 		Yeah : 1.3
profile 		none summary
tarball 		36 of 41 dfb19bde14
NEW 		7d7d4ab834 [0] ASM:Graph
 Armadillo| lines=91 trace
T:08:26:00 Win2K-f 118.83.49.158 (HTOJ.J-CNET.JP):
JCN-HTMNET,
JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
123 lines 		Yeah : 1.3
profile 		none summary
tarball 		38 of 41
38 of 41		 23450f8f72
NEW
f5e13a2c21
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:08:40:00 WinXP 202.124.3.43 (TAKAMORI.NE.JP):
TAKAMORI CABLE INTERNET SERVICE,
TOKYO, TOKYO, JP. (DSL) 		91.193.194.67:65520 CN:proxima.ircgalaxy.pl
US:microsoft.com
CN:88.perfectexe.com
CN:w.nucleardiscover.com
CN:ck.perfectexe.com
US:dietarab.com
CN:s5.perfectexe.com
US:images01.tzimg.com
US:images01.trafficz.com
US:domdex.com
US:38.125.36.11:80 		135 pcap raw alerts
ruleset 		irc
http
130 lines 		Yeah : 1.8
profile 		none summary
tarball 		23 of 41
30 of 32
39 of 42
21 of 42
9 of 42		 457c53cd9a
NEW
8390780c27
NEW
adc7a3a471
NEW
d8652f98a7
NEW
e4240d7958
NEW 		none[none]
none [4]
none [none]
none [none]
none [none] 		none:none
none:none
none:none
none:none
none:none
 none|none
tElock|
none|none
none|none
none|none 		none
none
none
none
none 		none
trace
none
none
none
T:08:56:00 WinXP 27.54.20.222 (-):
. 		n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		41 of 43 fb486908b0
NEW 		none[none] none:none
 none|none none none
T:08:57:00 Win2K-f 118.83.48.126 (HTOJ.J-CNET.JP):
JCN-HTMNET,
JP. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
127 lines 		Yeah : 1.3
profile 		none summary
tarball 		32 of 36
34 of 36		 0b951c2832
NEW
e4ed4df0f0
NEW 		5fe761661a [0]
de471fc380[0] 		ASM:Graph
ASM:Graph
 Armadillo|
tElock| 		lines=91
lines=64
embedded dns 		trace
trace
T:08:57:00 WinXP 118.9.202.204 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
YOKOHAMA, KANAGAWA, JP. (DSL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
14 lines 		Yeah : 1.3
profile 		none summary
tarball 		29 of 29 831f4ee0a7
NEW 		none[0] none:none
 none|none lines=60 trace
T:08:59:00 Win2K-f 65.50.34.15 (BILTMORECOMMUNICATIONS.NET):
DIRECPATH LLC,
ATLANTA, GEORGIA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
113 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 41
37 of 40		 5d445c59d8
NEW
8a54950abb
NEW 		892e12db7b [0]
f6b9e43917[0] 		ASM:Graph
ASM:Graph
 tElock|
Armadillo| 		lines=64
embedded dns
lines=91 		trace
trace
T:09:53:00 WinXP 218.175.149.218 (HINET.NET):
CHUNGHWA TELECOM DATA COMMUNICATION BUSINESS GROUP,
TAIPEI, T'AI-PEI, TW. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:09:53:00 WinXP 2.133.207.162 (-):
. 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:09:58:00 Win2K-f 65.31.49.154 (RR.COM):
ROAD RUNNER HOLDCO LLC,
SPRINGFIELD, OHIO, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 33		 53bfe15e91
NEW
57ce4acac2
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:10:02:00 WinXP 186.88.43.122 (-):
. 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:10:23:00 WinXP 111.80.29.161 (HINET.NET):
MOBILE BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:11:25:00 WinXP 186.122.34.156 (-):
. 		n/a DE:moscow-advokat.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		41 of 42 ff851345d8
NEW 		none[none] none:none
 none|none none none
T:11:51:00 WinXP 111.81.188.56 (HINET.NET):
MOBILE BUSINESS GROUP CHUNGHWA TELECOM CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		42 of 43 420b1a76c4
NEW 		none[none] none:none
 none|none none none
11:57:00 Win2K-f 114.143.106.42 (RADIOONE.IN):
TATA TELESERVICES MAHARASHTRA LTD,
MUMBAI, MAHARASHTRA, IN. (DSL) 		n/a US:www.maxmind.com
:checkip.dyndns.org
:www.getmyip.org
EU:getmyip.co.uk
DE:131.220.6.26:80
EU:78.40.35.134:80
EU:91.198.22.70:80 		445 pcap raw alerts
ruleset 		http
4 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:12:06:00 Win2K-f 114.143.106.42 (RADIOONE.IN):
TATA TELESERVICES MAHARASHTRA LTD,
MUMBAI, MAHARASHTRA, IN. (DSL) 		n/a US:www.maxmind.com
:www.getmyip.org
US:checkip.dyndns.org
DE:131.220.6.26:80 		445 pcap raw alerts
ruleset 		http
5 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:12:11:00 WinXP 94.253.155.251 (XNET.HR):
BNET HRVATSKA,
HR. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		41 of 43 6e6fde936f
NEW 		none[none] none:none
 none|none none none
T:12:13:00 WinXP 109.60.188.100 (JWS.COM):
EU-ZZ,
UK. (DSL) 		n/a DE:moscow-advokat.ru
SE:qis.md.us.dal.net
:flanders.be.eu.undernet.org
:lulea.se.eu.undernet.org
AT:graz.at.eu.undernet.org
:caen.fr.eu.undernet.org
SE:viking.dal.net
:brussels.be.eu.undernet.org
:london.uk.eu.undernet.org
SE:broadway.ny.us.dal.net
:gaspode.zanet.org.za
NL:diemen.nl.eu.undernet.org
DE:82.98.86.164:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		41 of 43 04d4170d3b
NEW 		none[none] none:none
 none|none none none
T:12:31:00 Win2K-f 61.222.111.216 (HINET.NET):
XU-RONG-CHANG-TP,
TAIPEI, T'AI-PEI, TW. (100Mbps) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
110 lines 		Yeah : 1.3
profile 		none summary
tarball 		40 of 41
none		 2bc8f15054
NEW
964911406f
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:14:13:00 Win2K-f 70.65.227.232 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
RED DEER, ALBERTA, CA. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:15:08:00 WinXP 164.132.190.253 (-):
IUNET S.P.A,
MILANO, LOMBARDIA, IT. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 f53baa2781
NEW 		none[none] none:none
 none|none none none
T:15:35:00 Win2K-f 98.175.173.224, 60.190.223.75 (INVALID IPV4 ADDRESS):
INVALID IPV4 ADDRESS,
INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS, INVALID IPV4 ADDRESS. (INVALID IPV4 ADDRESS) 		91.193.194.67:65520 DE:proxim.ircgalaxy.pl
US:microsoft.com
EU:ii.kakgezaebalsha.com
EU:adcavern.com
CN:88.perfectexe.com
RU:neraline.com
:skypallete.net
CN:w.nucleardiscover.com
EU:basslombardy.org
CN:ck.perfectexe.com
CN:s5.perfectexe.com
CN:hn.yigeyuming.com
CN:2b.yigeyuming.com
CN:60.190.223.75:10167
EU:91.193.194.114:80 		135 pcap raw alerts
ruleset 		irc
http
175 lines 		Yeah : 1.8
profile 		none summary
tarball 		25 of 41
39 of 42
none
23 of 41
14 of 42
14 of 41
29 of 43
21 of 42
9 of 42		 0ee7662f37
NEW
220c0b183d
NEW
40a82f045f
NEW
457c53cd9a
NEW
9183f260e2
NEW
93e6f19839
NEW
b34e640329
NEW
d8652f98a7
NEW
e4240d7958
NEW 		none[none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none]
none [none] 		none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
none:none
 none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none
none|none 		none
none
none
none
none
none
none
none
none 		none
none
none
none
none
none
none
none
none
T:15:40:00 WinXP 110.227.212.87 (59.AIRTELBROADBAND.IN):
BHARTI AIRTEL LTD,
GURGAON, HARYANA, IN. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		39 of 40 dc467897c8
NEW 		none[none] none:none
 none|none none none
T:16:34:00 Win2K-f 74.243.222.162 (BELLSOUTH.NET):
BELLSOUTH.NET INC,
COLUMBIA, SOUTH CAROLINA, US. (DSL) 		n/a US:trademarkangel.com
:ad.doubleclick.net
US:view.atdmt.com
:furniturerents.net 		445 pcap raw alerts
ruleset 		http
irc
54 lines 		Argh : 0.3
profile 		none summary
tarball 		6 of 42 e169a143be
NEW 		none[none] none:none
 none|none none none
T:16:41:00 Win2K-f 74.235.130.68 (BELLSOUTH.NET):
BELLSOUTH.NET INC,
JACKSONVILLE, FLORIDA, US. (DSL) 		83.133.119.197:65520 RU:neraline.com
:a.95622.com
DE:proxim.ircgalaxy.pl
CN:ck.perfectexe.com
US:electronicsmed.com
CN:88.perfectexe.com
:images.ddc.com
US:domdex.com
US:p.chango.com
US:germanyny.com
EU:kakgezaebalsha.com
:cdn.dsultra.com
208.93.137.180:80
EU:91.193.194.114:80 		445 pcap raw alerts
ruleset 		http
irc
54 lines 		Yeah : 1.3
profile 		none summary
tarball 		23 of 41 457c53cd9a
NEW 		none[none] none:none
 none|none none none
T:16:50:00 WinXP 186.187.160.116 (-):
. 		n/a DE:moscow-advokat.ru
DE:82.98.86.164:6667 		445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		39 of 41 019100f1c5
NEW 		none[none] none:none
 none|none none none
T:17:14:00 WinXP 187.82.80.35 (CAMPUSEAI.ORG):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 		n/a DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
1 line 		Yeah : 0.8
profile 		none summary
tarball 		39 of 42 5a6624d74f
NEW 		none[none] none:none
 none|none none none
T:17:19:00 WinXP 75.95.236.71 (CLEARWIRE-DNS.NET):
CLEARWIRE US LLC,
HONOLULU, HAWAII, US. (DSL) 		n/a DE:citi-bank.ru
DE:213.155.0.224:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		26 of 28 7d99b0e910
NEW 		none[0] none:none
 PolyEnE| lines=68 trace
T:17:33:00 Win2K-f 208.79.96.12 (KARIBCABLE.COM):
KARIB CABLE,
KINGSTOWN, SAINT GEORGE, VC. (DSL) 		n/a   135 pcap raw alerts
ruleset 		other
209 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 40 1db29886ac
NEW 		none[none] none:none
 none|none none none
T:17:37:00 WinXP 187.82.130.64 (CAMPUSEAI.ORG):
COMITE GESTOR DA INTERNET NO BRASIL,
BR. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		42 of 43 95d1a78f0d
NEW 		none[none] none:none
 none|none none none
T:18:00:00 WinXP 190.153.4.24 (NET-UNO.NET):
NET UNO C.A,
CARACAS, DISTRITO FEDERAL, VE. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		41 of 43 6e6fde936f
NEW 		none[none] none:none
 none|none none none
T:18:03:00 Win2K-f 172.132.60.221 (AOL.COM):
AMERICA ONLINE,
RESTON, VIRGINIA, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
156 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 41
39 of 41		 5af05bec2e
NEW
ff34a1caa4
NEW 		ec2138d5b2 [0]
979a6569d4[0] 		ASM:Graph
ASM:Graph
 tElock|
Armadillo| 		lines=64
embedded dns
lines=91 		trace
trace
18:14:00 WinXP 93.102.243.132 (REV.OPTIMUS.PT):
OPTIMUS PORTUGAL,
PT. (DSL) 		213.155.0.224:80 DE:citi-bank.ru 445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 1.3
profile 		none summary
tarball 		34 of 34 d20f157117
NEW 		738f555183 [0] ASM:Graph
 PolyEnE| lines=68 trace
T:18:24:00 Win2K-f 66.60.106.38 (FIRSTDIGITAL.COM):
FIRSTDIGITAL COMMUNICATIONS LLC,
ROSEVILLE, CALIFORNIA, US. (100Mbps) 		n/a   135 pcap raw alerts
ruleset 		other
18 lines 		Yeah : 1.3
profile 		none summary
tarball 		none none none none none none none
T:19:13:00 Win2K-f 204.181.133.183 (SPRINTLINK.NET):
SPRINT,
GREENWOOD, MAINE, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
112 lines 		Yeah : 1.3
profile 		none summary
tarball 		37 of 40
38 of 41		 ae4bd44962
NEW
c48d5a281d
NEW 		none[none]
none [none] 		none:none
none:none
 none|none
none|none 		none
none 		none
none
T:20:12:00 WinXP 70.65.249.149 (SHAWCABLE.NET):
SHAW COMMUNICATIONS INC,
LETHBRIDGE, ALBERTA, CA. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:20:18:00 WinXP 173.25.166.241 (MCHSI.COM):
MEDIACOM COMMUNICATIONS CORP,
CHANHASSEN, MINNESOTA, US. (DSL) 		n/a RU:siliconfireware.ru
RU:auction.nic.ru
:www.google-analytics.com
RU:domain-parking.ru
:wpad 		445 pcap raw alerts
ruleset 		http
http
http
39 lines 		Yeah : 0.8
profile 		none summary
tarball 		29 of 29 df17a625ee
NEW 		none[0] none:none
 ASPack| lines=298
embedded dns 		trace
T:20:30:00 Win2K-f 27.98.0.4 (-):
. 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
99 lines 		Yeah : 1.3
profile 		none summary
tarball 		39 of 40
40 of 41		 6a6aaa5b73
NEW
8bde6dd126
NEW 		63889c9976 [0]
885c68f500[0] 		ASM:Graph
ASM:Graph
 tElock|
tElock| 		lines=42
lines=64
embedded dns 		trace
trace
T:20:36:00 Win2K-f 70.61.227.194 (RR.COM):
ROAD RUNNER HOLDCO LLC,
AKRON, OHIO, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
20:42:00 Win2K-f 115.82.45.144 (TAIWANMOBILE.NET):
TAIWAN MOBILE CO. LTD,
TAIPEI, T'AI-PEI, TW. (DSL) 		n/a US:www.maxmind.com
:www.getmyip.org
EU:checkip.dyndns.org
US:208.43.124.51:80 		445 pcap raw alerts
ruleset 		http
2 lines 		Yeah : 0.8
profile 		none summary
tarball 		3 of 37 d9cb288f31
NEW 		45603a001c [0] ASM:Graph
 UPX| lines=174
embedded dns 		trace
T:20:59:00 WinXP 70.182.174.45 (COX.NET):
COX COMMUNICATIONS,
EUREKA SPRINGS, ARKANSAS, US. (DSL) 		n/a US:microsoft.com 135 pcap raw alerts
ruleset 		other
75 lines 		Yeah : 1.3
profile 		none summary
tarball 		33 of 33
0 of 32		 53bfe15e91
NEW
73f1082158
NEW 		1473091351 [0]
none [0] 		ASM:Graph
none:none
 tElock|
Armadillo| 		lines=75
embedded dns
lines=90 		trace
trace
T:22:14:00 WinXP 114.149.142.199 (OCN.NE.JP):
OPEN COMPUTER NETWORK,
JP. (DSL) 		n/a   445 pcap raw alerts
ruleset 		shell
ftp
15 lines 		Yeah : 1.3
profile 		none summary
tarball 		31 of 32 741e3b03b3
NEW 		none[0] none:none
 none|none lines=61 trace