Title: DEFIANTWARRIOR and the NSA’s Use of Bots

Release Date: 2015-01-17

Document Date: 2010-05-24

Description: This 24 May 2010 NSA presentation describes the ways the agency uses botnets (“bot herding”): see the Der Spiegel article The Digital Arms Race: NSA Preps America for Future Battle, 17 January 2015.

Document: TOP SECRET//COMINT//REL USA, FVEY

DEFIANTWARRIO R 7
/ //and the ;
NSA's Uè^ojÆotá/

Overall Classification: TOP SECRET//COMINT//REL FVEY
Current As Of: 24 May 2010

Derived From: NSA/CSSM 1-52
Dated: 20070108
Declassify On: 20350401

TOP SECRET//COMINT//REL USA, FVEY

Unless otherwise noted, treat all coptained^items within
slides as classified at the level of the containing slide
as indicated at the top of the slide. yy /Z///^/Z///

SECRET//REL USA, FVEY

• BotNet Background

Bot Herding 101 x

• NSA’s Adventures in Bot Herding (FAIL)

• Successful Endeavors ///^Z^/aZv/

SECRET//REL USA, FVEY

UNCLASSIFIED//FOR OFFICIAL USE ONLY

Bot Networks - Worldwide

Symantec..

► Average of 63,912 active bot network computers per day, an 11% increase.
Worldwide total rose to just over 6,049,594 - a 29% increase.

► 4,746 Command and Control servers were observed; 40% U.S. based

► China has moved to the top - to 26% while the United States continues to
decline. EMEA countries, with the exception of the U.K., showed the largest
increase.

Canada (10) 2% United Kingdom (6)4% France - Poland
United States (3)6% jTA (8)3%
(2) 14% Spain ' (5) 5% Germany (4} 6%

China
(1) 26%

-Taman
[75 4%

Key

(X) = Rank

% = Current prapitrtiôn

Brazil
(9) 3%

UNCLASSIFIED//FOR OFFICIAL USE ONLY

TOP SECRET//COMINT//REL USA, FVEY

Bot Herding 101 - It’s a Business

• Used Extensively for Illicit Means vZ////,

- Distributed Denial of Service (DDoS)

- SPAM Operations Z/^Z/%Z/Z^/Z/yy/

- Financial Fraud

- Intelligence Collection (Brazil, Russia, China, etc)

• Three Modes of Control

- Phase 1 - IRC

Phase 2- HTTP (OLYMPUS/UNITEDRAKE are Bots)

- Phase 3 - Peer-to-Peer

TOP SECRET//COMINT//REL USA, FVEY

SECRET//REL USA, FVEY

Master Herder Controls
Subordinate Command &
Control Nodes

Each C2 Nodes Relays
Herder’s Instructions to
Bots

- Individuals /////////

- Era-Mass //

BotNets Have Been
Observed with Millions of
Nodes

SECRET//REL USA, FVEY

SECRET//REL USA, FVEY

Box Herdina 101 - Hostile Take Over

• BotNets are Regularly
Exchanged, via

- Rent '///a////

- Sale

- Hostile Take Over -
aka BotWar

• Sting Operations

- Use Valid BotHerder
Credentials

^ - Take Control of the C2
Channel



rmo

■_J till



non

ZJ

Node

xlOO

xlO.OOO

SECRET//REL USA, FVEY

/,//// // / 7/7/ - 77/" 77/

7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7 7

• FBI Open BotNet Cases

• US Government Control

• Bots Directed to “Bot Prison”

- Custom IRC Server

• Bot IPs Processed Through
Quarantine Engine

- .foreign - Directed to TAO IR
Server

- .gov/.mil - NTOC Business
Logic

- .us - FBI Office of Victim
Assistance

• FBI Goes Public - Avoid
BotWar

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

fyÿ/WtëÿfâlU T Approach

Leverage FVEY SIGINT Systems to Identify
and Target Foreign Bots

Extensively Utilize GCHQ Midpoint
Collection Platforms (and Personnel)

Heavy Integration with TURBULENCE
Architecture (aka QUANTUMBOT)

- TURMOIL - Passive Tipping /'//^K/yy^//////

- TURBINE - High/Low/High Interaction

- Snipers - Man-on-the-Side Injection

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

What the DW OPSEC Profile Buys:

• “go broad” active CNE

• Pervasive network analysis vantage points

• Throw-away hon-attributable CNA nodes

Doreen 13 US ScriptK 16 Rom

I_______I_______I______I___

Scale of L33t

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

XTjot Apgpfeition Setup /

• Check XKEYSCORE for exploitable bots

• Task TURMOIL to watch for such traffic

• Task TURBINE to generate MOTS packet

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

IRC Server

commands

o—

ping-pong for
commands

Ch

I’m here

Q

■Cr

TAO IRC TAO Bot

y

NSA

Bot

Go download this
executable: □

command
• packet

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

The Reality /

• QBO"f tippingioff of INCENSER

• ... but nowhere else

• Have bots in and

• ... but nowhere else

• Channel healths is highly diurnal

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

• A botnet upon which the sun never sets

• QUANTUMBOT tipping diversification

STELLABLUE //

- SMOKYSINK / V

- TURMOILS at Menwith, MSOC, YRS

• Technique diversification

- Man In The Middle (vs Man On The Side)

/ • More locations

• easier to exploit HTTP bots (no race condition)

- Throw exploits from our bots

• Exploit toe-holds on networks to get better penetratipn

TOP SECRET//COMINT//REL USA, FVEY

STOVEPIPES

Through extensive coordination, we will build a comm unity of com plete incom patibility.

TOP SECRET//COMINT//REL USA, FVEY



• QBOT tasking can* get stale (bots change)

• TURMOIL QBOT tasking can* break

• TURBINE QBOT tasking can* break

• ISLANDTRANSPORT can* break

• QUANTUM Diodes can* break

• Web sniper can* break

• FESTIVEWRAPPER can* break

• TURBINE bot tasking can* break

• LPs can* break

• FREEFLOW diodes can* break

• TAO-homed post-processing can* break

y TURBINE-homed post-processing can* break

• Security Marking Service can* break

• PRESSUREWAVE can* break

* do / does

TOP SECRET//COMINT//REL USA, FVEY

CDR

TAO Net

TOP SECRET//COMINT//REL USA, FVEY

DEERFRJEDPIG

SEAGULLFAftO k
T

COLOSSUS

STORM PIG

WAITAUTO

FTPMoveS

Data cleanup

FREEFLOW FREEFLOW
HANGAfiSLrRPLUS(high) SURPLUÊHANGAR {high)

FREEFLOW

HANGARSURPLUS {low)

FREEFLOW

SURPLUSHANGAR {low}

MWdleMan

WARNVOLCANO

Listen rg Post Server

STRAITBIZARRE

'RC Server ■

UFE Server

ÖMW I

-► Weh Seiner

/targels

COR (high)

CDR (low)

BMS Server

BMS

• Glom onto every status feed you can

• Squeeze the possible problem region

• Know who can help you

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

Metrics, Metrics, and more Metrics

1 Botlnstances: index - Mozilla Firefox

File Edit View History Bookmarks Tools Help

TOP SECRET//COMINT//REL USA, FVEY

C X

□ I

•* I ’ j Google



a Most Visited ^ Getting Started Latest Headlines

But Instances: indew |g|| Q Botlnstances: show

[Herds] [Bots] [Connected Botsl [Bet Types 1 [Machines] HP Usages! [Countries] i Com in a n d Recurrences! fCommand Tvtjesl

Logged in as:

n Refresh Every Minut

For Botlnstances Located In^|Of Type XTNZ ( Connected | [All] )
Displaying Botlnstances i - 30 of 1593 in total

« Previous 123456789,.,5354 Next »
_____Per Page: 25 < 50 < 100 < All_

[Ü Bot Instance Bat Type Machine Last Observed IP First Callback Time Last Callback Time V Lifetime Country Binary Key
1 □ rXTNZI-JGIAWCHYMBNIAHVJKIBl [+] XTNZ JGIAWCMYMBNIAHVJKIBI 2010-03-26 13:56:42 UTC 2010-04-21 19:21:03 UTC 26d 5h 24m 21s
2 n rXTNZl-AVHTNOCSPJWODWWYWDXB [+] XTNZ AVHTNOCSPJWODWWYWDXB 2010-03-22 07:49:12 UTC 2010-04-21 19:21:00 UTC 30d llh 31m 48s
3 [+] XTN7 XOBJWCONEVJEMEDGKUXT 2010-03-00 10:42:00 UTC 2010-04-21 19:20:54 UTC ■44d Bfi^Ssu’iSs-.
4 □ TâiWÈ'T“Pf3cSiihi6iiyiifrïîiippiysaô [+] X-fÈ]£' PDDWHBKVOIGRPPAUZABD 2010-03-10 08:02:17 UTC 2010-04-21 19:20:54 UTC füÿ
5 □ rXTNZl-XHJWODYTIIZHYMYPOJRM [+] XTNZ XHJWODYTIIZHYMYPOJRM 2010-03-10 13:55:54 UTC 2010-04-21 19:20:54 UTC 42d 5h 25m 05
6 □ rXTNZl-YWGCEFULROUZS WJIIFOC [+] XTNZ Y WG CEFULRO ÜZS WJ IIFOC 2009-11-30 05:15:05 UTC 2010-04-21 19:20:45 UTC 142d 14h 5m 40s
7 u rXTNZl-SESLOOPVICGZVOKWlVUN [+] XTNZ SESLOOPVICGZVOKWIYUN 2010-03-21 16:16:34 UTC 2010-04-21 19:20:29 UTC 31d 3h 3m 55s
3 □ 'FXTN7l-IfjyriMRYRBOäSSSaiS!nT7:B' KîXTN7 INYDMRYRROACSSBBDTZP 2010-03-17 19:06:20 UTC 2010-04-21 19:20:20 UTC äscToh
9 □ ïx¥Ml-Flù¥4îfeM^ [+] XTMZ HUTAfMSCBIOGKLCZLX VEA 2010-Q3-1B 06:54:59 UTC 2010-04-21 19:20:23 UTC
10 □ rXTNZl-MKILDRAENRUXYHWONDMO [+] XTNZ MKILDRAENRUXYHWONDMO 2010-03-21 15:45:32 UTC 2010-04-21 19:20:23 UTC 31d 3h 34m 56s
11 rXTNZl-HOSHJBVRPJ WBNFCEMSXK [+] XTNZ H OS HJBVRPJ WBNFCEMSXK 2010-03-21 19:52:13 UTC 2010-04-21 19:20:28 UTC 30d 23h 28m 15s
12 n rXTNZl-NCCRJFJJNMXUXJBIAUCH [+] XTNZ NCCRJFJJNMXUXJ&IAUCH 2010-03-22 10:01:02 UTC 2010-04-21 19:20:23 UTC 30d 9h 19m 26s
13 IViTSii -MH^fH888WWin14 □ Ti^iT'-BSifiilÖMBÖVFHALaffiSgB [+] X-fN-Z FFCKJIOMBUVFHALTRRBG 2010-03-11 11:59:05 UTC 2010-04-21 19:20:17 UTC
15 B rXTfMZl-LNKWMUOJDRBIFERNUPEC [+] XTNZ LNKWMUOJDRBIFERNUPEC 2010-03-17 21:07:41 UTC 2010-04-21 19:20:17 UTC 34d 22h 12m -365
16 □ rXTNZl-PKQKRNROSSXUTSZHTOJN [+] XTNZ PKQKRNROSSXUTSZHTOJN 2010-04-01 18:09:15 UTC 2010-04-21 19:20:08 UTC 20d lh 10m 53s
17 B rXTNZl-EVDELNABZLXZHYGBCNYG [+] XTNZ EVDELNABZLXZHYGBCNYG 2010-03-31 13:53:33 UTC 2010-04-21 19; 19:47 UTC 21d Sh 26m 14s
18 □ TXTN7i-FM»KlïïllïXVrÎLVPl7;19 □ TKVÄkl-HVVn^VMYVSHWFAÄasBäwA [+] HWOWMYVSHWEAMEJOJDNA 2010-03-23 09:30:13 UTC 2010-04-21 19: 19:21 UTC Shî Btl ,4ï&M fe
20 V, rXTNZl-OYZYUYPWDOLZIIPPMOOP [+] XTNZ OYZYUYPWDOLZIIPPMOOP 2010-03-23 09:42:21 UTC 2010-04-21 19: 19:19 UTC 29d 9h 36m 505
21 B rXTNZl-AGEXNMBSBOAVGXJHLOPA [+] XTNZ AGEXNMBSBOAVGXJHLOPA 2010-03-22 06:23:50 UTC 2010-04-21 19: 19:07 UTC 30d 12h 55m 17s
22 n rXTNZl-MRSGJRZXUSMNMUPXWNlO [+] XTNZ MRSGJRZXUSMNMUPXWNIO 2010-03-23 09:29:10 UTC 2010-04-21 19; 19:07 UTC 29d 9h 49m 57s
23 B ÏXTNZl iNÎ^jfeîîi® [+] XTN7 CXDTLZNAZJJNT VXAOJGW 2010-03-26 13:21:40 UTC 2010-04-21 19: 19:07 UTC aed Sh ää&sJi»
24 □ iSüülSPB Hiää^öSiSM \M K M F ySSî [+] X-fN-Z OHASZJMBRYMWXKMFYKTA 2010-03-27 01:46:33 UTC 2010-04-21 19: 19:01 UTC
25 B ïxtmzi-f-bfxwèmemWâltya'rezz [+] XTNZ FBFffiiëMEKmALîVÂiREMi 2009-11-11 13:00:34 UTC 2010-04-21 19: 18:30 UTC 161d 6h 17m 565
26 □ rXTNZl-XZABQDIONKXUDNOVWLL [+] XTNZ XZABODIONKXUDNOVWLL 2010-04-01 08:53:39 UTC 2010-04-21 19: 16:47 UTC 20d 10h 18m 8s
27 B rXTNZl-LNLHUONJZGAHDOELTHJÜ [+] XTNZ LN LH UO NJ Z G A H DO E L T H J ü 2010-03-23 04:42:40 UTC 2010-04-21 19; 16:20 UTC 29d 14h 33m 40s
20 □ ■®

• Be awesome enough to be useful...

• ... and not get caught trivially

• ... but not as awesome as a state actor

• ... and notice when we do get burned

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

Prevent and Detect

^/Fod ay /'

- Uniquely packed shipped binaries

- Uniquely keyed shipped binaries '///

- Separate LPs

• Tomorrow x yyy^0^0y^//

- LPs shielded with commercial services

- Deployment is carefully staged

- Reverse honey-nets ' / y

TOP SECRET//COMINT//REL USA, FVEY

• Today

- Put SIGDEV surveys in PRESSUREWAVE

- Send traceroutes to TREASUREMAP

• Tomorrow > ///////////

// - Enrich connect logs with PUZZLECUBE //////////

- Make hot data visible to MARINA

// - Make file collection possible with SEEKER

- Put BMS on NSANet

- Push captured PKI to CES

- Harvest user identifiers and marry up with other data

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

0 C X , J]

03 Most Visited ^ Getting Started Latest Headlines

Botlnstances: indeK Iti Q Botlnstances: show

Ù ' ir‘l'| •

rHerds'! fBotsl [“Connected Botsl [Bot Types! [“Machines! riP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Logged in as: 73BB2
n Refresh Every Minute

For Botlnstances Unfiltered ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 5940 in total

[+] Bat Instance Bat Type Machine
1 □ rXTNZI-IVKCCBINSYEENCFLCHXM [+] XTNZ IVKCCBINSYEENCFLCHXM 1
2 □ iw«6»*ei69psiw!eaa#&iwi>tm n»« SESLOOP YICGZVOKWIYUN
3 □ rXTNZl-EVDELIMABZLXZHYGBCNYG [+] XTNZ EVDELNABZLXZHYGBCNYG
4 □ iTURDl-NGVWGSPPCADOOMSVIVDW [+] TURD NGVWGSPPCADOOMSVIVDW
5 H ÎXTNZ1-PKOKRNROSSXUTSZHTQJN [+] XTNZ PKOKRNROSSXUTSZHTOJN
e □ iTURDl-PDDWHBKVQIGRPPAUZABD [+] TURD PDDWHBKVÜIGRPPAUZABD
7 rfvj'Bbi-fflfcs'ftMsiNOFriijiMSïftii IUC WOTDONOFGUAROSVOX
a □ T TURD 1-CXDTLZNAZJJNTVX AOJGW [+] TURD CXDTLZNAZJJNTVX AOJGW
g □ [TURD1-OWZLCRMTLDVICGEUORL [+] TURD- 0VVZLC RMTLDVICGEUORL
ID E rXTNZl-FMWNTULXVOLVPCXLAUUH [+] XTNZ FMWNTULXVOLVPCXLAUUH
li iXTNZl-MFRDCUMTYKZGLYCRWEFW [+] XTNZ MFRDCUMTYKZGLYCRWEFW
12 □ rSitfeï^FRftpnRFræïÿifiîiiiRiliHH ll»« JERBPDBEDPIYKOWDJUHH
13 □ TXTNZl-BOOCGVRAF WWIJH ACJOOG [+] XTNZ BOOCGVRAF W WÏJHACJOOG
1 + □ iTURDl-FMWNTULXVOLVPCXLAUUH [+] TURD FMWNTULXVOLVPCXLAUUH

15 u iXTNZl-lUCWOTDQNQFGUARQSVOX [+] XTNZ IUCWOTDONOFGUAROSYOX
16 □ rXTNZl-AGEXNMBSBOAVGXJHLOPA [+] XTNZ AGEXNMBSBOAYGXJHLOPA
17 WlKB rYRB8| VZAIHOEDBSOIOZGHHANS
IB □ rXTNZl-MRSGJRZXUSMNMUPXWNIO [+] XTNZ MRSGJRZXUSMNMUPXWNIO
19 TXTNZl-CXDTLZNAZJJNTVX AOJGW [+] XTNZ CXDTLZNAZJJNTVX AOJGW
2D E f XTNZ1-GJPDFSZHXIBYGQIRCBXC [+] XTNZ GJPDFSZHXIBYGOIRCBXC
21 tt iXTNZl-HOFDDPPYCKFKGDGOAHHS [+] XTNZ HOFDDPPYCKFKGDGOAHHS
22 □ [Spun XOBJWCONEVJEMEDGKUXT
23 □ rTURDl-OHTFJEDWUXFBNDMODONl [+] TURD OHTFJEDWUXFBNDMODONI
24 □ [TURDl-IASTIKABAOIDWYNMYSCA [+] TURD IASTIKABAOIDWYNMYSCA

25 H ÎTURD1-ALNABRMDZOJOKBKUZDIJ [+] TURD ALNABRMDZOJOKBKUZDIJ
26 □ iTURDl-AGEXNMBSBOAVGXJHLOPA [+] TURD AGEXNMBSBOAVGXJHLOPA
27 □ rTijHDf-È^rt^'Sfel^i^îîWWÀ-as V7ATH0FnB80Tn7GHHANR
2B □ TTURDl-IUWCJYNSTCILDHOWZAO [+] TURD IUWCJYNSTCILDHOWZAO

: Previous 123456789,., 197 198 Next ;
Per Page: 25 < 5B < 100 < All

First CallbackTime Last CallbackTime T Lifetime
2010-03-22 06:24:57 UTC 2010-04-21 19:07:25 UTC 30d 12h 42m 28s
2010-03-21 16:16:34 UTC 2D1D-U4-21 19:07:24 UTC ■S'Id’iiuSGrti'Sos
2010-03-31 13:53:33 UTC 2010-04-21 19:07:14 UTC 2 id Sh 13m 415
2D1D-D4-D1 19:39:13 UTC 2D1D-U4-21 19:07:11 UTC 19d 23h 27m 53s
2010-04-01 13:09:15 UTC 2010-04-21 19:07:10 UTC 20d Oh 57m 55s
2010-03-11 17:01:31 UTC 2010-04-21 19:07:09 UTC 4Id 2h 5m 38s
0hi'S4tmS§s
2010-04-01 13:12:36 UTC 2010-04-21 19:07:09 UTC 20d 5h 54m 335
2010-04-16 15:10:04 UTC 2D1D-U4-21 19:07:09 UTC 5d 3h 57m 5s
2010-03-11 09:36:28 UTC 2010-04-21 19:07:04 UTC 4Id 9h 30m 36s
2010-03-23 04:43:29 UTC 2010-04-21 19:07:04 UTC 29d 14h 23m 35s
2010-03-27 13:14:09 UTC 2D1D-U4-21 19:07:04 UTC
2010-03-31 14:22:32 UTC 2010-04-21 19:07:04 UTC 2 id 4h 44m 325
2010-03-11 19:47:17 UTC 2D1D-U4-21 19:07:03 UTC 40d 23h 19m 46s
2010-03-22 03:17:53 UTC 2010-04-21 19:06:54 UTC 30d 15h 49m Is
2010-03-22 06:23:50 UTC 2010-04-21 19:06:54 UTC 30d 12h 43m 4s
sdffîÉraiiHnfc 6 ï iSSffl® 2D1D-U4-21 19:06:54 UTC ■3Bdith' limiSs
2010-03-23 09:29:10 UTC 2010-04-21 19:06:54 UTC 29d 9h 37m 445
2010-03-26 13:21:48 UTC 2D1D-U4-21 19:06:54 UTC 26d 5h 45m 6s
2010-03-30 03:04:43 UTC 2010-04-21 19:06:54 UTC 22d llh 2m 11s
2010-03-30 10:46:34 UTC 2010-04-21 19:06:54 UTC 22d 8h 20m 20s
2010-03-11 19:47:19 UTC 2D1D-U4-21 19:06:52 UTC
2010-03-24 15:44:37 UTC 2010-04-21 19:06:52 UTC 28d 3h 22m 155
2010-03-24 15:44:53 UTC 2D1D-U4-21 19:06:52 UTC 28d 3h 21m 59s
2010-04-01 19:35:29 UTC 2010-04-21 19:06:52 UTC 19d 23h 31m 23s
2010-03-24 13:42:48 UTC 2010-04-21 19:06:42 UTC 28d 5h 23m 54s
¿j8SiiMa8fci&iSWrfflM» 2D1D-U4-21 19:06:42 UTC Atid llr lSmsSs
2010-03-24 10:31:23 UTC 2010-04-21 19:06:42 UTC 2Gd Oh 35m 195

TOP SECRET//COMINT//REL USA, FVEY

Country Binary Key

rvFuu3ycHT ,

SFFxbPlvOS ■

HcOjEzE6Zh ,

RVndBn5JLl .

nebDlepHmt ,

vrXTYEsveP ,

aSWfnfhmVn .

9G6VqR2rBq .

Psi5n7iDWC .

E5rZJBF3A7 ,

irLqAl953x ,

cFihNdi?P7f .

K3zlDGrDmk .

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

@ ’ C X u

Ù ' ir‘l'i •

03 Most Visited ^ Getting Started Latest Headlines

Botlnstances: indeK Iti Q Botlnstances: show

rHerds! fBots! [“Connected Bots! [Bot Types! fMachines! riP Usages! [“Countries! fCommand Recurrences! [“Command Types!

Logged in as: 73BB2
n Refresh Every Minute

For Botlnstances Unfiltered ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 5940 in total

[+] Bat Instance: Bat Type Machine
1 □ rXTNZl-IVKCCBINSVEENCFLCHXM
View Bots Of Tvoe BFLCHXM

2 □ r iStfet-s e bss® p v iceitfÊiK w iyuw. fOKWI YUISI
View Bets Also Of Tvoe

3 □ rXTNZl-EVDELIMABZLXZHYGBCNYG IYGBCNYG

View Type Stats

4 □ iTURDl-NGVWGSPPCADOOMSVIVDW )OMSVI YDW

5 H rXTNZl-PKOKRNROSSXUTSZHTQJN [+] XTNZ PKOKRNROSSXUTSZHTQJN
e □ iTURDl-PDDWHBKVQIGRPPAUZABD [+] TURD PDDWHBKYOIGRPPAUZABD
7 rfVJBbl-Äfcä'ftMSiNOFElIjiMÄÄii T WtiMiill IUC WOTDONOFGUAROSVOX
a □ TTURDl-CXDTLZNAZJJNTVX AOJGW [+] TURD CXDTLZNAZJJNTVXAOJGW
g □ [TURD1-OWZLCRMTLDVICGEUORL [+] TURD 0 VVZLC RMTLDVICGEUORL
ID E rXTNZl-FMWNTULXVOLVPCXLAUUH [+] XTNZ FMWNTULXVOLVPCXLAUUH
li iXTNZl-MFRDCUMTYKZGLYCRWEFW [+] XTNZ MFRDCUMTYKZGLYCRWEFW
12 □ iSSn^^FRhpnRFra&iiiWBitJHH JERBPDBEDPIYKOWDJUHH
13 □ rXTNZl-BOOCGVRAF WWIJH ACJOOG [+] XTNZ &OOCGVRÀFWWIJHACJOOG
1 + n iTURDl-FMWNTULXVOLVPCXLAUUH r+! TURD FMWNTULXVOLVPCXLAUUH

15 Ö rXTNZl-lUCWOTDONOFGUAROSVOX [+] XTNZ IUCWOTDONOFGUAROSYOX
16 □ rXTNZl-AGEXNM&SBOAVGXJHLOPA [+] XTNZ AGEXNMBSBOAYGXJHLOPA
17 WlKB VZAIHOEDBSOIOZGHHANS
IB □ rXTNZl-MRSGJRZXUSMNMUPXWNIO [+] XTNZ MRSGJRZXUSMNMUPXWNIO
19 TXTNZl-CXDTLZN AZJJNTVXAOJG W [+] XTNZ CXDTLZNAZJJNTVXAOJGW
2D E rXTNZl-GJPDFBZHXIBYGOIRC&XC [+] XTNZ GJPDFSZHXIBYGOIRCBXC
21 tt iXTNZl-HOFDDPPYCKFKGDGOAHHS [+] XTNZ HOFDDPPYCKFKGDGOAHHS
22 □ pfijppplf XOBJWCONEVJEMEDGKUXT
23 □ rTURDl-OHTFJEDWUXFBNDMODONl [+] TURD OHTFJEDWUXFBNDMODONI
24- n [TURDl-IASTIKABAOIDWYNMYSCA r+! TURD IAST1KABAOIDWYNMYSCA

25 H ÎTURD1-ALNABRMDZOJOKBKUZDIJ [+] TURD ALNABRMDZOJOKBKUZDIJ
26 □ iTURDl-AGEXNM&SBOAVGXJHLOPA [+] TURD AGEXNMBSBOAVGXJHLOPA
27 □ rTijHDf-È^rt^'Sfel^ï^îîWË'Â-as V7ATHOFnBSOTn7GHHANR
2B □ TTURDl-IUWCJYNSTCILDHOWZAO [+] TURD IUWCJYNSTCILDHOWZAO

: Previous 123456789,., 197 198 Next ;
Per Page: 25 < 5B < 100 < All

First CallbackTime Last CallbackTime T Lifetime
2010-03-22 06:24:57 UTC 2010-04-21 19:07:25 UTC 30d 12h 42m 28s 1
2010-03-21 1&:16:34 UTC 2Q1Q-Q4-21 19:07:24 UTC
2010-03-31 13:53:33 UTC 2010-04-21 19:07:14 UTC 2 id Sh 13m 415
2010-04-01 19:39:13 UTC 2Q1Q-Q4-21 19:07:11 UTC 19d 23h 27m 53s
2010-04-01 13:09:15 UTC 2010-04-21 19:07:10 UTC 20d Oh 57m 55s
2010-03-11 17:01:31 UTC 2010-04-21 19:07:09 UTC 41d 2h 5m 38s
’£.‘ ■''„'LVjÄ.vSjf Wg Aid OhfSrttmSgs
2010-04-01 13:12:36 UTC 2010-04-21 19:07:09 UTC 20d 5h 54m 335
2010-04-16 15:10:04 UTC 2Q1Q-Q4-21 19:07:09 UTC 5d 3h 57m 5s
2010-03-11 09:36:28 UTC 2010-04-21 19:07:04 UTC 41d 9h 30m 36s
2010-03-23 04:43:29 UTC 2010-04-21 19:07:04 UTC 29d 14h 23m 35s
2010-03-27 13:14:09 UTC 2Q1Q-Q4-21 19:07:04 UTC :SpSpif||
2010-03-31 14:22:32 UTC 2010-04-21 19:07:04 UTC 2id 4h 44m 325
2010-03-11 19:47:17 UTC 2Q1Q-Q4-21 19:07:03 UTC 40d 23h 19m 46s
2010-03-22 03:17:53 UTC 2010-04-21 19:06:54 UTC 30d 15h 49m Is
2010-03-22 06:23:50 UTC 2010-04-21 19:06:54 UTC 30d 12h 43m 4s
iSiÂÈSHlfestiMÔÉË 2Q1Q-Q4-21 19:06:54 UTC ■3Bdith' limiSs
2010-03-23 09:29:10 UTC 2010-04-21 19:06:54 UTC 29d 9h 37m 445
2010-03-26 13:21:48 UTC 2Q1Q-Q4-21 19:06:54 UTC 26d 5h 45m 6s
2010-03-30 03:04:43 UTC 2010-04-21 19:06:54 UTC 22d llh 2m 11s
2010-03-30 10:46:34 UTC 2010-04-21 19:06:54 UTC 22d 8h 20m 20s
2010-03-11 19:47:19 UTC 2Q1Q-Q4-21 19:06:52 UTC
2010-03-24 15:44:37 UTC 2010-04-21 19:06:52 UTC 28d 3h 22m 155
2010-03-24 15:44:53 UTC 2Q1Q-Q4-21 19:06:52 UTC 28d 3h 21m 59s
2010-04-01 19:35:29 UTC 2010-04-21 19:06:52 UTC 19d 23h 31m 23s
2010-03-24 13:42:43 UTC 2010-04-21 19:06:42 UTC 28d 5h 23m 54s
iSÂSM.dï : 2Q1Q-Q4-21 19:06:42 UTC Aid llr ism 23s
2010-03-24 10:31:23 UTC 2010-04-21 19:06:42 UTC 28d Oh 35m 195

Last Observed IP

TOP SECRET//COMINT//REL USA, FVEY

Country Binary Key

rvFuu3ycHT .

SFFxbPlvQS ■

HcOjEzE&Zh ,

RVndBn5JLl .

nebDlepHmt .

yrXTYEsveP .

aSWfnfhmVn .

9G6VqR2rBq .

Psi5n7iDWC .

E5rZJBF3A7 ,

irLqAl953x ,

nF!hNdi?P7f .

K3zlDGrDmk .

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

m - c x

03 Most Visited ^ Getting Started Latest Headlines

Botlnstances: in dew Q Botlnstances: show

Ù ' ir‘l'i •

rHerds'! fBotsl [“Connected Botsl fBot Types! [Machines] [IP Usages! [“Countries! fCommand Recurrences'! fCommand Types!

Logged in as: 73BB2
n Refresh Every Minute

For Botlnstances Of Type XTNZ ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 3556 in total

1 pï Bot Instance Bot Type Machine
1 □ rXTNZl-AVHTNOCSPJWODWWYWDXB [+] XTNZ AVHTNOCSPJWODWWYWDXB
2 □ ifiMSl -HW:0:»TÎfteHW'EAifflëSiâÏHSNA [+] iffiBg HWOWMYVSHWEAMEJOJDNA
3 □ rXTNZl-OYZYUYP WDOLZIIPPMOOP [+] XTNZ OYZ YUYP WDOLZIIPPMOOP
4 □ rXTNZl-IUC WOTDONOFGUARQS VOX [+] XTNZ IUCWOTDONOFGUAROSVGX
5 u rXTISIZl-AGEXNMBSBOAVGXJHLOPA [+] XTNZ AGEXNMBSBOAVGXJHLOPA
6 □ rXTNZl-VZAIHOEDBSOIOZGHHANS [+] XTNZ VZAIHOED&SOIOZGHHANS
7 Jtf ‘¡WMl-MR^^^BèSIrvIUPXVVNIffl [+] xite, MRSGJRZXUSMNMUPXWNIO
3 □ rXTNZl-CXDTLZNAZJJNT VXAOJGW [+] XTNZ C XDTLZNAZJJNT VX A OJ GW
9 □ rXTNZl-HOFDDPPYCKFKGDGOAHHS [+] XTNZ HOFDDPPYCKFKGDGOAHHS
10 n rXTNZI-OHASZJMBRYMWXKMFYKTA [+] XTNZ OHASZJMBRYMWXKMFYKTA
11 rXTNZl-XPINCPGRUCIKORBNCDTN [+] XTNZ XPINCPGRUCIKCR&NCDTN
12 □ ffiMHSäSSÜfe 1 ïKffiïÈ-i' J E M ESäWSf [+] iffiBg XOBJWCQNEVJEMEDGKUXT
13 □ rXTNZl-PDDWHBKVOIGRPPAUZABD [+] XTNZ PDDWH&KVOIGRPPAUZABD

14 □ rXTNZl-XHJWODYTIIZHYMYPOJRM [+] XTNZ XHJWODYTIIZHYMYPOJRM
15 u rXTNZl-OGBCUWGTUBÜNCOVEXOPL [+] XTNZ OGBCÜWGTUBÜNCOVEXOPL
1Ô □ rXTNZl-OHTFJEDWUXF&NDMODONI [+] XTNZ OHTFJEDWUXFBNDMODONI
17 [+] xite, DFFZDNZVJKOHZAOJXFHU
18 □ rXTNZl-YWGCEFULROUZS WJIIFOC [+] XTNZ Y WG CEFULRO UZS WJ IIFOC
19 Ul rXTNZl-FBFXHJGMEMWALTYAREZZ [+] XTNZ FBFXHJGMEMWALTYAREZZ

20 □ rXTNZl-ALNABRMDZOJOKBKUZDIJ [+] XTNZ ALNABRMDZOJOKBKUZDIJ
21 rXTNZl-NGVWGSPPCADOOMSVIVDW [+] XTNZ NGVWGSPPCADOOMSVIVDW
22 □ [+] iffiBg CTVEMNPOOOOOLSYZSUTJ
23 □ rXTNZl-INYDMRYRROACSSBBDTZP [+] XTNZ INYDMRYRROACSSBBDTZP

24 □ rXTNZl-HUTANSCBIOGKLCZLXVEA [+] XTNZ HUTANSCBIOGKLCZLX VEA
25 rXTNZl-MKILDRAENRÜXVHWONDMO [+] XTNZ MKILDRAENRÜXYHWONDMO
2Ô □ rXTNZl-HOSHJBVRPJWBNFCEMSXK [+] XTNZ HOSHJBVRPJW&NFCEMSXK
27 □ ■ r KŸft'éj-É1 M1 --'isQ: : [+] PMTNPRORI IFXAOAWWYDN

28 □ rXTNZl-IMCCRJFJJNMXÜXJBIAÜCH [+] XTNZ NCCRJFJJNMXÜXJBIAUCH


: Previous 123456789,., 118 119 Next s
Per Page: 25 < 5B < 100 < All

First Callback Time Last CallbackTime ¥ Lifetime
2010-03-22 07:49:12 UTC 2010-04-21 19:19:21 UTC 30d llh 30m 9s
2B1B-03-23 09:30:13 UTC 2810-04-21 19: 19:21 UTC
2010-03-23 09:42:21 UTC 2010-04-21 19! 19! 19 UTC 29d 9h 36m 505
2010-03-22 03:17:53 UTC 2010-04-21 19: 19:07 UTC 30d 16h lm 14s
2010-03-22 06:23:50 UTC 2010-04-21 19; 19:07 UTC 30d 12h 55m 17s
2010-03-22 09:51:26 UTC 2010-04-21 19; 19; 07 UTC 30d 9h 27m 41s
SSa-Bä||| 2010-04-21 19: 19:07 UTC ii® * iliyisfe
2010-03-26 13:21:40 UTC 2010-04-21 19! 19:07 UTC 26d 5h 57m 195
2010-03-30 10:46:34 UTC 2010-04-21 19: 19:07 UTC 22d 8h 32m -33s
2010-03-27 01:46:33 UTC 2010-04-21 19; 19:01 UTC 25d 17h 32m 20s
2010-03-30 21:07:09 UTC 2010-04-21 19; 18; 54 UTC 2Id 22h 11m 45s
2010-03-03 10:42:00 UTC 2010-04-21 19: 18:43 UTC 44d 8h 36m 40s
2010-03-10 08:02:17 UTC 2010-04-21 19! 18! 4B UTC 42d llh 16m -31s
2010-03-10 13:55:54 UTC 2010-04-21 19: 18:43 UTC 42d Sh 22m 54s
2010-03-22 08:37:13 UTC 2010-04-21 19; 10;4B UTC 30d lOh 41m 35s
2010-03-23 04:44:10 UTC 2010-04-21 19; 18:48 UTC 29d 14h 34m 38s
2010-03-31 13:04:41 UTC 2010-04-21 19: 18: 4B UTC %ur 6h iieli
2009-11-30 05:15:05 UTC 2010-04-21 19! 18:40 UTC 142d 14h 3m 355
2009-11-11 13:00:34 UTC 2010-04-21 19: 18: 3B UTC 161d 6h 17m 56s
2010-04-01 19:11:19 UTC 2010-04-21 19; 18:30 UTC 20d Oh 7m 11s
2010-03-29 10:25:28 UTC 2010-04-21 19; 18:29 UTC 23d 8h 53m Is
2009-12-01 15:04:12 UTC 2010-04-21 19: 18:21 UTC gpjgf! i+m gjpr 1
2010-03-17 19:06:20 UTC 2010-04-21 19: 18:21 UTC 3Sd Oh 11m 53s
2010-03-13 86:54:59 UTC 2010-04-21 19: 18:21 UTC 34d 12h 23m 22s
2010-03-21 15:45:32 UTC 2010-04-21 19; 18:21 UTC 31d 3h 32m 49s
2010-03-21 19:52:13 UTC 2010-04-21 19; 18:21 UTC 30d 23h 26m 8s
2010-03-22 87:29:36 UTC 2010-04-21 19: 18:21 UTC Sod lib JSwiiels
2010-03-22 10:01:02 UTC 2010-04-21 19: 18:21 UTC 30d 9h 17m 195

Last Observed IP

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
c x ¡51 Google PI
i/il Most Visited ^ Getting Started ¿¿j Latest Headlines
Botlnstances: indew Igi Q] Botlnstances: show y 1 4

rHerds'! fBotsl [“Connected Botsl fBot Types! [Machines] [IP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Logged in as: 73BB2
n Refresh Every Minute

For Botlnstances Of Type XTNZ ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 3556 in total

rt-i Bot Instance Bot Type Machine
1 □ rXTNZl-AVHTNOCSPJWODWWYWDXB [+] XTNZ AVHTNOCSPJWODWWYWDXB
2 o •fSlSiZl -EIWsMYVSHW'E SSBBSSBp® [+] HWOWMYVSHWEAMEJOJDNA
3 □ TXTNZ1-OYZYUYP WDOLZÏIPPMOOP [+] XTNZ OYZ YUYP WDOLZIIPPMOOP
4 □ rXTNZl-IUC WOTDONOFGUARQS VOX [+] XTNZ IUC WOT DO NO F GU A ROE! VOX
5 u rXTNZl-AGEXNMBSBOAVGXJHLQPA [+] XTNZ AGEXNMBSBOAVGXJHLOPA
6 □ rXTNZl-VZAIHOEDBSOIOZGHHANS [+] XTNZ VZAIHOEDBSOIOZGHHANS
7 Iff ‘¡WMl-MR^^^BèSIrvIUPXVVNIffl [+] xite, MRSGJRZXUSMNMUPXWNIO
3 □ TXTNZ1-CXDTLZNAZJJNT VXAOJGW [+] XTNZ C XDTLZNAZJJNT VX A OJ GW
9 □ rXTNZl-HOFDDPPYCKFKGDGOAHHS [+] XTNZ HOFDDPPYCKFKGDGOAHHS
10 n rXTNZI-OHASZJMBRYMWXKMFYKT A [+] XTNZ OHASZJMBRYMWXKMFYKTA
11 ff| rXTNZl-XPINCPGRUCIKORBNCDTN [+] XTNZ XPINCPGRUCIKCRBNCDTN
12 □ ifSüHSäSSüfe 1 1E m ESawsf [+] iffiBg XOBJWCQNE VJEMEDGKUXT
13 □ rXTNZl-PDDWHBKVOIGRPPAUZABD [+] XTNZ PDDWHBKVOIGRPPAUZABD

14 □ rXTNZl-XHJWODYTIIZHYMYPOJRM [+] XTNZ XHJWODYTIIZHYMYPOJRM
15 u rXTISIZl-OGBCUWGTUBUNCOVEXOPL [+] XTNZ OGBCUWGTUBUNCOVEXOPL
1Ô □ rXTNZl-OHTFJEDWUXFBNDMODONI [+] XTNZ OHTFJEDWUXFBNDMODONI
17 Iff [+] xite, DFFZDNZVJKOHZAOJXFHU
18 □ rXTNZl-YWGCEFULROUZS WJIIFOC [+] XTNZ Y WG CEFULRO UZS WJ IIFOC
19 Iff rXTNZl-FBFXHJGMEMWALTYAREZZ [+] XTNZ FBFXHJGMEMWALTYAREZZ

20 □ rXTNZI-ALNABRMDZOJOKBKUZDIJ [+] XTNZ ALNABRMDZOJOKBKUZDIJ
21 ff rXTNZl-NGVWGSPPCADOOMSYIVDW [+] XTNZ NGVWGSPPCADOOMSVIVDW
22 □ [+] iffiBg CTVEMNPOOOOOLSYZSUTJ
23 □ rXTNZl-INYDMRYRROACSSBBDTZP [+] XTNZ INYDMRYRROACSSBBDTZP

24 □ rXTNZl-HUTANSCBIOGKLCZLXVEA [+] XTNZ HUTANSCBIOGKLCZLX VEA
25 ff rXTNZl-MKILDRAENRUXVHWONDMO [+] XTNZ MKILDRAENRUXYHWONDMO
2Ô □ rXTNZl-HOSHJBVRPJWBNFCEMSXK [+] XTNZ HOSHJBVRPJWBNFCEMSXK
27 □ ■ r KŸft'éj-É1 M1 --'isQ: : [+] ■Unfa/1. PMTNPRORI IFXAOAWWYDN

28 □ rXTNZl-IMCCRJFJJNMXÜXJBIAÜCH [+] XTNZ NCCRJFJJNMXUXJBIÀUCH


: Previous 123456789,., 118 119 Next s
Per Page: 25 < 5B < 100 < All

First Callback Time Last Callback Time Y Lifetime
2Q10-03-22 07:49:12 UTC 2010-04-21 19:19:21 UTC 30d llh 30m 9s
2010-03-23 09:30:13 UTC 2010-04-21 19: 19:21 UTC
2010-03-23 09:42:21 UTC 2010-04-21 19! 19! 19 UTC 29d 9h 36m 505
2010-03-22 03:17:53 UTC 2010-04-21 19: 19:07 UTC 30d 16h lm 14s
2010-03-22 06:23:50 UTC 2010-04-21 19; 19:07 UTC 30d 12h 55m 17s
2010-03-22 09:51:26 UTC 2010-04-21 19; 19; 07 UTC 30d 9h 27m 41s
¥Sia-BäÄ MiSi'fefffc: 2010-04-21 19: 19:07 UTC «ft 9fl
2010-03-26 13:21:43 UTC 2010-04-21 19! 19:07 UTC 26d 5h 57m 195
2010-03-30 10:46:34 UTC 2010-04-21 19: 19:07 UTC 22d 8h 32m 33s
2010-03-27 01:46:33 UTC 2010-04-21 19; 19:01 UTC 25d 17h 32m 2Bs
2010-03-30 21:07:09 UTC 2010-04-21 19; 18; 54 UTC 2Id 22h 11m 45s
2010-03-03 10:42:08 UTC 2010-04-21 19: 18:43 UTC 44d 8h 36m 40s
2010-03-10 08:02:17 UTC 2810-04-21 19! 18:40 UTC 42d llh 16m -31s
2010-03-10 13:55:54 UTC 2810-04-21 19: 18:43 UTC 42d Sh 22m 54s
2010-03-22 08:37:13 UTC 2010-04-21 19; 10;4B UTC 30d lOh 41m 35s
2010-03-23 04:44:10 UTC 2010-04-21 19; 18:48 UTC 29d 14h 34m 38s
2010-03-31 13:04:41 UTC 2010-04-21 19: 18:43 UTC ifttj 6b ihli
2009-11-30 05:15:05 UTC 2010-04-21 19! 18:40 UTC 142d 14h 3m 355
2009-11-11 13:00:34 UTC 2010-04-21 19: 18:30 UTC 161d 6h 17m 56s
2010-04-01 19:11:19 UTC 2010-04-21 19; 18:30 UTC 20d Oh 7m 11s
2010-03-29 10:25:28 UTC 2010-04-21 19; 18:29 UTC 23d 8h 53m Is
2009-12-01 15:04:12 UTC 2010-04-21 19: 18:21 UTC
2010-03-17 19:06:23 UTC 2010-04-21 19: 18:21 UTC 3Sd Oh llm 53s
2010-03-13 06:54:59 UTC 2810-04-21 19: 18:21 UTC 34d 12h 23m 22s
2010-03-21 15:45:32 UTC 2010-04-21 19; 18:21 UTC 31d 3h 32m 49s
2010-03-21 19:52:13 UTC 2010-04-21 19; 18:21 UTC 30d 23h 26m 8s
2010-03-22 07:29:36 UTC 2010-04-21 19: 18:21 UTC Sod lib Jiw’.isfe
2010-03-22 10:01:02 UTC 2010-04-21 19: 18:21 UTC 30d 9h 17m 195

Country Binary Key

View Bets In Country

View Bots Also In Country

View Country Stats

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
** 1 '■J*- Google PI
i/il Most Visited ^ Getting Started ¿¿j Latest Headlines
Botlnstances: indew ,_|] Botlnstances: show y 1 + 1

rHerds'! fBotsl [“Connected Botsl font Types! [Machines] [IP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Logged in as: 73BB2
n Refresh Every Minute

For Botlnstances Located In^|Of Type XTNZ ( Connected j [All] )
Displaying Botlnstances 1 - 30 of 1593 in total

1 Pï Bot Instance Bot Type Machine
1 □ rXTNZl-JGIAWCMYMBNIAHVJKIBI [+] XTNZ JGIAWCMYMBNIAHVJKIBI
2 □ [+] iffiBg AVHTNOCSPJWODWWYWDXB
3 □ rXTNZl-XOBJWCONE VJEMEDGKUXT [+] XTNZ XOBJWC ONE VJEMEDGKUXT
4 □ rXTNZl-PDDWHBKVOIGRPPAUZABD [+] XTNZ PDDWHBKVOIGRPPAUZABD

5 u rXTNZI-XHJWODYTIIZHYMYPOJRM [+] XTNZ XHJWODYTIIZHYMYPOJRM
6 □ rXTNZl-YWGCEFULROÜZSWJIIFOC [+] XTNZ Y WG CEFULRO UZS WJ IIFOC
7 Iff 1 r :iîïi [+] xite, SESLOOPVICGZVOKWIYUN
3 □ rXTNZl-INYDMRYRROACSSBBDTZP [+] XTNZ INYDMRYRROACSSBBDTZP

9 □ rXTNZl-HUT ANSCBIQGKLCZLXVEA [+] XTNZ HUTANSCBIOGKLCZLX YEA
10 n rXTNZl-MKILDRAENRUXYHWONDMO [+] XTNZ MKILDRAENRUXYHWONDMO
11 ff rXTNZl-HOSHJBVRPJWBNFCEMSXK [+] XTNZ HOSHJBVRPJWBNFCEMSXK
12 □ iSfö^KlÖTR IlF.l INiyffäife'iSlAt ICH" [+] iffiBg NCCRJFJJNMXUXJBIAUCH

13 □ rXTNZl-EKSHESSIJURPILYTPBDO [+] XTNZ EKSHESSIJURP1LYTPBDO
14 □ rXTNZl-FFCKJIOMBUVFHALTRRBG [+] XTNZ FFCKJIOMBUYFHALTRRBG

15 u rXTMZl-LNKWMUOJDRBIFERMÜPEC [+] XTNZ LNKWMUOJDRBIFERNUPEC
16 □ rXTNZl-PKOKRNROSSXUTSZHTOJN [+] XTNZ PKOKRNRÜSSXUTSZHTOJN
17 Iff IwnfflBsiiiHiS [+] xite, EVDELNABZLXZHYGBCNYG

18 □ rXTNZl-FMWNTULXVOLVPCXLAUUH [+] XTNZ FMWNTULXVOLVPCXLAÜUH

19 Iff rXTNZl-HWOWMYVSHWEAMEJOJDNA [+] XTNZ HWOWMYVSHWEAMEJOJDNA
20 □ rXTNZl-OYZYUVPWDOLZIIPPMOOP [+] XTNZ OYZYUVPWDOLZIIPPMOOP
21 ff rXTNZl-AGEXNMBSBOAVGXJHLOPA [+] XTNZ AGEXNMBSBOAVGXJHLOPA
22 □ 'fSlW£'T“MRSiSäJ®SAlä®rviupxwNi& [+] iffiBg MRSGJRZXUSMNMUPXWNIO
23 □ rXTNZl-CXDTLZNAZJJNT VXAOJGW [+] XTNZ CXDTLZNAZJJNT YXAOJGW
24 □ rXTNZl-OHASZJMBRYMWXKMFYKTA [+] XTNZ OHASZJMBRYMWXKMFYKTA
25 ff rXTNZI-FBFXHJGMEMWALTYAREZZ [+] XTNZ FBFXHJGMEMWALTYAREZZ

26 □ rXTNZl-XZABODIONKXUDNOVWLL [+] XTNZ XZABODIÜNKXUDNOVWLL
27 □ WflHSaft NI - [+] X'tîhX 1 NI HUON17GAHDOFI TH1U
28 □ rXTNZl-RFSDIDGLVYLYFTOGFYZC [+] XTNZ RFSD1DGLVYLYFTOGFYZC

; Previous 123456789,.,5354 Next s
Per Page: 25 < 5B < 100 < All

First Callback Time Last CallbackTime Y Lifetime
2010-03-26 13:55:42 UTC 2010-04-21 19:21:03 UTC 26d Eh 24m 21s
2010-03-22 07:49:12 UTC 2010-04-21 19: 21:00 UTC Scia
2010-03-00 10:42:00 UTC 2010-04-21 19:20:54 UTC 44d Oh 3Bm 465
2Q1Q-03-1Q 08:32:17 UTC 2010-04-21 19:20:54 UTC 42d llh 18m 37s
2010-03-10 13:55:54 UTC 2010-04-21 19:20:54 UTC 42d 5h 25m Os
2009-11-30 05:15:05 UTC 2010-04-21 19:20:45 UTC 142d 14h 5m 40s
2313-Q3-21 16:16:34 UTC 2010-04-21 19:20:29 UTC gSM Sh'-ämSÄi
2010-03-17 19:06:23 UTC 2010-04-21 19:20:20 UTC 3Sd Oh 14m Os
2Q1Q-Q3-1B 06:54:59 UTC 2010-04-21 19:20:20 UTC 34d 12h 25m 29s
2010-03-21 15:45:32 UTC 2010-04-21 19:20:20 UTC 31d 3h 34m 56s
2010-03-21 19:52:13 UTC 2010-04-21 19:20:28 UTC 30d 23h 28m 15s
2Q1Q-Q3-22 10:31:02 UTC 2010-04-21 19:20:20 UTC
2010-04-01 10:27:41 UTC 2010-04-21 19:20:21 UTC 20d Oh 52m 405
2313-Q3-11 11:59:05 UTC 2010-04-21 19:20:17 UTC 41d 7h 21m 12s
2010-03-17 21:07:41 UTC 2010-04-21 19:20:17 UTC 34d 22h 12m 36s
2010-04-01 18:09:15 UTC 2010-04-21 19:20:08 UTC 20d lh 10m 53s
2313-Q3-31 13:53:33 UTC 2010-04-21 19: 19:47 UTC ÏM sir.sBfe-14s-.
2010-03-11 09:36:23 UTC 2010-04-21 19! 19:06 UTC 4ld 9h 43m 05
2Q1Q-Q3-23 09:33:13 UTC 2010-04-21 19: 19:21 UTC 29d 9h 49m Os
2010-03-23 09:42:21 UTC 2010-04-21 19; 19:19 UTC 29d 9h 36m 58s
2010-03-22 06:23:50 UTC 2010-04-21 19; 19; 07 UTC 30d 12h 55m 17s
2Q1Q-Q3-23 09:29:10 UTC 2010-04-21 19: 19:07 UTC ¿Ij, 1
2010-03-26 13:21:40 UTC 2010-04-21 19! 19:07 UTC 26d 5h 57m 195
2Q1Q-Q3-27 01:46:33 UTC 2010-04-21 19: 19:01 UTC 25d 17h 32m 28s
2009-11-11 13:00:34 UTC 2010-04-21 19; 18:30 UTC 161d 6h 17m 56s
2010-04-01 08:58:39 UTC 2010-04-21 19; 16:47 UTC 20d 10h 18m 8s
2Q1Q-Q3-23 04:42:40 UTC 2010-04-21 19: 16:20 UTC «0 i4b-.SfeM&!
2010-04-02 09:19:50 UTC 2010-04-21 19! 14:29 UTC 19d 9h 54m 395

Last Observed IP

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

m - c x

03 Most Visited ^ Getting Started Latest Headlines

Botlnstances: in dew Q Botlnstances: show

Ù ' i

rHerds'! fBotsl [“Connected Botsl rent Types! [Machines] [IP Usages! [“Countries! fCommand Recurrences'! fCommand Types!

Logged in as: 73BB2
n Refresh Every Minute

For Botlnstances Located In^|Of Type XTNZ ( Connected j [All] )
Displaying Botlnstances 1 - 30 of 1593 in total

Bot Instance Bot Type Machine
1 □ rXTNZl-JGIAWCMYMBNIAHVJKIBI [+] XTNZ JGIAWCMYMBNIAHVJKIBI
2 □ [+] iffiBg AVHTNOCSPJWODWWYWDXB
3 □ rXTNZl-XOBJWCONE VJEMEDGKUXT [+] XTNZ XOBJWC ONE VJEMEDGKUXT
4 □ rXTNZl-PDDWHBKVOIGRPPAUZABD [+] XTNZ PDDWHBKVOIGRPPAUZABD

5 u rXTNZl-XHJWODYTIIZHYMYPQJRM [+] XTNZ XHJWODYTIIZHYMYPOJRM
6 □ rXTNZl-YWGCEFULRCUZSWJIIFOC [+] XTNZ Y WG CEFULRO UZS WJ IIFOC
7 Jtf [+] xite, SESLOQPVICGZVOKWIYUN
3 □ rXTNZl-INYDMRYRROACSSBBDTZP [+] XTNZ INYDMRYRROACSSBBDTZP

9 □ rXTNZl-HUT ANSCBIQGKLCZLXVEA [+] XTNZ HUTANSCBIOGKLCZLX YEA
10 n rXTNZI-MKILDRAENRUXYHWONDMO [+] XTNZ MKILDRAENRUXYHWONDMO
11 Iff; rXTNZl-HOSHJBVRPJWBNFCEMSXK [+] XTNZ HOSHJBVRPJWBNFCEMSXK
12 □ ÎFJ INiyffilS'iSlAt JCH" [+] iffiBg NCCRJFJJNMXUXJBIAUCH

13 □ rXTNZl-EKSHESSIJURPILYTPBDO [+] XTNZ EKSHESSIJURP1LYTPBDO
14 □ rXTNZl-FFCKJIOMBUVFHALTRRBG [+] XTNZ FFCKJIOMBUYFHALTRRBG

15 u rXTNZl-LNKWMUOJDRBIFERNUPEC [+] XTNZ LNKWMUOJDRBIFERNUPEC
16 □ rXTNZl-PKOKRNROSSXUTSZHTOJN [+] XTNZ PKOKRNROSSXUTSZHTOJN
17 [+] xite, EVDELNABZLXZHYGBCNYG

18 □ rXTNZl-FMWNTULXVOLVPCXLAUUH [+] XTNZ FMWIMTULXVOLVPCXLAUUH

19 ¡51 rXTNZl-HWOWMYVSHWEAMEJOJDNA [+] XTNZ HWOWMYVSHWEAMEJOJDNA
20 □ rXTNZl-OYZYUVPWDOLZIIPPMOOP [+] XTNZ OYZYUVPWDOLZIIPPMOOP
21 rXTNZl-AGEXNMBSBCAVGXJHLOPA [+] XTNZ AGEXNMBSBOAVGXJHLOPA
22 □ 'fSlW£'T“MRSiSSj®SAte®rviupxwNi& [+] iffiBg MRSGJRZXUSMNMUPXWNIO
23 □ rXTNZl-CXDTLZNAZJJNT VXAOJGW [+] XTNZ CXDTLZNAZJJNT VXAOJGW
24 □ rXTNZl-OHASZJMBRYMWXKMFYKTA [+] XTNZ OHASZJMBRYMWXKMFYKTA
25 :ff: rXTNZl-FBFXHJGMEMWALTYAREZZ [+] XTNZ FBFXHJGMEMWALTYAREZZ

26 □ rXTNZl-XZABODIONKXUDNOVWLL [+] XTNZ XZABODIONKXLJDNOVWLL
27 □ WflHfcft Nl - [+] XtîhX 1 NI HUDN1ZGAHDDFI TH1U
28 □ rXTNZl-RFSDIDGLVYLYFTOGFYZC [+] XTNZ RFSD1DGLVYLYFTOGFYZC

i Previous 123456789,.,5354 Next s
Per Page: 25 < 5B < 100 < All

First Callback Time Last CallbackTime ¥ Lifetime
2818-03-26 13:56:42 UTC 2010-04-21 19:21:03 UTC 26d Eh 24m 21s 1
2010-03-22 07:49:12 UTC 2010-04-21 19:21:00 UTC ’‘ggg
2010-03-OB 10:42:00 UTC 2010-04-21 19:20:54 UTC 44d 8h 3Bm 465
2Q1Q-Q3-1Q 08:32:17 UTC 2010-04-21 19:20:54 UTC 42d llh 18m 37s
2010-03-10 13:55:54 UTC 2010-04-21 19:20:54 UTC 42d 5h 25m Os
2009-11-30 05:15:05 UTC 2010-04-21 19:20:45 UTC 142d 14h 5m 40s
2313-03-21 16:16:34 UTC 2010-04-21 19:20:29 UTC Sitf: Sh-AwSife
2313-03-17 19:36:23 UTC 2010-04-21 19:20:20 UTC 3Sd Oh 14m Os
2313-B3-1B 06:54:59 UTC 2010-04-21 19:20:28 UTC 34d 12h 25m 29s
2313-03-21 15:45:32 UTC 2010-04-21 19:20:23 UTC 31d 3h 34m 56s
2010-03-21 19:52:13 UTC 2010-04-21 19:20:28 UTC 30d 23h 28m 15s
2313-03-22 10:01:02 UTC 2010-04-21 19:20:23 UTC
2010-04-01 10:27:41 UTC 2010-04-21 19:20:21 UTC 20d 8h 52m 405
2010-03-11 11:59:05 UTC 2010-04-21 19:20:17 UTC 41d 7h 21m 12s
2313-03-17 21:37:41 UTC 2010-04-21 19:20:17 UTC 34d 22h 12m 36s
2010-04-01 18:09:15 UTC 2010-04-21 19:20:08 UTC 20d lh 10m 53s
2010-03-31 13:53:33 UTC 2010-04-21 19: 19:47 UTC ÏM sir.sgfe-14s-.
2010-03-11 09:36:23 UTC 2010-04-21 19! 19:36 UTC 4ld 9h 43m 05
2010-03-23 09:30:13 UTC 2010-04-21 19: 19:21 UTC 29d 9h 49m Os
2010-03-23 09:42:21 UTC 2010-04-21 19; 19:19 UTC 29d 9h 36m 58s
2010-03-22 06:23:50 UTC 2010-04-21 19; 19; 07 UTC 30d 12h 55m 17s
2010-03-23 09:29:10 UTC 2010-04-21 19: 19:07 UTC
2010-03-26 13:21:40 UTC 2010-04-21 19! 19:07 UTC 26d 5h 57m 195
2010-03-27 01:46:33 UTC 2010-04-21 19: 19:01 UTC 25d 17h 32m 20s
2009-11-11 13:00:34 UTC 2010-04-21 19; 18:30 UTC 15Id 6h 17m 55s
2010-04-01 08:58:39 UTC 2010-04-21 19; 16:47 UTC 20d lOh 18m 8s
2010-03-23 04:42:40 UTC 2010-04-21 19: 16:20 UTC «0
2010-04-02 09:19:50 UTC 2010-04-21 19! 14:29 UTC 19d 9h 54m 395

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
Ǥ 5J' Google PI

03 Most Visited ^ Getting Started Latest Headlines

Botlnstances: indew Iti Q Botlnstances: show

fHerdsl fBotsl [Connected Botsl fBct Types! [Machines] flP Usages! [Countries! \Command Recurrences! [Command Types! Logged in as: 73882 j :

n Refresh Every Minute

For Botlnstances Located 1 ^|of Type XTNZ ( Connected j [All] )

Displaying Botlnstances 1 - 30 of 1593 in total

Previous 123456789,.,5354 Next »
Per Page: 25 < 5D < 100 < All_

[+] Bat Instance Bot Type Machine Last Observed IP First Callback Time Y Last Callback Time Lifetime Country Binary Key
1 □ rXTNZl-tirmPNZNJTDMTNWZICNDF [+] XTNZ tmoPNZNJTDMTNWZICNDF 2010-04-21 IQ: 47:31 UTC 2010-04-21 13:34:32 UTC 2h 47m Is
2 E [+] iffiHg tmpSZQLLXJUZWGKTHDLG 2010-04-21 07: Dl: 26 UTC 2010-04-21 08:20:08 UTC lh jgppjpg
3 □ rXTNZl-tmoYJFMOÜHYRFHSVGKOR [+] XTNZ tmoYJFMOUHYRFHSVGKOR 2010-04-21 03:53:50 UTC 2010-04-21 10:44:19 UTC 6h 50m 29s
4 □ rXTNZl-tirmEKT AZMEEOKMO YJLGC [+] XTNZ tmnEKT AZMEEOKMGYJLGC 2010-04-20 13:48:50 UTC 2010-04-20 19:52:47 UTC lh 3m 57s
5 fl rXTNZl-tmDJHTBAVONDKIOMlGTH [+] XTNZ tmaJHTBAVONDKIOMIGTH 2010-04-17 02:30:47 UTC 2010-04-17 02:30:47 UTC
e E rXTNZl-tmDRRJSOSKYMRRGXGIIR [+] XTNZ tmoRRJSOSKYMRRGXGIIR 2010-04-15 12:14:15 UTC 2010-04-15 12:37:18 UTC 23m 3s
7 0 rftrfwT-'tmiariÊ&'SÎfeiiîj ifS-jM [+] xite, tmpGGZIYEVGCCZLYLPJM 2010-04-15 12:03:19 UTC 26m 29s
G □ rXTNZl-tmoEDCCJKWCGRPOIOEZA [+] XTNZ tmnEDCCJKWCGRPOIOEZA 2010-04-15 05:22:57 UTC 2010-04-15 10:49:39 UTC Sh 26m 42s
9 □ iXTNZl-tmoKOTDKOGWOBGDXMWGC [+] XTNZ tmnKOTDKOGWQBGDXMWGC 2010-04-15 03:47:11 UTC 2010-04-15 04:49:31 UTC lh 2m 20s
ID E rXTNZl-tmoWCFGGGCIKBAZZAGUN [+] XTNZ tmaWCFGGGCIKBAZZAGUN 2010-04-14 10:42:36 UTC 2010-04-14 14:05:43 UTC 3h 23m 7s
11 P [XTNZl-tmDXGEFADDYRTLLUIKEI [+] XTNZ tmoXGEFADDYRTLLUIKEI 2010-04-14 04:39:07 UTC 2010-04-14 09:51:57 UTC 5h 12m 50s
12 E îniü. [+] iffiHg tmpXDPKPFFAIOJNNYNID 2010-04-14 03:44:43 UTC 2010-04-14 05:59:48 UTC IP jppgg
13 □ rXTNZl-tmoKJVNIERZFOYNYYGWB [+] XTNZ tmnKJVNIERZFOYNYYGWB 2010-04-13 11:38:57 UTC 2010-04-13 15:26:09 UTC 3h 47m 12s
14 □ [XTNZl-tmDAOTYUWLAAOSNPJCXT [+] XTNZ tmnAOTYUWLAAOSNPJCXT 2010-04-13 09:15:10 UTC 2010-04-13 09:47:19 UTC 32m 9s
15 G rXTNZl-tmDlOUDBWCPJARXJDKCD [+] XTNZ tmoIOUDBWCPJARXJDKCD 2010-04-13 05:41:22 UTC 2010-04-13 11:36:43 UTC 5h 55m 21s
16 E [XTNZl-tmDAVOECDHRPGOOJANFI [+] XTNZ tmoAVOECDHRPGOOJANFI 2010-04-13 05:26:47 UTC 2010-04-13 05:36:47 UTC 10m 0s
17 0 fä¥ifeösM niiUFFNKOKIKMTNirii [+] xite, tmpLDKUFFNKOKIKMINID 2010-04-12 09:23:13 UTC 6m 48s
18 □ rXTNZl-tmoONWIOPUAIHYMJWFSJ [+] XTNZ tmnONWIOPUAIHYMJWFSJ 2010-04-12 03:37:52 UTC 2010-04-12 12:01:40 UTC 3h 23m 48s
19 0 [XTNZl-tmDTOGKOOCJEDMSUMVOS [+] XTNZ tmnTOGKOOCJEDMSUMVOS 2010-04-12 03:16:57 UTC 2010-04-12 03:59:59 UTC 43m 2s
2D E rXTNZl-tmDÜBCVDAVZMGBMGWLRX [+] XTNZ tmoUBCVDAVZMGBMGWLRX 2010-04-11 11:00:17 UTC 2010-04-12 08:19:03 UTC 21h 18m 46s
21 0 rXTNZl-tmpWZNSFOHUBDJGNRMFL [+] XTNZ tmpWZNSFOHUBDJGNRMFL 2010-04-11 07:38:33 UTC 2010-04-11 10:54:57 UTC 3h 16m 24s
22 E [+] iffiHg tmpEZOSZJXOHJKIOKNVT 2010-04-11 05: 49:55, UTC 2010-04-11 07:35:20 UTC I'-*.;:--;;*;;;
23 □ rXTNZl-tmoWZVAPKOOEFKRUEBMJ [+] XTNZ tmnWZVAPKOOEFKRUEBMJ 2010-04-11 05:17:14 UTC 2010-04-11 05:20:28 UTC 3m 14s
24 E rXTNZl-tmDYREOVAOORGKYYILBX [+] XTNZ tmnYREOVAOORGKYYILBX 2010-04-11 04:44:17 UTC 2010-04-11 05:46:01 UTC lh lm 44s
25 0 rXTNZl-trriDMGNZCLTWUSNZDVGJN [+] XTNZ tmaMGNZCLTWUSNZDYGJN 2010-04-11 04:03:14 UTC 2010-04-11 14:04:36 UTC lOh lm 22s
26 E rXTNZl-tmpVJFIZPWYRJLLMPUXJ [+] XTNZ tmpVJFIZPWYRJLLMPUXJ 2010-04-10 11:17:28 UTC 2010-04-11 04:40:50 UTC 17h 23m 22s
27 □ f ™T*imMm [+] rmpDI FOUJPRGRTNHAGWM 2010-04-10 11:09:21 UTC siMllyaffl
28 □ rXTNZl-tmoHOFKTGEWDCHGCLKJI [+] XTNZ tmnHOFKTGEWDCHGCLKJI 2010-04-10 06:25:54 UTC 2010-04-10 07:11:37 UTC 45m 43s

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

0E>~ c x v • a- ~p\

M Most Visited ^ Getting Started Latest Headlines

J Q Botlnstances: indew LjI Q Botlnstances: show 4 ____________________________________________________________________________________________________________________________________________________j -

fHerdsl fBotsl [Connected Botsl fBct Types! [Machines] flP Usages! [Countries! \Command Recurrences] fCommand Types! Logged in as: 73882

Listing Herds

New herd

Herd Action
■ netblock Show All / Show Connected J Edit / Hide
xtnz Show All / Show Connected / Edit / Hide
some Awesome Herd Show All / Show Connected / Edit / Hide

New herd

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
Öö c x L ;j * -1 Google E
\P.\ Most Visited ^ Getting Started ¡¿¡] Latest Headlines
Botlnstances: indew lyj .Q Botlnstances: show |yj J * 1-

fHerdsl fBotsl [“Connected Botsl fBot Types! Machines 1 riP Usages! fCcuntriesI \Command Recurrences! fCcmmand Types! Logged in as: 73882

Listing Herds

Mew herd

Herd Action
■ netblock Show All / Show Connected J Edit / Hide
xtnz Show All / Show Connected / Edit / Hide
some Awesome Herd Show All / Show Connected / Edit / Hide

Mew herd

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

Ü ex* * -1 i: ' Google E
jjp) Most Visited ^ Getting Started ¡¿J Letest Heed lines
0 Botlnstances: edit ö D Botlnstences: show ÿ 1 + 1 -

fHerdsl fBotsl [Connected Botsl fBot Types! [Machines] flP Usages! [Countries! \Command Recurrences] fCommand Types! Logged in as: 73882

Editing Herd My New Herd7 «i> ►

View Connected Herd
View Index

Bot Types ( Any )

Update and .., —
1 Stay Here Ihepb
1 - 1 Inzvt
1 View Herd | ¡TURD
■ XTNZ

- C ho ose AB ot Type -

- Choose A Bot Type -

Currently In Country ( Any )

----Choose A Countiy-------

Ever In Country ( Any )

- Choose A Countiy-----

Currently In Netblock ( Any )

| AddNetblock |

Historically In Netblock ( Any )

j | AddNetblock J

Bot Instances ( Any )

| Add Bot Instance ]

i



TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

Ü * c x v * -1 i: ' Google E
jjp) Most Visited ^ Getting Started ¡¿J Letest Heed lines
0 Botlnstances: edit ö D Botlnstences: show wh 1 -

fHerdsl fBotsl [Connected Botsl fBot Types! [Machines] flP Usages! [Countries! \Command Recurrences] [Command Types! Logged in as: 73882

Editing Herd My New Herd7 «i> ►

Update and ..,

I Stay Here |

I View Herd |

[ View Connected Herd
[ View Index |

BotTypes ( ©Any Of | O

[;....; Choose AÉ9lXYRg..Zz:

0 XTNZ

None Of )

Currently In Country ( Any )

----Choose A Country ijj|

Ever In Country ( Any )

-Choose A Co untry--- v

Currently In Net block ( Any )
_________________| | Add Netbloek |

Historically In Netbloek ( Any )

~| | Add Netbloek |

Bot Instances ( Any )

~| | Add Bot Instance ]

i



TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

@ ’ C X u

L£j Most Visited ^ Getting Started ¡¿J Latest Headlines
J Qj Botlnstances: edit ISI D Botlnstances: show

rHerds'! fBotsl [“Connected Botsl fBot Types! fMachinesI [IP Usages! fCcuntriesI fCommand Recurrences'! [“Command Types!

Û * ~‘l ~ Pi



Logged in as: 73882

Editing Herd My New Herd7 «i> ►

Update and ..,

| Stay Here |

[ View Herd |

[ View Connected Herd
[ View Index |

BotTypes ( ©Any Of | O

[;.....Choose A Bot JypgjTTTT;

0 XTNZ

None Of )

Currently In Country ( Any )

----Choose A Country ijj|

Ever In Country ( Any )

-Choose A Co untry--- v

Currently In Net block ( Any )
_________________| | Add Netbloek |

Historically In Netbloek ( Any )

~| | Add Netbloek |

Bot Instances ( Any )

~| | Add Bot Instance ]

i



TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
Google PI
i/il Most Visited ^ Getting Started ¿¿j Latest Headlines
Botlnstances: indew Botlnstances: show y 1 + 1

rHerds'! fBotsl [“Connected Botsl fBot Types! [Machines] [IP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Logged in as: 73002
n Refresh Every Minute

For Herd 'Mv New Herd' ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 3556 in total

Bot Instance Bot Type Machine
1 □ rXTNZl-BOGPMHKNXLHVAUXFOVOM [+] XTNZ BOGPMHKNXLHVAUXFOVOM
2 E fïffiîei.^lBJR&WCSBMÉÎÎKXSHNÔ- pwap.. JCBJRBWCXTSHOXXXSHNG
3 □ rXTNZl-üHTFJEDWUXFBNDMODÛNI [+] XTNZ OHTFJEDWUXFBNDMODONI
4 □ rXTNZl-FTVIQJZMWWMHHGTYEVPG [+] XTNZ FTVIOJZMWWMHHGTYEVPG
5 r ; ÎXTNZ1-AFWIOMOQFKVKTZNMJDUC [+] XTNZ AFW1QMGOFKVKTZNMJDUC
e E rXTNZl-SRUKDPYTOGIVWOHAWYTL [+] XTNZ SRUKDPYTOGIVWOHAWYTL
7 B r 'A8)mr. feS Iff iij. 1 OKXJLBTTOOZNKLDPWMZ
a □ ÎXTNZl-FMWNTULXVOLVPCXLAUUH [+] XTNZ FM WNTULXVOLVPCXLAUUH

g □ rXTNZl-JERBPDBEDPIYKOWDJUHH [+] XTNZ JERBPDBEDPIYKQWDJUHH
10 E rXTNZl-WHOBIGFYHJSMBGCFMZSH [+] XTNZ WHOBIGFYHJSMBGCFMZSH
il r.. rXTNZl-LOKUNHPCHTSWOZULOPPR [+] XTNZ LOKUN HPCH TS WOZU LOPPR
12 E riiWli5nH3fl6l8MÄ88M13 □ rXTNZl-NGVWGSPPCADOOMSVIVDW [+] XTNZ NGV WGSPPC ADOOMSVIVDW
14 □ rXTNZl-Y WGCEFULROUZS WJIIFOC [+] XTNZ V WGCEFULROUZS WJIIFOC
15 r ; iXTNZl-IUCWQTDONOFGUARQSVOX [+] XTNZ IUCWOTDGNGFGUAROSVQX
16 E rXTNZl-AGEXNMBSBOAVGXJHLOPA [+] XTNZ AGEXNMBSBOAVGXJHLOPA
17 T | MRSGJRZXUSMNMUPXWNIO
13 □ rXTNZl-CXDTLZIMAZJJNT VXAOJGW [+] XTNZ CXDTLZNAZJJNTVXAOJGW
19 r ; rXTNZl-XPINCPGRUCIKORBNCDTN [+] XTNZ XPINCPGRUCIKORBNCDTN
20 E iXTNZl-XHJWODYTIIZHYMYPOJRM [+] XTNZ XHJWODYTIIZHYMYPOJRM
21 r J rXTNZl-INYDMRYRROACSSBBDTZP [+] XTNZ INYDMRYRRCACSSBBDTZP
22 E pwap.. SESLOOPVICGZ YOK WIYUN
23 □ IXTNZ1-OGBCUWGTUBUNCO VEXOPL [+] XTNZ OGB CU WGTUBUNCO VEXOPL
24 E rXTNZl-DFFZDNZVJKOHZAOJXFHU [+] XTNZ DFFZDNZVJKOHZAQJXFHU
25 r ; rXTNZl-EKSHESSIJURPILYTPBDO [+] XTNZ EKSHESSIJURPILYTPBDO
26 E rXTNZl-CTVEMNPOOOOOLSYZSUTJ [+] XTNZ CTVEMNPOOOOOLSYZSUTJ
27 □ r ÉmÊa [afs -fcnifr HUTANRCRTOGKI C7I XVFA
28 □ rXTNZl-POUUCOTDEDTYRJUMJBAL [+] XTNZ POUUCOTDEDTYRJUMJBAL

: Previous 123456789,., 118 119 Next s
Per Page: 25 < 5B < 100 < All

First Callback Time Last Callback Time ¥ Lifetime
2Q10-03-10 16:53:36 UTC 2010-04-21 19:48:52 UTC 42d 2h 55m 16s
2Q10-Q3-17 18:49:34 UTC 2010-04-21 19:48:52 UTC
2010-03-23 04:44:13 UTC 2010-04-21 19:48:52 UTC 29d 15h 4m 425
2010-04-01 20:34:36 UTC 2010-04-21 19:48:52 UTC 19d 23h 14m 46s
2010-04-01 20:34:19 UTC 2010-04-21 19:48:52 UTC 19d 23h 14m 33s
2010-04-01 20:52:52 UTC 2010-04-21 19:48:52 UTC 19d 22h 56m 0s
2010-04-09 14:11:52 UTC 2010-04-21 19:48:38 UTC- lää-i'iÄimi-iäfe
2010-03-11 09:36:23 UTC 2010-04-21 19:48:37 UTC 41d 10h 12m 9s
2010-03-27 13:14:09 UTC 2010-04-21 19:48:28 UTC 25d 6h 34m 19s
2010-03-22 21:36:37 UTC 2010-04-21 19:48:17 UTC 29d 22h Ilm 40s
2010-03-22 10:39:07 UTC 2010-04-21 19: 48: ID UTC 3üd 9h 9m 3s
2010-03-27 01:46:33 UTC 2010-04-21 19:48:10 UTC ifäPiii75
2010-03-29 10:25:23 UTC 2010-04-21 19:48:10 UTC 23d 9h 22m 425
2009-11-30 05:15:05 UTC 2010-04-21 19:48:01 UTC 142d 14h 32m 56s
2010-03-22 03:17:53 UTC 2010-04-21 19:47:59 UTC 30d 16h 30m 6s
2010-03-22 06:23:50 UTC 2010-04-21 19:47:59 UTC 3üd 13h 24m 9s
2010-03-23 09:29:10 UTC 2010-04-21 19:47:59 UTC- Üa liwÄ»»»
2010-03-26 13:21:43 UTC 2010-04-21 19:47:59 UTC 26d 6h 26m 115
2010-03-30 21:07:09 UTC 2010-04-21 19:47:41 UTC 21d 22h 40m 32s
2010-03-10 13:55:54 UTC 2010-04-21 19:47:39 UTC 42d 5h 51m 45s
2010-03-17 19:06:28 UTC 2010-04-21 19:47:39 UTC 35d 0h 41m 11s
2010-03-21 16:16:34 UTC 2010-04-21 19:47:39 UTC
2010-03-22 08:37:13 UTC 2010-04-21 19:47:39 UTC 30d 11h 10m 265
2010-03-31 13:04:41 UTC 2010-04-21 19:47:39 UTC 21d 6h 42m 58s
2010-04-01 10:27:41 UTC 2010-04-21 19:47:39 UTC 20d 9h 19m S8s
2009-12-01 15:04:12 UTC 2010-04-21 19; 47; 3D UTC 141d 4h 43 m 18s
2010-03-18 06:54:59 UTC 2010-04-21 19: 47: 3D UTC-
2010-03-21 21:16:16 UTC 2010-04-21 19:47:30 UTC 30d 22h 3lm 145

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

iJ6

c

Ù ' ir‘l'| •

03 Most Visited ^ Getting Started | Latest Headlines

Botlnstances: indeK

yi □ BotInstances: show

rHerds! fBots! fConnected Bots! [Bot Types! [“Machines! riP Usages! [“Countries! fCommand Recurrences! [“Command Types!

Logged in as: 73BB2
n Refresh Every Minute

For Herd 'Mv New Herd' ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 3556 in total

Bot Instance Bot Type Machine
1 □ rXTNZl-BOGPMHKNXLHVAUXFOVOM [+] XTNZ BOGPMHKNXLHVAUXFOVOM
2 E JCBJRBWCXTSHOXXXSHNG
3 □ rXTNZl-üHTFJEDWUXFBNDMODÛNI [+] XTNZ OHTFJEDWUXFBNDMODON1
4 □ TXTNZl-FT V1QJZMWWMHHGTYE VPG [+] XTNZ FTVIOJZMWWMHHGTYEVPG
5 r ; ÎXTNZ1-AFWIOMOQFKVKTZNMJDUC [+] XTNZ AFW1QMQOFKVKTZNMJDUC
e E rXTNZl-SRUKDPYTOGIVWOHAWYTL [+] XTNZ SRUKDPYTOGIVWOHAWYTL
7 tt r &9h8r. feS || f ■ 1 OKXJLBTTOOZNKLDPWMZ
a □ iXTNZl-FMWNTULXVOLVPCXLAllUH [+] XTNZ FM WIMTULX VCLVPCXLAUUH

g □ rXTNZl-JERBPDBEDPIYKOWDJUHH [+] XTNZ JERBPDBEDPIYKOWDJUHH
10 E iXTNZl-WHOBIGFYHJSMBGCFMZSH [+] XTNZ W HO B IG F Y HJ SM B GC F MZ SH
il r.. rXTNZl-LOKUNHPCHTSWOZULOPPR [+] XTNZ LOKUN HPCH TS WOZU LOPPR
12 E OHASZJMBRYMWXKMFYKTA
13 □ rXTNZl-NGVWGSPPCADOOMSVIVDW [+] XTNZ NGV WGSPPC ADOOMSVIVDW
14 □ rXTNZl-Y WGCEFULROUZS WJIIFOC [+] XTNZ YWGCEFULROUZSWJIIFOC
15 r ; iXTNZl-IUCWOTDONOFGUAROBVOX [+] XTNZ IUCWOTDQNQFGUAROSVQX
16 E rXTNZl-AGEXNMBSBOAVGXJHLOPA [+] XTNZ AGEXNMBSBOAVGXJHLOPA
17 t | IlfF.viij. MRSGJRZXUSMNMUPXWNIO
13 □ rXTNZl-CXDTLZIMÀZJJNT VXÀOJGW [+] XTNZ CXDTLZNÀZJJNTVXAOJGW
10 r ; rXTNZl-XPINCPGRUCIKORBNCDTN [+] XTNZ XPINCPGRUCIKORBNCDTN
20 E ÎXTNZ1-XHJWODYTIIZHYMYPOJRM [+] XTNZ XHJWQDYTIIZHYMYPOJRM
21 H rXTNZl-INYDMRYRROACSSBBDTZP [+] XTNZ INYDMRYRRCÂCSSBBDTZP
22 E SESLOQPVICGZVOKWIYUN
23 □ rXTNZl-OGBCUWGTUBUIMCO VEXOPL [+] XTNZ OGBCUWGTUBUNCOVEXOPL
24 E rXTNZl-DFFZDNZVJKOHZAOJXFHU [+] XTNZ DFFZDNZVJKOHZAQJXFHU
25 r ; iXTNZl-EKSHESSIJURPILYTPBDO [+] XTNZ EKSHESSIJURPILYTPBDO
26 E rXTNZl-CTVEMNPOOOOOLSYZSUTJ [+] XTNZ CTVEMNPOOOOOLSYZSUTJ
27 □ r ÉmÊa [aæ -fcnifr HUTANRGRTOGKI G7I XVFA
28 □ rXTNZl-POUUCOTDEDTYRJUMJBAL [+] XTNZ POUUCOTDEDTYRJUMJBAL

: Previous 123456789,., 118 119 Next s
Per Page: 25 < 5B < 100 < All

First Callback Time Last Callback Time Y Lifetime
2Q10-03-10 16:53:36 UTC 2010-04-21 19:48:52 UTC 42d 2h 55m 16s
2010-03-17 18:49:34 UTC 2010-04-21 19:48:52 UTC
2010-03-23 04:44:10 UTC 2010-04-21 19:40:52 UTC 29d 15h 4m 425
2010-Q4-01 20:34:06 UTC 2010-04-21 19:48:52 UTC 19d 23h 14m 46s
2010-04-01 20:34:19 UTC 2010-04-21 19:48:52 UTC 19d 23h 14m 33s
2010-04-01 20:52:52 UTC 2010-04-21 19:48:52 UTC 19d 22h 56m 0s
2010-04-09 14:11:52 UTC 2010-04-21 19:48:38 UTC-
2010-03-11 09:36:20 UTC 2010-04-21 19:48:37 UTC 41d lOh 12m 9s
2010-03-27 13:14:09 UTC 2010-04-21 19:48:28 UTC 25d 6h 34m 19s
2010-03-22 21:36:37 UTC 2010-04-21 19:48:17 UTC 29d 22b 11m 40s
2010-03-22 10:39:07 UTC 2010-04-21 19: 48:1D UTC 3üd 9h 9m 3s
2010-03-27 01:46:33 UTC 2010-04-21 19:48:10 UTC
2010-03-29 10:25:23 UTC 2010-04-21 19:48:10 UTC 23d 9h 22m 425
2009-11-30 05:15:05 UTC 2010-04-21 19:48:01 UTC 142d 14h 32m 56s
2010-03-22 03:17:53 UTC 2010-04-21 19:47:59 UTC 30d 16h 30m 6s
2010-03-22 06:23:50 UTC 2010-04-21 19:47:59 UTC 30d 13h 24m 9s
2010-03-23 09:29:10 UTC 2010-04-21 19:47:59 UTC-
2010-03-26 13:21:40 UTC 2010-04-21 19:47:59 UTC 26d 6h 26m Ils
2010-03-30 21:07:09 UTC 2010-04-21 19:47:41 UTC 21d 22h 40m 32s
2010-03-10 13:55:54 UTC 2010-04-21 19:47:39 UTC 42d Sh 51m 45s
2010-03-17 19:06:28 UTC 2010-04-21 19:47:39 UTC 35d Oh 41m Ils
2010-03-21 16:16:34 UTC 2010-04-21 19:47:39 UTC S pPJggggggs
2010-03-22 00:37:13 UTC 2010-04-21 19:47:39 UTC 30d llh 10m 265
2010-03-31 13:04:41 UTC 2010-04-21 19:47:39 UTC 21d 6h 42m 58s
2010-04-01 10:27:41 UTC 2010-04-21 19:47:39 UTC 20d 9h 19m ESs
2009-12-01 15:04:12 UTC 2010-04-21 19; 47; 3D UTC 141d 4h 43 m 18s
2010-03-1B 06:54:59 UTC 2010-04-21 19: 47: 3D UTC- £4iiggv£t'JS *
2010-03-21 21:16:16 UTC 2010-04-21 19:47:30 UTC 30d 22h 31m 145

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
É$ C X , I * Google PI
i/li Most Visited ^ Getting Started ¿¿j Latest Headlines
Botlnstances: indew Q] Botlnstances: show y 1 + 1

rHerds'! fBotsl [“Connected Botsl [Bot Types! [“Machines! riP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Logged in as: 73BB2
n Refresh Every Minute

For Herd 'Mv New Herd' ( [Connected] | AM )
Displaying Botlnstances 1 - 30 of 40 in total

[+] Bnt Instance Bot Type Machine
1 □ rXTNZl-OHTFJEDWUXFBNDMODONI [+] XTIMZ OH T F JE D WU X F B ND MO DO NI
2 □ räaa^FfirtpnRFnpi!f'Bft.pÄkSfHM [+] iffiBg JERBPDBEDP1YKQWDJUHH
3 □ rXTNZl-ODKISFYLRYXHKRZVTPOC [+] XTNZ ODKISFYLRYXHKRZVTPOC
4 □ rXTNZl-FTVIOJZMWWMHHGTYEVPG [+] XTNZ FTV1QJZMWWMHHGTYEVPG
5 n rXTNZI-AFWIOMOOFKVKTZNMJDUC [+] XTNZ AFWIOMQQFKVKTZNMJDUC
6 □ rXTNZl-SRUKDPYTOGIVWOHAWYTL [+] XTNZ SRUKDPYTOG1VWOHAWYTL
7 □ [+] xite, WHOBIGFYHJSMBGCFMZSH
B □ rXTNZl-NGWVGSPPC ADOOMSVIVDW [+] XTNZ NGVWGSPPCADOOMSVIVDW
9 □ rXTNZl-LOKUNHPCHTSWOZULOPPR [+] XTNZ LOKUNHPCHTSWOZULOPPR
ID □ rXTNZl-OHASZJMBRYMWXKMFYKTA [+] XTNZ OHASZJMBRYMWXKMFYKTA
11 □ rXTNZl-YWGCEFULROUZSWJIIFOC [+] XTNZ Y WG CEFULRO ÜZS WJ IIFOC
12 □ [+] iffiBg JCBJRBWCXTSHOXXXSHNG
13 □ rXTNZl-IÜCWOTDONOFGÜAROSVOX [+] XTNZ IUCWOTDONOFGUAROSVOX
14 □ rXTNZl-AGEXNMBSBOAVGXJHLOPA [+] XTNZ AGEXNMBSBOAVGXJHLOPA
15 n rXTNZl-MRSGJRZXUSMNMUPXWNIO [+] XTNZ MRSGJRZXUSMNMUPXWNIO
15 □ rXTNZl-CXDTLZNAZJJNTVXAOJGW [+] XTNZ CXDTLZNAZJJNTYXAOJGW
17 □ ïtiSttiffriŸpô'iRM [+] xite, XHJWODYTIIZHYMYPOJRM
IB □ rXTNZl-INYDMRYRROACSSBBDTZP [+] XTNZ INYDMRYRROACSSBBDTZP
19 □ rXTNZl-SESLOQPVICGZ VOK WIYUN [+] XTNZ SESLOQPVICGZVOKWIYUN
20 □ rXTMZl-XPINCPGRUCIKORBNCDTN [+] XTNZ XPINCPGRUCIKORBNCDTN
21 □ rXTNZl-EKSHESSIJURPILYTPBDO [+] XTNZ EKSHESSIJURP1LYTPBDO
22 □ MSW®®ïï®ÿSruBUÈ}eilS!Ï5âfiâ2 [+] iffiBg OGBC UW GTU BUNCO VEXOPL

23 □ rXTNZl-DFFZDNZVJKOHZAOJXFHU [+] XTNZ DFFZDNZVJKOHZAOJXFHU
24 □ rXTNZl-CTVEMNPOOOOOLS YZSUTJ [+] XTNZ CTVEMNPQOOQOLSYZSUTJ
25 n rXTNZl-HUT ANSCBIQGKLCZLXVEA [+] XTNZ HUTANSCBIQGKLCZLX VEA
26 □ rXTNZl-POUUCOTDEDTYRJUMJBAL [+] XTNZ POUUCOTDEDTYRJUMJBAL
27 □ 1 lÄVHMfFrAi-j ch [+] NGCR IF 11NIY1XIJX lBIAl ICH

2B □ rXTNZl-OSLIOENWBASOUVLEUOGT [+] XTNZ OSLIOEN WB ASOUVLEUOGT

; Previous 1 2 Next s
Per Page: 25 < 5B < IBB < All

First Callback Time Last Callback Time f Lifetime
2010-03-23 04:44:10 UTC 2010-04-21 19:50:29 UTC 29d ISh 6m 19s
2D1D-Q3-27 13:14:09 UTC 2818-84-21 19:58:29 UTC imm, SBHBHBS
2010-04-01 19:07:19 UTC 2818-04-21 19:50:29 UTC 20d Oh 43m 10s
2010-04-01 20:34:06 UTC 2010-84-21 19:50:29 UTC 19d 23h 16m 23s
2010-04-01 20:34:19 UTC 2010-04-21 19:50:29 UTC 19d 23h 16m 10s
2010-04-01 20:52:52 UTC 2010-04-21 19:50:29 UTC 19d 22h 57m 37s
2010-03-22 21:36:37 UTC 2010-04-21 19:50:24 UTC issgal
2010-03-29 10:25:28 UTC 2010-04-21 19:50:18 UTC 23d 9h 24m 50s
2010-03-22 10:39:07 UTC 2818-04-21 19:58:16 UTC 30d 9h 11m 9s
2010-03-27 01:46:33 UTC 2010-04-21 19:50:14 UTC 25d lGh 3m 41s
2009-11-30 05:15:05 UTC 2010-04-21 19:50:06 UTC 142d 14h 35m Is
2010-03-17 18:49:34 UTC 2818-04-21 19:50:06 UTC [IpCSti ngpMI
2010-03-22 03:17:53 UTC 2010-04-21 19:50:04 UTC 30d 16h 32m 11s
2010-03-22 06:23:50 UTC 2818-04-21 19:58:04 UTC 30d 13h 26m 14s
2010-03-23 09:29:10 UTC 2010-04-21 19:50:04 UTC 29d lOh 20m 54s
2010-03-26 13:21:48 UTC 2010-04-21 19:50:04 UTC 26d 6h 28m 16s
2010-03-10 13:55:54 UTC 2818-04-21 19:49:45 UTC 4 -.1 Sh.5S5ft-.rftS'.
2010-03-17 19:06:28 UTC 2010-04-21 19:49:45 UTC 35d Oh 43m 17s
2010-03-21 16:16:34 UTC 2010-04-21 19:49:45 UTC 3 Id 3h 33m 11s
2010-03-30 21:07:09 UTC 2010-04-21 19:49:45 UTC 2 Id 22h 42m 36s
2010-04-01 10:27:41 UTC 2010-04-21 19:49:45 UTC 20d 9h 22m 4s
2010-03-22 88:37:13 UTC 2818-04-21 19:49:44 UTC
2010-03-31 13:04:41 UTC 2010-04-21 19:49:44 UTC 2 Id 6h 45m 3s
2009-12-01 15:04:12 UTC 2818-04-21 19:49:30 UTC 141d 4h 45m 18s
2010-03-13 06:54:59 UTC 2010-04-21 19:49:30 UTC 34d 12h 54m 31s
2010-03-21 21; 16:16 UTC 2010-04-21 19:49:30 UTC 30d 22h 33m 14s
2010-03-22 18:Q1:Ü2 UTC 2818-04-21 19:49:30 UTC
2010-03-23 09:58:09 UTC 2010-04-21 19:49:30 UTC 29d 9h Sim 2ls

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
Éte- C X 1 J * Google PI
i/li Most Visited ^ Getting Started ¿¿j Latest Headlines
Botlnstances: indew Igi Q] Botlnstances: show

rHerds'! fBotsl [“Connected Botsl fBot Types! [Machines] [IP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Logged in as: 73BB2
n Refresh Every Minute

For Herd 'Mv New Herd' ( [Connected] | AM )
Displaying Botlnstances 1 - 30 of 40 in total

[+] Bnt Instance Bot Type Machine
1 □ rXTNZl-OHTFJEDWUXFBNDMODONI [+] XTNZ OH T F JE D WU X F B ND MO DO NI
2 □ räaa^FfirtpnRFnpi!f'Bft.pÄkSfHM [+] iffiBg JERBPDBEDP1YKQWDJUHH
3 □ rXTNZl-ODKISFYLRYXHKRZVTPOC [+] XTNZ ODKISFYLRYXHKRZVTPOC
4 □ rXTNZl-FTVIOJZMWWMHHGTYEVPG [+] XTNZ FTV1QJZMWWMHHGTYEVPG
5 n rXTNZI-AFWIOMOOFKVKTZNMJDUC [+] XTNZ AFWIOMOQFKVKTZNMJDUC
6 □ rXTNZl-SRUKDPYTOGIVWOHAWYTL [+] XTNZ SRUKDPYTOG1VWOHAWYTL
7 □ [+] xite, WHOBIGFYHJSMBGCFMZSH
B □ rXTNZl-NGV WGSPPC ADOOMSVIVDW [+] XTNZ NGVWGSPPCADOOMSVIVDW
9 □ rXTNZl-LOKUNHPCHTSWOZULOPPR [+] XTNZ LOKUNHPCHTSWOZULOPPR
ID □ rXTNZl-QHASZJMBRYMWXKMFYKTA [+] XTNZ OHASZJMBRYMWXKMFYKTA
11 □ rXTNZl-YWGCEFULROUZSWJIIFOC [+] XTNZ Y WG CEFULRO ÜZS WJ IIFOC
12 □ [+] iffiBg JCBJRBWCXTSHOXXXSHNG
13 □ rXTNZl-IUCWOTDONOFGUAROSVOX [+] XTNZ IUCWOTDONOFGUAROSVOX
14 □ rXTNZl-AGEXNMBSBOAVGXJHLOPA [+] XTNZ AGEXNMBSBOAVGXJHLOPA
15 n rXTNZl-MRSGJRZXUSMHMUPXWNIO [+] XTNZ MRSGJRZXUSMNMUPXWNIO
15 □ rXTNZl-CXDTLZNAZJJNTVXAOJGW [+] XTNZ CXDTLZNAZJJNTVXAOJGW
17 □ ïtiSttiffriŸpô'iRM [+] xite, XHJWODYTIIZHYMYPOJRM
IB □ rXTNZl-INYDMRYRROACSSBBDTZP [+] XTNZ INYDMRYRROACSSBBDTZP
19 □ rXTNZl-SESLOOPVICGZ VOK WIYUN [+] XTNZ SESLOQPVICGZVOKWIYUN
20 □ rXTMZl-XPINCPGRUCIKORBNCDTN [+] XTNZ XPINCPGRUCIKORBNCDTN
21 □ rXTNZl-EKSHESSIJURPILYTPBDO [+] XTNZ EKSHESSIJURP1LYTPBDO
22 □ MSW®®ïï®ÿSruBUÈ}eilS!Ï5âfiâ2 [+] iffiBg OGBC UW GTU BUNCO VEXOPL

23 □ rXTNZl-DFFZDNZVJKOHZAOJXFHU [+] XTNZ DFFZDNZVJKOHZAOJXFHU
24 □ rXTNZl-CTVEMNPOOOOOLS YZSUTJ [+] XTNZ CTVEMNPQOOQOLSYZSUTJ
25 n rXTNZl-HUT ANSCBIQGKLCZLXVEA [+] XTNZ HUTANSCBIOGKLCZLX VEA
26 □ rXTNZl-POUUCOTDEDTYRJUMJBAL [+] XTNZ POUUCOTDEDTYRJUMJBAL
27 □ 1 iwÄHMfFrAii ch [+] NGCR IF 11NIY1XIJX lBIAl ICH

2B □ rXTNZl-OSLIOENWBASOUVLEUOGT [+] XTNZ OSLIOEN WB ASOUVLEUOGT

; Previous 1 2 Next s
Per Page: 25 < 5B < IBB < All

First Callback Time Last Callback Time f Lifetime
2010-03-23 04:44:10 UTC 2010-04-21 19:50:29 UTC 29d ISh 6m 19s
2D1D-Q3-27 13:14:09 UTC 2818-84-21 19:58:29 UTC imm, SBHBHBS
2010-04-01 19:07:19 UTC 2818-04-21 19:50:29 UTC 20d Oh 43m 10s
2010-04-01 20:34:06 UTC 2010-84-21 19:50:29 UTC 19d 23h 16m 23s
2010-04-01 20:34:19 UTC 2010-04-21 19:50:29 UTC 19d 23h 16m 10s
2010-04-01 20:52:52 UTC 2010-04-21 19:50:29 UTC 19d 22h 57m 37s
2010-03-22 21:36:37 UTC 2010-04-21 19:50:24 UTC issgal
2010-03-29 10:25:28 UTC 2010-04-21 19:50:18 UTC 23d 9h 24m 50s
2010-03-22 10:39:07 UTC 2818-04-21 19:58:16 UTC 30d 9h 11m 9s
2010-03-27 01:46:33 UTC 2010-04-21 19:50:14 UTC 25d lGh 3m 41s
2009-11-30 05:15:05 UTC 2010-04-21 19:50:06 UTC 142d 14h 35m Is
2010-03-17 18:49:34 UTC 2818-04-21 19:50:06 UTC [IpCSti ngpMI
2010-03-22 03:17:53 UTC 2010-04-21 19:50:04 UTC 30d 16h 32m 11s
2010-03-22 06:23:50 UTC 2818-04-21 19:58:04 UTC 30d 13h 26m 14s
2010-03-23 09:29:10 UTC 2010-04-21 19:50:04 UTC 29d lOh 20m 54s
2010-03-26 13:21:48 UTC 2010-04-21 19:50:04 UTC 26d 6h 28m 16s
2010-03-10 13:55:54 UTC 2818-04-21 19:49:45 UTC 4 -.1 Sh.5S5ft-.rftS'.
2010-03-17 19:06:28 UTC 2010-04-21 19:49:45 UTC 35d Oh 43m 17s
2010-03-21 16:16:34 UTC 2010-04-21 19:49:45 UTC 3 Id 3h 33m 11s
2010-03-30 21:07:09 UTC 2010-04-21 19:49:45 UTC 2 Id 22h 42m 36s
2010-04-01 10:27:41 UTC 2010-04-21 19:49:45 UTC 20d 9h 22m 4s
2010-03-22 88:37:13 UTC 2818-04-21 19:49:44 UTC
2010-03-31 13:04:41 UTC 2010-04-21 19:49:44 UTC 2 Id 6h 45m 3s
2009-12-01 15:04:12 UTC 2818-04-21 19:49:30 UTC 141d 4h 45m 18s
2010-03-13 06:54:59 UTC 2010-04-21 19:49:30 UTC 34d 12h 54m 31s
2010-03-21 21:16:16 UTC 2010-04-21 19:49:30 UTC 30d 22h 33m 14s
2010-03-22 18:Q1:Ü2 UTC 2818-04-21 19:49:30 UTC l3ri:Sfla ^fe
2010-03-23 09:58:09 UTC 2010-04-21 19:49:30 UTC 29d 9h Sim 21s

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

(Ci * c x , * i: ' Google E
jjp) Most Visited ^ Getting Started ¡¿J Letest Heed lines
J Q Botlnstances: edit ö D Botlnstences: show 01 * 1-'

fHerdsl fBotsl [Connected Botsl fBot Types! [Machines] flP Usages! [Countries! \Command Recurrences] [Command Types! Logged in as: 73882

Editing Herd My New Herd7 «i> ►

Update and ..
I Stay Here |

I View Herd |

I View Connected Herd ]
I View Index |

BotTypes ( ©Any Of | O None Of)

-----Choose A Bot Type —- v

0 XTNZ

Currently In Country ( Any )

----Choose A Country- ijj|

Ever In Country ( Any )

-Choose A Country v

Bol Instances ( Any )

I I Add Bot Instance ]

Currently In Net block ( Any )
___________________| | Add Netblock |

Historically In Netblock ( Any )

~| | Add Netblock |



TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
ÉI c x , ;J * \ Google E
\P.\ Most Visited ^ Getting Started Latest Headlines
Botlnstances: edit Igi Q] Bot Instances: show 1 -

rHerds'! fBotsl [“Connected Botsl [Bot Types! [“Machines! riP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Logged in as:

Editing Herd TMy New Herd7 < gg ►

Update and ..,
I Stay Here |
View Herd

View Connected Herd
View Index

Bot Types ( ©Any Of | O Mane Of)

------ Choose A Bot Type -- v

0 XTNZ

Currently In Country ( Any )

-Choose A Counti

Currently In Net bleck ( Any )

I I AddNetblock

Historically In Netbloek ( Any )

I I Add Netbloek

Bot Instances ( Any )

1 I Add Bot Instance

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

* -1 i: ' Google E
jjp) Most Visited ^ Getting Started ¡A] Letest Heed lines
1 Q Botlnstances: edit ö D Botlnstences: show tül 1 + 1-'

fHerdsl fBotsl [Connected Botsl fBot Types! [Machines] flP Usages! [Countries! \Command Recurrences] [Command Types! Logged in as

Editing Herd My New Herd7 «i> ►

Update and ..
I Stay Here |

I View Herd |

I View Connected Herd ]
I View Index |

BotTypes ( ©Any Of | O None Of)

-----Choose A Bot Type —- v

0 XTNZ

Currently In Country ( ©Any Of | ©None Of )

-------Choose A Country----- v

0 Pakistan

Ever In Country ( Any )

-------Choose A Country----- ----v

Currently In Netblock ( Any )

[ | AddNetblock ]

Historically In Netblock ( Any )

~| I Add Netblock J

Bot Instances ( Any )

~| I Add Bot Instance ]



TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
* ■ t. Google E
L£j Most Visited ^ Getting Started ¡A] Latest Headlines

Q Botlnstances: edit kJj Q Botlnstances: show

rHerds! fBots! [“Connected Bets! fBot Types! fMachines! [IP Usages! [“Countries! fCommand Recurrences! [“Command Types!

Logged in as

Editing Herd My New Herd7 «i> ►

Update and ..
I Stay Here |
[ View Herd |

I View Connected Herd ]
I View Index |

Bot Types ( ©Any Of | O None Of)

-----Choose A Bot Type —-- v

0 XTNZ

Currently In Country ( ©Any Of | ©None Of )

-------Choose A Country----- v

0 Pakistan

Ever In Country ( Any )

-------Choose A Country----- ----v

Currently In [\Jetblock ( Any )

[ | AddNetblock ]

Historically In Netblock ( Any )

~| I Add Netblock J

Bot Instances ( Any )

~| I Add Bot Instance ]

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
4* * - , Google PI
i/ll Most Visited ^ Getting Started Latest Headlines
Botlnstances: indew Botlnstances: show y 1 + 1

rHerds'! fBotsl [“Connected Botsl [Bot Types! fMachinesI riP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Logged in as: 73B82
n Refresh Every Minute

For Herd Mv New Herd' ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 1655 in total

[+] Bot Instance Bot Type Machine
1 P ÎXTNZ1-ODK1SFYLRYXHKRZVTPOC [+] XTNZ ODKISFYLRYXHKRZVTPOC
2 □ T^SSÜSSBfiFflSônRFriSSSÏÈSSpSiiS [+] iffiBg JERBPDBEDP1YKQWDJUHH
3 □ rXTNZl-lUCWOTDONOFGUAROSVOX [+] XTNZ IUCWOTDONOFGUÀROSVOX
4 □ [XTNZl-OHTFJEDWUXFBNDMODONI [+] XTNZ OHTFJEDWUXFBNDMODONI
5 □ rXTNZl-XPINCPGRUCIKORBNCDTN [+] XTNZ X PIN CPGRU CIKO RÛNCD TM
6 □ iXTNZl-CGBCUWGTUBUNCOVEXOPL [+] XTNZ OGBCUWGTUBUNCOVEXOPL
7 □ r «tfföißfi f f Ht j [+] xite, DFFZDNZVJKOHZAOJXFHU
8 □ rXTNZl-CTVEMNPOOOOOLS YZSUTJ [+] XTNZ CTVEMNPOOOOOLSYZSUTJ
g p [XTNZl-OSLIOENWBASOUVLEUOGT [+] XTNZ OSLIOEN WB ASOUVLEUOGT
ID □ [XTNZ1-UUPHEOOPCDMPZHSADZOI [+] XTNZ UUPHEOOPCDMPZHSADZOI
11 □ rXTNZl-WFMOPEKFUHXZFMIBLBWL [+] XTNZ WFMOPEKFUHXZFMIBLBWL
12 □ [+] iffiBg ALNABRMDZOJOKBKUZDIJ
13 p ÎXTNZ1-NLEEGIEKSLE1TLFYAVUE [+] XTNZ NLEEGIEKSLEITLFYAVUE

1 + □ rXTNZl-XTOTDFlKIZELINKOKLVW [+] XTNZ XTOTDFIKIZEL1NKOKLVW
15 □ ÎXTNZl-HOFDDPPYCKFKGDGOAHHS [+] XTNZ HOFDDPPYCKFKGDGOAHHS
16 □ rXTNZl-PMINPROBLIEXAOÀWWYDN [+] XTNZ PMINPROBLIEXAOAWWYDN

17 □ r 'it '■vVl ■ ■ f■ [+] xite, OVVZLCRMTLDVICGEUORL
13 □ rXTNZl-VZAlHOEDBSOIOZGHHANS [+] XTNZ VZAIHOEDBSOIOZGHHANS
19 □ rXTNZl-MMTOYCHLCZBTÜYSBBDJA [+] XTNZ MMTOYCHLCZBTUYSBBDJA

23 □ [XTNZ1-XLDIZDUHZSZWVBUMKHTF [+] XTNZ XLDIZDUHZSZWYBUMKHTF

21 □ rXTNZl-XYBKUJALLWATCCTHIEXU [+] XTNZ XYBKUJALLWATCCTHIEXU
22 □ [+] iffiBg BQOCGVRAFW WIJHACJOQG
23 p ÎXTNZ1-GJPDFSZHXIBYGOÏRCBXC [+] XTNZ GJPDFSZHXIBYGOIRCBXC
24 □ rXTNZl-UUOX YEOOSLVFHVAFHCJH [+] XTNZ UUOXYEOOSLVFHYAFHCJH
25 □ ÎXTNZ1-1LJWCJYNSTCILDHOWZAO [+] XTNZ IUWCJVNSTCILDHOWZAO
26 □ rXTNZl-NBGJJNFLTJSASGJFGMDO [+] XTNZ NBGJJNFLTJSAEGJFGMDO
27 p 'Kffei5^:£F#^''l#ÂRKRnRHWll [+] lÂTtU? nAFlVZOl NYH1RKRDBHWU

23 □ ÎXTNZ1-TLXINOXWXZMVOTANOXLZ [+] XTNZ TLXINOX WXZMVOT ANOXLZ

! Previous 1 2 3 4 5 6 7 8 9 ... 55 56 Next s
Per Page: 25 < 5B < 100 < All

First Callback Time Last Callback Time Y Lifetime
2010-04-01 19:07:19 UTC 2010-04-21 19:57:17 UTC 20d Oh 49m 58s
2013-03-27 13:14:09 UTC 2010-04-21 19:56:41 UTC
2010-03-22 03:17:53 UTC 2010-04-21 19:56:21 UTC 30d 16h 38m 28s
2013-03-23 34:44:10 UTC 2010-04-21 19:56:21 UTC 29d ISh 12m 11s
2010-03-30 21:07:09 UTC 2010-04-21 19:55:54 UTC 21d 22h 43m 45s
2010-03-22 08:37:13 UTC 2010-04-21 19:55:53 UTC 3Dd llh 18m 40s
2010-03-31 13:04:41 UTC 2010-04-21 19:55:53 UTC gpl âtSâumem
2009-12-01 15:04:12 UTC 2010-04-21 19:55:38 UTC 141d 4h 51m 26s
2010-03-23 09:58:09 UTC 2010-04-21 19:55:38 UTC 29d 9h 57m 29s
2010-03-30 11:36:17 UTC 2010-04-21 19:55:38 UTC 22d 8h 19m 21s
2010-03-30 17:32:40 UTC 2010-04-21 19:55:38 UTC 22d 2h 22m 58s
2010-04-01 19:11:19 UTC 2010-04-21 19:55:38 UTC fP oh 44m l?i'
2010-03-30 11:51:05 UTC 2010-04-21 19:55:22 UTC 22d 8h 4m 17s
2010-03-29 22:34:02 UTC 2010-04-21 19:55:04 UTC 22d 21h 21m 2s
2010-03-30 10:46:34 UTC 2010-04-21 19:43:51 UTC 22d 8h 57m 17s
2010-03-22 07:29:36 UTC 2010-04-21 19:43:23 UTC 3Dd 12h 13m 47s
2010-03-30 19:28:41 UTC 2010-04-21 19:43:23 UTC SSd ûh iwfaah
2010-03-22 09:51:26 UTC 2010-04-21 19:39:46 UTC 30d 9h 48m 20s
2010-04-01 19:15:17 UTC 2010-04-21 19:20:28 UTC 2Dd Oh Sm 11s
2010-03-27 13:14:29 UTC 2010-04-21 19:16:17 UTC 25d 6h lm 48s
2010-03-22 09:13:12 UTC 2010-04-21 19:12:42 UTC 3Dd 9h 54m 30s
2010-03-31 14:22:32 UTC 2010-04-21 19:09:12 UTC §|§ 4i| mmgip
2010-03-30 00:04:43 UTC 2010-04-21 19:06:54 UTC 22d llh 2m Ils
2010-04-01 03:01:54 UTC 2010-04-21 19:06:35 UTC 20d 16h 4m 41s
2010-03-23 09:13:42 UTC 2010-04-21 19:05:38 UTC 29d 9h 46m S6s
2010-03-29 21:33:26 UTC 2010-04-21 19:02:44 UTC 22d 2lh 29m 18s
2010-04-01 19:08:31 UTC 2010-04-21 19:01:55 UTC
2010-03-31 14:03:27 UTC 2010-04-21 13:54:07 UTC 21d 4h 50m 40s

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
Ü ex. 1 * - I Google PI
Pi Most Visited ^ Getting Started ¿¿j Latest Headlines
Botlnstances: indeK Igi Q] Botlnstances: show
fHerdsl TBotsl fConnected Bets! TBot Types! [Machines! TIP Usages! fCountriesl iCommand Recurrences! fCommand Types! Logged in

n Refresh Every Minute

For Herd Mv New Herd' ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 1655 in total

[+] But Instance Bot Type Machine
1 P ÎXTNZ1-ODK1SFYLRYXHKRZVTPOC [+] XTIMZ ODKISFYLRYXHKRZVTPOC
2 □ T^SSÜSSBfiFflSônRFriSSSÏÈSSpSiiS [+] iffiBg JERBPDBEDP1YKQWDJUHH
3 B ÎXTNZI-IUCWÛTDONOFGUAROSVOX [+] XTNZ IUC WOTDONOFGUAROSVOX
4 a [XTNZl-OHTFJEDWUXFBNDMODONI [+] XTNZ OHTFJEDWUXFBNDMODONI
5 h rXTNZl-XPINCPGRUCIKGRBNCDTN [+] XTNZ X PIN CPGRU CIKO RÛNCD TM
6 h iXTNZl-CGBCUWGTUBUNCOVEXOPL [+] XTNZ OGBCUWGTUBUNCOVEXOPL
7 0 r «tfföißfi F F Ht j [+] xite, DFFZDNZVJKOHZAOJXFHU
8 □ rXTNZl-CTVEMNPOOOOOLS YZSUTJ [+] XTNZ CTVEMNPOOOOOLSYZSUTJ
g p rXTNZ!-OSLIOENWBASOUVLEUOGT [+] XTNZ OSL1QEN WB ASOUVLEUQGT
ID □ T-XTNZ1-UUPHEOQPCDMPZHSADZQI [+] XTNZ UUPHEOOPCDMPZHSADZOI
11 □ [XTNZl-WFMOPEKFUHXZFMIBLBWL [+] XTNZ WFMOPEKFUHXZFMIBLBWL
12 □ [+] iffiBg ALNABRMDZOJOKBKUZDIJ
13 p ÎXTNZ1-NLEEGIEKSLE1TLFYAVUE [+] XTNZ NLEEGIEKSLEITLFYAVUE

1 + □ TXTNZl-XTOTDFlKIZELINKOKLVW [+] XTNZ XTOTDFIKIZEL1NKOKLVW
15 □ ÎXTNZVHOFDDPPYCKFKGDGOAHHS [+] XTNZ HOFDDPPYCKFKGDGOAHHS
16 □ TXTNZl-PMINPRDBLIEXAOAWWYDN [+] XTNZ PMINPROBLIEXAOAWWYDN

17 □ r '¡L '■Wi' . f'I [+] xite, OVYZLCRMTLDYICGEUORL
13 □ rXTNZl-VZAlHOEDBSOIOZGHHANS [+] XTNZ VZAIHOEDBSOIOZGHHANS
19 □ rXTNZl-MMTOYCHLCZBTUYSBBDJA [+] XTNZ MMTOYCHLCZBTUYSBBDJA

23 □ [XTNZ!-XLDIZDUHZSZWVBUMKHTF [+] XTNZ XLDIZDUHZSZWYBUMKHTF

21 □ rXTNZl-XYBKUJALLWATCCTHIEXU [+] XTNZ XYBKUJALLWATCCTHIEXU
22 □ [+] iffiBg BQOCGVRAFW WIJHACJOQG
23 p ÎXTNZ1-GJPDFSZHXIBYGOÏRCBXC [+] XTNZ GJPDFSZHXIBYGOIRCBXC
24 □ rXTNZl-UUOX YEOQSLVFHVAFHCJH [+] XTNZ UUOXYEOOSLVFHVAFHCJH
25 □ ÎXTNZ!-1LJWCJYNSTCILDHOWZAO [+] XTNZ IUWCJVNSTCILDHOWZAO
26 □ ÎXTNZl-NBGJJNFLTJSASGJFGMDO [+] XTNZ NBGJJNFLTJSAEGJFGMDO
27 p 'Kffe!5^:£F#^''l#ÂRKRnRHWll [+] lÂTtU? nAFlVZOl NYH1RKRDBHWU

23 □ ÎXTNZ1-TLXINOXWXZMVOTANOXLZ [+] XTNZ TLXINOX WXZMVOT ANOXLZ

! Previous 1 2 3 4 5 6 7 8 9 ... 55 56 Next s
Per Page: 25 < 50 < 100 < All

First Callback Time Last Callback Time t Lifetime
2010-04-01 19:07:19 UTC 2010-04-21 19:57:17 UTC 20d Oh 49m 58s
2013-03-27 13:14:09 UTC 2010-04-21 19:56:41 UTC
2010-03-22 03:17:53 UTC 2010-04-21 19:56:21 UTC 30d 16h 38m 28s
2013-03-23 34:44:10 UTC 2313-04-21 19:56:21 UTC 29d ISh 12m 11s
2010-03-30 21:07:09 UTC 2010-04-21 19:55:54 UTC 21d 22h 48m 45s
2010-03-22 08:37:13 UTC 2010-04-21 19:55:53 UTC 3Dd llh 18m 40s
2010-03-31 13:04:41 UTC 2010-04-21 19:55:53 UTC gpl âtSâumem
2009-12-01 15:04:12 UTC 2010-04-21 19:55:38 UTC 141d 4h 51m 26s
2010-03-23 39:58:09 UTC 2010-04-21 19:55:38 UTC 29d 9h 57m 29s
2010-03-30 11:36:17 UTC 2010-04-21 19:55:38 UTC 22d 8h 19m 21s
2010-03-30 17:32:40 UTC 2010-04-21 19:55:38 UTC 22d 2h 22m 58s
2010-04-01 19:11:19 UTC 2010-04-21 19:55:38 UTC fP oh 44m l?i'
2010-03-30 11:51:05 UTC 2010-04-21 19:55:22 UTC 22d 8h 4m 17s
2010-03-29 22:34:02 UTC 2313-04-21 19:55:04 UTC 22d 21h 21m 2s
2010-03-30 10:46:34 UTC 2010-04-21 19:43:51 UTC 22d 8h 57m 17s
2010-03-22 07:29:36 UTC 2010-04-21 19:43:23 UTC 3Dd 12h 13m 47s
2010-03-30 19:28:41 UTC 2010-04-21 19:43:23 UTC SSd JDh lifms4fe:
2010-03-22 09:51:26 UTC 2010-04-21 19:39:46 UTC 30d 9h 48m 20s
2013-04-01 19:15:17 UTC 2010-04-21 19:20:28 UTC 2Dd Oh Sm 11s
2010-03-27 13:14:29 UTC 2010-04-21 19:16:17 UTC 25d 6h lm 48s
2010-03-22 09:18:12 UTC 2010-04-21 19:12:42 UTC 3Dd 9h 54m 30s
2010-03-31 14:22:32 UTC 2010-04-21 19:09:12 UTC 'giä 4hi mmgip
2010-03-30 00:04:43 UTC 2010-04-21 19:06:54 UTC 22d llh 2m Ils
2010-04-01 03:01:54 UTC 2313-04-21 19:06:35 UTC 2Dd 16h 4m 41s
2010-03-23 09:13:42 UTC 2010-04-21 19:05:38 UTC 29d 9h 46m S6s
2010-03-29 21:33:26 UTC 2010-04-21 19:02:44 UTC 22d 2lh 29m 18s
2010-04-01 19:08:31 UTC 2010-04-21 19:31:55 UTC lääl dH!«
2010-03-31 14:03:27 UTC 2010-04-21 13:54:07 UTC 21d 4h 50m 40s

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

m - c x

03 Most Visited ^ Getting Started Latest Headlines

Botlnstances: in dew Q Botlnstances: show

Ù ' ir‘l'i •



rHerds'! fBotsl [“Connected Botsl fBot Types! [Machines] [IP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Logged in as:^H|ü||

n Refresh Every Minute

For Herd Mv New Herd' ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 1655 in total

ZC

i Previous 1 2 3 4 5 6 7 8 9 ... 55 56 Next s
______Per Page: 25 < 50 < 100 < All

First CallbackTimo Last Callback Time t Lifetime
2010-04-01 19:07:19 UTC 2010-04-21 19:57:17 UTC 20d Oh 49m 58s
2010-03-27 13:14:09 UTC 2010-04-21 19:56:41 UTC
2010-03-22 03:17:53 UTC 2010-04-21 19:56:21 UTC 30d 16h 38m 28s
2010-03-23 04:44:10 UTC 2010-04-21 19:56:21 UTC 29d ISh 12m 11s
2010-03-30 21:07:09 UTC 2010-04-21 19:55:54 UTC 21d 22h 48m 45s
2010-03-22 08:37:13 UTC 2010-04-21 19:55:53 UTC 3Dd llh 18m 40s
2010-03-31 13:04:41 UTC 2010-04-21 19:55:53 UTC Bal âtSâumem
2009-12-01 15:04:12 UTC 2010-04-21 19:55:38 UTC 141d 4h 51m 26s
2010-03-23 09:58:09 UTC 2010-04-21 19:55:38 UTC 29d 9h 57m 29s
2010-03-30 11:36:17 UTC 2010-04-21 19:55:38 UTC 22d 8h 19m 21s
2010-03-30 17:32:40 UTC 2010-04-21 19:55:38 UTC 22d 2h 22m 58s
2010-04-01 19:11:19 UTC 2010-04-21 19:55:38 UTC fP oh 44m l?i'
2010-03-30 11:51:05 UTC 2010-04-21 19:55:22 UTC 22d 8h 4m 17s
2010-03-29 22:34:02 UTC 2010-04-21 19:55:04 UTC 22d 21h 21m 2s
2010-03-30 10:46:34 UTC 2010-04-21 19:43:51 UTC 22d 8h 57m 17s
2010-03-22 07:29:36 UTC 2010-04-21 19:43:23 UTC 3Dd 12h 13m 47s
2010-03-30 19:28:41 UTC 2010-04-21 19:43:23 UTC SSd JDh lifms4fe:
2010-03-22 09:51:26 UTC 2010-04-21 19:39:46 UTC 30d 9h 48m 20s
2010-04-01 19:15:17 UTC 2010-04-21 19:20:28 UTC 2Dd Oh Sm 11s
2010-03-27 13:14:29 UTC 2010-04-21 19:16:17 UTC 25d 6h lm 48s
2010-03-22 09:18:12 UTC 2010-04-21 19:12:42 UTC 3Dd 9h 54m 30s
2010-03-31 14:22:32 UTC 2010-04-21 19:09:12 UTC §|§ 4i| mmgip
2010-03-30 00:04:43 UTC 2010-04-21 19:06:54 UTC 22d llh 2m Ils
2010-04-01 03:01:54 UTC 2010-04-21 19:06:35 UTC 20d 16h 4m 41s
2010-03-23 09:13:42 UTC 2010-04-21 19:05:38 UTC 29d 9h 46m S6s
2010-03-29 21:33:26 UTC 2010-04-21 19:02:44 UTC 22d 2lh 29m 18s
2010-04-01 19:08:31 UTC 2010-04-21 19:01:55 UTC pd däeSHh
2010-03-31 14:03:27 UTC 2010-04-21 13:54:07 UTC 21d 4h 50m 40s

Augment herd with.

Bot Instance

■IKRZVTPQC

Bot Type

Currently Has IP

Ever Had IP

Currently In Country

Ever In Country

Binary Key

























GUAROSVQX

BNDMQDQNI

QRBNCDTN

. ••■ic..I'VE-o-1-

HZAOJXFHU

ÜQL5YZSUTJ

[ XTNZl - O S LI Q E N W BASOUVLEUQGT

iXTNZl-UUPHEOQPCDMPZHSADZQI

iXTNZl-WFMOPEKFUHXZFMIBLBWL

rXTNZl-ALNABRMDZOJOKBKUZDIJ

IXTNZ! -NLE E GIEK5LEITLF Y A VUE

[XTNZl-XTQTDFIKIZELINKDKLVW

iXTNZl-HQFDDPPYCKFKGDGQAHHS

iXTNZl-PMINPROBLIEXAOAWWYDN

rXTNZl-OYVZLCRMTLDVICGEUORL

ÎXTNZ1-VZAIHQEDBSOIOZGHHAN5

rXTNZl-MMTOYCHLCZBTUYSBBDJA

ÎXTNZ1-XLDIZDUHZSZWVBUMKHTF
[ XTNZl - X Y B- K U J A LL W ATCCTHIEXU

rXTNZl-BOQCGVRAF WWIJH ACJOQG

rXTNZl-GJPDFSZHXIBYGOIRCBXC

[XTNZl-UUQX YEQQSLVFHVAFHCJH

iXTNZl-Il—IWCJYNSTCILDHQWZAQ
r XTN Zl -NBGJJNFLTJSASGJFGMDO

rXTN7l-nAFlVZCll NYH1RKRDBHWU

iXTNZl-TLXINOXWXZMVOTANQXLZ

Bot Type

Machine

[+] XTNZ ODKISFYLRVXHKRZVTPQC

[+] XTNZ JERBPDBEDPIYKOWDJUHH

[+] XTNZ IUCW0TD0N0FGUÀR05V0X

[+] XTNZ OHTFJEDWUX F BNDMQDQNI

[+] XTNZ XPINCPGRUCIKORBNCDTN
[+] XTNZ QGBCUWGTUBUNCOVEXOPL

[+] XTNZ DFFZDNZVJKOHZAOJXFHU

[+] XTNZ CTVEMNPOOOOOL5YZSUTJ

[+] XTNZ OSLIPENWBASOUVLEUQGT

[+] XTNZ UUPHEQOPCDMPZHSADZQI
[+] XTNZ WFMQP E K F UHX Z FMIBLBWL

[+] XTNZ ALNABRMDZQJOKBKUZDIJ

[+] XTNZ IMLEEGIEKSLEITLFYAVUE

[+] XTNZ XTQTDFIKIZELINKOKLVW

[+] XTNZ HQFDDPPYCKFKGDGQAHHS
[+] XTNZ PMINPROBLIEXAOAWWYDN

[+] XTNZ QVYZLCRMTLDYICGEUQRL

[+] XTNZ VZAIH0EDB50I0ZGHHAN5

[+] XTNZ M MT O V CHLCZ B T U Y S B B DJ A

[+] XTNZ XLDIZDUHZSZWYBUMKHTF

[+] XTNZ XYBKUJALLWATCCTHIEXU

[+] XTNZ BQQCGVRAFWWIJHACJQQG

[+] XTNZ GJPDFSZHXIBYGOIRCBXC

[+] XTNZ UUOXYEQOSLVFHVAFHCJH

[+] XTNZ IUWCJVNSTCILDHQWZAQ

[+] XTNZ NBGJJNFLTJSASGJFGMDO

[+] XTN7 DAF1VZOI NYH1RKBDRHWI)

[+] XTNZ TLXINOXWXZMVOTANOXLZ

TOP SECRET//COMINT//REL USA, FVEY

Country Binary Key

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
X u 1 u ù - Google £1


|^| Botlnstances: indew

m Most Visited ^ Getting Started | Latest Headlines

ö Ö Bet Instances: show

fHerds! fBotsl [“Connected Bots! [Bot Types] rMachines! riP Usages! [“Countries! \Command Recurrences! [“Command Types!

Logged in as: 78BB2
□ Refresh Every Minute

For Herd Mv New Herd’ ( Connected | [All] )
Displaying Botlnstances 1 - 30 of 1655 in total

BotInstance Bot Type Machine
1 : j ÎXTNZ1-ODKISFVLRYXHKRZVTPOC [lî XTNZ ODK1SFYLRYXHKRZVTPOC
2 n [+] XTNZ JERBPDBEDPIYKOWDJUHH
3 □ rXTNZl-IUCWOTDONOFGU AROSVOX [+] XTN7 1UCWOTDONOFGUAROSVOX
4 0 iXTNZl-OHTFJEDW.UXFBNDMQD ON I [+] XTNZ OHTFJEDWUXFBNDMODONI
5 h rXTNZl-XPINCPGRUCIKQRBNCDTN [+] XTNZ XPINCPGRUCIKQRBNCDTN
6 a rXTNZl-OG&CUWGTUBUNCOYEXOPL [+] KINZ OGBCUWGTUBUNCOVEXOPL
7 0 r+i DFFZDNZVJKOHZAOJXFHU
8 □ rXTNZl-CTVEMNPOOOOOLSY ZSUTJ [+] XTNZ CTVEMNPOOOOOLS YZSUTJ
9 □ [+] XTNZ OSLIOENWBASOUVLEUOGT
10 □ rXTNZl-UUPHEOOPCDMPZHSADZOI [+] XTNZ UUPHEOOPCDMPZHSADZOI
11 □ ÎXTNZ1-WFMOPEKFUHXZFMIBLBWL [+] XTNZ WFMOPEKFUHXZFMIBLBWL
12 n rS¥rä^LÄLWABRMDlÖfS*SiM]irilJ [+] XTNZ ALNABRMDZOJOKBfÎUZDIJ
13 □ rXTNZl-NLEEGIEKSLEITLFYAVUE ÿ.~ : riz NLEEGIEKSLEITLFYAVUE
14 □ iXTNZl-XTQTDFIKIZELINKOKLVW [+] XTNZ XTOTDFIKIZELINKOKLVW
15 □ ÎXTNZ1-HOFDDPPYCKFKGDGOAHHS [+] XTNZ HOFDDPPYCKFKGDGOAHHS
16 □ rXTNZl-PMINPROBLIEXAOAWWYDM [+] KINZ PM1NPROBLIEXAOAWWYDN
17 p r sifÄä-fiSiilSf en M T1 wirier Ég r+i
10 □ rXTNZl-VZAIHOEDBSOIOZGHH ANS [+] XTNZ VZAIHOEDBSOIOZGHHANS
19 □ iäüH ) '.vi'iViillx (■..■ [+] XTNZ MMTOYCHLCZBTUYSBBDJA
20 □ ÎXTNZ1-XLDIZDUHZSZWYBUMKHTF [+] XTNZ XLDIZDUHZSZWY&UMKHTF
21 □ rXTNZl-XYBKUJALLW AT CCT HIEXU [+] XTNZ X YBKUJ ALLW A TCC T HIEX U
22 n iBSBSÎ -àil ßtäMA RVÏ!#I JH Ä [+] XTNZ BOOCGVRAF WWIJH ACJOOG
23 □ rXTNZl-GJPDFSZHXIB YGOIRCBXC [+] XTN7 GJPDFSZHXIBYGOIRCBXC
24 □ ÎXTNZl-UUQXYEOQSLVFH VAFHCJH [+] XTNZ UUOX YEOQSLVFHVAFHCJH
25 □ ÎXTNZ1-IUWCJYNSTCILDHOWZAO [+] XTNZ 1UWCJYNSTCILDHOWZAO
26 □ rXTNZl-NBGJJNFLTJSABGJFGMDO ®f KINZ N B GJ JN F LT J5 A SG JFGMD O
27 □ I+.3 XTNZ nAFIVZOl NYHlRKRn&HWU

28 □ [X'fNZ l-TLK 1 MO AN OX LZ [+] XTNZ TLXlWO>ia^ZWVOTANbXL2

Previous 1 2 3 4 5 6 7 S 9 ... 55 56 Next ■
Per Page: 25 < 5B < IBB < All____________

by 'Bot Instance1,

i v- Cancel

First Callback Time

2Q10-04-01 19:07; 19-ÙTC

2010-03-27 13

2010-03-22 03

2010-03-23 04

2010-03-30 21

2010-03-22 OS

2010-03-31 13

04

□ 9 UTC

IB, UTC

Last Callback Time ▼

2010-04-21 19:57:17 UTC

.2010-04-21 19:56:41 UTC

2010-04-21 19:56:21 UTC

.2010-04-21 19:56:21 UTC

2010-04-21 19:55:54 UTC

2010-04-21 19:55:53 UTC

2010-B4-21 19:55:53 UTC

2009-12-01 15:04:12 UTC 2010-04-21 19:55:30 UTC

14-21 19: 55:30 UTC

Update Herd

34-21 19:55:30 UTC
i-21 19:55:38 UTC

2U1U-04-21 19:55:30 UTC

03-30 11: 51:05- UTC 2010-04-21 19:55:22 UTC 22d 8h 4m 175
rd 03-29 22:34:0,2 UTC 2010-04-21 19:55:04 UTC 22d 21h 21m 2s
2010-03-30 10:46:34 UT0 2010-04-21 19:43:51 UTC 22d 8h 57m 17s
2010-03-22. 07:29:36 UTC 2010-04-21 19:43:23 UTC 30d 12h 13m 47s
2010-03-30 19:23:41. UTC »¿üiO'ËiL.21 mBHk 2M Ëh
2010-03-22 09:51:26 UTC 2010-04-21 19:39:46 UTC 30d 9h 48m 205
2010-04-01 19:15:17.UTC 2010-B4-21 19:20:20 UTC 20d Oh 5m Ils
2010-03-27 13:14:29 UTC 2010-04-21 19: 16:17 UTC 2Sd 6h 1m 48s
2010-03-22 09:18:12 UTC 2010-04-21 19: 12:42 UTC 30d 9h 54m 30s
2010-03-31 14:2.2:32 UTC î I.d ;4tSj§pB|
2010-03-30 08: 04: 43 UTC 2010-04-21 19:06:54 UTC 22d llh 2m Ils
2010-04-01 03:01:54 UTC 2010-04-21 19:06:35 UTC 20d îeh 4m 41s
2010-03-23 09:18 ; 42 UTC 2010-04-21 19:05:38 UTC 29d 9h 46m 56s
2010-03-29 21:33:26 UTC 2010-04-21 19:02:44 UTC 22d 2lh 29m 18s
2010-04-01 19:03:31. UTC »¿ülO'ËiL.z.1 1&: üliÆSÎff-Ëi;
2010-03-31 14:03:27 UTC 2010-04-21 18:54:07 UTC 2ld 4h 50m 40s

Lifetime

20d Oh 49 m ESs

25d 6h 42m 32s

2 Id 6h . 51m 12s

29d 9h .57m 29s

22d 8h 19m 21s
22d 2h 22m ESs

20d Oh 44m 1.9s

Country

Binary Key

30d 16h 3Bm 205

29d 15h 12m 11s

2 Id 22h 4Bm 45s

30d llh 18m 40s

I4ld 4h 5lm 265

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
(f ■ C X ui Û 1 d Google ^1
\P.\ Most Visited ^ Getting Started ¡A] Latest Headlines
Botlnstances: edit |y| 1 Q Botlnstances: show ! -

rHerds'! fBotsl [“Connected Botsl fBot Types! [Machines] [IP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

Editing Herd TMy New Herd7 «

§ ►

Update and ..,
I Stay Here |
View Herd

View Connected Herd
View Index

Bot Types ( ©Any Of | O Mane Of)

------ Choose A Bot Type -- v

0 XTNZ

Currently In Country ( 0Any Of | OlMone Of )

-----—Choose A Co untry—--- v>

0 Pakistan

Ever In Country ( Any )

-----—Choose A Country----- v

Currently In Netblock ( Any )

I Add Netblock

Historically In Netblock ( Any )

I I Add Netblock

Bot Instances ( 0 Any Of | OlMone Of )

I I [ Add Bot Instance ]

0 [XTIMZ]-IUC WQTDONQFGUAROSVOX
0 [XTNZ]-GHTFJEDWUXFBNDMQDQNI
0 [XTNZ]-XPINCPGRUCIKQRBNCDTN
0 [XTNZ]-OGBCUWGTUBUNCOVEKOPL

0 [XTNZ]-DFFZDNZVJKQHZAQJXFHU

Logged in as: 73882

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

& • ~‘l ~ Pi

fHerdsl fBotsl [“Connected Botsl fBot Types! Machines 1 riP Usages! [“Countries! \Command Recurrences! [“Command Types! Logged in as: 73882

n Refresh Every Minute

For Herd 'Mv New Herd' ( Connected | [All] )

Displaying all 5 Botlnstances

Per Page: 55 < 5D < 1DD < All

M Bat Instance Bot Type Machine Last Observed IP First Callback Time Last Callback Time v Lifetime Count ry Binary Kev
1 n rXTNZl-IUCWOTDONOFGU AROSVOX [+] XTNZ IUCWOTDOIMOFGUAROSVOX 2010-03-22 03! 17:53 UTC 2010-04-21 20:00:30 UTC 30d 16h 42m 37s [■See
2 □ iXTNZl-XPINCPGRUCIKORBNCDTN [+] XTNZ XPINCPGRUCIKORBNCDTN 2010-03-30 21:07:09 UTC 2010-04-21 20:00:00 UTC 2id 22h 52m Sis »ee
3 □ rXTNZl-OGBCUWGTUBUNCOVEXOPL [+] XTNZ OGBCUWGTUBUNCOVEXOPL 2010-03-22 08:37:13 UTC 2010-04-21 19:59:59 UTC 30d llh 22m 46s [+] EE
4 □ rXTNZl-DFFZDNZVJKOHZAOJXFHU [+] XTNZ DFFZDNZVJKOHZAOJXFHU 2010-03-31 13:04:41 UTC 2010-04-21 19:59:59 UTC 2Id 6h EEm 18s [+] £&
5 □ I’Mtln'lltl. OHTFJEDWUXFBNDMODON1 2010-03-23 04:44:10 UTC 2010-04-21 19:56:21 UTC 2M:i1fe-Kfn- -Si [+] EE

File Edit View History Bookmarks Tools Help

@ * C X u

03 Most Visited ^ Getting Started | Latest Headlines

Botlnstances: indew

u □ Botlnstances: show

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
£* ' C X * ■ * Google E
\P.\ Most Visited ^ Getting Started ¡¿] Latest Headlines
Botlnstances: new Igi Q] Bet Instances: show ö ! + 1 -

rHerdsl fBotsl [“Connected Botsl fBct Types! Machines 1 riP Usages! [“Countries! \Command Recurrences! [“Command Types! Logged in as: 73882

New Command Recurrence

Name

|Dirwalks FTvY |

Command Type

I —S el Com ma njd T y p e —iw

— Select Command Type —

GetDirWalk

! GetProcInfc
I

[ Create ]

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
Ü * c x ui 3] * Google E
\P.\ Most Visited ^ Getting Started ¡¿] Latest Headlines
Botlnstances: new Q] Bot Inst an cas: show ¡si + 1 -

rHerds'! fBotsl [“Connected Botsl fBot Types! [Machines] [IP Usages! [“Countries! fCommand Recurrences'! [“Command Types!

New Command Recurrence

Logged in as: 73882

Dirwalks FTvY

Command Type

GetDirWalk__

Herd

( — Select Herd— \v

— Select Herd —

My New Herd
paki netblock
pakirtnz

Some Awesome Herd

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

@1 - C X v ~P\

03 Most Visited ^ Getting Started Latest Headlines

J Q Botlnstances: edit LjI Q Botlnstances: show 4 _____________________________________________________________________________________________________________________________| -

fHerdsl fBotsl [“Connected Botsl fBct Types! [Machines] flP Usages! [Countries] \Command Recurrences! [Command Types] Logged in as: 73882

CommandRecurrence was successfully created.

Editing Command Recurrence Dirwalks FTW

Recurrence Name Command Type Name Herd Name
|Dirwalks FTW 1 GelDirWalk | My New Herd -
Earliest Execution Time Latest Execution Time

Yes v Cycle Commands?

Yes v| Broadcast Commands?

Maximum Total Executions For Herd
Maximum Total Executions Per Bot
Maximum Concurrent Executions Far Herd

[1_____ Maximum Concurrent Executions Per Bot

U Delay Interval For Herd (seconds)

U Delay Interval For Bot (seconds)

[ Update ] [ Update And Activate | Deactivated [ Add ACommand Spec ]

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
Ü ' C X * Google E
\P.\ Most Visited ^ Getting Started ¡¿f| Latest Headlines
Botlnstances: edit lyj Q Bot Inst an cas: show Iwj 1 + 1-

rHerds'! fBotsl [“Connected Botsl [Bet Types! [“Machines! riP Usages! [“Countries! fCommand Recurrences'! [“Command Types!
CommandRecurrence was successfully created.

Logged in as: 73882

Editing Command Recurrence Dirwalks FTWr

Recurrence Name Command Type Name Herd Name

V My NewHerd v

Dirwalks FTW

GelDirWalk

Earliest Execution Time Latest Execution Time

c

o April 2010 o
Su Me Tu We Th Fr Sa
1 2 3
1 3 S 6 7 8 9 10
11 12 13 14 IS 16 17
18 19 20 ■3l! 20 23 24
1 Ä 26 27 28 29 30


1

For Herd
Per Bot

Maximum Concurrent Executions Per But

0 Delay Interval For Herd (seconds)

0 Delay Interval For Bot (seconds)

Update ] [ Update And Activate | De act! : [ Add ACommand Spec ]

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help
ft» c ifif i13 * Google E
\P.\ Most Visited ^ Getting Started Latest Headlines
Botlnstances: edit lyj .Q Botlnstances: show tül 1 1-

fHerdsl fBotsl [“Connected Botsl fBct Types! Machines 1 riP Usagesl [“Countries! \Command Recurrences! [“Command Types! Logged in as: 73882

CommandRecurrence was successfully created.

Editing Command Recurrence Dirwalks FTW

Recurrence Name Command Type Name Herd Name

|Dirwalks FTW | | GetDirWalk vj | My New Herd v

Earliest Execution Time Latest Execution Time

|p4/22/2P1Q

[Yes v Cycle Commands?

[Yes v| Broadcast Commands?

Maximum Total Executions For Herd
Maximum Total Executions Per Bet
Maximum Concurrent Executions Far Herd

[1____ Maximum Concurrent Executions Per Bot

U Delay Interval For Herd (seconds)

U Delay Interval For Bot (seconds)

| Update ] [ Update And Activate | . [ Add ACommand Spec ]

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

& • ~‘l ~ Pi

fHerdsl fBotsl [“Connected Botsl fBct Types! Machines 1 riP Usagesl [“Countries! \Command Recurrences! [“Command Types! Logged in as: 73882

CommandSpec was successfully updated.

Editing Command Recurrence Dirwalks FTW

Recurrence Name Command Type Name Herd Name

|DiiwalksFTW | | GetDirWalk v-] | My New Herd v

Earliest Execution Time Latest Execution Time

Yes v Cycle Commands?

Yes v| Broadcast Commands?

Maximum Total Executions For Herd
Maximum Total Executions Per Bot
Maximum Concurrent Executions For Herd

[1_____ Maximum Concurrent Executions Per Bot

U Delay Interval For Herd (seconds)

U Delay Interval For Bot (seconds)

| Update ] [ Update And Activate | ; [ Add ACommand Spec ] [ View Command Specs |

File Edit View History Bookmarks Tools Help

- c .

03 Most Visited ^ Getting Started | Latest Heed lines

L j Botlnstances: edit

yi □ Botlnstences: show

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

TOP SECRET//COMINT//REL USA, FVEY

File Edit View History Bookmarks Tools Help

0 - C X 6i?

M Most Visited ^ Getting Started Latest Headlines

J Qj Botlnstances: show lyl Q Botlnstances: show

f Herds! fBotsl [Connected Botsl [Bot Types! [Machines 1 HP Usages! [Countries! \Command Recurrences'! [Command Types!
CommandRecurrence was successfully updated and activated.

& ~ ’I-

Executions for Command Recurrence 'Dirwalks FTW1

Execution Spec Bat Instance Creation Time * Transmission Time Acknow\edqernent Time Completion Time Status

3



Logged in as: 73882

TOP SECRET//COMINT//REL USA, FVEY


e-Highlighter

Click to send permalink to address bar, or right-click to copy permalink.

Un-highlight all Un-highlight selectionu Highlight selectionh