Canadian logs sample

[Cashwell]

Bot ID: 26_KENTREXS-PC_E532648A39C9F955_Bot_N26 Botnet: CIT Version: 1.3.4.5 OS Version (language): Unknown OS Language: 1033 Local time: 2012 09:45:06 GMT: -6:00 Session time: 270:22:13 Report time: 2012 15:46:42 Country: ?? IPv4: 96.52.178.236 Process name: C:\Program Files\Internet Explorer\iexplore.exe Process info: Microsoft Corporation | Windows® Internet Explorer | 9.00.8112.16421 Source: Type: HTTPS request Size (bytes): 1 477 ============================================== Proxy 74.221.211.117 : 3128 Bank of America Login: 4519019755465081 Password: 04192006 QUESTION1=In which city was my father born QUESTION2=what the full name of my oldest QUESTION3=Grandma name no space PVQList1=In which city was my father born ANSWER1=muping OWNQUESTION2=what the full name of my oldest cousin ANSWER2=yuli OWNQUESTION3=Grandma name no space ANSWER3=wangsiqing
12:23:51 PM holder owne
N1
12:24:03 PM holder owne
30_IT-8CBBTJ1_1F3D59E96522DF69_Bot_N30 IPv4: 136.159.172.87 Process name: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process info: Microsoft Corporation | Windows® Internet Explorer | 8.00.7600.16385 Source: https://www1.royalbank.com/cgi-bin/rbaccess/rbcgi3m01 Type: HTTPS request Size (bytes): 442 ================================================== = Proxy 198.27.123.59 : 80 Canada 947 ms HTTP, SSL royalbank.com Login: 4519013503753096 Password: aNNELISE OWNQUESTION1=What is my birthdate ANSWER1=jan. 22, 1966 OWNQUESTION2=Mother maiden name ANSWER2=martin OWNQUESTION3=My maiden name ANSWER3=mercier ================================================== =
12:24:05 PM holder owne
N2

31_HOME-PC_1CB98D876522DF69_Bot_N31 IPv4 Process name: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process info: Microsoft Corporation | Windows® Internet Explorer | 9.00.8112.16421 Source: https://www1.royalbank.com/cgi-bin/rbaccess/rbcgi3m01 Type: HTTPS request Size (bytes): 2 153 ================================================== ===== Proxy 198.27.127.75 : 8080 Canada 964 ms HTTP royalbank.com Login: 4519036683329924 Password: action1977 OWNQUESTION1=Wife ANSWER1=Megan OWNQUESTION2=work ANSWER2=Boston Pizza OWNQUESTION3=cat name ANSWER3=Patches ================================================== ========



37_DHAMPEL_E532648AA81CB95E_Bot_N37 ======================================== Local time: 19:21:12 Session time: 04:22:06 Report time: 15:07:27 Process name: C:\Program Files\Internet Explorer\iexplore.exe Process info: Microsoft Corporation | Windows® Internet Explorer | 9.00.8112.16421 Source: https://www1.royalbank.com/cgi-bin/rbaccess/rbcgi3m01 Type: HTTPS request Size (bytes): 2 183 LANGUAGE=ENGLISH 198.27.100.200:8080 760 ms HTTP ---------------------------------------- royalbank.com Login: 4519019859854644 Password: patrick92 OWNQUESTION1=What is my sister name ANSWER1=alisan OWNQUESTION2=what is my mom dog name ANSWER2=heidi OWNQUESTION3=What is my mom first name ANSWER3=christina



8_DELLLT_1F3D59E96522DF69_Bot_N38 ================================================== ========== Process name: C:\Program Files (x86)\Internet Explorer\iexplore.exe Process info: Microsoft Corporation | Windows® Internet Explorer | 9.00.8112.16421 Source: https://www1.royalbank.com Type: HTTPS request Size (bytes): 1 322 Accept-Language: en-US Accept-Encoding: gzip ====================================== Proxy 198.27.107.41 8080 Canada 683 ms HTTP ====================================== Login: 4519027474605093 Password: UA67local QUESTION1=Who was my favourite cartoon character as a child [ANSWER1=mickey mouse] QUESTION2=What was the first book I ever read [ANSWER2=bible] QUESTION3=What was the make of my first car [ANSWER3=ford]



---------------------------------------- royalbank.com Login: 4519019859854644 Password: patrick92 OWNQUESTION1=What is my sister name ANSWER1=alisan OWNQUESTION2=what is my mom dog name ANSWER2=heidi OWNQUESTION3=What is my mom first name ANSWER3=christina