Analysis Report

Overview

General Information

Joe Sandbox Version:	22.0.0
Analysis ID:	523581
Start time:	09:55:13
Joe Sandbox Product:	Cloud
Start date:	05.04.2018
Overall analysis duration:	0h 6m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	payment.jar
Cookbook file name:	Java Tracing.jbs
Analysis system description:	Windows 7 (Office 2010 SP2, Java 1.8.0_40, Flash 16.0.0.305, Acrobat Reader 11.0.08, Internet Explorer 11, Chrome 55, Firefox 43)
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies	HCA enabled EGA enabled
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal68.expl.troj.winJAR@9/4@8/3
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
EGA Information:	Failed
Cookbook Comments:	Adjust boot time Correcting counters for adjusted boot time
Warnings:	Show All Exclude process from analysis (whitelisted): WmiPrvSE.exe, conhost.exe, WMIADAP.exe Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtEnumerateKey calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtQueryValueKey calls found. Report size getting too big, too many NtReadFile calls found. Report size getting too big, too many NtSetInformationFile calls found. Skipping Hybrid Code Analysis (implementation is based on Java, .Net, VB or Delphi, or parses a document) for: cmd.exe, java.exe, java.exe

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	68	0 - 100	Report FP / FN

Confidence

Strategy	Score	Range	Further Analysis Required?	Confidence
Threshold	5	0 - 5	false

Classification

Analysis Advice

Sample has a GUI, but Joe Sandbox has not found any clickable buttons, likely more UI automation may extend behavior

Sample monitors Window changes (e.g. starting applications), analyze the sample with the 'Simulates keyboard and window changes' cookbook

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Signature Overview

Click to jump to signature section

Software Vulnerabilities:

Exploit detected, runtime environment starts unknown processes

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Process created: C:\Windows\System32\reg.exe

Jump to behavior

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.1.16:49190 -> 81.171.7.178:4040

Uses TOR for connection hidding

Show sources

Source: unknown	DNS query: name: vvrhhhnaijyj6s2m.onion.top
Source: unknown	DNS query: name: vvrhhhnaijyj6s2m.onion.top
Source: unknown	DNS query: name: vvrhhhnaijyj6s2m.onion.top
Source: unknown	DNS query: name: vvrhhhnaijyj6s2m.onion.top
Source: unknown	DNS query: name: vvrhhhnaijyj6s2m.onion.top

Uses dynamic DNS services

Show sources

Source: unknown

DNS query: name: blockholder.duckdns.org

IP address seen in connection with other malware

Show sources

Source: Joe Sandbox View

IP Address: 207.250.29.221 207.250.29.221

Internet Provider seen in connection with other malware

Show sources

Source: Joe Sandbox View	ASN Name: FNIS-FidelityNationalInformationServicesIncUS FNIS-FidelityNationalInformationServicesIncUS
Source: Joe Sandbox View	ASN Name: LEASEWEB-NLNetherlandsNL LEASEWEB-NLNetherlandsNL

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: vvrhhhnaijyj6s2m.onion.top

Urls found in memory or binary data

Show sources

Source: java.exe	String found in binary or memory: file:///
Source: java.exe	String found in binary or memory: file:///C:/Program%20Files/Java/jre1.8.0_40/lib/jce.jar
Source: java.exe	String found in binary or memory: file:///C:/Program%20Files/Java/jre1.8.0_40/lib/resources.jar
Source: java.exe	String found in binary or memory: file:///C:/Program%20Files/Java/jre1.8.0_40/lib/rt.jar
Source: java.exe	String found in binary or memory: file:///C:/Users/user/AppData/Local/Temp/jartracer.jar
Source: java.exe	String found in binary or memory: file:///C:/Users/user/Desktop/payment.jar
Source: java.exe	String found in binary or memory: http://
Source: java.exe	String found in binary or memory: http://bugreport.sun.com/bugreport/
Source: java.exe	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html
Source: java.exe	String found in binary or memory: http://cps.chambersign.org/cps/chambersroot.html0
Source: java.exe	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl
Source: java.exe	String found in binary or memory: http://crl.chambersign.org/chambersroot.crl0
Source: java.exe	String found in binary or memory: http://crl.comodo.net/AAACertificateServices.crl
Source: java.exe	String found in binary or memory: http://crl.comodo.net/AAACertificateServices.crl0
Source: java.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl
Source: java.exe	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: java.exe	String found in binary or memory: http://crl.globalsign.net/root-r2.crl
Source: java.exe	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: java.exe	String found in binary or memory: http://crl.securetrust.com/STCA.crl
Source: java.exe	String found in binary or memory: http://crl.securetrust.com/STCA.crl0
Source: java.exe	String found in binary or memory: http://crl.usertrust.com/UTN-DATACorpSGC.crl
Source: java.exe	String found in binary or memory: http://crl.usertrust.com/UTN-DATACorpSGC.crl0
Source: java.exe	String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-ClientAuthenticationandEmail.crl
Source: java.exe	String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-ClientAuthenticationandEmail.crl0
Source: java.exe	String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-Hardware.crl
Source: java.exe	String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-Hardware.crl01
Source: java.exe	String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-Object.crl
Source: java.exe	String found in binary or memory: http://crl.usertrust.com/UTN-USERFirst-Object.crl0)
Source: java.exe	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl
Source: java.exe	String found in binary or memory: http://crl.xrampsecurity.com/XGCA.crl0
Source: java.exe	String found in binary or memory: http://null.sun.com/
Source: java.exe	String found in binary or memory: http://policy.camerfirma.com
Source: java.exe	String found in binary or memory: http://policy.camerfirma.com0
Source: java.exe	String found in binary or memory: http://repository.swisssign.com/
Source: java.exe	String found in binary or memory: http://repository.swisssign.com/0
Source: java.exe	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl
Source: java.exe	String found in binary or memory: http://trustcenter-crl.certificat2.com/Keynectis/KEYNECTIS_ROOT_CA.crl0
Source: java.exe	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: java.exe	String found in binary or memory: http://www.certplus.com/CRL/class2.crl
Source: java.exe	String found in binary or memory: http://www.certplus.com/CRL/class2.crl0
Source: java.exe	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl
Source: java.exe	String found in binary or memory: http://www.certplus.com/CRL/class3P.crl0
Source: java.exe	String found in binary or memory: http://www.chambersign.org
Source: java.exe	String found in binary or memory: http://www.chambersign.org1
Source: java.exe	String found in binary or memory: http://www.quovadis.bm
Source: java.exe	String found in binary or memory: http://www.quovadis.bm0
Source: java.exe	String found in binary or memory: http://www.quovadisglobal.com/cps
Source: java.exe	String found in binary or memory: http://www.quovadisglobal.com/cps0
Source: java.exe	String found in binary or memory: http://www.trustcenter.de/crl/v2/tc_class_2_ca_II.crl
Source: java.exe	String found in binary or memory: http://www.usertrust.com
Source: java.exe	String found in binary or memory: http://www.usertrust.com1
Source: java.exe	String found in binary or memory: http://www.usertrust.com1604
Source: java.exe	String found in binary or memory: http://www.valicert.com/
Source: java.exe	String found in binary or memory: http://www.valicert.com/1
Source: java.exe	String found in binary or memory: https://ocsp.quovadisoffshore.com
Source: java.exe	String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: java.exe	String found in binary or memory: https://vvrhhhnaijyj6s2m.onion.top/storage/cryptOutput/0.62515200

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49189
Source: unknown	Network traffic detected: HTTP traffic on port 49188 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49188
Source: unknown	Network traffic detected: HTTP traffic on port 49189 -> 443

Boot Survival:

Creates autostart registry keys to launch java

Show sources

Source: C:\Windows\System32\reg.exe

Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run J14bfe7e2dc5:U6c756b657461796c6f72_s "C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe" -jar "C:\Users\user\.6520706727662484494.jar"

Jump to behavior

Creates autostart registry keys with suspicious names

Show sources

Source: C:\Windows\System32\reg.exe

Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run J14bfe7e2dc5:U6c756b657461796c6f72_s

Jump to behavior

Creates an autostart registry key

Show sources

Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run J14bfe7e2dc5:U6c756b657461796c6f72_s			Jump to behavior
Source: C:\Windows\System32\reg.exe	Registry value created or modified: HKEY_USERS\Software\Microsoft\Windows\CurrentVersion\Run J14bfe7e2dc5:U6c756b657461796c6f72_s			Jump to behavior

Remote Access Functionality:

Java Jar sets JVM global properties found in jRAT

Show sources

Source: Java tracing	Java Jar sets suspicious JVM global properties: javax.script.AbstractScriptEngine.eval(java.lang.String) on java.lang.System.setProperty("q.main-class","qua.enterprise.qontroller.q4slave.q4local.SlaveMain");
Source: Java tracing	Java Jar sets suspicious JVM global properties: javax.script.AbstractScriptEngine.eval(java.lang.String) on java.lang.System.setProperty("q.encryptedPathsPath","/com/indene/impressive/JarvisLungan");

Stealing of Sensitive Information:

Searches for user specific document files

Show sources

Source: C:\Windows\explorer.exe

Directory queried: C:\Users\user\Documents

Jump to behavior

Data Obfuscation:

Java code performs script evaluation on high entropy strings

Show sources

Source: Java tracing

Executes: javax.script.AbstractScriptEngine.eval(java.lang.String) on com.tryptogen.redfin.Outcaste.yezCheck=com.indene.DecayPray.getNodiPacs().getDeclaredMethod("defineClass", com.indene.De

Launches a Java Jar file from a suspicious file location

Show sources

Source: Java tracing

Executes: java.lang.ProcessBuilder(java.lang.String[]) on c:\program files\java\jre1.8.0_40\bin\java.exe -jar c:\users\user\.6520706727662484494.jar

System Summary:

Reads the hosts file

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Uses reg.exe to modify the Windows registry

Show sources

Source: unknown

Process created: C:\Windows\System32\reg.exe reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v J14bfe7e2dc5:U6c756b657461796c6f72_s /t REG_SZ /d '\'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe\' -jar \'C:\Users\user\.6520706727662484494.jar\''

Classification label

Show sources

Source: classification engine

Classification label: mal68.expl.troj.winJAR@9/4@8/3

Creates files inside the user directory

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312302014-279660585-3511680526-1004\83aa4cc77f591dfc2374580bbd95f6ba_041d84af-7e76-450d-8340-55db3c73c359

Jump to behavior

Creates temporary files

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

File created: C:\Users\user~1\AppData\Local\Temp\hsperfdata_user

Jump to behavior

Executable is probably coded in java

Show sources

Source: C:\Windows\System32\cmd.exe

Section loaded: C:\Program Files\Java\jre1.8.0_40\bin\java.dll

Jump to behavior

Launches a second explorer.exe instance

Show sources

Source: unknown	Process created: C:\Windows\explorer.exe
Source: unknown	Process created: C:\Windows\explorer.exe

Reads ini files

Show sources

Source: C:\Windows\explorer.exe

File read: C:\Program Files\desktop.ini

Jump to behavior

Reads software policies

Show sources

Source: C:\Windows\System32\cmd.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Spawns processes

Show sources

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ''C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\payment.jar'' >> C:\cmdlinestart.log 2>&1
Source: unknown	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\payment.jar'
Source: unknown	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -jar C:\Users\user\.6520706727662484494.jar
Source: unknown	Process created: C:\Windows\System32\reg.exe reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v J14bfe7e2dc5:U6c756b657461796c6f72_s /t REG_SZ /d '\'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe\' -jar \'C:\Users\user\.6520706727662484494.jar\''
Source: unknown	Process created: C:\Windows\explorer.exe explorer.exe 'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe' -jar 'C:\Users\user\.6520706727662484494.jar'
Source: unknown	Process created: C:\Windows\explorer.exe C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Source: C:\Windows\System32\cmd.exe	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\payment.jar'	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Program Files\Java\jre1.8.0_40\bin\java.exe 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -jar C:\Users\user\.6520706727662484494.jar	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process created: C:\Windows\System32\reg.exe reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v J14bfe7e2dc5:U6c756b657461796c6f72_s /t REG_SZ /d '\'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe\' -jar \'C:\Users\user\.6520706727662484494.jar\''	Jump to behavior

Uses an in-process (OLE) Automation server

Show sources

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Uses Rich Edit Controls

Show sources

Source: C:\Windows\explorer.exe

File opened: C:\Windows\system32\MsftEdit.dll

Jump to behavior

Found graphical window changes (likely an installer)

Show sources

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

File opened: C:\Program Files\Java\jre1.8.0_40\bin\msvcr100.dll

Jump to behavior

Anti Debugging:

Checks for kernel debuggers (NtQuerySystemInformation(SystemKernelDebuggerInformation))

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

System information queried: KernelDebuggerInformation

Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Memory protected: page read and write and page guard

Jump to behavior

Malware Analysis System Evasion:

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Show sources

Source: C:\Windows\explorer.exe

Window / User API: threadDelayed 492

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Show sources

Source: C:\Windows\explorer.exe TID: 3824	Thread sleep time: -60000s >= -60000s			Jump to behavior
Source: C:\Windows\explorer.exe TID: 3852	Thread sleep time: -60000s >= -60000s			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: java.exe	Binary or memory string: %com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe	Binary or memory string: com/sun/corba/se/impl/util/SUNVMCID.classPK
Source: java.exe	Binary or memory string: java/lang/VirtualMachineError.classPK
Source: java.exe	Binary or memory string: org/omg/CORBA/OMGVMCID.classPK

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Show sources

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\explorer.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Language, Device and Operating System Detection:

Queries time zone information

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation DynamicDaylightTimeDisabled

Jump to behavior

Queries the cryptographic machine GUID

Show sources

Source: C:\Program Files\Java\jre1.8.0_40\bin\java.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Behavior Graph

Simulations

Behavior and APIs

Time	Type	Description
09:56:43	API Interceptor	2x Sleep call for process: java.exe modified
09:57:15	API Interceptor	1x Sleep call for process: reg.exe modified
09:57:19	API Interceptor	589x Sleep call for process: explorer.exe modified
09:57:19	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run J14bfe7e2dc5:U6c756b657461796c6f72_s "C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe" -jar "C:\Users\user\.6520706727662484494.jar"

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link
207.250.29.221	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse
	qrat.jar	eacaf45986584e6f20618409a55a6c3296329bd043d69637b4fccbf4dca7cf39	malicious	Browse
	qrat.jar	eacaf45986584e6f20618409a55a6c3296329bd043d69637b4fccbf4dca7cf39	malicious	Browse
	NEW ORDER .LIST 105.jar	031daa275ae5c3ec2a103e0484d496acb3237173d57c8772197e7547d09c97cd	malicious	Browse
	oSBFkSOqOc.jar	6355f0e371f283679ed13b2c3b921c34706dd1f6fbd8630bae9e6d6622c1426d	malicious	Browse
	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse
	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse
	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse
	CONT_WX_BAS.jar	5fe771916df7152c4d1a9d04d325fd3e69f6daa1e381f89d62565b1080be3563	malicious	Browse
	b53P4Umfx.jar	bf5adc2216c0c3f1a84aa412ee97b82fcecae7f0e1ca8a773991a44161d3d407	malicious	Browse
	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse
	Document.jar	e94b1e6c3b02ded7c9fd8ebd9968549504e20ef40a6061c4602d2c89a2dceeb2	malicious	Browse
81.171.7.178	payment.jar	2e4429e1fad34021acb0325df71755bc698560bdfc680ab90ec1b720d4ea507d	malicious	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
vvrhhhnaijyj6s2m.onion.top	New Order & Payment TT Copy.jar	cfc3be4fbf57c1350929d0f89cd4a368aad89eb93071b402c56a6c4c8c4f7515	malicious	Browse	46.246.120.179
	0.05185200 1514601062.jar	fd2f198a5cf7ad8bcf4c3a7ca9ae700e13fb52e82dc8afa2cc1ec02344dd5788	malicious	Browse	46.246.120.179
	0.86370800 1515583201.jar	2a79d7c6aadd1144eb83c1fb976e1c25aa9b76ba0e24c5682e1cdc832b0cd2dc	malicious	Browse	46.246.120.179
	https://dl.dropbox.com/s/45vovjy58vmss1d/QuiteImp_Pdf.zip?dl=0		malicious	Browse	46.246.120.179
	Court Case.jar	811ab1fee15fabe24ad39a55ebc87a771a1be78b2282d2cf9d766d185abdd68e	malicious	Browse	80.67.3.122
	COPY OF ORIGINAL SHIPPING .DOCUMENT.jar	a0a17f4d58f298ab33312f3b9c0c4dd3fc6be97faa72ee172da367014e27982e	malicious	Browse	62.0.58.94
	receipt_refund_13032018.jpg.jar	579c5178304a029268fb06d0ec10229a82a273e1b300d64072c76c080116c147	malicious	Browse	62.0.58.94
	payment.jar	2e4429e1fad34021acb0325df71755bc698560bdfc680ab90ec1b720d4ea507d	malicious	Browse	62.0.58.94
	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse	207.250.29.221
	qrat.jar	eacaf45986584e6f20618409a55a6c3296329bd043d69637b4fccbf4dca7cf39	malicious	Browse	207.250.29.221
	qrat.jar	eacaf45986584e6f20618409a55a6c3296329bd043d69637b4fccbf4dca7cf39	malicious	Browse	207.250.29.221
	NEW ORDER .LIST 105.jar	031daa275ae5c3ec2a103e0484d496acb3237173d57c8772197e7547d09c97cd	malicious	Browse	207.250.29.221
	Closing Instructions 12-5-2017.jar	631b1f229578ee344fffaef116ca19082055ddc69747e5a3bb0a5c2699b1d54d	malicious	Browse	46.246.120.179
	Pending Invoice 567824742_doc.jar	5bd850d706a4836acde0e6a00726cc2b21595e5d682f76d382411e84347b9cd8	malicious	Browse	46.246.120.179
	0.29074100 1512093541.jar	d8ad8b8c638df861a1ce19a0e9ce218f713b28ac1faba3d71c2a28e62ac8f6c1	malicious	Browse	46.246.120.179
	vvrhhhnaijyj6s2m.onion.top		malicious	Browse	46.246.120.179
	OFFER-20171110376.docx	32df4b31a55a62c9d6e0a4d5e9251f1bf602141be7b465cd30ef8ec1862b5278	malicious	Browse	46.246.120.179

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
LEASEWEB-NLNetherlandsNL	67New Spec. Order.exe	782a3fab9b36bf28b9c4fc1cc35c1117d0befe85532742d881dfc43d49a4b3fc	malicious	Browse	95.211.125.236
	Wollin_Info.doc	229c479ee2ad6ee880ce9fa196c453c0d0b7d8deb9bcfd8b9c5b695d3e786c13	malicious	Browse	37.48.122.26
	31SIMREG INCENTIVE BREAKDOWN.xls.exe	44ec55d01db8cc10489808865bf3e8c727b0f95665c788252129c48730e03c9d	malicious	Browse	185.227.83.36
	4920171219_KYC Form for SIM Registration Partners.pd.exe	ab08adc286b8ad4f9050172fe2c9241e5e5be5d192a33b9b7a0222d157cccf1f	malicious	Browse	185.227.83.36
	51Delivery_Notification_00121801.doc.wsf	faba2b71f4ae95ff92dd05aa0779624427197fafe4633750aae98c3320788e73	malicious	Browse	185.246.13.229
	sj.js	7be1c9b5c8ef6d9b52bc0415c43fd826ac56f7b85104c83e278460f7666ec579	malicious	Browse	185.231.69.166
	35ACTIVATION TARGET FOR JANUARY 2018.xlsx.exe	05be5d370dab29f36bb68b660bad837e4d720b7fb7922f44b102aefef798fbf6	malicious	Browse	185.227.83.36
	SL7561298.jse	7458694590c8e390140576b47dfda12cb7d23b881d78ac1fbfc0d4e317f23c8c	malicious	Browse	37.48.122.26
	emotet2.doc	ef2e6152fe8c07575ff05966bb8ca0f42fd820efb37de8431033312e6223924b	malicious	Browse	185.224.137.49
	66DHL_AWB_Shipping.exeDoc2.exe	3971766f2ca5265556c3fb6c99db04f5647465058b9b48cdcde096dc8afa6a3e	malicious	Browse	212.7.208.153
	OrCnUKH5vX.pdf	c86f2967dd7e38aa76bae295f4ab047770b8114a4a6c065cb8f1b6ae35585f08	malicious	Browse	94.75.250.33
	receipt_package_995383740043153369841.js	9c272806dcd9a862431e0ef0c58d761f6d5ee298133500366b277dddfc83b7ee	malicious	Browse	185.241.54.14
	F4Puxs8irK.pdf	c86f2967dd7e38aa76bae295f4ab047770b8114a4a6c065cb8f1b6ae35585f08	malicious	Browse	94.75.250.33
	payment.jar	2e4429e1fad34021acb0325df71755bc698560bdfc680ab90ec1b720d4ea507d	malicious	Browse	81.171.7.178
	fb-register68.hol.es/incorrect_email.html		malicious	Browse	185.224.137.100
	www.wsop.com		malicious	Browse	136.144.49.28
	Emotet 29.03.doc	5a5f9266e16497ffd86d7f36a18b6551a4d8ca29463d410afd499768b876d8ed	malicious	Browse	81.171.31.235
	https://www.jqcdn.download/jquery-3.3.1.min.js		malicious	Browse	185.234.216.52
	drop.exe	302e1245ef2e0607d653e0d3b3ba8af3de32e419264457513c3cf59627692c24	malicious	Browse	185.228.233.126
	49TWQOWU.exe	b7de5f1a5e823f609786050d424ea338e278d68a058fb2ab29a2e890270943f8	malicious	Browse	95.211.125.236
FNIS-FidelityNationalInformationServicesIncUS	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse	207.250.29.221
	qrat.jar	eacaf45986584e6f20618409a55a6c3296329bd043d69637b4fccbf4dca7cf39	malicious	Browse	207.250.29.221
	qrat.jar	eacaf45986584e6f20618409a55a6c3296329bd043d69637b4fccbf4dca7cf39	malicious	Browse	207.250.29.221
	NEW ORDER .LIST 105.jar	031daa275ae5c3ec2a103e0484d496acb3237173d57c8772197e7547d09c97cd	malicious	Browse	207.250.29.221
	oSBFkSOqOc.jar	6355f0e371f283679ed13b2c3b921c34706dd1f6fbd8630bae9e6d6622c1426d	malicious	Browse	207.250.29.221
	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse	207.250.29.221
	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse	207.250.29.221
	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse	207.250.29.221
	CONT_WX_BAS.jar	5fe771916df7152c4d1a9d04d325fd3e69f6daa1e381f89d62565b1080be3563	malicious	Browse	207.250.29.221
	b53P4Umfx.jar	bf5adc2216c0c3f1a84aa412ee97b82fcecae7f0e1ca8a773991a44161d3d407	malicious	Browse	207.250.29.221
	5Hzr1MXNCp.jar	877ad7ee754dfa9949c7881ac202fab8fba0bcb53564b91f471e6e697d5002d0	malicious	Browse	207.250.29.221
	Document.jar	e94b1e6c3b02ded7c9fd8ebd9968549504e20ef40a6061c4602d2c89a2dceeb2	malicious	Browse	207.250.29.221

Dropped Files

No context

Screenshots

Startup

System is w7_1

cmd.exe (PID: 3596 cmdline: C:\Windows\system32\cmd.exe /c ''C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\payment.jar'' >> C:\cmdlinestart.log 2>&1 MD5: AD7B9C14083B52BC532FBA5948342B98)

java.exe (PID: 3624 cmdline: 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\payment.jar' MD5: 6F4EB294ACF731771AFE3EF6F7EE812D)

java.exe (PID: 3732 cmdline: 'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -jar C:\Users\user\.6520706727662484494.jar MD5: 6F4EB294ACF731771AFE3EF6F7EE812D)

reg.exe (PID: 3788 cmdline: reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v J14bfe7e2dc5:U6c756b657461796c6f72_s /t REG_SZ /d '\'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe\' -jar \'C:\Users\user\.6520706727662484494.jar\'' MD5: D69A9ABBB0D795F21995C2F48C1EB560)

explorer.exe (PID: 3804 cmdline: explorer.exe 'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe' -jar 'C:\Users\user\.6520706727662484494.jar' MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

explorer.exe (PID: 3828 cmdline: C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding MD5: 6DDCA324434FFA506CF7DC4E51DB7935)

cleanup

Created / dropped Files

C:\Users\user\.6520706727662484494.jar
Process:	C:\Program Files\Java\jre1.8.0_40\bin\java.exe
File Type:	Java Jar file data (zip)
Size (bytes):	427132
Entropy (8bit):	7.652096104312218
Encrypted:	false
MD5:	D54129C9695C893D5452CF3849DB3016
SHA1:	DBB5259FDBCFB11326D6908BC35E1D1AD33F208B
SHA-256:	2E4429E1FAD34021ACB0325DF71755BC698560BDFC680AB90EC1B720D4EA507D
SHA-512:	B5A826B276A50474283142D7B8A18ADCCDFE1DE9B2BCD2D0F2FB164B937AB707BE4DC03EE75534F4276CF1199B4BE6FAA6A5398FD66311909D137BACD23397E7
Malicious:	true
Reputation:	low

C:\Users\user\5kvhk71td4v0e\1u4qq41jcj0451ihj8mj3fe2a9\ler7kh071ab4mftbmh70tcjdqkhbc5r9c8h8ujec49dradbh4br
Process:	C:\Program Files\Java\jre1.8.0_40\bin\java.exe
File Type:	data
Size (bytes):	4896
Entropy (8bit):	7.000752919492679
Encrypted:	false
MD5:	0D012D7570F1BD333447F9CEE9FBE653
SHA1:	716DE5D6E6909EA39A0E291B210E2BE0759C4F5C
SHA-256:	D4E47D2A6C57D178DBDBD3CA2AEC490A2B965D95C38DFCC8A4897D7A8AA924F1
SHA-512:	0FD0F80D91FF17B068E7297FB47B17864F02E4B3FD7A4738A444A2961D2AB5BE91A6BE8E27DBC1051D7F2BAF049EB59AD20D0BC2F455514522F02B04F7106A1C
Malicious:	false
Reputation:	low

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-312302014-279660585-3511680526-1004\83aa4cc77f591dfc2374580bbd95f6ba_041d84af-7e76-450d-8340-55db3c73c359
Process:	C:\Program Files\Java\jre1.8.0_40\bin\java.exe
File Type:	data
Size (bytes):	45
Entropy (8bit):	0.9111711733157262
Encrypted:	false
MD5:	C8366AE350E7019AEFC9D1E6E6A498C6
SHA1:	5731D8A3E6568A5F2DFBBC87E3DB9637DF280B61
SHA-256:	11E6ACA8E682C046C83B721EEB5C72C5EF03CB5936C60DF6F4993511DDC61238
SHA-512:	33C980D5A638BFC791DE291EBF4B6D263B384247AB27F261A54025108F2F85374B579A026E545F81395736DD40FA4696F2163CA17640DD47F1C42BC9971B18CD
Malicious:	false
Reputation:	moderate, very likely benign file

unknown
Process:	C:\Program Files\Java\jre1.8.0_40\bin\java.exe
File Type:	ASCII text, with CRLF line terminators
Size (bytes):	2191
Entropy (8bit):	4.777228022782642
Encrypted:	false
MD5:	F00C700B7D492F8CAA50ECF986EDA19C
SHA1:	070C8EA460534A699907696E5441AC4DD1B0B71C
SHA-256:	84D215A5C33B0292DB614B8B97783327D0C3765D7123345AC5982CF0667BFA95
SHA-512:	D1771FC0E7870EEAF97E627648325F766D4CD245DF20ABE262A2AD6475C287D4F3F86CBC3AB806DF7E8DB1EDDB0C69FC38A85BBE0B4E8D701ED6E52D0392F4AC
Malicious:	true
Reputation:	low

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
blockholder.duckdns.org	81.171.7.178	true	true		unknown
vvrhhhnaijyj6s2m.onion.top	207.250.29.221	true	true		unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	ASN	ASN Name	Malicious
207.250.29.221	United States	18434	FNIS-FidelityNationalInformationServicesIncUS	true
8.8.8.8	United States	15169	GOOGLE-GoogleIncUS	false
81.171.7.178	Netherlands	60781	LEASEWEB-NLNetherlandsNL	true

Static File Info

General
File type:	Java Jar file data (zip)
Entropy (8bit):	7.652096104312218
TrID:	Java Archive (13504/1) 77.13% ZIP compressed archive (4004/1) 22.87%
File name:	payment.jar
File size:	427132
MD5:	d54129c9695c893d5452cf3849db3016
SHA1:	dbb5259fdbcfb11326d6908bc35e1d1ad33f208b
SHA256:	2e4429e1fad34021acb0325df71755bc698560bdfc680ab90ec1b720d4ea507d
SHA512:	b5a826b276a50474283142d7b8a18adccdfe1de9b2bcd2d0f2fb164b937ab707be4dc03ee75534f4276cf1199b4be6faa6a5398fd66311909d137bacd23397e7
File Content Preview:	PK........!CsL................META-INF/MANIFEST.MF....M....!..{...R.6....N..V.6f..#......^.lg&3".........+......!..H5....R.LX..O..?@w7..~..Z.3.@...b...k)F..m.Rz...5/..71\|h...[d..;.....PK...GMi........PK........!CsL................com/indene/impressive/Plu

File Icon

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 5, 2018 09:57:16.438105106 CEST	63638	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:17.434628010 CEST	63638	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:18.434189081 CEST	63638	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:20.434401035 CEST	63638	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:20.447156906 CEST	53	63638	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:20.447210073 CEST	53	63638	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:20.447242975 CEST	53	63638	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:20.476495028 CEST	53	63638	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:20.618629932 CEST	49188	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:20.618674994 CEST	443	49188	207.250.29.221	192.168.1.16
Apr 5, 2018 09:57:20.618808031 CEST	49188	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:20.780015945 CEST	49188	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:20.780062914 CEST	443	49188	207.250.29.221	192.168.1.16
Apr 5, 2018 09:57:20.974550962 CEST	443	49188	207.250.29.221	192.168.1.16
Apr 5, 2018 09:57:20.974800110 CEST	49188	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:20.981374979 CEST	49188	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:20.981425047 CEST	443	49188	207.250.29.221	192.168.1.16
Apr 5, 2018 09:57:34.758858919 CEST	59362	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:34.816751957 CEST	53	59362	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:34.820943117 CEST	49189	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:34.820988894 CEST	443	49189	207.250.29.221	192.168.1.16
Apr 5, 2018 09:57:34.821053982 CEST	49189	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:34.925195932 CEST	49189	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:34.925240040 CEST	443	49189	207.250.29.221	192.168.1.16
Apr 5, 2018 09:57:35.160362005 CEST	443	49189	207.250.29.221	192.168.1.16
Apr 5, 2018 09:57:35.160466909 CEST	49189	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:35.164037943 CEST	49189	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:35.164077044 CEST	443	49189	207.250.29.221	192.168.1.16
Apr 5, 2018 09:57:35.164338112 CEST	49189	443	192.168.1.16	207.250.29.221
Apr 5, 2018 09:57:35.164357901 CEST	443	49189	207.250.29.221	192.168.1.16
Apr 5, 2018 09:57:36.198326111 CEST	52261	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:36.754153013 CEST	53	52261	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:36.755932093 CEST	49190	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:36.755985022 CEST	4040	49190	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:36.756093025 CEST	49190	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:36.772327900 CEST	49190	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:36.772357941 CEST	4040	49190	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:36.772531033 CEST	49190	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:36.772550106 CEST	4040	49190	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:36.772664070 CEST	49190	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:36.772680044 CEST	4040	49190	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:36.772815943 CEST	49190	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:36.772834063 CEST	4040	49190	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:37.473273993 CEST	4040	49190	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:37.473365068 CEST	49190	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:46.466741085 CEST	49191	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:46.466793060 CEST	4040	49191	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:46.466851950 CEST	49191	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:46.467128038 CEST	49191	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:46.467144966 CEST	4040	49191	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:46.467276096 CEST	49191	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:46.467291117 CEST	4040	49191	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:46.467396021 CEST	49191	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:46.467410088 CEST	4040	49191	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:46.467503071 CEST	49191	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:46.467514992 CEST	4040	49191	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:46.810964108 CEST	4040	49191	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:46.811093092 CEST	49191	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:47.447520971 CEST	49192	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:47.447570086 CEST	4040	49192	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:47.448044062 CEST	49192	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:47.448298931 CEST	49192	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:47.448314905 CEST	4040	49192	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:47.448683977 CEST	49192	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:47.448709011 CEST	4040	49192	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:47.904377937 CEST	4040	49192	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:47.904494047 CEST	49192	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:48.446824074 CEST	49193	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:48.446882963 CEST	4040	49193	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:48.446969032 CEST	49193	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:48.447330952 CEST	49193	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:48.447355986 CEST	4040	49193	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:48.447520018 CEST	49193	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:48.447541952 CEST	4040	49193	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:48.447654009 CEST	49193	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:48.447674036 CEST	4040	49193	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:48.447794914 CEST	49193	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:48.447813988 CEST	4040	49193	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:48.995738983 CEST	4040	49193	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:48.995953083 CEST	49193	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:49.464587927 CEST	49194	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:49.464641094 CEST	4040	49194	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:49.464705944 CEST	49194	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:49.465009928 CEST	49194	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:49.465030909 CEST	4040	49194	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:49.465179920 CEST	49194	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:49.465198040 CEST	4040	49194	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:49.465667963 CEST	49194	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:49.465687990 CEST	4040	49194	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:49.465812922 CEST	49194	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:49.465830088 CEST	4040	49194	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:49.732215881 CEST	4040	49194	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:49.732382059 CEST	49194	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:50.457556963 CEST	49195	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:50.457612991 CEST	4040	49195	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:50.457755089 CEST	49195	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:50.458183050 CEST	49195	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:50.458214998 CEST	4040	49195	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:50.458395958 CEST	49195	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:50.458415985 CEST	4040	49195	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:50.458559036 CEST	49195	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:50.458575964 CEST	4040	49195	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:50.458719015 CEST	49195	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:50.458736897 CEST	4040	49195	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:50.824949980 CEST	4040	49195	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:50.825062037 CEST	49195	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:51.479547977 CEST	49196	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:51.479607105 CEST	4040	49196	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:51.479724884 CEST	49196	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:51.479962111 CEST	49196	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:51.479978085 CEST	4040	49196	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:51.480138063 CEST	49196	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:51.480151892 CEST	4040	49196	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:51.480237961 CEST	49196	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:51.480249882 CEST	4040	49196	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:51.480355978 CEST	49196	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:51.480367899 CEST	4040	49196	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:51.896819115 CEST	4040	49196	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:51.896931887 CEST	49196	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:52.480016947 CEST	49197	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:52.480067015 CEST	4040	49197	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:52.480175972 CEST	49197	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:52.480441093 CEST	49197	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:52.480458975 CEST	4040	49197	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:52.480626106 CEST	49197	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:52.480640888 CEST	4040	49197	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:52.480727911 CEST	49197	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:52.480741024 CEST	4040	49197	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:52.480832100 CEST	49197	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:52.480844975 CEST	4040	49197	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:52.902674913 CEST	4040	49197	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:52.903142929 CEST	49197	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:53.488217115 CEST	49198	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:53.488276958 CEST	4040	49198	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:53.488737106 CEST	49198	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:53.489037991 CEST	49198	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:53.489057064 CEST	4040	49198	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:53.489181995 CEST	49198	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:53.489197016 CEST	4040	49198	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:53.489288092 CEST	49198	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:53.489301920 CEST	4040	49198	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:53.489396095 CEST	49198	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:53.489409924 CEST	4040	49198	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:53.815290928 CEST	4040	49198	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:53.815386057 CEST	49198	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:54.486361980 CEST	49199	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:54.486408949 CEST	4040	49199	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:54.486489058 CEST	49199	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:54.486756086 CEST	49199	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:54.486777067 CEST	4040	49199	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:54.486923933 CEST	49199	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:54.486942053 CEST	4040	49199	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:54.487252951 CEST	49199	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:54.487271070 CEST	4040	49199	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:54.802880049 CEST	4040	49199	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:54.803071022 CEST	49199	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:55.538909912 CEST	49200	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:55.538966894 CEST	4040	49200	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:55.543148041 CEST	49200	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:55.543514967 CEST	49200	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:55.543543100 CEST	4040	49200	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:55.545336008 CEST	49200	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:55.545363903 CEST	4040	49200	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:55.905766964 CEST	4040	49200	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:55.906037092 CEST	49200	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:56.515238047 CEST	49201	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:56.515292883 CEST	4040	49201	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:56.515388012 CEST	49201	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:56.515680075 CEST	49201	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:56.515698910 CEST	4040	49201	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:56.516321898 CEST	49201	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:56.516340017 CEST	4040	49201	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:56.901899099 CEST	4040	49201	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:56.902095079 CEST	49201	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:57.576026917 CEST	49202	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:57.576109886 CEST	4040	49202	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:57.576255083 CEST	49202	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:57.576662064 CEST	49202	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:57.576688051 CEST	4040	49202	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:57.577389956 CEST	49202	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:57.577405930 CEST	4040	49202	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:58.196628094 CEST	4040	49202	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:58.196856976 CEST	49202	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:58.564918995 CEST	49203	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:58.564995050 CEST	4040	49203	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:58.565133095 CEST	49203	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:58.565623999 CEST	49203	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:58.565660000 CEST	4040	49203	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:58.565912008 CEST	49203	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:58.565939903 CEST	4040	49203	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:58.566121101 CEST	49203	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:58.566145897 CEST	4040	49203	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:58.566530943 CEST	49203	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:58.566562891 CEST	4040	49203	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:59.101403952 CEST	4040	49203	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:59.101531982 CEST	49203	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:59.615725040 CEST	49204	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:59.615778923 CEST	4040	49204	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:59.616184950 CEST	49204	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:59.616502047 CEST	49204	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:59.616522074 CEST	4040	49204	81.171.7.178	192.168.1.16
Apr 5, 2018 09:57:59.617110968 CEST	49204	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:57:59.617135048 CEST	4040	49204	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:00.004784107 CEST	4040	49204	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:00.005062103 CEST	49204	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:00.623337984 CEST	49205	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:00.623393059 CEST	4040	49205	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:00.623775005 CEST	49205	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:00.624178886 CEST	49205	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:00.624207973 CEST	4040	49205	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:00.624708891 CEST	49205	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:00.624763966 CEST	4040	49205	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:01.104568958 CEST	4040	49205	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:01.104867935 CEST	49205	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:01.618356943 CEST	49206	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:01.618402958 CEST	4040	49206	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:01.618494987 CEST	49206	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:01.618767977 CEST	49206	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:01.618791103 CEST	4040	49206	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:01.621871948 CEST	49206	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:01.621900082 CEST	4040	49206	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:02.101264954 CEST	4040	49206	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:02.101393938 CEST	49206	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:02.619616985 CEST	49207	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:02.619687080 CEST	4040	49207	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:02.620098114 CEST	49207	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:02.620392084 CEST	49207	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:02.620412111 CEST	4040	49207	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:02.620981932 CEST	49207	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:02.621006012 CEST	4040	49207	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:03.220527887 CEST	4040	49207	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:03.220712900 CEST	49207	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:03.612459898 CEST	49208	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:03.612541914 CEST	4040	49208	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:03.612693071 CEST	49208	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:03.613198996 CEST	49208	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:03.613238096 CEST	4040	49208	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:03.613476038 CEST	49208	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:03.613503933 CEST	4040	49208	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:03.613938093 CEST	49208	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:03.613972902 CEST	4040	49208	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:03.992028952 CEST	4040	49208	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:03.992342949 CEST	49208	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:04.621033907 CEST	49209	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:04.621098042 CEST	4040	49209	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:04.621505976 CEST	49209	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:04.621789932 CEST	49209	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:04.621810913 CEST	4040	49209	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:04.622025967 CEST	49209	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:04.622044086 CEST	4040	49209	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:04.623514891 CEST	49209	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:04.623534918 CEST	4040	49209	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:04.905344963 CEST	4040	49209	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:04.905621052 CEST	49209	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:05.611753941 CEST	49210	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:05.611835003 CEST	4040	49210	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:05.611943960 CEST	49210	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:05.612199068 CEST	49210	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:05.612219095 CEST	4040	49210	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:05.612370968 CEST	49210	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:05.612385988 CEST	4040	49210	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:05.612695932 CEST	49210	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:05.612711906 CEST	4040	49210	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:06.096992970 CEST	4040	49210	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:06.097150087 CEST	49210	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:06.611906052 CEST	49211	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:06.611984015 CEST	4040	49211	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:06.612463951 CEST	49211	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:06.612941027 CEST	49211	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:06.612974882 CEST	4040	49211	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:06.613493919 CEST	49211	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:06.613523006 CEST	4040	49211	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:06.999439955 CEST	4040	49211	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:06.999638081 CEST	49211	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:07.656655073 CEST	52165	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:58:07.702348948 CEST	53	52165	8.8.8.8	192.168.1.16
Apr 5, 2018 09:58:07.705137014 CEST	49212	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:07.705198050 CEST	4040	49212	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:07.705328941 CEST	49212	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:07.705826998 CEST	49212	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:07.705863953 CEST	4040	49212	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:07.706135988 CEST	49212	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:07.706176996 CEST	4040	49212	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:07.706669092 CEST	49212	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:07.706702948 CEST	4040	49212	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:08.024158001 CEST	4040	49212	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:08.024333954 CEST	49212	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:08.610814095 CEST	49213	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:08.610861063 CEST	4040	49213	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:08.610918045 CEST	49213	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:08.611193895 CEST	49213	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:08.611213923 CEST	4040	49213	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:08.611351967 CEST	49213	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:08.611368895 CEST	4040	49213	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:08.611959934 CEST	49213	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:08.611979008 CEST	4040	49213	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:09.097062111 CEST	4040	49213	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:09.097191095 CEST	49213	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:09.618016005 CEST	49214	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:09.618096113 CEST	4040	49214	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:09.618207932 CEST	49214	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:09.618715048 CEST	49214	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:09.618750095 CEST	4040	49214	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:09.619342089 CEST	49214	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:09.619374990 CEST	4040	49214	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:09.900269985 CEST	4040	49214	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:09.900407076 CEST	49214	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:10.610165119 CEST	49215	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:10.610219955 CEST	4040	49215	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:10.610668898 CEST	49215	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:10.611052036 CEST	49215	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:10.611082077 CEST	4040	49215	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:10.611267090 CEST	49215	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:10.611289024 CEST	4040	49215	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:10.611567020 CEST	49215	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:10.611587048 CEST	4040	49215	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:10.872325897 CEST	4040	49215	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:10.872931957 CEST	49215	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:11.609934092 CEST	49216	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:11.610013962 CEST	4040	49216	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:11.611104012 CEST	49216	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:11.611430883 CEST	49216	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:11.611449957 CEST	4040	49216	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:11.611634970 CEST	49216	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:11.611654043 CEST	4040	49216	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:11.611763954 CEST	49216	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:11.611778975 CEST	4040	49216	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:11.611886978 CEST	49216	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:11.611901045 CEST	4040	49216	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:11.832587957 CEST	4040	49216	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:11.832717896 CEST	49216	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:12.612637997 CEST	49217	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:12.612680912 CEST	4040	49217	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:12.612744093 CEST	49217	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:12.613004923 CEST	49217	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:12.613022089 CEST	4040	49217	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:12.613178968 CEST	49217	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:12.613194942 CEST	4040	49217	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:12.613838911 CEST	49217	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:12.613861084 CEST	4040	49217	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:12.996494055 CEST	4040	49217	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:12.996711016 CEST	49217	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:13.620446920 CEST	49218	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:13.620496988 CEST	4040	49218	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:13.620577097 CEST	49218	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:13.620946884 CEST	49218	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:13.620969057 CEST	4040	49218	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:13.621160030 CEST	49218	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:13.621180058 CEST	4040	49218	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:13.621639967 CEST	49218	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:13.621654034 CEST	4040	49218	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:13.996433973 CEST	4040	49218	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:13.996529102 CEST	49218	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:14.611058950 CEST	49219	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:14.611104012 CEST	4040	49219	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:14.611183882 CEST	49219	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:14.611552954 CEST	49219	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:14.611569881 CEST	4040	49219	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:14.611737013 CEST	49219	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:14.611752033 CEST	4040	49219	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:14.612251997 CEST	49219	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:14.612271070 CEST	4040	49219	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:15.005285025 CEST	4040	49219	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:15.005491972 CEST	49219	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:15.627259016 CEST	49220	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:15.627300024 CEST	4040	49220	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:15.627373934 CEST	49220	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:15.627629995 CEST	49220	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:15.627646923 CEST	4040	49220	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:15.627793074 CEST	49220	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:15.627808094 CEST	4040	49220	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:15.628309965 CEST	49220	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:15.628328085 CEST	4040	49220	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:16.003077984 CEST	4040	49220	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:16.003271103 CEST	49220	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:16.611479044 CEST	49221	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:16.611535072 CEST	4040	49221	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:16.611614943 CEST	49221	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:16.611979008 CEST	49221	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:16.611999989 CEST	4040	49221	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:16.612160921 CEST	49221	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:16.612178087 CEST	4040	49221	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:16.612586975 CEST	49221	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:16.612602949 CEST	4040	49221	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:16.904511929 CEST	4040	49221	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:16.904762983 CEST	49221	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:17.614958048 CEST	49222	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:17.615041971 CEST	4040	49222	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:17.615236998 CEST	49222	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:17.615957975 CEST	49222	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:17.615998983 CEST	4040	49222	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:17.616312981 CEST	49222	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:17.616341114 CEST	4040	49222	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:17.616568089 CEST	49222	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:17.616594076 CEST	4040	49222	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:17.617074966 CEST	49222	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:17.617103100 CEST	4040	49222	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:18.004858017 CEST	4040	49222	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:18.005222082 CEST	49222	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:18.612492085 CEST	49223	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:18.612574100 CEST	4040	49223	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:18.612724066 CEST	49223	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:18.613223076 CEST	49223	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:18.613261938 CEST	4040	49223	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:18.613518953 CEST	49223	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:18.613547087 CEST	4040	49223	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:18.613717079 CEST	49223	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:18.613742113 CEST	4040	49223	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:18.614087105 CEST	49223	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:18.614114046 CEST	4040	49223	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:19.001074076 CEST	4040	49223	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:19.001286030 CEST	49223	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:19.611850977 CEST	49224	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:19.611920118 CEST	4040	49224	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:19.612020016 CEST	49224	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:19.612296104 CEST	49224	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:19.612315893 CEST	4040	49224	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:19.612473011 CEST	49224	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:19.612489939 CEST	4040	49224	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:19.612801075 CEST	49224	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:19.612817049 CEST	4040	49224	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:20.003143072 CEST	4040	49224	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:20.003331900 CEST	49224	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:20.610775948 CEST	49225	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:20.610831022 CEST	4040	49225	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:20.610923052 CEST	49225	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:20.611242056 CEST	49225	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:20.611268997 CEST	4040	49225	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:20.612061024 CEST	49225	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:20.612082005 CEST	4040	49225	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:21.000948906 CEST	4040	49225	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:21.001187086 CEST	49225	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:21.617679119 CEST	49226	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:21.617748976 CEST	4040	49226	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:21.617878914 CEST	49226	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:21.618371010 CEST	49226	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:21.618403912 CEST	4040	49226	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:21.618665934 CEST	49226	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:21.618693113 CEST	4040	49226	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:21.618860006 CEST	49226	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:21.618884087 CEST	4040	49226	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:21.619642019 CEST	49226	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:21.619666100 CEST	4040	49226	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:21.997095108 CEST	4040	49226	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:21.997308016 CEST	49226	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:22.610125065 CEST	49227	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:22.610200882 CEST	4040	49227	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:22.610294104 CEST	49227	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:22.610583067 CEST	49227	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:22.610605955 CEST	4040	49227	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:22.610750914 CEST	49227	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:22.610769987 CEST	4040	49227	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:22.611085892 CEST	49227	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:22.611105919 CEST	4040	49227	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:23.104819059 CEST	4040	49227	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:23.104985952 CEST	49227	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:23.613476038 CEST	49228	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:23.613526106 CEST	4040	49228	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:23.613594055 CEST	49228	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:23.613930941 CEST	49228	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:23.613951921 CEST	4040	49228	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:23.614562035 CEST	49228	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:23.614586115 CEST	4040	49228	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:24.217415094 CEST	4040	49228	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:24.218240976 CEST	49228	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:24.614726067 CEST	49229	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:24.614804029 CEST	4040	49229	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:24.615442991 CEST	49229	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:24.615927935 CEST	49229	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:24.615958929 CEST	4040	49229	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:24.616590977 CEST	49229	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:24.616626024 CEST	4040	49229	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:25.005718946 CEST	4040	49229	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:25.005871058 CEST	49229	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:25.610620022 CEST	49230	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:25.610676050 CEST	4040	49230	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:25.611213923 CEST	49230	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:25.611572027 CEST	49230	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:25.611596107 CEST	4040	49230	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:25.611800909 CEST	49230	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:25.611821890 CEST	4040	49230	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:25.612255096 CEST	49230	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:25.612273932 CEST	4040	49230	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:26.004021883 CEST	4040	49230	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:26.004266024 CEST	49230	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:26.609915018 CEST	49231	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:26.609972000 CEST	4040	49231	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:26.610035896 CEST	49231	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:26.610337973 CEST	49231	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:26.610363007 CEST	4040	49231	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:26.610806942 CEST	49231	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:26.610829115 CEST	4040	49231	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:26.906487942 CEST	4040	49231	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:26.906688929 CEST	49231	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:27.609752893 CEST	49232	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:27.609824896 CEST	4040	49232	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:27.610399008 CEST	49232	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:27.610661983 CEST	49232	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:27.610683918 CEST	4040	49232	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:27.611181021 CEST	49232	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:27.611212015 CEST	4040	49232	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:28.101433992 CEST	4040	49232	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:28.101584911 CEST	49232	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:28.623862982 CEST	49233	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:28.623950005 CEST	4040	49233	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:28.624686003 CEST	49233	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:28.624963999 CEST	49233	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:28.624991894 CEST	4040	49233	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:28.625119925 CEST	49233	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:28.625135899 CEST	4040	49233	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:28.625452042 CEST	49233	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:28.625468016 CEST	4040	49233	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:29.109287977 CEST	4040	49233	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:29.109579086 CEST	49233	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:29.610528946 CEST	49234	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:29.610596895 CEST	4040	49234	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:29.611118078 CEST	49234	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:29.611424923 CEST	49234	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:29.611454964 CEST	4040	49234	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:29.611843109 CEST	49234	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:29.611864090 CEST	4040	49234	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:30.101447105 CEST	4040	49234	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:30.101710081 CEST	49234	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:30.612083912 CEST	49235	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:30.612158060 CEST	4040	49235	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:30.612672091 CEST	49235	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:30.613173962 CEST	49235	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:30.613213062 CEST	4040	49235	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:30.613491058 CEST	49235	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:30.613519907 CEST	4040	49235	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:30.613758087 CEST	49235	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:30.613784075 CEST	4040	49235	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:30.614345074 CEST	49235	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:30.614373922 CEST	4040	49235	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:31.001115084 CEST	4040	49235	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:31.001379013 CEST	49235	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:31.609122992 CEST	49236	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:31.609169960 CEST	4040	49236	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:31.609261990 CEST	49236	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:31.609529972 CEST	49236	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:31.609549046 CEST	4040	49236	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:31.609685898 CEST	49236	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:31.609702110 CEST	4040	49236	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:31.610018969 CEST	49236	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:31.610034943 CEST	4040	49236	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:31.996804953 CEST	4040	49236	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:31.998198986 CEST	49236	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:32.612201929 CEST	49237	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:32.612261057 CEST	4040	49237	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:32.612658024 CEST	49237	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:32.612982035 CEST	49237	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:32.613023043 CEST	4040	49237	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:32.613410950 CEST	49237	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:32.613439083 CEST	4040	49237	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:32.994750023 CEST	4040	49237	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:32.995104074 CEST	49237	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:33.614214897 CEST	49238	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:33.614274979 CEST	4040	49238	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:33.614350080 CEST	49238	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:33.614708900 CEST	49238	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:33.614742041 CEST	4040	49238	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:33.614975929 CEST	49238	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:33.615012884 CEST	4040	49238	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:33.615181923 CEST	49238	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:33.615201950 CEST	4040	49238	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:33.616375923 CEST	49238	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:33.616405964 CEST	4040	49238	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:34.212744951 CEST	4040	49238	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:34.213030100 CEST	49238	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:34.611529112 CEST	49239	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:34.611587048 CEST	4040	49239	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:34.612209082 CEST	49239	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:34.612715960 CEST	49239	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:34.612751961 CEST	4040	49239	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:34.613033056 CEST	49239	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:34.613060951 CEST	4040	49239	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:34.613291979 CEST	49239	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:34.613317013 CEST	4040	49239	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:34.613739014 CEST	49239	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:34.613765955 CEST	4040	49239	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:35.119630098 CEST	4040	49239	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:35.119774103 CEST	49239	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:35.612704992 CEST	49240	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:35.612760067 CEST	4040	49240	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:35.613280058 CEST	49240	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:35.613787889 CEST	49240	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:35.613820076 CEST	4040	49240	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:35.614092112 CEST	49240	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:35.614115000 CEST	4040	49240	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:35.614553928 CEST	49240	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:35.614574909 CEST	4040	49240	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:36.094654083 CEST	4040	49240	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:36.094861031 CEST	49240	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:36.610588074 CEST	49241	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:36.610629082 CEST	4040	49241	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:36.611040115 CEST	49241	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:36.611378908 CEST	49241	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:36.611401081 CEST	4040	49241	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:36.611763954 CEST	49241	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:36.611784935 CEST	4040	49241	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:36.995486975 CEST	4040	49241	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:36.995714903 CEST	49241	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:37.612869978 CEST	49242	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:37.612941980 CEST	4040	49242	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:37.613070965 CEST	49242	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:37.613603115 CEST	49242	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:37.613634109 CEST	4040	49242	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:37.613883018 CEST	49242	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:37.613924026 CEST	4040	49242	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:37.614067078 CEST	49242	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:37.614092112 CEST	4040	49242	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:37.614471912 CEST	49242	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:37.614500046 CEST	4040	49242	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:38.101259947 CEST	4040	49242	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:38.101408005 CEST	49242	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:38.648793936 CEST	52814	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:58:38.700602055 CEST	53	52814	8.8.8.8	192.168.1.16
Apr 5, 2018 09:58:38.703628063 CEST	49243	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:38.703690052 CEST	4040	49243	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:38.703799009 CEST	49243	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:38.704289913 CEST	49243	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:38.704324961 CEST	4040	49243	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:38.704575062 CEST	49243	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:38.704602003 CEST	4040	49243	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:38.704991102 CEST	49243	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:38.705018997 CEST	4040	49243	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:39.105194092 CEST	4040	49243	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:39.105427027 CEST	49243	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:39.611938953 CEST	49244	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:39.612008095 CEST	4040	49244	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:39.612154961 CEST	49244	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:39.612669945 CEST	49244	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:39.612704039 CEST	4040	49244	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:39.612957001 CEST	49244	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:39.612991095 CEST	4040	49244	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:39.613179922 CEST	49244	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:39.613208055 CEST	4040	49244	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:39.613564968 CEST	49244	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:39.613593102 CEST	4040	49244	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:39.945034981 CEST	4040	49244	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:39.945257902 CEST	49244	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:40.611198902 CEST	49245	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:40.611279964 CEST	4040	49245	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:40.611439943 CEST	49245	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:40.611943007 CEST	49245	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:40.611978054 CEST	4040	49245	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:40.612215042 CEST	49245	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:40.612242937 CEST	4040	49245	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:40.612426043 CEST	49245	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:40.612449884 CEST	4040	49245	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:40.612797976 CEST	49245	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:40.612831116 CEST	4040	49245	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:40.872713089 CEST	4040	49245	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:40.872867107 CEST	49245	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:41.622740984 CEST	49246	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:41.622787952 CEST	4040	49246	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:41.622915030 CEST	49246	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:41.623245001 CEST	49246	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:41.623264074 CEST	4040	49246	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:41.623420000 CEST	49246	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:41.623436928 CEST	4040	49246	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:41.624488115 CEST	49246	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:41.624506950 CEST	4040	49246	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:41.856865883 CEST	4040	49246	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:41.856983900 CEST	49246	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:42.612524033 CEST	49247	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:42.612611055 CEST	4040	49247	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:42.612767935 CEST	49247	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:42.613297939 CEST	49247	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:42.613333941 CEST	4040	49247	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:42.613584042 CEST	49247	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:42.613611937 CEST	4040	49247	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:42.613782883 CEST	49247	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:42.613807917 CEST	4040	49247	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:42.614226103 CEST	49247	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:42.614259005 CEST	4040	49247	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:42.847263098 CEST	4040	49247	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:42.847466946 CEST	49247	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:43.610577106 CEST	49248	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:43.610627890 CEST	4040	49248	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:43.610698938 CEST	49248	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:43.611010075 CEST	49248	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:43.611030102 CEST	4040	49248	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:43.611179113 CEST	49248	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:43.611196041 CEST	4040	49248	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:43.611546993 CEST	49248	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:43.611567974 CEST	4040	49248	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:43.969244003 CEST	4040	49248	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:43.969460964 CEST	49248	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:44.623137951 CEST	49249	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:44.623183966 CEST	4040	49249	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:44.625145912 CEST	49249	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:44.625463963 CEST	49249	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:44.625482082 CEST	4040	49249	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:44.625659943 CEST	49249	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:44.625679970 CEST	4040	49249	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:44.626339912 CEST	49249	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:44.626359940 CEST	4040	49249	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:44.931073904 CEST	4040	49249	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:44.931160927 CEST	49249	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:45.613106966 CEST	49250	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:45.613157034 CEST	4040	49250	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:45.613270044 CEST	49250	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:45.613666058 CEST	49250	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:45.613688946 CEST	4040	49250	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:45.614248037 CEST	49250	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:45.614267111 CEST	4040	49250	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:45.844604969 CEST	4040	49250	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:45.844837904 CEST	49250	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:46.610843897 CEST	49251	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:46.610908985 CEST	4040	49251	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:46.611035109 CEST	49251	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:46.611478090 CEST	49251	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:46.611505032 CEST	4040	49251	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:46.611738920 CEST	49251	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:46.611766100 CEST	4040	49251	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:46.611937046 CEST	49251	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:46.611959934 CEST	4040	49251	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:46.612324953 CEST	49251	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:46.612349033 CEST	4040	49251	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:46.966666937 CEST	4040	49251	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:46.966957092 CEST	49251	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:47.610249043 CEST	49252	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:47.610301018 CEST	4040	49252	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:47.610399008 CEST	49252	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:47.610714912 CEST	49252	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:47.610740900 CEST	4040	49252	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:47.613185883 CEST	49252	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:47.613208055 CEST	4040	49252	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:48.072731018 CEST	4040	49252	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:48.072977066 CEST	49252	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:48.612149000 CEST	49253	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:48.612202883 CEST	4040	49253	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:48.612745047 CEST	49253	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:48.613029003 CEST	49253	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:48.613048077 CEST	4040	49253	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:48.613209009 CEST	49253	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:48.613225937 CEST	4040	49253	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:48.613564014 CEST	49253	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:48.613579035 CEST	4040	49253	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:49.044934034 CEST	4040	49253	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:49.045150995 CEST	49253	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:49.611527920 CEST	49254	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:49.611588001 CEST	4040	49254	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:49.611946106 CEST	49254	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:49.612261057 CEST	49254	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:49.612279892 CEST	4040	49254	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:49.612517118 CEST	49254	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:49.612531900 CEST	4040	49254	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:49.612929106 CEST	49254	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:49.612941027 CEST	4040	49254	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:50.032253027 CEST	4040	49254	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:50.032556057 CEST	49254	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:50.606487989 CEST	49255	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:50.606554985 CEST	4040	49255	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:50.606705904 CEST	49255	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:50.606817007 CEST	49255	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:50.606837034 CEST	4040	49255	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:50.606934071 CEST	49255	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:50.606950045 CEST	4040	49255	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:50.607042074 CEST	49255	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:50.607055902 CEST	4040	49255	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:50.607121944 CEST	49255	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:50.607135057 CEST	4040	49255	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:50.905049086 CEST	4040	49255	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:50.905318022 CEST	49255	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:51.607254982 CEST	49256	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:51.607351065 CEST	4040	49256	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:51.607481956 CEST	49256	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:51.607662916 CEST	49256	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:51.607700109 CEST	4040	49256	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:51.608082056 CEST	49256	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:51.608113050 CEST	4040	49256	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:52.000744104 CEST	4040	49256	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:52.000883102 CEST	49256	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:52.608236074 CEST	49257	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:52.608278036 CEST	4040	49257	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:52.608370066 CEST	49257	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:52.608494997 CEST	49257	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:52.608514071 CEST	4040	49257	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:52.608741045 CEST	49257	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:52.608757019 CEST	4040	49257	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:53.017072916 CEST	4040	49257	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:53.017465115 CEST	49257	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:53.608036041 CEST	49258	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:53.608078003 CEST	4040	49258	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:53.608136892 CEST	49258	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:53.608247995 CEST	49258	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:53.608263969 CEST	4040	49258	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:53.608485937 CEST	49258	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:53.608500957 CEST	4040	49258	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:54.020631075 CEST	4040	49258	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:54.020793915 CEST	49258	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:54.607254028 CEST	49259	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:54.607311964 CEST	4040	49259	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:54.607403994 CEST	49259	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:54.607570887 CEST	49259	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:54.607598066 CEST	4040	49259	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:54.607708931 CEST	49259	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:54.607724905 CEST	4040	49259	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:54.607790947 CEST	49259	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:54.607805014 CEST	4040	49259	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:54.607873917 CEST	49259	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:54.607887983 CEST	4040	49259	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:55.028795004 CEST	4040	49259	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:55.028947115 CEST	49259	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:55.606551886 CEST	49260	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:55.606615067 CEST	4040	49260	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:55.606832027 CEST	49260	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:55.606954098 CEST	49260	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:55.606975079 CEST	4040	49260	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:55.607137918 CEST	49260	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:55.607156038 CEST	4040	49260	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:55.607224941 CEST	49260	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:55.607239962 CEST	4040	49260	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:55.607315063 CEST	49260	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:55.607330084 CEST	4040	49260	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:55.845885992 CEST	4040	49260	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:55.846131086 CEST	49260	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:56.607044935 CEST	49261	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:56.607093096 CEST	4040	49261	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:56.607177019 CEST	49261	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:56.607290983 CEST	49261	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:56.607306957 CEST	4040	49261	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:56.607409000 CEST	49261	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:56.607424021 CEST	4040	49261	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:56.607476950 CEST	49261	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:56.607489109 CEST	4040	49261	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:56.607554913 CEST	49261	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:56.607568026 CEST	4040	49261	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:56.862360954 CEST	4040	49261	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:56.862432957 CEST	49261	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:57.608088017 CEST	49262	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:57.608141899 CEST	4040	49262	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:57.608216047 CEST	49262	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:57.608347893 CEST	49262	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:57.608366966 CEST	4040	49262	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:57.608491898 CEST	49262	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:57.608509064 CEST	4040	49262	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:57.608581066 CEST	49262	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:57.608594894 CEST	4040	49262	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:57.608679056 CEST	49262	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:57.608694077 CEST	4040	49262	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:57.954066992 CEST	4040	49262	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:57.954138994 CEST	49262	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:58.608779907 CEST	49263	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:58.608835936 CEST	4040	49263	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:58.609005928 CEST	49263	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:58.609177113 CEST	49263	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:58.609204054 CEST	4040	49263	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:58.609395027 CEST	49263	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:58.609417915 CEST	4040	49263	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:58.609512091 CEST	49263	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:58.609532118 CEST	4040	49263	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:58.609632969 CEST	49263	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:58.609652996 CEST	4040	49263	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:58.944592953 CEST	4040	49263	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:58.944835901 CEST	49263	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:59.607927084 CEST	49264	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:59.607995033 CEST	4040	49264	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:59.608113050 CEST	49264	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:59.608314991 CEST	49264	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:59.608345985 CEST	4040	49264	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:59.608783007 CEST	49264	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:58:59.608810902 CEST	4040	49264	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:59.930449009 CEST	4040	49264	81.171.7.178	192.168.1.16
Apr 5, 2018 09:58:59.930687904 CEST	49264	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:00.607214928 CEST	49265	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:00.607276917 CEST	4040	49265	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:00.607338905 CEST	49265	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:00.607456923 CEST	49265	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:00.607475996 CEST	4040	49265	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:00.607703924 CEST	49265	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:00.607719898 CEST	4040	49265	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:00.894298077 CEST	4040	49265	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:00.894459009 CEST	49265	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:01.606604099 CEST	49266	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:01.606650114 CEST	4040	49266	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:01.607141018 CEST	49266	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:01.607284069 CEST	49266	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:01.607306957 CEST	4040	49266	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:01.607589960 CEST	49266	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:01.607613087 CEST	4040	49266	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:01.837656975 CEST	4040	49266	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:01.837975979 CEST	49266	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:02.609019041 CEST	49267	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:02.609093904 CEST	4040	49267	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:02.609285116 CEST	49267	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:02.609467030 CEST	49267	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:02.609499931 CEST	4040	49267	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:02.609690905 CEST	49267	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:02.609718084 CEST	4040	49267	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:02.609858036 CEST	49267	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:02.609883070 CEST	4040	49267	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:02.610018969 CEST	49267	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:02.610044003 CEST	4040	49267	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:02.832861900 CEST	4040	49267	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:02.832964897 CEST	49267	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:03.607086897 CEST	49268	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:03.607146025 CEST	4040	49268	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:03.607243061 CEST	49268	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:03.607414961 CEST	49268	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:03.607431889 CEST	4040	49268	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:03.607551098 CEST	49268	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:03.607566118 CEST	4040	49268	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:03.607623100 CEST	49268	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:03.607637882 CEST	4040	49268	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:03.607702017 CEST	49268	4040	192.168.1.16	81.171.7.178
Apr 5, 2018 09:59:03.607714891 CEST	4040	49268	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:03.897659063 CEST	4040	49268	81.171.7.178	192.168.1.16
Apr 5, 2018 09:59:03.897830963 CEST	49268	4040	192.168.1.16	81.171.7.178

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 5, 2018 09:57:16.438105106 CEST	63638	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:17.434628010 CEST	63638	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:18.434189081 CEST	63638	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:20.434401035 CEST	63638	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:20.447156906 CEST	53	63638	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:20.447210073 CEST	53	63638	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:20.447242975 CEST	53	63638	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:20.476495028 CEST	53	63638	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:34.758858919 CEST	59362	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:34.816751957 CEST	53	59362	8.8.8.8	192.168.1.16
Apr 5, 2018 09:57:36.198326111 CEST	52261	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:57:36.754153013 CEST	53	52261	8.8.8.8	192.168.1.16
Apr 5, 2018 09:58:07.656655073 CEST	52165	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:58:07.702348948 CEST	53	52165	8.8.8.8	192.168.1.16
Apr 5, 2018 09:58:38.648793936 CEST	52814	53	192.168.1.16	8.8.8.8
Apr 5, 2018 09:58:38.700602055 CEST	53	52814	8.8.8.8	192.168.1.16

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Apr 5, 2018 09:57:20.476634979 CEST	192.168.1.16	8.8.8.8	cf1a	(Port unreachable)	Destination Unreachable

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 5, 2018 09:57:16.438105106 CEST	192.168.1.16	8.8.8.8	0xa7e5	Standard query (0)	vvrhhhnaijyj6s2m.onion.top	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:17.434628010 CEST	192.168.1.16	8.8.8.8	0xa7e5	Standard query (0)	vvrhhhnaijyj6s2m.onion.top	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:18.434189081 CEST	192.168.1.16	8.8.8.8	0xa7e5	Standard query (0)	vvrhhhnaijyj6s2m.onion.top	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:20.434401035 CEST	192.168.1.16	8.8.8.8	0xa7e5	Standard query (0)	vvrhhhnaijyj6s2m.onion.top	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:34.758858919 CEST	192.168.1.16	8.8.8.8	0x8a6	Standard query (0)	vvrhhhnaijyj6s2m.onion.top	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:36.198326111 CEST	192.168.1.16	8.8.8.8	0xa958	Standard query (0)	blockholder.duckdns.org	A (IP address)	IN (0x0001)
Apr 5, 2018 09:58:07.656655073 CEST	192.168.1.16	8.8.8.8	0xa917	Standard query (0)	blockholder.duckdns.org	A (IP address)	IN (0x0001)
Apr 5, 2018 09:58:38.648793936 CEST	192.168.1.16	8.8.8.8	0x1837	Standard query (0)	blockholder.duckdns.org	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	Address	Type	Class
Apr 5, 2018 09:57:20.447156906 CEST	8.8.8.8	192.168.1.16	0xa7e5	No error (0)	vvrhhhnaijyj6s2m.onion.top	207.250.29.221	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:20.447210073 CEST	8.8.8.8	192.168.1.16	0xa7e5	No error (0)	vvrhhhnaijyj6s2m.onion.top	207.250.29.221	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:20.447242975 CEST	8.8.8.8	192.168.1.16	0xa7e5	No error (0)	vvrhhhnaijyj6s2m.onion.top	207.250.29.221	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:20.476495028 CEST	8.8.8.8	192.168.1.16	0xa7e5	No error (0)	vvrhhhnaijyj6s2m.onion.top	207.250.29.221	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:34.816751957 CEST	8.8.8.8	192.168.1.16	0x8a6	No error (0)	vvrhhhnaijyj6s2m.onion.top	207.250.29.221	A (IP address)	IN (0x0001)
Apr 5, 2018 09:57:36.754153013 CEST	8.8.8.8	192.168.1.16	0xa958	No error (0)	blockholder.duckdns.org	81.171.7.178	A (IP address)	IN (0x0001)
Apr 5, 2018 09:58:07.702348948 CEST	8.8.8.8	192.168.1.16	0xa917	No error (0)	blockholder.duckdns.org	81.171.7.178	A (IP address)	IN (0x0001)
Apr 5, 2018 09:58:38.700602055 CEST	8.8.8.8	192.168.1.16	0x1837	No error (0)	blockholder.duckdns.org	81.171.7.178	A (IP address)	IN (0x0001)

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: cmd.exe PID: 3596 Parent PID: 208

General

Start time:	09:56:26
Start date:	05/04/2018
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ''C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\payment.jar'' >> C:\cmdlinestart.log 2>&1
Imagebase:	0x4a4e0000
File size:	302592 bytes
MD5 hash:	AD7B9C14083B52BC532FBA5948342B98
Has administrator privileges:	true
Programmed in:	Java
Reputation:	high

Chronological Activities

Analysis Process: java.exe PID: 3624 Parent PID: 3596

General

Start time:	09:56:26
Start date:	05/04/2018
Path:	C:\Program Files\Java\jre1.8.0_40\bin\java.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -javaagent:'C:\Users\user~1\AppData\Local\Temp\jartracer.jar' -jar 'C:\Users\user\Desktop\payment.jar'
Imagebase:	0xf80000
File size:	190888 bytes
MD5 hash:	6F4EB294ACF731771AFE3EF6F7EE812D
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: java.exe PID: 3732 Parent PID: 3624

General

Start time:	09:57:08
Start date:	05/04/2018
Path:	C:\Program Files\Java\jre1.8.0_40\bin\java.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Java\jre1.8.0_40\bin\java.exe' -jar C:\Users\user\.6520706727662484494.jar
Imagebase:	0xf80000
File size:	190888 bytes
MD5 hash:	6F4EB294ACF731771AFE3EF6F7EE812D
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 3788 Parent PID: 3732

General

Start time:	09:57:14
Start date:	05/04/2018
Path:	C:\Windows\System32\reg.exe
Wow64 process (32bit):	false
Commandline:	reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v J14bfe7e2dc5:U6c756b657461796c6f72_s /t REG_SZ /d '\'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe\' -jar \'C:\Users\user\.6520706727662484494.jar\''
Imagebase:	0x920000
File size:	62464 bytes
MD5 hash:	D69A9ABBB0D795F21995C2F48C1EB560
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate

Chronological Activities

Analysis Process: explorer.exe PID: 3804 Parent PID: 2948

General

Start time:	09:57:19
Start date:	05/04/2018
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	explorer.exe 'C:\Program Files\Java\jre1.8.0_40\bin\javaw.exe' -jar 'C:\Users\user\.6520706727662484494.jar'
Imagebase:	0x1e0000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: explorer.exe PID: 3828 Parent PID: 536

General

Start time:	09:57:19
Start date:	05/04/2018
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
Imagebase:	0x1e0000
File size:	2972672 bytes
MD5 hash:	6DDCA324434FFA506CF7DC4E51DB7935
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Disassembly

Code Analysis

Reset < >

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Confidence

Classification

Analysis Advice

Signature Overview

Software Vulnerabilities:

Networking:

Boot Survival:

Remote Access Functionality:

Stealing of Sensitive Information:

Data Obfuscation:

System Summary:

Anti Debugging:

Malware Analysis System Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Behavior Graph

Simulations

Behavior and APIs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Joe Sandbox View / Context

IPs

Domains

ASN

Dropped Files

Screenshots

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

File Icon

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

ICMP Packets

DNS Queries

DNS Answers

Code Manipulations

Statistics

CPU Usage

Memory Usage

High Level Behavior Distribution

back

Behavior

System Behavior

Analysis Process: cmd.exe PID: 3596 Parent PID: 208

General

Chronological Activities

Analysis Process: java.exe PID: 3624 Parent PID: 3596

General

Chronological Activities

Analysis Process: java.exe PID: 3732 Parent PID: 3624

General

Chronological Activities

Analysis Process: reg.exe PID: 3788 Parent PID: 3732

General