Edit tour

macOS Analysis Report
anytrans-ios-official-en-mac.dmg

Overview

General Information

Sample Name:	anytrans-ios-official-en-mac.dmg
Analysis ID:	1333147
MD5:	07224f1984974110e7cb74039405f2dd
SHA1:	0ecca4a9997abaa4917476959a2be25d9e79c453
SHA256:	befb2c5fb57cec2e3c6e1272bd0518a49a7995377d264d9add88ec544d93944f
Infos:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Contains symbols with suspicious names likely related to encryption

Contains symbols with suspicious names likely related to networking

Reads the systems hostname

Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)

Reads launchservices plist files

Reads hardware related sysctl values

App bundle contains hidden files/directories

Uses CFNetwork bundle containing interfaces for network communication (HTTP, sockets, and Bonjour)

Creates hidden files, links and/or directories

Reads the systems OS release and/or type

Uses Security framework containing interfaces for system-level user authentication and authorization

Classification

General Information

Joe Sandbox Version:	38.0.0 Ammolite
Analysis ID:	1333147
Start date and time:	2023-10-27 09:28:08 +02:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 4m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Virtual Machine, High Sierra (Office 2016 16.16, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.13
CPU architecture:	x86_64
Analysis Mode:	default
Sample file name:	anytrans-ios-official-en-mac.dmg
Detection:	MAL
Classification:	mal48.macDMG@0/13@2/0

Warnings

Excluded IPs from analysis (whitelisted): 17.253.13.202, 17.253.13.206, 184.84.137.117, 192.178.50.78, 142.250.64.202, 142.250.64.138, 142.250.189.138, 142.250.64.234, 192.178.50.42, 192.178.50.74, 172.217.3.74, 142.250.217.234, 142.250.64.170, 142.250.217.202, 142.250.217.170, 17.253.13.207, 23.193.120.219, 17.253.13.208, 17.253.13.201, 17.253.13.204, 17.253.13.203, 172.217.15.202, 142.251.35.234, 172.217.2.202
Excluded domains from analysis (whitelisted): cds-cdn.v.aaplimg.com, e11408.d.akamaiedge.net, mesu-cdn.apple.com.akadns.net, cds.apple.com.akadns.net, ocsp-a.g.aaplimg.com, cds.apple.com, e6858.dscx.akamaiedge.net, help-ar.apple.com.edgekey.net, valid.apple.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, ocsp-lb.apple.com.akadns.net, mesu-cdn.origin-apple.com.akadns.net, ocsp.apple.com, valid.origin-apple.com.akadns.net, help.origin-apple.com.akadns.net, firebaseinstallations.googleapis.com, valid-apple.g.aaplimg.com, mesu.g.aaplimg.com, firebaselogging-pa.googleapis.com, help.apple.com, mesu.apple.com, world-gen.g.aaplimg.com, www.google-analytics.com

Runtime Messages

Command:	open "/Volumes/AnyTrans Installer/AnyTrans Installer.app"
PID:	910
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

System is macvm-highsierra

mono-sgen32 New Fork (PID: 910, Parent: 825)

open (MD5: 40ed6d8f35c9f20484b97582d296398f) Arguments:

xpcproxy New Fork (PID: 911, Parent: 1)

AnyTrans Installer (MD5: dd749d71bc516596b6f4b39e4cbc1c4e) Arguments: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer

cleanup

HTTP traffic detected: HTTP/1.1 200 OKDate: Fri, 27 Oct 2023 07:29:17 GMTServer: ApacheLast-Modified: Fri, 11 Dec 2020 03:06:33 GMTAccept-Ranges: bytesCache-Control: max-age=172800Expires: Sun, 29 Oct 2023 07:29:17 GMTVary: Accept-Encoding,User-AgentContent-Encoding: gzipContent-Length: 268Keep-Alive: timeout=5, max=100Connection: Keep-AliveData Raw: 1f 8b 08 00 00 00 00 00 00 03 6d d0 5d 6b 83 30 14 06 e0 eb f9 2b b2 dc eb 31 51 ab 8e d4 b2 d5 0e 0a d2 09 b3 17 bb 14 0d ad cc 8f 10 c3 5c ff fd 62 0b 1b ae b9 cc e1 c9 9b 37 87 6d be bb 16 7d 71 39 36 43 bf c6 c4 71 31 e2 7d 35 d4 4d 7f 5a e3 63 f1 6a 47 78 93 58 ec 31 7d db 16 1f f9 0e 89 b6 19 15 ca 8f 2f d9 7e 8b b0 0d f0 2c 44 cb 01 d2 22 45 79 b6 7f 2f 90 ce 00 d8 1d 30 c2 67 a5 c4 13 c0 34 4d 4e 39 2b a7 1a ba 19 8e 90 cb 41 70 a9 2e 99 0e b3 f5 05 a7 56 35 d6 cf dc d2 17 75 f4 b4 6e 2a 95 58 0f ec 93 5f 92 52 95 19 ef 4f 67 c5 60 3e ea a9 e4 65 9b ac c2 95 eb c7 d4 63 70 3d fe e2 ca 84 e3 80 12 2f 8c fe db c6 64 89 e7 d2 d0 0d 7c ba d4 9d 31 38 8a 74 05 3f 5c 52 61 a4 ba 00 f5 ee ad 34 fe 8e 12 57 63 72 87 8d 8d bd 98 04 61 f4 87 19 dc f6 c7 e0 ba dd c4 fa 01 cd f7 98 38 f4 01 00 00 Data Ascii: m]k0+1Q\b7m}q96Cq1}5MZcjGxX1}/~,D"Ey/0g4MN9+Ap.V5un*X_ROg`>ecp=/d|18t?\Ra4Wcra8

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown	Network traffic detected: HTTP traffic on port 49405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49405

Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.205
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.13.205
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: CodeResources	String found in binary or memory: http://crl.apple.com/applerootcag3.crl0
Source: AnyTrans Installer	String found in binary or memory: http://crl.apple.com/root.crl0
Source: AnyTrans Installer	String found in binary or memory: http://crl.apple.com/timestamp.crl0
Source: AnyTrans Installer	String found in binary or memory: http://dl.imobie.com/config/installer.plist
Source: AnyTrans Installer	String found in binary or memory: http://goo.gl/9vSsPb
Source: AnyTrans Installer	String found in binary or memory: http://goo.gl/RfcP7r)
Source: CodeResources	String found in binary or memory: http://ocsp.apple.com/ocsp03-applerootcag307
Source: CodeResources	String found in binary or memory: http://ocsp.apple.com/ocsp03-asica4020
Source: AnyTrans Installer	String found in binary or memory: http://ocsp.apple.com/ocsp03-devid060
Source: anytrans-ios-official-en-mac.dmg, login.keychain-db.sb-6160925d-nmfh2M.274.dr, installer.plist.274.dr, login.keychain-db.sb-6160925d-oLwkGW.274.dr, Info.plist, AnyTrans Installer, CodeResources	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: AnyTrans Installer	String found in binary or memory: http://www.apple.com/appleca0
Source: AnyTrans Installer	String found in binary or memory: http://www.apple.com/certificateauthority/0
Source: AnyTrans Installer	String found in binary or memory: https://app-measurement.com/a
Source: AnyTrans Installer	String found in binary or memory: https://app-measurement.com/config/app/%
Source: AnyTrans Installer	String found in binary or memory: https://app-measurement.com/sdk-exp
Source: AnyTrans Installer	String found in binary or memory: https://goo.gl/YNbdK2
Source: AnyTrans Installer	String found in binary or memory: https://goo.gl/txkZbE
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/ad-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/af-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/am-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/amo-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/anydrive-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/appt-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/ati-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/au-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/dk-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/pc-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/pra-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/pri-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://imobie-resource.com/product/config/pt-config.xml
Source: AnyTrans Installer	String found in binary or memory: https://support.google.com/admob/answer/6383165
Source: AnyTrans Installer	String found in binary or memory: https://www.apple.com/appleca/0
Source: AnyTrans Installer	String found in binary or memory: https://www.google-analytics.com/collect?
Source: AnyTrans Installer	String found in binary or memory: https://www.googleadservices.com/pagead/conversion/app/deeplink?sdk_version=%

Source: unknown

HTTP traffic detected: POST /a HTTP/1.1Host: app-measurement.comContent-Type: application/x-www-form-urlencodedConnection: keep-aliveAccept: */*Content-Encoding: gzipAccept-Language: en-usContent-Length: 609Accept-Encoding: br, gzip, deflateUser-Agent: AnyTrans%20Installer/8.8.4 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)

Source: unknown

DNS traffic detected: queries for: app-measurement.com

Source: global traffic	HTTP traffic detected: GET /config/app/1:123117501914:ios:4b8e5422acb19112b454e3?app_instance_id=2F2E386EDBDB431C9DEE812604D07792&gmp_version=90600&runtime_version=0&platform=macos HTTP/1.1Host: app-measurement.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: AnyTrans%20Installer/8.8.4 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /config/installer.plist HTTP/1.1Host: dl.imobie.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: gzip, deflateUser-Agent: AnyTrans%20Installer/8.8.4 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)

Source: unknown	HTTPS traffic detected: 142.250.217.206:443 -> 192.168.11.11:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.217.206:443 -> 192.168.11.11:49405 version: TLS 1.2

Source: classification engine

Classification label: mal48.macDMG@0/13@2/0

Source: /usr/bin/open (PID: 910)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist			Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Launchservices plist file read: /System/Library/Preferences/Logging/Subsystems/com.apple.launchservices.plist			Jump to behavior

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)

CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist

Jump to behavior

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Hidden File created: /Users/berri/Library/Application Support/google-heartbeat-storage/.dat.nosync038f.VN0ZMz	Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Hidden File created: /Users/berri/Library/Application Support/Google/FIRApp/.dat.nosync038f.C877rf	Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Hidden File created: /Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_event_data/1001/.dat.nosync038f.dBRSCz	Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Hidden File created: /Users/berri/Library/Application Support/google-heartbeat-storage/.dat.nosync038f.iNYFrX	Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Hidden File created: /Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_library_data/.dat.nosync038f.jyoiBd	Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Hidden File created: /Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_library_data/.dat.nosync038f.mKxo24	Jump to behavior

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)

Security framework info plist opened: /System/Library/Frameworks/Security.framework/Resources/Info.plist

Jump to behavior

Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer

Mach-O header: dylib_command -> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer

Mach-O header: dylib_command -> /System/Library/Frameworks/Security.framework/Versions/A/Security

Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer

Mach-O header: dylib_command -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Binary plist file created: /Users/berri/Library/Application Support/Google/FIRApp/.dat.nosync038f.C877rf	Jump to dropped file
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Binary plist file created: /Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_event_data/1001/.dat.nosync038f.dBRSCz	Jump to dropped file
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	XML plist file created: /Users/berri/Library/Application Support/com.iMobie.AnyTrans-iOS-Installer/AnyTrans Installer/tmp/installer.plist	Jump to dropped file
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Binary plist file created: /Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_library_data/.dat.nosync038f.mKxo24	Jump to dropped file

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Source: extracted file from DMG submission

CodeResources XML file: AnyTrans Installer/AnyTrans Installer.app/Contents/_CodeSignature/CodeResources

Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer

Mach-O header: dylib_command -> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)

Random device file read: /dev/urandom

Jump to behavior

Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer

Mach-O header: dylib_command -> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics

Source: submission

CodeSign Info: Executable=/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer

Source: archive file from DMG submission

Hidden file : AnyTrans Installer/.en.tiff

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)

Sysctl read request: kern.safeboot (1.66)

Jump to behavior

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)

Sysctl requested: kern.hostname (1.10)

Jump to behavior

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Sysctl read request: hw.availcpu (6.25)			Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Sysctl read request: hw.memsize (6.24)			Jump to behavior

Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Sysctl requested: kern.ostype (1.1)			Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	Sysctl requested: kern.osrelease (1.2)			Jump to behavior

Source: /usr/bin/open (PID: 910)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer (PID: 911)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	1 Plist Modification	1 Plist Modification	1 Masquerading	1 GUI Input Capture	1 System Network Configuration Discovery	Remote Services	1 GUI Input Capture	Exfiltration Over Other Network Medium	2 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 Hidden Files and Directories	1 Input Capture	51 System Information Discovery	Remote Desktop Protocol	1 Input Capture	Exfiltration Over Bluetooth	2 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	1 Invalid Code Signature	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	4 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	2 Code Signing	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	5 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Source	Detection	Scanner	Label	Link
anytrans-ios-official-en-mac.dmg	30%	ReversingLabs	MacOS.PUA.IMobie
anytrans-ios-official-en-mac.dmg	24%	Virustotal		Browse

Dropped Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
app-measurement.com	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://imobie-resource.com/product/config/ati-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/pt-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/amo-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/anydrive-config.xml	0%	Avira URL Cloud	safe
https://app-measurement.com/a	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/pc-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/ati-config.xml	0%	Virustotal		Browse
https://imobie-resource.com/product/config/ad-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/amo-config.xml	1%	Virustotal		Browse
https://app-measurement.com/a	0%	Virustotal		Browse
https://imobie-resource.com/product/config/pt-config.xml	1%	Virustotal		Browse
https://imobie-resource.com/product/config/anydrive-config.xml	0%	Virustotal		Browse
https://imobie-resource.com/product/config/af-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/am-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/pc-config.xml	1%	Virustotal		Browse
https://imobie-resource.com/product/config/pra-config.xml	0%	Avira URL Cloud	safe
https://app-measurement.com/config/app/1:123117501914:ios:4b8e5422acb19112b454e3?app_instance_id=2F2E386EDBDB431C9DEE812604D07792&gmp_version=90600&runtime_version=0&platform=macos	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/af-config.xml	0%	Virustotal		Browse
https://imobie-resource.com/product/config/pri-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/pra-config.xml	0%	Virustotal		Browse
https://imobie-resource.com/product/config/dk-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/am-config.xml	0%	Virustotal		Browse
https://app-measurement.com/config/app/%	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/ad-config.xml	1%	Virustotal		Browse
https://imobie-resource.com/product/config/dk-config.xml	0%	Virustotal		Browse
https://imobie-resource.com/product/config/au-config.xml	0%	Avira URL Cloud	safe
https://app-measurement.com/config/app/%	0%	Virustotal		Browse
https://imobie-resource.com/product/config/appt-config.xml	0%	Avira URL Cloud	safe
https://imobie-resource.com/product/config/pri-config.xml	1%	Virustotal		Browse
https://imobie-resource.com/product/config/appt-config.xml	0%	Virustotal		Browse
https://imobie-resource.com/product/config/au-config.xml	0%	Virustotal		Browse

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
app-measurement.com	142.250.217.206	true	false	0%, Virustotal, Browse	unknown
dl.imobie.com	67.225.249.166	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://dl.imobie.com/config/installer.plist	false		high
https://app-measurement.com/a	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://app-measurement.com/config/app/1:123117501914:ios:4b8e5422acb19112b454e3?app_instance_id=2F2E386EDBDB431C9DEE812604D07792&gmp_version=90600&runtime_version=0&platform=macos	false	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://imobie-resource.com/product/config/amo-config.xml	AnyTrans Installer	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://goo.gl/RfcP7r)	AnyTrans Installer	false		high
https://imobie-resource.com/product/config/anydrive-config.xml	AnyTrans Installer	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://imobie-resource.com/product/config/ati-config.xml	AnyTrans Installer	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.google.com/admob/answer/6383165	AnyTrans Installer	false		high
https://goo.gl/YNbdK2	AnyTrans Installer	false		high
https://imobie-resource.com/product/config/pt-config.xml	AnyTrans Installer	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://goo.gl/txkZbE	AnyTrans Installer	false		high
https://imobie-resource.com/product/config/pc-config.xml	AnyTrans Installer	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://imobie-resource.com/product/config/ad-config.xml	AnyTrans Installer	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://imobie-resource.com/product/config/af-config.xml	AnyTrans Installer	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://imobie-resource.com/product/config/am-config.xml	AnyTrans Installer	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://imobie-resource.com/product/config/pra-config.xml	AnyTrans Installer	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://imobie-resource.com/product/config/pri-config.xml	AnyTrans Installer	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://imobie-resource.com/product/config/dk-config.xml	AnyTrans Installer	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://goo.gl/9vSsPb	AnyTrans Installer	false		high
https://app-measurement.com/config/app/%	AnyTrans Installer	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://imobie-resource.com/product/config/au-config.xml	AnyTrans Installer	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://imobie-resource.com/product/config/appt-config.xml	AnyTrans Installer	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
142.250.217.206	app-measurement.com	United States		15169	GOOGLEUS	false
67.225.249.166	dl.imobie.com	United States		32244	LIQUIDWEBUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
67.225.249.166	phonerescue-android-en-mac.dmg	Get hash	malicious	Unknown	Browse	dl.imobie.com/config/installer.plist

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
dl.imobie.com	phonerescue-android-en-mac.dmg	Get hash	malicious	Unknown	Browse	67.225.249.166

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIQUIDWEBUS	https://www.googleadservices.com/pagead/aclk?nis=4&sa=L&ai=CCF9Jqkb_ZMG4JdXPkPIP8diV0AO7nsLzcvPfl8faEZamoJ-WERABINnPliJgyQagAdbA6_gDyAEJqAMByAPLBKoE7wFP0EJWkNFzu88On-wXNreTjooKCB1o4DDC22vkIqFKrOv38j1ELK4159eZ2s9dmWgdhGM7pDYRJRqEPle3pfO65ojDHAfdtYWTIgiLhhE_CFOd2zPmycqA2AyQhHeUJ5MX_gva3Rh4T5Z0mBfnIw6Op2cIp2paKnotmvh8vf8Ev_my8eFzoLCwrlA6_rBIcKTqSH9q_u8EkCwrnMAwfN_eM6hqmhxqBwWbZWyRAHL5FvzmP9e3aGKxR63ix6vsTQmW-ahCizvAyC3RjJ6kPJWZeF8Z7N7saHhviymOXbvdBpuRpXGLwS8mErWFjSECNcAEvc7c27AEiAW4noqOTKAGLoAH2fnImASoB9m2sQKoB47OG6gHk9gbqAfulrECqAf-nrECqAeko7ECqAfVyRuoB6a-G6gHmgaoB_PRG6gHltgbqAeqm7ECqAeDrbECqAf_nrECqAffn7ECqAfKqbECqAfrpbEC2AcA0ggUCIBhEAEYHzICigI6AoBASL39wTqxCXjRhsbnQrS5gAoBmAsByAsBgAwB2gwQCgoQ8MSanpDYwr0mEgIBA6oNAlVTyA0B2BMMiBQB0BUB-BYBgBcB&ae=1&ase=2&gclid=EAIaIQobChMIwbWjoIOjgQMV1SdECB1xbAU6EAEYASAAEgL9w_D_BwE&num=1&cid=CAQSOwBpAlJWDZJcodo3QjQwioQ7FD5Had4cwyiWR1PfI1z7eDLg2ps0wEFIlrZgon5hfIeLX5QvuPyTEInQGAE&sig=AOD64_07yruLLOFfvYQo_NgCp8JCSMcK8A&client=ca-pub-1452786187751943&rf=1&nb=9&adurl=https://ipfs.io/ipfs/bafybeifvzj5fz7nq6xclrmyooytccqq2h7bcop4xjhud7mbv3pfx5s6up4/43lJTZJ7j9.html%3Fcamp_id%3D139122%26utm_term%3DFrameworks%2Bfor%2Bmedical%2Bimage%2Banalysis,Medical%2Bimage%2Banalysis%2Bframeworks,Medical%2Bimaging%2Bsoftware%2Bframeworks,AI%2Bframeworks%2Bfor%2Bmedical%2Bimage%2Banalysis,Image%2Banalysis%2Bplatforms%2Bfor%2Bmedical%2Bresearch,Medical%2Bimage%2Banalysis%2Bsolutions,Frameworks%2Bfor%2Bmedical%2Bimage%2Banalysis,Medical%2Bimage%2Banalysis%2Bframeworks,Medical%2Bimaging%2Bsoftware%2Bframeworks,AI%2Bframeworks%2Bfor%2Bmedical%2Bimage%2Banalysis,Image%2Banalysis%2Bplatforms%2Bfor%2Bmedical%2Bresearch,Medical%2Bimage%2Banalysis%2Bsolutions%26device%3Dc%26ag_id%3D150516213565%26c_id%3D20430622520%26src%3Dadwd%26kw%3D%26mt%3D%26plmt%3Dkolikoweb.com%26pos%3D%26fi_id%3D%26gdn1%3Dnetwork%26gclid%3DEAIaIQobChMIwbWjoIOjgQMV1SdECB1xbAU6EAEYASAAEgL9w_D_BwE#YnBldHJhY2hla0BhdGxhcy1hcGV4LmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	67.225.142.57
	https://marinagroup.com.ng/hgwconsult.com/xmlrpc.html?folder=xY7491iridium&email=bWF0dGhldy5kZXNjaEBpcmlkaXVtLmNvbQ==	Get hash	malicious	HTMLPhisher	Browse	208.79.237.170
	https://slopeofhope.com/commentsys/lnk.php?u=https://login.authenticating.flys2wa.com/EhaiHSWy#274796c65722e7475636b657240786661622e636f6d	Get hash	malicious	HTMLPhisher	Browse	67.227.172.55
	XDCC Browser v4.52.exe	Get hash	malicious	Unknown	Browse	50.28.52.187
	oq4NwZ7fjn.elf	Get hash	malicious	Mirai	Browse	209.59.174.211
	https://www.erhealthplans.com/RKduHZzY/d?url=pblfmwjrj3kxjoWIqcHUd0IhrjmdDp9PHmkGgoqwR3GqcWGZHZ#pblfmwjrj3kxjoWIqcHUd0IhrjmdDp9PHmkGgoqwR3GqcWGZHZMAYYY2hyaXN0aWUuYmFlejFAc3NzcHIuY29t	Get hash	malicious	Unknown	Browse	67.227.158.192
	d5TtJOCYil.elf	Get hash	malicious	Unknown	Browse	192.138.18.220
	http://www.baidu.com/link?url=0I1k9OfpGGc9KxPkAhJV2qtwnQhwFjwl7Ucl9U9eYXP8Bko1YBfNAg-ydj3nHAHm&wd#am9uX2FsbGVuQGJheWxvci5lZHU=	Get hash	malicious	Unknown	Browse	50.28.34.78
	http://shrifreevs.live	Get hash	malicious	Unknown	Browse	67.225.245.7
	g5oo6DQ4pd.exe	Get hash	malicious	Unknown	Browse	69.16.231.82
	http://email.praxischool.com/ls/click?upn=IsurcGKzCnvS79kVJMc7SnrZ2iwLgmzEW-2F5FN-2BxGO4ZwP-2BGLZlLOOHljQE4rCR34HKaPKu4zR7cjB6OfZfQCCA-3D-3DrkwG_ubMY-2BScvlgpMt9geg7URkJAzbDmes0F38C8as4IiP-2Fv0-2BLtRmZiUTD8L62LrZ2giGN5bVD02nm2lsewLDkLPh0oUtXTa80A3Zx3T2qOCB5KK-2BPI6xjAMv9fi8YIiI8PLauZ-2BEqNA1S9868-2BY12VVnhDL-2B1Sgpcvzi8VURhvM4aliPCEpMKvyMXH9LNbOePxnnxrxJGJPRrMGZTqUtAjlIXXUjicI99IyxuofEBLHBiTi1mwbv7ivzXNQuNAzLJPBzEo-2FUJWws-2Fe5LLutCbOjRJjEuxBfJur4B6MN42E58Jc8BEH3FOqFIy2RqePj8hIGhdEtP95iZW0jf8efnKGLCw-3D-3D	Get hash	malicious	Unknown	Browse	67.227.172.213
	http://email.praxischool.com/ls/click?upn=idG6t1z7WnEGBsXx-2FNRRRfQp2CACaDYtYa8z0AFwR1S5xAYHJiO9dz10GXr0xK3IZIPzBdJVFB3lEvYZ3c8cT4TRMy6TrAqM7tS17XTF2qgx7fzCitXUjcKjIC2OQCJvFatk_SfXildSuyDUJaqETQLjZ90t8osLbhQu3JnA20x9YBMgFsrLlBg3bXVyVydHkmgbnEjM5-2BHc-2BZv8TjWCSo8zWVm323XTeHyggvs9qTADvt5sMLn-2BetfzZ2P3XCNoiVUQXePK3THUrbC-2BKAKzPuOTwbICnWKAXj-2BaWXZQdBqzv6MOMg1Ka1JgWySn0psjqBsBoefp9150239OKFQhd83qYcyCIW0ZIIfvoffoFm8I-2BwHw-3D	Get hash	malicious	Unknown	Browse	67.227.172.213
	https://www.coimmune.com/	Get hash	malicious	Unknown	Browse	67.225.255.196
	http://eld.com/returns	Get hash	malicious	Unknown	Browse	67.227.241.203
	https://e%C2%AD%C2%AD%C2%AD%C2%ADez%C2%AD%C2%AD%C2%AD%C2%ADee.c%C2%AD%C2%AD%C2%AD%C2%ADo%C2%AD%C2%AD%C2%AD%C2%ADm.s%C2%AD%C2%AD%C2%AD%C2%ADg/v20/#himpatientportal@noch.org	Get hash	malicious	Unknown	Browse	205.174.26.39
	asMAadSRFd.elf	Get hash	malicious	Mirai	Browse	209.59.174.210
	FAWRPLS6V3.elf	Get hash	malicious	Unknown	Browse	159.135.84.255
	https://rmp.gov.bd/oct_en.html	Get hash	malicious	Phisher	Browse	64.91.240.230
	file.exe	Get hash	malicious	PrivateLoader, RisePro Stealer	Browse	69.167.167.76
	file.exe	Get hash	malicious	Fabookie, PrivateLoader, RedLine, SmokeLoader, Tofsee	Browse	69.167.167.76

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
3e4e87dda5a3162306609b7e330441d2	https://theagency786.com/qomo/?32188931	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://hill-family.us	Get hash	malicious	Unknown	Browse	142.250.217.206
	https://aussieshutters.com/ed/?71517431	Get hash	malicious	Unknown	Browse	142.250.217.206
	https://tlctrlstate.com/Mpetra.de.graaf@ict.nl	Get hash	malicious	Unknown	Browse	142.250.217.206
	https://re-captha-version-3-39.top/ms/1410_desc_1_B/?c=2e52e252-0e12-419b-8389-405438cdfa40&a=l143904	Get hash	malicious	Unknown	Browse	142.250.217.206
	https://urluso.com/2tvRvp	Get hash	malicious	Unknown	Browse	142.250.217.206
	1rNsYj4HBT	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206
	http://zx.paymentsmusic.com	Get hash	malicious	Unknown	Browse	142.250.217.206

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	376
Entropy (8bit):	5.841994750625603
Encrypted:	false
SSDEEP:	6:NMjCBM+kkWGXcQWMTQ2YF9pKF5uRYBkXTAkmxml0TkCHYiKY+RjE+5Gk2UE//m:ijCarNQLTQ2YpKDDkXTZhqYXl+XFUEXm
MD5:	A14C20BF4A831D337337C348C113014B
SHA1:	15ED14F96EB0DA58CBC048848FCAF934FFCF2EDC
SHA-256:	743AE088E3FE66E3CEFF9143EB256A14D2E06F2EE9D6828D4663EC46FD31804A
SHA-512:	C41C87CF032F7044244BFAF4826F3FE2FD63A71B59C0B0D5D14EA1BDDA73946807EE91949095A91A7CADAE032CFD6BE950A8555479A0FFE46EEDE4C1FB476574
Malicious:	false
Reputation:	low
Preview:	bplist00....... !X$versionX$objectsY$archiverT$top............U$null.......WNS.keysZNS.objectsV$class.........._..FIRCoreDiagnostics.....WNS.time#A.u.&..........Z$classnameX$classesVNSDate...XNSObject....._..NSMutableDictionary....\NSDictionary_..NSKeyedArchiver."#Troot.........#.-.2.7.>.D.K.S.^.e.g.i.k.m.o...................................................$................

/Users/berri/Library/Application Support/com.iMobie.AnyTrans-iOS-Installer/AnyTrans Installer/tmp/installer.plist

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	XML 1.0 document, ASCII text
Category:	dropped
Size (bytes):	500
Entropy (8bit):	5.217994236964112
Encrypted:	false
SSDEEP:	12:TMHdgo+tJVEdQiCXFkwV9xJ6pB+vwE/bYK:2dfyiwLbH
MD5:	91010DE7E56B8DAD30A24848734EAEC6
SHA1:	1875F11C511ADC2C2E1F03830B08B6EFEB06F0E6
SHA-256:	C8C047855294E65B1831951005CA9BBDF19C4FA7FEF64945722EBACA12A626F0
SHA-512:	03F36DD56729A919E5EF2CB9D94ACE5301837914E7BBC14C041097E2BD18ABED11A1B1FBA119A2BB6CC19087B8DB0CC515A009B2CF4392444702085B1B82A5F1
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>ataLenght</key>..<real>67604923</real>..<key>atcLenght</key>..<real>9521378</real>..<key>atiLenght</key>..<real>130270542</real>..<key>mcLenght</key>..<real>8892347</real>..<key>pcLenght</key>..<real>13723347</real>..<key>praLenght</key>..<real>21023317</real>..<key>priLenght</key>..<real>39157817</real>.</dict>.</plist>.

/Users/berri/Library/Application Support/google-heartbeat-storage/.dat.nosync038f.VN0ZMz

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	JSON data
Category:	dropped
Size (bytes):	487
Entropy (8bit):	4.844144024730963
Encrypted:	false
SSDEEP:	12:YZhDruQKqZKSOA1ybgSJPv/X5hv67t/rzijHue:YfDtkSOCybgCP5070f
MD5:	6361B5C7205CAEAEAF89611FE4095F5D
SHA1:	A9C60C8089677BC746F326E52374D78F72DDE9E5
SHA-256:	BC9362C9658F0B335E5DB925C6FF1AE2C281DD7B92FEA6405DA7AC699960DCB5
SHA-512:	4905D5028D6572AAA9E1B43D39798419804017158C9DF32D25C946D9076126E14E4415811FD8D1DA82FA258A1DC451595B572EC395D00EB254524028C76A0884
Malicious:	false
Reputation:	low
Preview:	{"lastAddedHeartbeatDates":[1,720057600],"buffer":{"circularQueue":[{"version":0,"timePeriods":[1],"agent":"apple-platform\/macos apple-sdk\/20E214 appstore\/false deploy\/cocoapods device\/Macmini8,1 fire-analytics\/9.6.0 fire-install\/9.6.0 fire-ios\/9.6.0 os-version\/10.13.2 xcode\/13A233","date":720057600},null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null],"tailIndex":1},"capacity":30}

/Users/berri/Library/Application Support/google-heartbeat-storage/.dat.nosync038f.iNYFrX

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	JSON data
Category:	dropped
Size (bytes):	248
Entropy (8bit):	3.767942994749956
Encrypted:	false
SSDEEP:	3:YJEWRkBBoRh4UXV5rxmlQKk6if0Ql4aaaaaaaaaaaaaaaaaaaaaaaaaaaauQ6Hi/:YAoRhR5r8lQKqDjHiOe
MD5:	BC2014915C57CFA287044A8B8B5A1677
SHA1:	AD671381446779A9F3FE5EFC50D7592CEF39A301
SHA-256:	B46DAB162F08B4F4DBD778109D099DDC2D05600E40960B3BC3F04CA77682955F
SHA-512:	6FC7CEB251D29FD17B4F06EE519F46D4BC5B19478DDC62EF0319067ACCFB000332A1B007FACB9D89C7EB1B59411AFAE21005A69FCF697DE95C9E5196D8B0C6FE
Malicious:	false
Reputation:	low
Preview:	{"lastAddedHeartbeatDates":[1,720057600],"buffer":{"circularQueue":[null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null,null],"tailIndex":0},"capacity":30}

/Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_event_data/1001/.dat.nosync038f.dBRSCz

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	1318
Entropy (8bit):	6.392114798473027
Encrypted:	false
SSDEEP:	24:UGo+ENadeNMABPcEDf+zUvG6zTqStLjb+HNKreR0VVfmYCH8qiGgTJGAXlgJGD:UGofa+NuED1zeyLjb+4reOVVfucRjcAl
MD5:	AA8D9C66995122E560A94AB0720459B6
SHA1:	842904D5DAC0EA7734BA955B91A7BFBC0F5C32EA
SHA-256:	8E4B60D9B53279D87AD560C091FEBDAF8A712BA9171E83D9BDB7A9A0B2B45F97
SHA-512:	8C2884AD3FE5DA6BD1AA7700A9B15F4D9761FCA82863047AEC28B828CD6D1C7335A0F2D302736C629EFC45EE00D1114B7CC17697FF1A2AC3363B17FC6ED711F5
Malicious:	false
Reputation:	low
Preview:	bplist00.......HIX$versionX$objectsY$archiverT$top..........&'159<@DU$null...................V$class_..GDTCOREventExpirationDateKey_.'GDTCOREventSerializedDataObjectBytesKey_..GDTCOREventQoSTierKey_..GDTCOREventTargetKey_..GDTCOREventClockSnapshotKey_..GDTCOREventMappingIDKey_..GDTCOREventCustomDataKey_..GDTCOREventEventIDKey.......................YNS.string.._. 1468B65AECCC4C1F894785520F6E69BC. !"#Z$classnameX$classes_..NSMutableString."$%XNSStringXNSObjectS137..()*+,-./0_..GDTCORClockTimeMillis_..GDTCORClockUptime_. GDTCORClockTimezoneOffsetSeconds_..GDTCORClockKernelBootTime.......p.......E{.E... .....MB<.. !23[GDTCORClock.4%[GDTCORClock.6.78WNS.time#A.zlf.!h... !:;VNSDate.:%.=.>?WNS.dataO..Q..:..J.Macmini8,1R)1:123117501914:ios:4b8e5422acb19112b454e3b!com.iMobie.AnyTrans-iOS-Installer......90600000.........10.13.2.........13A233-20E214..........apple-platform/macos apple-sdk/20E214 appstore/false deploy/cocoapods device/Macmini8,1 fire-analytics/9.6.0 fire-install/9.6.0 fire-ios/9

/Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_library_data/.dat.nosync038f.jyoiBd

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	data
Category:	dropped
Size (bytes):	4
Entropy (8bit):	0.8112781244591328
Encrypted:	false
SSDEEP:	3:M:M
MD5:	4352D88A78AA39750BF70CD6F27BCAA5
SHA1:	3C585604E87F855973731FEA83E21FAB9392D2FC
SHA-256:	67ABDD721024F0FF4E0B3F4C2FC13BC5BAD42D0B7851D456D88D203D15AAA450
SHA-512:	EDF92E3D4F80FC47D948EA2F17B9BFC742D34E2E785A7A4927F3E261E8BD9D400B648BFF2123B8396D24FB28F5869979E08D58B4B5D156E640344A2C0A54675D
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	....

/Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_library_data/.dat.nosync038f.mKxo24

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	567
Entropy (8bit):	6.068573352509202
Encrypted:	false
SSDEEP:	12:ijCRYN01IAScPTIU4OatU7gUnkXThjgXfeFKX/:KNuIASc7IiaogThjmfCq/
MD5:	8D5AA37ADD6CD8BE03DCD04B6E31D714
SHA1:	3BFEDF5DEC0D0BD66E7936037DBA920A76E053AA
SHA-256:	EE7F69248EACA905DC655474CDB0BCD019A0131FC775F7CB83F9054E047E19A1
SHA-512:	DCE72E5C4C8B0DF4421F667718799F2D8B139DA1609A97B83ABFADF7CE29C4CA8CC8BB8F9EAEE7B51562434EC66F468418CD73724565CA086872B801E5A245F7
Malicious:	false
Reputation:	low
Preview:	bplist00......../X$versionX$objectsY$archiverT$top............#&U$null.......V$class_..collectionStartDate_..logSourceMetrics...........WNS.time#A.u.5.........Z$classnameX$classesVNSDate...XNSObject....._..droppedEventCounterByLogSource........ !"WNS.keysZNS.objects.......$%\NSDictionary.$....'(_..GDTCORLogSourceMetrics.)._..GDTCORLogSourceMetrics...+,_..GDTCORMetricsMetadata.-._..GDTCORMetricsMetadata_..NSKeyedArchiver.01Troot.........#.-.2.7.A.G.N.U.k.~.................................................".%..C.F._.d.\|.........................2................

/Users/berri/Library/Keychains/login.keychain-db.sb-6160925d-nmfh2M

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	data
Category:	dropped
Size (bytes):	80276
Entropy (8bit):	5.071951660525322
Encrypted:	false
SSDEEP:	1536:kZ+ZScgPx/4ddIoYrOQWBZn+q56TEmjNmKYHVIm4N/3bu/3mUQF+vJWDWTjMB:kZ+ZScgPx4ddIoYrMn+q56TEe1YHVIHn
MD5:	41AB366866D4F6301D7E24B24F4FB3C8
SHA1:	B82463B457B7833E37B94F686716106B73E29460
SHA-256:	A1C2C41A7CFF184A35D879DCC368A611930F46B7CA7CAAA9A2373946D49C1504
SHA-512:	C39EB7E36DEB72A75D1D34B83BE37E07E9BCC1BF9805B7D0ECE0D5D15DB4693A80162B55A7BC3016E080BB75A895CBB0FCC09C5D70D46E5D1CD202ECE0AC7DE4
Malicious:	false
Reputation:	low
Preview:	...................H...............H...............X...................D.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...(.......................!...%...........(.......................!...%...........(.......................!...%...........0.......................!...%........DBBlob.....D.......................!...%........CSSM_DL_DB_RECORD_PUBLIC_KEY...H.......................!...%........CSSM_DL_DB_RECORD_PRIVATE_KEY......H.......................!...%........CSSM_DL_DB_RECORD_SYMMETRIC_KEY............d.......P...\...\.......P...\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\........

/Users/berri/Library/Keychains/login.keychain-db.sb-6160925d-oLwkGW

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	data
Category:	dropped
Size (bytes):	80924
Entropy (8bit):	5.105636112681368
Encrypted:	false
SSDEEP:	1536:kZ+ZScgPx/4ddIoYrOQWBZn+q56TEmjNmKYHVIm4fd3bu/3mUQF+v/g8WDVTjCP:kZ+ZScgPx4ddIoYrMn+q56TEe1YHVIHc
MD5:	CCAFE7A237FAE10EBD8F14AC1CEA6B4C
SHA1:	4A9699F802722413F71D795AA20A247C8F76CF34
SHA-256:	55498022E47D3B91B02905023626241A299B4272E7968E53AF9A3E1167624830
SHA-512:	5C9F3BBB1D413A7829ECAA4B96AB376A229E810A602A23A67D586C88BD099814C529733541C4C8413825BF0E036FD8F1913FAA0D233947812A7D0EF2F04B2B5F
Malicious:	false
Reputation:	low
Preview:	...................H...............H...............X...................D.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...(.......................!...%...........(.......................!...%...........(.......................!...%...........0.......................!...%........DBBlob.....D.......................!...%........CSSM_DL_DB_RECORD_PUBLIC_KEY...H.......................!...%........CSSM_DL_DB_RECORD_PRIVATE_KEY......H.......................!...%........CSSM_DL_DB_RECORD_SYMMETRIC_KEY............d.......P...\...\.......P...\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\...............\........

/dev/null

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	ASCII text
Category:	dropped
Size (bytes):	627
Entropy (8bit):	5.1302356551985016
Encrypted:	false
SSDEEP:	12:kWPVREgXHPKrREgXw04L0TSWihPKIREgXdLSWicR/qdRhrybHP2s1REgXTg:7ESiFESw0vPsESj/IRhrybvESTg
MD5:	40934DAEAC0EB3358CAA019482BE2F71
SHA1:	1C5526FFAB5B55A72D3EA601B0809E95F1CF7D20
SHA-256:	EA1A7C182596818197EF18B687D4B657F475B96782ADAF5B6E31BAEA73B90C2D
SHA-512:	83D8929D7F50FBFD91FF1F83FDF7D5868C250FDABCB55A363FECC0FED46199943C256A9462D7C14F0FEB65036190610446F2FF3AC75221A19B9511BCE4EDCC38
Malicious:	false
Reputation:	low
Preview:	2023-10-27 09:29:14.813 AnyTrans Installer[911:6772] ApplePersistence=NO.2023-10-27 09:29:15.585 AnyTrans Installer[911:6772] params: .{. cd4 = "Official-com-pp";. cd8 = "8.8.4.2";. ea = "Launch App";. ec = "Install SW";. el = Success;. ul = "en-US";.}.2023-10-27 09:29:15.636 AnyTrans Installer[911:6772] Event Name:Install_SW, Event parameters:{. ea = "Launch App";. el = Success;. "install_productversion" = "Official-com-pp";. "install_trackversion" = "8.8.4.2";. isPro = false;. "soft_os_version" = "Mac10.13.2";.}.2023-10-27 09:29:16.929 AnyTrans Installer[911:6772] downloadDidFinish.

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsDirectory.db_

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	48908
Entropy (8bit):	3.533948990143748
Encrypted:	false
SSDEEP:	384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGBOmBfbouR6/chQOnGqwc2U+v+h/:8MdGleOGmBouRwchQOnGqwc2U+v+h/
MD5:	09070E01FA6ED1973D94FAD50C35E3ED
SHA1:	7546663E66F9889EE3365A7A0BE372300C6022CA
SHA-256:	2E6EC437A97DD88F9067B2E99AC64789670D9B9C1FC50B2856E392E66163211F
SHA-512:	621399FF832F1A8352E5E9A54984B878C7D3432156D9CF9986A1A5B75662E92D9A00FA1BA6714D679286BB49E71916F72655AADA2B99880A2806FAFC6F86E7F3
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	kych...........................`...X...p..S0..SX..Th..T...T...[...^h...........L...X...............T...........d...................t...............t...........<...............P...........0...........$...p...........l...........X.......@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...D.......................!...%@.......MDS_CDSADIR_CSSM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_KRMM_RECORDTYPE....D.......................!...%@.......MDS_CDSADIR_EMM_RECORDTYPE.....L.......................!...%@......"MDS_CDSADIR_EMM_PRIMARY_RECORDTYPE.....H.......................!...%@.......MDS_CDSADIR_COMMON_RECORDTYPE......L.......................!...%@......"MDS_CDSADIR_CSP_PRIMARY_RECORDTYPE.....P.......................!...%@......%MDS_CDSADIR_CSP_CAPABILITY_R

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsObject.db_

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	Mac OS X Keychain File
Category:	dropped
Size (bytes):	4404
Entropy (8bit):	3.5113078915037033
Encrypted:	false
SSDEEP:	48:m6Xsh+CLjL3Pe3T5FFKfEuyu+iYxGv4sS:3X6LjLfe3wEuyu9YxGQX
MD5:	D487F899A14AE98519B46D51BC810F1B
SHA1:	64877ECFBE47ED66EED545B2449BBE8B22B775D0
SHA-256:	4835899C464487946E281D535381D4CAB8BC90EC08CD00A6A0ECB97854E9321D
SHA-512:	EB4FABD61B4FD2B9EF3C9E93793CA5F11353A1F81EA4DA22E0F79ED45D89180B77469B9E5DCD5350AE650B31DE9018743DA7716EFA7B5CDDFC3FA7A13C476F40
Malicious:	false
Preview:	kych.......................................d...................0...............0...p...........@...@.......................!...%........CSSM_DL_DB_SCHEMA_INFO.....D.......................!...%........CSSM_DL_DB_SCHEMA_ATTRIBUTES...D.......................!...%........CSSM_DL_DB_SCHEMA_INDEXES......H.......................!...%....... CSSM_DL_DB_SCHEMA_PARSING_MODULE...@.......................!...%@.......MDS_OBJECT_RECORDTYPE..............h........... ...`........... ...@.......................-...1...5...9...=@..............................X...............P................... ...p...........l...........d...........P...........H...........,...............h...........P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................RelationName.......P.......................1...5...9...=.......M................RelationID.........P.......................1...5...9...=.......M................AttributeID........X....

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/T/CFNetworkDownload_yDEabQ.tmp

Download File

Process:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	5.375109281933215
Encrypted:	false
SSDEEP:	12:+V6T6H2AY72Zmtu0fFOZII6Ye0pAKZLWiBAfIKAMnSAiOUWH/SqQhFeWv:+Vix28u0fUZIfY2aKiBWSXUH/SH7Xv
MD5:	5CD127E37B4C61349811043883E59429
SHA1:	3503A1025216C0BD3AB2B202591042BBC0688E83
SHA-256:	707D7EB226473CF8947A9BD9284102552B7D2779AC7D7F99032B4107DF2E1364
SHA-512:	D77D37FA8C60D701FFF965344EA1D9EE4EE2D6A755F68B16318A25195BF6FEB1B99333358CD7E85944926ECF2D624E5E0234750324536BFB940FA632FC171DAD
Malicious:	false
Preview:	........)1:123117501914:ios:4b8e5422acb19112b454e3.."%..measurement.audience.max_count..100"3.-measurement.upload.max_public_user_properties..25"4.-measurement.upload.max_event_name_cardinality..500"0.measurement.upload.max_public_event_params..25":.4measurement.upload.max_item_scoped_custom_parameters..27":.3measurement.upload.max_event_parameter_value_length..100"...gaia_collection_enabled..1"3.,measurement.account.time_zone_offset_minutes..480"9.4measurement.attribution.safariviewcontroller.enabled..0"..app_store_subscription_convert.....purchase.. ..app_store_subscription_renew..@.R...google_signals..r.G-9976YPB5RRz..............................a..ads....s..search....y..youtube....p..playstore....h..shopping....m..maps .....................

Static File Info

General

File type:	zlib compressed data
Entropy (8bit):	7.995409336255553
TrID:	Disk Image (Macintosh), bzlib (low compression) (2002/1) 66.67% ZLIB compressed file (1001/1) 33.33%
File name:	anytrans-ios-official-en-mac.dmg
File size:	6'743'409 bytes
MD5:	07224f1984974110e7cb74039405f2dd
SHA1:	0ecca4a9997abaa4917476959a2be25d9e79c453
SHA256:	befb2c5fb57cec2e3c6e1272bd0518a49a7995377d264d9add88ec544d93944f
SHA512:	f24cb92256a702e516080c4c39c4862b75959ebb851376357c4d346196fc5989d6f52a67996ee5845477077e7127b2a61175a78ff77eb65dccc2c5064385e0e2
SSDEEP:	196608:cog6xyHUhePrR8MrQ+vOSJfM0iAcZi4QcGBSo5:coNYHU+v2dfArcGB75
TLSH:	7C6633B938872EF5D2ECCCF5B8095509AE6F935B9277014007FAA943C986B3F45C1276
File Content Preview:	x....\|U.....{.krox....(..K.%.Y...A.R.........$...k5 .n..,...u-Z..].Vj..........j..A.Zk..k-UW..g..%9..s/7.D...d.9w....<3g^.....`..*.....S....-=.....W...\|..xt.G...Wp..A..?%D..!.?......!x{..`..u........q....`.Yt.O.....4.....!..q.i.ua.......zn.F.".....n..k6L.

CodeSign Information

[
    "Executable=/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer",
    "Identifier=com.iMobie.AnyTrans-iOS-Installer",
    "Format=app bundle with Mach-O thin (x86_64)",
    "CodeDirectory v=20500 size=13741 flags=0x10000(???) hashes=418+7 location=embedded",
    "OSPlatform=36",
    "OSSDKVersion=721664",
    "OSVersionMin=657664",
    "Hash type=sha256 size=32",
    "CandidateCDHash sha1=29c74e9b5fd5d18e98d48f073d13f7e3b9c8fdde",
    "CandidateCDHash sha256=655a4be67c8d21104576a63543303c6717d686c7",
    "Hash choices=sha1,sha256",
    "Executable Segment base=0",
    "Executable Segment limit=1245184",
    "Executable Segment flags=0x1",
    "Page size=4096",
    "CDHash=655a4be67c8d21104576a63543303c6717d686c7",
    "Signature size=9053",
    "Authority=Developer ID Application: iMobie Inc. (2QJGLWL8Y6)",
    "Authority=Developer ID Certification Authority",
    "Authority=Apple Root CA",
    "Timestamp=11 Oct 2023 at 05:44:13",
    "Info.plist entries=26",
    "TeamIdentifier=2QJGLWL8Y6",
    "Sealed Resources version=2 rules=13 files=54",
    "Internal requirements count=1 size=228"
]

Archive DMG

Archived Files

File Path	File Attributes	File Size
AnyTrans Installer/.DS_Store		10'244 bytes
AnyTrans Installer/.Trashes/501/.DS_Store		6'148 bytes
AnyTrans Installer/.VolumeIcon.icns		114'312 bytes
AnyTrans Installer/.en.tiff		135'190 bytes
AnyTrans Installer/.fseventsd/ffba01015e473dc8		51 bytes
AnyTrans Installer/.fseventsd/ffba01015e473dc9		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e47429c		98 bytes
AnyTrans Installer/.fseventsd/ffba01015e47429d		76 bytes
AnyTrans Installer/.fseventsd/ffba01015e474642		51 bytes
AnyTrans Installer/.fseventsd/ffba01015e474643		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e474ffb		1'949 bytes
AnyTrans Installer/.fseventsd/ffba01015e474ffc		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e499b0a		51 bytes
AnyTrans Installer/.fseventsd/ffba01015e499b0b		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e499e67		72 bytes
AnyTrans Installer/.fseventsd/ffba01015e499e68		76 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d38ca		51 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d38cb		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d40f4		143 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d40f5		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d8c18		3'512 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d8c19		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d8c1a		38 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d8c1b		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d8ea7		51 bytes
AnyTrans Installer/.fseventsd/ffba01015e4d8ea8		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e570ba2		51 bytes
AnyTrans Installer/.fseventsd/ffba01015e570ba3		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e571904		3'506 bytes
AnyTrans Installer/.fseventsd/ffba01015e571905		75 bytes
AnyTrans Installer/.fseventsd/ffba01015e68d649		3'511 bytes
AnyTrans Installer/.fseventsd/ffba01015e68d64a		76 bytes
AnyTrans Installer/.fseventsd/ffba010175a79e45		3'567 bytes
AnyTrans Installer/.fseventsd/ffba010175a79e46		75 bytes
AnyTrans Installer/.fseventsd/ffba010175a864ae		3'671 bytes
AnyTrans Installer/.fseventsd/ffba010175a864af		75 bytes
AnyTrans Installer/.fseventsd/ffba010175af2874		51 bytes
AnyTrans Installer/.fseventsd/ffba010175af2875		76 bytes
AnyTrans Installer/.fseventsd/ffba010175af3fd4		3'685 bytes
AnyTrans Installer/.fseventsd/ffba010175af3fd5		75 bytes
AnyTrans Installer/.fseventsd/fseventsd-uuid		36 bytes
AnyTrans Installer/.journal		524'288 bytes
AnyTrans Installer/.journal_info_block		4'096 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/CodeResources		2'221 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FBLPromises.framework/FBLPromises		28 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FBLPromises.framework/Resources		26 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FBLPromises.framework/Versions/A/FBLPromises		228'624 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FBLPromises.framework/Versions/A/Resources/Info.plist		1'347 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FBLPromises.framework/Versions/A/_CodeSignature/CodeResources		2'514 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FBLPromises.framework/Versions/Current		1 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCore.framework/FirebaseCore		29 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCore.framework/Resources		26 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCore.framework/Versions/A/FirebaseCore		253'808 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCore.framework/Versions/A/Resources/Info.plist		1'350 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCore.framework/Versions/A/_CodeSignature/CodeResources		2'514 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCore.framework/Versions/Current		1 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreDiagnostics.framework/FirebaseCoreDiagnostics		40 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreDiagnostics.framework/Resources		26 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreDiagnostics.framework/Versions/A/FirebaseCoreDiagnostics		122'624 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreDiagnostics.framework/Versions/A/Resources/Info.plist		1'383 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreDiagnostics.framework/Versions/A/_CodeSignature/CodeResources		2'514 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreDiagnostics.framework/Versions/Current		1 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreInternal.framework/FirebaseCoreInternal		37 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreInternal.framework/Resources		26 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreInternal.framework/Versions/A/FirebaseCoreInternal		464'288 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreInternal.framework/Versions/A/Resources/Info.plist		1'374 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreInternal.framework/Versions/A/_CodeSignature/CodeResources		2'514 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseCoreInternal.framework/Versions/Current		1 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseInstallations.framework/FirebaseInstallations		38 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseInstallations.framework/Resources		26 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseInstallations.framework/Versions/A/FirebaseInstallations		337'840 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseInstallations.framework/Versions/A/Resources/Info.plist		1'377 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseInstallations.framework/Versions/A/_CodeSignature/CodeResources		2'514 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/FirebaseInstallations.framework/Versions/Current		1 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleDataTransport.framework/GoogleDataTransport		36 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleDataTransport.framework/Resources		26 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleDataTransport.framework/Versions/A/GoogleDataTransport		462'000 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleDataTransport.framework/Versions/A/Resources/Info.plist		1'371 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleDataTransport.framework/Versions/A/_CodeSignature/CodeResources		2'514 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleDataTransport.framework/Versions/Current		1 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleUtilities.framework/GoogleUtilities		32 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleUtilities.framework/Resources		26 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleUtilities.framework/Versions/A/GoogleUtilities		334'016 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleUtilities.framework/Versions/A/Resources/Info.plist		1'360 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleUtilities.framework/Versions/A/_CodeSignature/CodeResources		2'514 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/GoogleUtilities.framework/Versions/Current		1 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/ZipArchive.framework/Resources		26 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/ZipArchive.framework/Versions/A/Resources/Info.plist		1'320 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/ZipArchive.framework/Versions/A/ZipArchive		251'792 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/ZipArchive.framework/Versions/A/_CodeSignature/CodeResources		2'514 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/ZipArchive.framework/Versions/Current		1 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/ZipArchive.framework/ZipArchive		27 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftAppKit.dylib		223'088 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftCloudKit.dylib		206'128 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftContacts.dylib		68'960 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftCore.dylib		6'456'704 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftCoreData.dylib		99'280 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftCoreFoundation.dylib		42'512 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftCoreGraphics.dylib		190'944 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftCoreImage.dylib		50'448 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftCoreLocation.dylib		55'248 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftDarwin.dylib		99'472 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftDispatch.dylib		328'672 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftFoundation.dylib		3'163'792 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftIOKit.dylib		46'048 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftMetal.dylib		85'312 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftObjectiveC.dylib		62'656 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftQuartzCore.dylib		58'752 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftXPC.dylib		46'128 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/libswiftos.dylib		72'752 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/nanopb.framework/Resources		26 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/nanopb.framework/Versions/A/Resources/Info.plist		1'336 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/nanopb.framework/Versions/A/_CodeSignature/CodeResources		2'514 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/nanopb.framework/Versions/A/nanopb		119'344 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/nanopb.framework/Versions/Current		1 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Frameworks/nanopb.framework/nanopb		23 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Info.plist		1'787 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer		1'750'208 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/PkgInfo		8 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/Assets.car		344'920 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/Base.lproj/Localizable.strings		12'018 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/Base.lproj/MainMenu.nib/keyedobjects-101300.nib		8'203 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/Base.lproj/MainMenu.nib/keyedobjects.nib		10'067 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/EULA.txt		14'180 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/GoogleService-Info.plist		1'132 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/IMBAlertViewController.nib/keyedobjects-101300.nib		23'291 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/IMBAlertViewController.nib/keyedobjects.nib		27'702 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/IMBInstallProgressViewController.nib/keyedobjects-101300.nib		44'007 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/IMBInstallProgressViewController.nib/keyedobjects.nib		60'998 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/IMBLicenseAgreementController.nib/keyedobjects-101300.nib		15'076 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/IMBLicenseAgreementController.nib/keyedobjects.nib		18'429 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/IMBMainViewController.nib/keyedobjects-101300.nib		20'739 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/IMBMainViewController.nib/keyedobjects.nib		26'066 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/ar.lproj/Localizable.strings		17'310 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/ati.icns		524'774 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/de.lproj/Localizable.strings		18'192 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/en.lproj/Localizable.strings		19'572 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/es.lproj/Localizable.strings		18'076 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/fr.lproj/Localizable.strings		18'808 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/it.lproj/Localizable.strings		11'896 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/ja.lproj/Localizable.strings		15'656 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/ko.lproj/Localizable.strings		4'516 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/nl.lproj/Localizable.strings		16'656 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/pt.lproj/Localizable.strings		12'878 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/tr.lproj/Localizable.strings		16'352 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/Resources/zh-Hant.lproj/Localizable.strings		4'010 bytes
AnyTrans Installer/AnyTrans Installer.app/Contents/_CodeSignature/CodeResources		26'441 bytes

Extracted Files

AnyTrans Installer/.DS_Store

File path:	AnyTrans Installer/.DS_Store
File size:	10'244 bytes
File type:	Apple Desktop Services Store

AnyTrans Installer/.VolumeIcon.icns

File path:	AnyTrans Installer/.VolumeIcon.icns
File size:	114'312 bytes
File type:	Mac OS X icon, 114312 bytes, "info" type

AnyTrans Installer/.en.tiff

File path:	AnyTrans Installer/.en.tiff
File size:	135'190 bytes
File type:	TIFF image data, big-endian, direntries=22, height=294, bps=0, compression=LZW, PhotometricIntepretation=RGB, description=instalBg_en.png, orientation=upper-left, width=332

AnyTrans Installer/.Trashes/501/.DS_Store

File path:	AnyTrans Installer/.Trashes/501/.DS_Store
File size:	6'148 bytes
File type:	Apple Desktop Services Store

AnyTrans Installer/.fseventsd/ffba01015e473dc8

File path:	AnyTrans Installer/.fseventsd/ffba01015e473dc8
File size:	51 bytes
File type:	gzip compressed data, original size modulo 2^32 33

AnyTrans Installer/.fseventsd/ffba01015e473dc9

File path:	AnyTrans Installer/.fseventsd/ffba01015e473dc9
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e47429c

File path:	AnyTrans Installer/.fseventsd/ffba01015e47429c
File size:	98 bytes
File type:	gzip compressed data, original size modulo 2^32 120

AnyTrans Installer/.fseventsd/ffba01015e47429d

File path:	AnyTrans Installer/.fseventsd/ffba01015e47429d
File size:	76 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e474642

File path:	AnyTrans Installer/.fseventsd/ffba01015e474642
File size:	51 bytes
File type:	gzip compressed data, original size modulo 2^32 33

AnyTrans Installer/.fseventsd/ffba01015e474643

File path:	AnyTrans Installer/.fseventsd/ffba01015e474643
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e474ffb

File path:	AnyTrans Installer/.fseventsd/ffba01015e474ffb
File size:	1'949 bytes
File type:	gzip compressed data, original size modulo 2^32 16360

AnyTrans Installer/.fseventsd/ffba01015e474ffc

File path:	AnyTrans Installer/.fseventsd/ffba01015e474ffc
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e499b0a

File path:	AnyTrans Installer/.fseventsd/ffba01015e499b0a
File size:	51 bytes
File type:	gzip compressed data, original size modulo 2^32 33

AnyTrans Installer/.fseventsd/ffba01015e499b0b

File path:	AnyTrans Installer/.fseventsd/ffba01015e499b0b
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e499e67

File path:	AnyTrans Installer/.fseventsd/ffba01015e499e67
File size:	72 bytes
File type:	gzip compressed data, original size modulo 2^32 63

AnyTrans Installer/.fseventsd/ffba01015e499e68

File path:	AnyTrans Installer/.fseventsd/ffba01015e499e68
File size:	76 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e4d38ca

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d38ca
File size:	51 bytes
File type:	gzip compressed data, original size modulo 2^32 33

AnyTrans Installer/.fseventsd/ffba01015e4d38cb

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d38cb
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e4d40f4

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d40f4
File size:	143 bytes
File type:	gzip compressed data, original size modulo 2^32 214

AnyTrans Installer/.fseventsd/ffba01015e4d40f5

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d40f5
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e4d8c18

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d8c18
File size:	3'512 bytes
File type:	gzip compressed data, original size modulo 2^32 34993

AnyTrans Installer/.fseventsd/ffba01015e4d8c19

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d8c19
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e4d8c1a

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d8c1a
File size:	38 bytes
File type:	gzip compressed data, truncated

AnyTrans Installer/.fseventsd/ffba01015e4d8c1b

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d8c1b
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e4d8ea7

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d8ea7
File size:	51 bytes
File type:	gzip compressed data, original size modulo 2^32 33

AnyTrans Installer/.fseventsd/ffba01015e4d8ea8

File path:	AnyTrans Installer/.fseventsd/ffba01015e4d8ea8
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e570ba2

File path:	AnyTrans Installer/.fseventsd/ffba01015e570ba2
File size:	51 bytes
File type:	gzip compressed data, original size modulo 2^32 33

AnyTrans Installer/.fseventsd/ffba01015e570ba3

File path:	AnyTrans Installer/.fseventsd/ffba01015e570ba3
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e571904

File path:	AnyTrans Installer/.fseventsd/ffba01015e571904
File size:	3'506 bytes
File type:	gzip compressed data, original size modulo 2^32 34888

AnyTrans Installer/.fseventsd/ffba01015e571905

File path:	AnyTrans Installer/.fseventsd/ffba01015e571905
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba01015e68d649

File path:	AnyTrans Installer/.fseventsd/ffba01015e68d649
File size:	3'511 bytes
File type:	gzip compressed data, original size modulo 2^32 34888

AnyTrans Installer/.fseventsd/ffba01015e68d64a

File path:	AnyTrans Installer/.fseventsd/ffba01015e68d64a
File size:	76 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba010175a79e45

File path:	AnyTrans Installer/.fseventsd/ffba010175a79e45
File size:	3'567 bytes
File type:	gzip compressed data, original size modulo 2^32 35546

AnyTrans Installer/.fseventsd/ffba010175a79e46

File path:	AnyTrans Installer/.fseventsd/ffba010175a79e46
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba010175a864ae

File path:	AnyTrans Installer/.fseventsd/ffba010175a864ae
File size:	3'671 bytes
File type:	gzip compressed data, original size modulo 2^32 36308

AnyTrans Installer/.fseventsd/ffba010175a864af

File path:	AnyTrans Installer/.fseventsd/ffba010175a864af
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba010175af2874

File path:	AnyTrans Installer/.fseventsd/ffba010175af2874
File size:	51 bytes
File type:	gzip compressed data, original size modulo 2^32 33

AnyTrans Installer/.fseventsd/ffba010175af2875

File path:	AnyTrans Installer/.fseventsd/ffba010175af2875
File size:	76 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/ffba010175af3fd4

File path:	AnyTrans Installer/.fseventsd/ffba010175af3fd4
File size:	3'685 bytes
File type:	gzip compressed data, original size modulo 2^32 36351

AnyTrans Installer/.fseventsd/ffba010175af3fd5

File path:	AnyTrans Installer/.fseventsd/ffba010175af3fd5
File size:	75 bytes
File type:	gzip compressed data, original size modulo 2^32 58

AnyTrans Installer/.fseventsd/fseventsd-uuid

File path:	AnyTrans Installer/.fseventsd/fseventsd-uuid
File size:	36 bytes
File type:	ASCII text, with no line terminators

AnyTrans Installer/AnyTrans Installer.app/Contents/CodeResources

File path:	AnyTrans Installer/AnyTrans Installer.app/Contents/CodeResources
File size:	2'221 bytes
File type:	data

AnyTrans Installer/AnyTrans Installer.app/Contents/Info.plist

File path:	AnyTrans Installer/AnyTrans Installer.app/Contents/Info.plist
File size:	1'787 bytes
File type:	XML 1.0 document, Unicode text, UTF-8 text

Plist Content

{
    "BuildMachineOSBuild": "20G1120",
    "CFBundleDevelopmentRegion": "en",
    "CFBundleExecutable": "AnyTrans Installer",
    "CFBundleIconFile": "ati",
    "CFBundleIdentifier": "com.iMobie.AnyTrans-iOS-Installer",
    "CFBundleInfoDictionaryVersion": "6.0",
    "CFBundleName": "AnyTrans Installer",
    "CFBundlePackageType": "APPL",
    "CFBundleShortVersionString": "8.8",
    "CFBundleSupportedPlatforms": [
        "MacOSX"
    ],
    "CFBundleVersion": "8.8.4",
    "DTCompiler": "com.apple.compilers.llvm.clang.1_0",
    "DTPlatformBuild": "13A233",
    "DTPlatformName": "macosx",
    "DTPlatformVersion": "11.3",
    "DTSDKBuild": "20E214",
    "DTSDKName": "macosx11.3",
    "DTXcode": "1300",
    "DTXcodeBuild": "13A233",
    "InstallProduct": 1,
    "LSMinimumSystemVersion": "10.9",
    "NSAppTransportSecurity": {
        "NSAllowsArbitraryLoads": true
    },
    "NSHumanReadableCopyright": "Copyright © 2019 ding ming. All rights reserved.",
    "NSMainNibFile": "MainMenu",
    "NSPrincipalClass": "NSApplication",
    "NSRequiresAquaSystemAppearance": true
}

AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer

File path:	AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File size:	1'750'208 bytes
File type:	Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|PIE>

Static Mach Info

General Information for header 1
Endian:	little-endian
Size:	64-bit
Architecture:	x86_64
Filetype:	execute
Nbr. of load commands:	47
Entry point:	0xDEDB

segment_command_64 aggregated: 4

Name	Value
segname	__PAGEZERO
vmaddr	0x0
vmsize	0x100000000
fileoff	0x0
filesize	0x0
maxprot	0x0
initprot	0x0
nsects	0
flags	0x0

Name

Value

segname

__TEXT

vmaddr

0x100000000

vmsize

0x130000

fileoff

0x0

filesize

0x130000

maxprot

0x5

initprot

0x5

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__text	__TEXT	0x100002150	0xF54E0	0x2150	6.2327	0x4	0x0	0	0x80000400
__stubs	__TEXT	0x1000F7630	0x5CA	0xF7630	3.9157	0x1	0x0	0	0x80000408
__stub_helper	__TEXT	0x1000F7BFC	0x9B6	0xF7BFC	4.8595	0x2	0x0	0	0x80000400
__cstring	__TEXT	0x1000F85B2	0x1538D	0xF85B2	5.0328	0x0	0x0	0	0x2
__objc_methname	__TEXT	0x10010D93F	0x166E2	0x10D93F	4.9747	0x0	0x0	0	0x2
__objc_classname	__TEXT	0x100124021	0x137D	0x124021	4.9901	0x0	0x0	0	0x2
__objc_methtype	__TEXT	0x10012539E	0x3835	0x12539E	5.2801	0x0	0x0	0	0x2
__gcc_except_tab	__TEXT	0x100128BD4	0x112C	0x128BD4	5.2750	0x2	0x0	0	0x0
__const	__TEXT	0x100129D00	0x1670	0x129D00	2.4690	0x4	0x0	0	0x0
__ustring	__TEXT	0x10012B370	0x1C	0x12B370	3.8074	0x1	0x0	0	0x0
__unwind_info	__TEXT	0x10012B38C	0x2A84	0x12B38C	6.1289	0x2	0x0	0	0x0
__eh_frame	__TEXT	0x10012DE10	0x21F0	0x12DE10	3.0928	0x3	0x0	0	0x0

Name

Value

segname

__DATA

vmaddr

0x100130000

vmsize

0x5C000

fileoff

0x130000

filesize

0x5C000

maxprot

0x3

initprot

0x3

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__nl_symbol_ptr	__DATA	0x100130000	0x8	0x130000	-0.0000	0x3	0x0	0	0x6
__got	__DATA	0x100130008	0x320	0x130008	0.1792	0x3	0x0	0	0x6
__la_symbol_ptr	__DATA	0x100130328	0x7B8	0x130328	3.2506	0x3	0x0	0	0x7
__const	__DATA	0x100130AE0	0x3FB0	0x130AE0	2.4690	0x4	0x0	0	0x0
__cfstring	__DATA	0x100134A90	0x14540	0x134A90	1.9620	0x3	0x0	0	0x0
__objc_classlist	__DATA	0x100148FD0	0x670	0x148FD0	3.2371	0x3	0x0	0	0x10000000
__objc_nlclslist	__DATA	0x100149640	0x20	0x149640	2.5000	0x3	0x0	0	0x10000000
__objc_catlist	__DATA	0x100149660	0x78	0x149660	2.9042	0x3	0x0	0	0x10000000
__objc_protolist	__DATA	0x1001496D8	0x100	0x1496D8	2.9775	0x3	0x0	0	0x0
__objc_imageinfo	__DATA	0x1001497D8	0x8	0x1497D8	0.5436	0x2	0x0	0	0x0
__objc_const	__DATA	0x1001497E0	0x31B88	0x1497E0	3.2559	0x3	0x0	0	0x0
__objc_selrefs	__DATA	0x10017B368	0x4618	0x17B368	3.8105	0x3	0x0	0	0x10000005
__objc_protorefs	__DATA	0x10017F980	0x30	0x17F980	2.5629	0x3	0x0	0	0x0
__objc_classrefs	__DATA	0x10017F9B0	0x848	0x17F9B0	2.3447	0x3	0x0	0	0x10000000
__objc_superrefs	__DATA	0x1001801F8	0x518	0x1801F8	3.1345	0x3	0x0	0	0x10000000
__objc_ivar	__DATA	0x100180710	0x17B0	0x180710	1.2219	0x3	0x0	0	0x0
__objc_data	__DATA	0x100181EC0	0x5A70	0x181EC0	2.3952	0x3	0x0	0	0x0
__data	__DATA	0x100187930	0x10F8	0x187930	1.9555	0x4	0x0	0	0x0
__bss	__DATA	0x100188A28	0x4C8	0x0	0.0000	0x3	0x0	0	0x1
__common	__DATA	0x100188EF0	0x20	0x0	0.0000	0x3	0x0	0	0x1

Name	Value
segname	__LINKEDIT
vmaddr	0x10018C000
vmsize	0x20000
fileoff	0x18C000
filesize	0x1F4C0
maxprot	0x1
initprot	0x1
nsects	0
flags	0x0

dyld_info_command aggregated: 1

Name	Value
rebase_off	1622016
rebase_size	9712
bind_off	1631728
bind_size	7728
weak_bind_off	0
weak_bind_size	0
lazy_bind_off	1639456
lazy_bind_size	6784
export_off	1646240
export_size	36632

symtab_command aggregated: 1

Name	Value
symoff	1689136
nsyms	457
stroff	1698832
strsize	10400

dysymtab_command aggregated: 1

Name	Value
ilocalsym	0
nlocalsym	1
iextdefsym	1
nextdefsym	1
iundefsym	2
nundefsym	455
tocoff	0
ntoc	0
modtaboff	0
nmodtab	0
extrefsymoff	0
nextrefsyms	0
indirectsymoff	1696448
nindirectsyms	595
extreloff	0
nextrel	0
locreloff	0
nlocrel	0

dylinker_command aggregated: 1

Name

Value

name

Datas

/usr/lib/dyld

uuid_command aggregated: 1

Name	Value
uuid	b'\x193\xd6\xc7+p=\x99\xb1\xabe.K/{\xb6'

version_min_command aggregated: 1

Name	Value
version	657664
sdk	721664

source_version_command aggregated: 1

Name	Value
version	0

entry_point_command aggregated: 1

Name	Value
entryoff	57051
stacksize	0

dylib_command aggregated: 27

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

905.6.0

compatibility_version

1.0.0

Datas

/usr/lib/libc++.1.dylib

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

321.3.0

compatibility_version

9.0.0

Datas

/usr/lib/libsqlite3.dylib

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.2.11

compatibility_version

1.0.0

Datas

/usr/lib/libz.1.dylib

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

2022.44.149

compatibility_version

45.0.0

Datas

/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

0.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/CoreTelephony.framework/Versions/A/CoreTelephony

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

@rpath/FBLPromises.framework/Versions/A/FBLPromises

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

@rpath/FirebaseCore.framework/Versions/A/FirebaseCore

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

@rpath/FirebaseCoreDiagnostics.framework/Versions/A/FirebaseCoreDiagnostics

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

@rpath/FirebaseCoreInternal.framework/Versions/A/FirebaseCoreInternal

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

@rpath/FirebaseInstallations.framework/Versions/A/FirebaseInstallations

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1775.118.101

compatibility_version

300.0.0

Datas

/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

@rpath/GoogleDataTransport.framework/Versions/A/GoogleDataTransport

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

@rpath/GoogleUtilities.framework/Versions/A/GoogleUtilities

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

59754.100.106

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/Security.framework/Versions/A/Security

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

379.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/StoreKit.framework/Versions/A/StoreKit

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1109.101.1

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

@rpath/nanopb.framework/Versions/A/nanopb

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1292.100.5

compatibility_version

1.0.0

Datas

/usr/lib/libSystem.B.dylib

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1775.118.101

compatibility_version

150.0.0

Datas

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1463.4.2

compatibility_version

64.0.0

Datas

/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1122.33.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/CoreText.framework/Versions/A/CoreText

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

275.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/ImageIO.framework/Versions/A/ImageIO

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.11.0

compatibility_version

1.2.0

Datas

/System/Library/Frameworks/QuartzCore.framework/Versions/A/QuartzCore

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

228.0.0

compatibility_version

1.0.0

Datas

/usr/lib/libobjc.A.dylib

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

@rpath/ZipArchive.framework/Versions/A/ZipArchive

rpath_command aggregated: 5

Name

Value

path

Datas

/usr/lib/swift

Name

Value

path

Datas

@executable_path/../Frameworks

Name

Value

path

Datas

@loader_path/Frameworks

Name

Value

path

Datas

/Applications/Xcode.app/Contents/Developer/Toolchains/XcodeDefault.xctoolchain/usr/lib/swift/macosx

Name

Value

path

Datas

@executable_path/../Frameworks

linkedit_data_command aggregated: 3

Name	Value
dataoff	1682872
datasize	5952

Name	Value
dataoff	1688824
datasize	312

Name	Value
dataoff	1709232
datasize	40976

Internal Symbols

_CACurrentMediaTime

_CATransform3DMakeRotation

_CCCrypt

_CCSymmetricKeyUnwrap

_CCSymmetricKeyWrap

_CC_MD5

_CC_SHA1

_CC_SHA256

_CCrfc3394_iv

_CCrfc3394_ivLen

_CFArrayCreate

_CFBooleanGetValue

_CFBundleGetVersionNumber

_CFDictionaryGetValue

_CFNumberIsFloatType

_CFPreferencesAppSynchronize

_CFPreferencesCopyAppValue

_CFPreferencesCopyKeyList

_CFPreferencesSetAppValue

_CFPreferencesSetMultiple

_CFPropertyListCreateDeepCopy

_CFRelease

_CFRetain

_CFRunLoopGetMain

_CFStringTransform

_CFURLCopyResourcePropertyForKey

_CFUUIDCreate

_CFUUIDCreateString

_CGColorCreate

_CGColorSpaceCreateDeviceRGB

_CGColorSpaceRelease

_CGContextAddPath

_CGContextClip

_CGContextDrawLinearGradient

_CGContextRestoreGState

_CGContextSaveGState

_CGGradientCreateWithColorComponents

_CGGradientRelease

_CGImageSourceCreateImageAtIndex

_CGImageSourceCreateWithData

_CGPathAddCurveToPoint

_CGPathAddLineToPoint

_CGPathCloseSubpath

_CGPathCreateCopy

_CGPathCreateMutable

_CGPathCreateMutableCopy

_CGPathMoveToPoint

_CGPathRelease

_FIRFirebaseVersion

_FIRInstallationIDDidChangeNotification

_GULIsLoggableLevel

_GULLogBasic

_GULLogError

_GULLogWarning

_GULSetLoggerLevel

_Gestalt

_IOBSDNameMatching

_IOIteratorNext

_IOMasterPort

_IOObjectRelease

_IORegistryEntryCreateCFProperty

_IORegistryEntryGetParentEntry

_IOServiceGetMatchingServices

_NSApp

_NSApplicationDidBecomeActiveNotification

_NSApplicationDidFinishLaunchingNotification

_NSApplicationMain

_NSApplicationWillResignActiveNotification

_NSBackgroundColorAttributeName

_NSClassFromString

_NSCursorAttributeName

_NSDefaultRunLoopMode

_NSFileImmutable

_NSFileSize

_NSFileSystemFreeSize

_NSFilenamesPboardType

_NSFilesPromisePboardType

_NSFontAttributeName

_NSForegroundColorAttributeName

_NSFoundationVersionNumber

_NSKeyValueChangeNewKey

_NSLinkAttributeName

_NSLocaleCurrencyCode

_NSLocalizedDescriptionKey

_NSLocalizedFailureReasonErrorKey

_NSLog

_NSMouseInRect

_NSParagraphStyleAttributeName

_NSRectFill

_NSRunLoopCommonModes

_NSSearchPathForDirectoriesInDomains

_NSSelectorFromString

_NSSetUncaughtExceptionHandler

_NSStringFromClass

_NSStringFromSelector

_NSToolTipAttributeName

_NSURLAuthenticationMethodServerTrust

_NSURLErrorFailingURLErrorKey

_NSURLIsExcludedFromBackupKey

_NSURLSessionTransferSizeUnknown

_NSUnderlyingErrorKey

_NSWindowDidResignKeyNotification

_NSZeroPoint

_NSZeroRect

_OBJC_CLASS_$_CAAnimationGroup

_OBJC_CLASS_$_CABasicAnimation

_OBJC_CLASS_$_CAKeyframeAnimation

_OBJC_CLASS_$_CAMediaTimingFunction

_OBJC_CLASS_$_CAShapeLayer

_OBJC_CLASS_$_CATransition

_OBJC_CLASS_$_CIColor

_OBJC_CLASS_$_FIRApp

_OBJC_CLASS_$_FIRComponent

_OBJC_CLASS_$_FIRInstallations

_OBJC_CLASS_$_GULAppDelegateSwizzler

_OBJC_CLASS_$_GULAppEnvironmentUtil

_OBJC_CLASS_$_GULMutableDictionary

_OBJC_CLASS_$_GULNetwork

_OBJC_CLASS_$_NSAffineTransform

_OBJC_CLASS_$_NSAnimationContext

_OBJC_CLASS_$_NSApplication

_OBJC_CLASS_$_NSArray

_OBJC_CLASS_$_NSAttributedString

_OBJC_CLASS_$_NSBezierPath

_OBJC_CLASS_$_NSBitmapImageRep

_OBJC_CLASS_$_NSBundle

_OBJC_CLASS_$_NSButton

_OBJC_CLASS_$_NSCharacterSet

_OBJC_CLASS_$_NSColor

_OBJC_CLASS_$_NSCursor

_OBJC_CLASS_$_NSData

_OBJC_CLASS_$_NSDate

_OBJC_CLASS_$_NSDateFormatter

_OBJC_CLASS_$_NSDecimalNumber

_OBJC_CLASS_$_NSDictionary

_OBJC_CLASS_$_NSError

_OBJC_CLASS_$_NSException

_OBJC_CLASS_$_NSFileHandle

_OBJC_CLASS_$_NSFileManager

_OBJC_CLASS_$_NSFont

_OBJC_CLASS_$_NSGraphicsContext

_OBJC_CLASS_$_NSHTTPURLResponse

_OBJC_CLASS_$_NSImage

_OBJC_CLASS_$_NSImageView

_OBJC_CLASS_$_NSIndexSet

_OBJC_CLASS_$_NSInputStream

_OBJC_CLASS_$_NSJSONSerialization

_OBJC_CLASS_$_NSLocale

_OBJC_CLASS_$_NSLock

_OBJC_CLASS_$_NSMutableArray

_OBJC_CLASS_$_NSMutableAttributedString

_OBJC_CLASS_$_NSMutableData

_OBJC_CLASS_$_NSMutableDictionary

_OBJC_CLASS_$_NSMutableParagraphStyle

_OBJC_CLASS_$_NSMutableSet

_OBJC_CLASS_$_NSMutableString

_OBJC_CLASS_$_NSMutableURLRequest

_OBJC_CLASS_$_NSNotificationCenter

_OBJC_CLASS_$_NSNull

_OBJC_CLASS_$_NSNumber

_OBJC_CLASS_$_NSNumberFormatter

_OBJC_CLASS_$_NSObject

_OBJC_CLASS_$_NSOperationQueue

_OBJC_CLASS_$_NSOutputStream

_OBJC_CLASS_$_NSParagraphStyle

_OBJC_CLASS_$_NSPredicate

_OBJC_CLASS_$_NSProcessInfo

_OBJC_CLASS_$_NSProgress

_OBJC_CLASS_$_NSPropertyListSerialization

_OBJC_CLASS_$_NSRegularExpression

_OBJC_CLASS_$_NSRunLoop

_OBJC_CLASS_$_NSScanner

_OBJC_CLASS_$_NSSet

_OBJC_CLASS_$_NSShadow

_OBJC_CLASS_$_NSSortDescriptor

_OBJC_CLASS_$_NSString

_OBJC_CLASS_$_NSTextView

_OBJC_CLASS_$_NSThread

_OBJC_CLASS_$_NSTimeZone

_OBJC_CLASS_$_NSTimer

_OBJC_CLASS_$_NSTrackingArea

_OBJC_CLASS_$_NSURL

_OBJC_CLASS_$_NSURLConnection

_OBJC_CLASS_$_NSURLCredential

_OBJC_CLASS_$_NSURLDownload

_OBJC_CLASS_$_NSURLRequest

_OBJC_CLASS_$_NSURLSession

_OBJC_CLASS_$_NSURLSessionConfiguration

_OBJC_CLASS_$_NSURLSessionDownloadTask

_OBJC_CLASS_$_NSURLSessionTask

_OBJC_CLASS_$_NSUUID

_OBJC_CLASS_$_NSUserDefaults

_OBJC_CLASS_$_NSValue

_OBJC_CLASS_$_NSView

_OBJC_CLASS_$_NSViewController

_OBJC_CLASS_$_NSWindow

_OBJC_CLASS_$_NSWindowController

_OBJC_CLASS_$_NSWorkspace

_OBJC_CLASS_$_NSXMLDocument

_OBJC_CLASS_$_NSXMLParser

_OBJC_CLASS_$_SKPaymentQueue

_OBJC_CLASS_$_SKProductsRequest

_OBJC_CLASS_$_SSZipArchive

_OBJC_CLASS_$__NSThemeWidgetCell

_OBJC_EHTYPE_$_NSException

_OBJC_METACLASS_$_NSButton

_OBJC_METACLASS_$_NSImageView

_OBJC_METACLASS_$_NSInputStream

_OBJC_METACLASS_$_NSObject

_OBJC_METACLASS_$_NSTextView

_OBJC_METACLASS_$_NSView

_OBJC_METACLASS_$_NSViewController

_OBJC_METACLASS_$_NSWindow

_OBJC_METACLASS_$_NSWindowController

_SCNetworkReachabilityCreateWithAddress

_SCNetworkReachabilityCreateWithName

_SCNetworkReachabilityGetFlags

_SCNetworkReachabilityScheduleWithRunLoop

_SCNetworkReachabilitySetCallback

_SCNetworkReachabilityUnscheduleFromRunLoop

_SecCertificateCopyData

_SecCertificateCreateWithData

_SecItemAdd

_SecItemCopyMatching

_SecItemDelete

_SecItemExport

_SecItemUpdate

_SecPolicyCreateBasicX509

_SecPolicyCreateSSL

_SecRandomCopyBytes

_SecTrustCopyPublicKey

_SecTrustCreateWithCertificates

_SecTrustEvaluate

_SecTrustGetCertificateAtIndex

_SecTrustGetCertificateCount

_SecTrustSetAnchorCertificates

_SecTrustSetPolicies

_UTTypeCopyPreferredTagWithClass

_UTTypeCreatePreferredIdentifierForTag

__Block_copy

__Block_object_assign

__Block_object_dispose

__Block_release

__NSConcreteGlobalBlock

__NSConcreteStackBlock

__Unwind_Resume

___CFConstantStringClassReference

___NSArray0__

___NSDictionary0__

___assert_rtn

___bzero

___error

___exp10

___objc_personality_v0

___stack_chk_fail

___stack_chk_guard

__dispatch_main_q

__dispatch_queue_attr_concurrent

__dispatch_source_type_timer

__dyld_get_image_header

__dyld_image_count

__mh_execute_header

__objc_empty_cache

_arc4random

_arc4random_uniform

_backtrace

_backtrace_symbols

_calloc

_ceil

_class_addMethod

_class_getInstanceMethod

_class_replaceMethod

_dispatch_after

_dispatch_async

_dispatch_block_cancel

_dispatch_block_create

_dispatch_block_wait

_dispatch_get_global_queue

_dispatch_group_async

_dispatch_group_create

_dispatch_once

_dispatch_once_f

_dispatch_queue_attr_make_with_qos_class

_dispatch_queue_create

_dispatch_queue_get_label

_dispatch_resume

_dispatch_semaphore_create

_dispatch_semaphore_signal

_dispatch_semaphore_wait

_dispatch_set_target_queue

_dispatch_source_cancel

_dispatch_source_create

_dispatch_source_set_event_handler

_dispatch_source_set_timer

_dispatch_source_testcancel

_dispatch_sync

_dispatch_time

_dispatch_walltime

_dlsym

_fclose

_fmod

_fopen

_fread

_free

_fseek

_ftell

_gettimeofday

_if_nametoindex

_kCAFillModeBackwards

_kCAFillModeForwards

_kCAFillRuleEvenOdd

_kCAMediaTimingFunctionEaseIn

_kCAMediaTimingFunctionEaseInEaseOut

_kCAMediaTimingFunctionEaseOut

_kCAMediaTimingFunctionLinear

_kCATransitionFromBottom

_kCATransitionFromLeft

_kCATransitionFromRight

_kCATransitionFromTop

_kCATransitionMoveIn

_kCATransitionPush

_kCATransitionReveal

_kCFAllocatorDefault

_kCFBooleanFalse

_kCFBooleanTrue

_kCFBundleExecutableKey

_kCFBundleIdentifierKey

_kCFBundleVersionKey

_kCFPreferencesAnyHost

_kCFPreferencesCurrentApplication

_kCFPreferencesCurrentUser

_kCFRunLoopCommonModes

_kCFURLIsAliasFileKey

_kCTForegroundColorAttributeName

_kCTUnderlineStyleAttributeName

_kFIRLoggerAnalytics

_kGULNetworkHTTPStatusCodeCannotAcceptTraffic

_kGULNetworkHTTPStatusCodeNotFound

_kGULNetworkHTTPStatusCodeNotModified

_kGULNetworkHTTPStatusCodeUnavailable

_kGULNetworkHTTPStatusNoContent

_kGULNetworkHTTPStatusOK

_kSecAttrAccessible

_kSecAttrAccessibleAlwaysThisDeviceOnly

_kSecAttrAccount

_kSecAttrGeneric

_kSecAttrService

_kSecClass

_kSecClassGenericPassword

_kSecMatchLimit

_kSecMatchLimitOne

_kSecRandomDefault

_kSecReturnAttributes

_kSecReturnData

_kSecValueData

_kUTTagClassFilenameExtension

_kUTTagClassMIMEType

_log10

_lstat$INODE64

_malloc

_malloc_size

_memchr

_memcmp

_memcpy

_memset

_method_exchangeImplementations

_method_getImplementation

_method_getTypeEncoding

_nextafter

_objc_alloc

_objc_autorelease

_objc_autoreleasePoolPop

_objc_autoreleasePoolPush

_objc_autoreleaseReturnValue

_objc_begin_catch

_objc_copyWeak

_objc_destroyWeak

_objc_end_catch

_objc_enumerationMutation

_objc_exception_rethrow

_objc_exception_throw

_objc_getAssociatedObject

_objc_getProperty

_objc_initWeak

_objc_loadWeakRetained

_objc_msgSend

_objc_msgSendSuper2

_objc_msgSend_stret

_objc_release

_objc_retain

_objc_retainAutorelease

_objc_retainAutoreleaseReturnValue

_objc_retainAutoreleasedReturnValue

_objc_retainBlock

_objc_setAssociatedObject

_objc_setProperty_atomic_copy

_objc_setProperty_nonatomic

_objc_setProperty_nonatomic_copy

_objc_storeStrong

_objc_storeWeak

_objc_sync_enter

_objc_sync_exit

_objc_terminate

_objc_unsafeClaimAutoreleasedReturnValue

_open

_pb_decode

_pb_decode_varint

_pb_encode

_pb_encode_string

_pb_encode_submessage

_pb_encode_tag_for_field

_pb_encode_varint

_pb_istream_from_buffer

_pb_ostream_from_buffer

_pb_read

_printf

_pthread_mutex_init

_pthread_mutex_lock

_pthread_mutex_unlock

_puts

_rewind

_round

_roundf

_signal

_sqlite3_bind_blob

_sqlite3_bind_double

_sqlite3_bind_int64

_sqlite3_bind_null

_sqlite3_bind_text

_sqlite3_changes

_sqlite3_clear_bindings

_sqlite3_close

_sqlite3_column_blob

_sqlite3_column_bytes

_sqlite3_column_count

_sqlite3_column_double

_sqlite3_column_int

_sqlite3_column_int64

_sqlite3_column_name

_sqlite3_column_text

_sqlite3_column_type

_sqlite3_errcode

_sqlite3_errmsg

_sqlite3_exec

_sqlite3_finalize

_sqlite3_open_v2

_sqlite3_prepare_v2

_sqlite3_reset

_sqlite3_step

_sscanf

_strcmp

_strerror

_strlen

_sysctl

_system

dyld_stub_binder

radr://5614542

External Symbols

_CACurrentMediaTime

_CATransform3DMakeRotation

_CCCrypt

_CCSymmetricKeyUnwrap

_CCSymmetricKeyWrap

_CC_MD5

_CC_SHA1

_CC_SHA256

_CFArrayCreate

_CFBooleanGetValue

_CFBundleGetVersionNumber

_CFDictionaryGetValue

_CFNumberIsFloatType

_CFPreferencesAppSynchronize

_CFPreferencesCopyAppValue

_CFPreferencesCopyKeyList

_CFPreferencesSetAppValue

_CFPreferencesSetMultiple

_CFPropertyListCreateDeepCopy

_CFRelease

_CFRetain

_CFRunLoopGetMain

_CFStringTransform

_CFURLCopyResourcePropertyForKey

_CFUUIDCreate

_CFUUIDCreateString

_CGColorCreate

_CGColorSpaceCreateDeviceRGB

_CGColorSpaceRelease

_CGContextAddPath

_CGContextClip

_CGContextDrawLinearGradient

_CGContextRestoreGState

_CGContextSaveGState

_CGGradientCreateWithColorComponents

_CGGradientRelease

_CGImageSourceCreateImageAtIndex

_CGImageSourceCreateWithData

_CGPathAddCurveToPoint

_CGPathAddLineToPoint

_CGPathCloseSubpath

_CGPathCreateCopy

_CGPathCreateMutable

_CGPathCreateMutableCopy

_CGPathMoveToPoint

_CGPathRelease

_FIRFirebaseVersion

_GULIsLoggableLevel

_GULLogBasic

_GULLogError

_GULLogWarning

_GULSetLoggerLevel

_Gestalt

_IOBSDNameMatching

_IOIteratorNext

_IOMasterPort

_IOObjectRelease

_IORegistryEntryCreateCFProperty

_IORegistryEntryGetParentEntry

_IOServiceGetMatchingServices

_NSApplicationMain

_NSClassFromString

_NSLog

_NSMouseInRect

_NSRectFill

_NSSearchPathForDirectoriesInDomains

_NSSelectorFromString

_NSSetUncaughtExceptionHandler

_NSStringFromClass

_NSStringFromSelector

_SCNetworkReachabilityCreateWithAddress

_SCNetworkReachabilityCreateWithName

_SCNetworkReachabilityGetFlags

_SCNetworkReachabilityScheduleWithRunLoop

_SCNetworkReachabilitySetCallback

_SCNetworkReachabilityUnscheduleFromRunLoop

_SecCertificateCopyData

_SecCertificateCreateWithData

_SecItemAdd

_SecItemCopyMatching

_SecItemDelete

_SecItemExport

_SecItemUpdate

_SecPolicyCreateBasicX509

_SecPolicyCreateSSL

_SecRandomCopyBytes

_SecTrustCopyPublicKey

_SecTrustCreateWithCertificates

_SecTrustEvaluate

_SecTrustGetCertificateAtIndex

_SecTrustGetCertificateCount

_SecTrustSetAnchorCertificates

_SecTrustSetPolicies

_UTTypeCopyPreferredTagWithClass

_UTTypeCreatePreferredIdentifierForTag

__Block_copy

__Block_object_assign

__Block_object_dispose

__Block_release

__Unwind_Resume

___assert_rtn

___bzero

___error

___exp10

___stack_chk_fail

__dyld_get_image_header

__dyld_image_count

_arc4random

_arc4random_uniform

_backtrace

_backtrace_symbols

_calloc

_ceil

_class_addMethod

_class_getInstanceMethod

_class_replaceMethod

_dispatch_after

_dispatch_async

_dispatch_block_cancel

_dispatch_block_create

_dispatch_block_wait

_dispatch_get_global_queue

_dispatch_group_async

_dispatch_group_create

_dispatch_once

_dispatch_once_f

_dispatch_queue_attr_make_with_qos_class

_dispatch_queue_create

_dispatch_queue_get_label

_dispatch_resume

_dispatch_semaphore_create

_dispatch_semaphore_signal

_dispatch_semaphore_wait

_dispatch_set_target_queue

_dispatch_source_cancel

_dispatch_source_create

_dispatch_source_set_event_handler

_dispatch_source_set_timer

_dispatch_source_testcancel

_dispatch_sync

_dispatch_time

_dispatch_walltime

_dlsym

_fclose

_fmod

_fopen

_fread

_free

_fseek

_ftell

_gettimeofday

_if_nametoindex

_log10

_lstat$INODE64

_malloc

_malloc_size

_memchr

_memcmp

_memcpy

_memset

_method_exchangeImplementations

_method_getImplementation

_method_getTypeEncoding

_nextafter

_objc_alloc

_objc_autorelease

_objc_autoreleasePoolPop

_objc_autoreleasePoolPush

_objc_autoreleaseReturnValue

_objc_begin_catch

_objc_copyWeak

_objc_destroyWeak

_objc_end_catch

_objc_enumerationMutation

_objc_exception_rethrow

_objc_exception_throw

_objc_getAssociatedObject

_objc_getProperty

_objc_initWeak

_objc_loadWeakRetained

_objc_msgSendSuper2

_objc_msgSend_stret

_objc_retainAutorelease

_objc_retainAutoreleaseReturnValue

_objc_retainAutoreleasedReturnValue

_objc_retainBlock

_objc_setAssociatedObject

_objc_setProperty_atomic_copy

_objc_setProperty_nonatomic

_objc_setProperty_nonatomic_copy

_objc_storeStrong

_objc_storeWeak

_objc_sync_enter

_objc_sync_exit

_objc_terminate

_objc_unsafeClaimAutoreleasedReturnValue

_open

_pb_decode

_pb_decode_varint

_pb_encode

_pb_encode_string

_pb_encode_submessage

_pb_encode_tag_for_field

_pb_encode_varint

_pb_istream_from_buffer

_pb_ostream_from_buffer

_pb_read

_printf

_pthread_mutex_init

_pthread_mutex_lock

_pthread_mutex_unlock

_puts

_rewind

_round

_roundf

_signal

_sqlite3_bind_blob

_sqlite3_bind_double

_sqlite3_bind_int64

_sqlite3_bind_null

_sqlite3_bind_text

_sqlite3_changes

_sqlite3_clear_bindings

_sqlite3_close

_sqlite3_column_blob

_sqlite3_column_bytes

_sqlite3_column_count

_sqlite3_column_double

_sqlite3_column_int

_sqlite3_column_int64

_sqlite3_column_name

_sqlite3_column_text

_sqlite3_column_type

_sqlite3_errcode

_sqlite3_errmsg

_sqlite3_exec

_sqlite3_finalize

_sqlite3_open_v2

_sqlite3_prepare_v2

_sqlite3_reset

_sqlite3_step

_sscanf

_strcmp

_strerror

_strlen

_sysctl

_system

AnyTrans Installer/AnyTrans Installer.app/Contents/_CodeSignature/CodeResources

File path:	AnyTrans Installer/AnyTrans Installer.app/Contents/_CodeSignature/CodeResources
File size:	26'441 bytes
File type:	XML 1.0 document, ASCII text, with very long lines (343)

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 35
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2023 09:29:17.299164057 CEST	49396	80	192.168.11.11	67.225.249.166
Oct 27, 2023 09:29:17.467020035 CEST	80	49396	67.225.249.166	192.168.11.11
Oct 27, 2023 09:29:17.467638016 CEST	49396	80	192.168.11.11	67.225.249.166
Oct 27, 2023 09:29:17.468414068 CEST	49396	80	192.168.11.11	67.225.249.166
Oct 27, 2023 09:29:17.635977983 CEST	80	49396	67.225.249.166	192.168.11.11
Oct 27, 2023 09:29:17.636306047 CEST	80	49396	67.225.249.166	192.168.11.11
Oct 27, 2023 09:29:17.636931896 CEST	49396	80	192.168.11.11	67.225.249.166
Oct 27, 2023 09:29:22.636842012 CEST	80	49396	67.225.249.166	192.168.11.11
Oct 27, 2023 09:29:22.637603045 CEST	49396	80	192.168.11.11	67.225.249.166
Oct 27, 2023 09:29:22.637836933 CEST	49396	80	192.168.11.11	67.225.249.166
Oct 27, 2023 09:29:22.806375027 CEST	80	49396	67.225.249.166	192.168.11.11
Oct 27, 2023 09:29:30.321640968 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.321782112 CEST	443	49403	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:30.322743893 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.323137045 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.323205948 CEST	443	49403	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:30.610212088 CEST	443	49403	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:30.610935926 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.610935926 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.611135960 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.624762058 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.624804020 CEST	443	49403	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:30.625545979 CEST	443	49403	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:30.626297951 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.627455950 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.668076992 CEST	443	49403	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:30.957325935 CEST	443	49403	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:30.957735062 CEST	443	49403	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:30.957866907 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.958328009 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.959625006 CEST	49403	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:30.959686995 CEST	443	49403	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:32.274025917 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.274080038 CEST	443	49405	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:32.274651051 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.276742935 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.276771069 CEST	443	49405	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:32.555118084 CEST	443	49405	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:32.556703091 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.556868076 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.557708979 CEST	49375	80	192.168.11.11	17.253.13.205
Oct 27, 2023 09:29:32.558535099 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.571264029 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.571274042 CEST	443	49405	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:32.571499109 CEST	443	49405	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:32.572164059 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.573244095 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.574117899 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.574174881 CEST	443	49405	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:32.687031984 CEST	80	49375	17.253.13.205	192.168.11.11
Oct 27, 2023 09:29:32.687536001 CEST	49375	80	192.168.11.11	17.253.13.205
Oct 27, 2023 09:29:32.833952904 CEST	443	49405	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:32.834244013 CEST	443	49405	142.250.217.206	192.168.11.11
Oct 27, 2023 09:29:32.834618092 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.834712029 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.835100889 CEST	49405	443	192.168.11.11	142.250.217.206
Oct 27, 2023 09:29:32.835150957 CEST	443	49405	142.250.217.206	192.168.11.11

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 27, 2023 09:29:16.842302084 CEST	56222	53	192.168.11.11	1.1.1.1
Oct 27, 2023 09:29:16.973561049 CEST	53	56222	1.1.1.1	192.168.11.11
Oct 27, 2023 09:29:17.149131060 CEST	53887	53	192.168.11.11	1.1.1.1
Oct 27, 2023 09:29:17.294907093 CEST	53	53887	1.1.1.1	192.168.11.11
Oct 27, 2023 09:29:30.964593887 CEST	53	55461	1.1.1.1	192.168.11.11

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 27, 2023 09:29:16.842302084 CEST	192.168.11.11	1.1.1.1	0x8d14	Standard query (0)	app-measurement.com	A (IP address)	IN (0x0001)	false
Oct 27, 2023 09:29:17.149131060 CEST	192.168.11.11	1.1.1.1	0xf303	Standard query (0)	dl.imobie.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 27, 2023 09:29:16.973561049 CEST	1.1.1.1	192.168.11.11	0x8d14	No error (0)	app-measurement.com		142.250.217.206	A (IP address)	IN (0x0001)	false
Oct 27, 2023 09:29:17.294907093 CEST	1.1.1.1	192.168.11.11	0xf303	No error (0)	dl.imobie.com		67.225.249.166	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

app-measurement.com

dl.imobie.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.11	49403	142.250.217.206	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.11.11	49405	142.250.217.206	443

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port
2	192.168.11.11	49396	67.225.249.166	80

Timestamp	kBytes transferred	Direction	Data
Oct 27, 2023 09:29:17.468414068 CEST	755	OUT	GET /config/installer.plist HTTP/1.1 Host: dl.imobie.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: AnyTrans%20Installer/8.8.4 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
Oct 27, 2023 09:29:17.636306047 CEST	768	IN	HTTP/1.1 200 OK Date: Fri, 27 Oct 2023 07:29:17 GMT Server: Apache Last-Modified: Fri, 11 Dec 2020 03:06:33 GMT Accept-Ranges: bytes Cache-Control: max-age=172800 Expires: Sun, 29 Oct 2023 07:29:17 GMT Vary: Accept-Encoding,User-Agent Content-Encoding: gzip Content-Length: 268 Keep-Alive: timeout=5, max=100 Connection: Keep-Alive Data Raw: 1f 8b 08 00 00 00 00 00 00 03 6d d0 5d 6b 83 30 14 06 e0 eb f9 2b b2 dc eb 31 51 ab 8e d4 b2 d5 0e 0a d2 09 b3 17 bb 14 0d ad cc 8f 10 c3 5c ff fd 62 0b 1b ae b9 cc e1 c9 9b 37 87 6d be bb 16 7d 71 39 36 43 bf c6 c4 71 31 e2 7d 35 d4 4d 7f 5a e3 63 f1 6a 47 78 93 58 ec 31 7d db 16 1f f9 0e 89 b6 19 15 ca 8f 2f d9 7e 8b b0 0d f0 2c 44 cb 01 d2 22 45 79 b6 7f 2f 90 ce 00 d8 1d 30 c2 67 a5 c4 13 c0 34 4d 4e 39 2b a7 1a ba 19 8e 90 cb 41 70 a9 2e 99 0e b3 f5 05 a7 56 35 d6 cf dc d2 17 75 f4 b4 6e 2a 95 58 0f ec 93 5f 92 52 95 19 ef 4f 67 c5 60 3e ea a9 e4 65 9b ac c2 95 eb c7 d4 63 70 3d fe e2 ca 84 e3 80 12 2f 8c fe db c6 64 89 e7 d2 d0 0d 7c ba d4 9d 31 38 8a 74 05 3f 5c 52 61 a4 ba 00 f5 ee ad 34 fe 8e 12 57 63 72 87 8d 8d bd 98 04 61 f4 87 19 dc f6 c7 e0 ba dd c4 fa 01 cd f7 98 38 f4 01 00 00 Data Ascii: m]k0+1Q\b7m}q96Cq1}5MZcjGxX1}/~,D"Ey/0g4MN9+Ap.V5un*X_ROg`>ecp=/d\|18t?\Ra4Wcra8

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.11	49403	142.250.217.206	443

Timestamp	Direction	Data
2023-10-27 07:29:30 UTC	OUT	GET /config/app/1:123117501914:ios:4b8e5422acb19112b454e3?app_instance_id=2F2E386EDBDB431C9DEE812604D07792&gmp_version=90600&runtime_version=0&platform=macos HTTP/1.1 Host: app-measurement.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: br, gzip, deflate User-Agent: AnyTrans%20Installer/8.8.4 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
2023-10-27 07:29:30 UTC	IN	HTTP/1.1 200 OK ETag: 8893282762406467254 Content-Type: application/x-protobuf Cross-Origin-Resource-Policy: cross-origin Date: Fri, 27 Oct 2023 07:29:30 GMT Server: Google Tag Manager Content-Length: 764 X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close
2023-10-27 07:29:30 UTC	IN	Data Raw: 08 cb ea 8c e5 a5 fe 80 03 12 29 31 3a 31 32 33 31 31 37 35 30 31 39 31 34 3a 69 6f 73 3a 34 62 38 65 35 34 32 32 61 63 62 31 39 31 31 32 62 34 35 34 65 33 18 02 22 25 0a 1e 6d 65 61 73 75 72 65 6d 65 6e 74 2e 61 75 64 69 65 6e 63 65 2e 6d 61 78 5f 63 6f 75 6e 74 12 03 31 30 30 22 33 0a 2d 6d 65 61 73 75 72 65 6d 65 6e 74 2e 75 70 6c 6f 61 64 2e 6d 61 78 5f 70 75 62 6c 69 63 5f 75 73 65 72 5f 70 72 6f 70 65 72 74 69 65 73 12 02 32 35 22 34 0a 2d 6d 65 61 73 75 72 65 6d 65 6e 74 2e 75 70 6c 6f 61 64 2e 6d 61 78 5f 65 76 65 6e 74 5f 6e 61 6d 65 5f 63 61 72 64 69 6e 61 6c 69 74 79 12 03 35 30 30 22 30 0a 2a 6d 65 61 73 75 72 65 6d 65 6e 74 2e 75 70 6c 6f 61 64 2e 6d 61 78 5f 70 75 62 6c 69 63 5f 65 76 65 6e 74 5f 70 61 72 61 6d 73 12 02 32 35 22 3a 0a 34 6d Data Ascii: )1:123117501914:ios:4b8e5422acb19112b454e3"%measurement.audience.max_count100"3-measurement.upload.max_public_user_properties25"4-measurement.upload.max_event_name_cardinality500"0*measurement.upload.max_public_event_params25":4m

Session ID	Source IP	Source Port	Destination IP	Destination Port
1	192.168.11.11	49405	142.250.217.206	443

Timestamp	kBytes transferred	Direction	Data
2023-10-27 07:29:32 UTC	1	OUT	POST /a HTTP/1.1 Host: app-measurement.com Content-Type: application/x-www-form-urlencoded Connection: keep-alive Accept: / Content-Encoding: gzip Accept-Language: en-us Content-Length: 609 Accept-Encoding: br, gzip, deflate User-Agent: AnyTrans%20Installer/8.8.4 CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
2023-10-27 07:29:32 UTC	1	OUT	Data Raw: 1f 8b 08 00 00 00 00 00 00 13 cd 92 c1 6b 13 41 14 c6 3b bb 49 b3 0e 9a ca 5a 4a 08 88 eb cd 82 bb 66 36 9b 66 53 4f 8d 49 45 b1 54 5b a5 d4 cb 38 d9 ce b6 53 37 3b 61 67 63 eb 2d f6 54 44 41 14 8a 57 05 2d f5 1f a8 78 15 2f 15 41 f0 ea c1 8b 20 82 20 5e ec 49 9c 66 13 14 bd 28 78 f0 b2 f3 e6 7b df 0c 3b bf f7 c1 5d 45 03 fa 49 a8 c1 14 6e af 90 1c e8 56 2d 9f e7 06 20 84 0a e6 7a 8a b4 63 0e 07 65 1d c9 ee de ea e5 80 ae 60 3f f7 f5 f6 e3 ce 36 ca 67 b5 a4 d0 55 ec 33 63 20 3f dc df a7 b0 cf 63 a3 f3 6e e3 c6 36 32 6e de db 94 da b1 a4 55 48 96 6a ba 49 3c 2e ce 66 50 c1 42 45 cb 9e 81 53 c4 6b b2 90 b9 c7 d1 e5 34 0d 4d 6f e9 ca ea 72 b6 49 c2 36 09 30 0b 45 4c 82 20 3a ea f1 a6 c5 a6 78 83 51 6b 22 bc 7e 31 22 a1 30 d9 f4 ac 79 26 31 d0 68 0d a8 ae e5 Data Ascii: kA;IZJf6fSOIET[8S7;agc-TDAW-x/A ^If(x{;]EInV- zce`?6gU3c ?cn62nUHjI<.fPBESk4MorI60EL :xQk"~1"0y&1h
2023-10-27 07:29:32 UTC	2	IN	HTTP/1.1 204 No Content Date: Fri, 27 Oct 2023 07:29:32 GMT Pragma: no-cache Expires: Fri, 01 Jan 1990 00:00:00 GMT Cache-Control: no-cache, no-store, must-revalidate Content-Type: image/gif Cross-Origin-Resource-Policy: cross-origin Server: Golfe2 Content-Length: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

System Behavior

Analysis Process: mono-sgen32 PID: 910, Parent PID: 825

General

Start time (UTC):	07:29:13
Start date (UTC):	27/10/2023
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Start time (UTC):	07:29:13
Start date (UTC):	27/10/2023
Path:	/usr/bin/open
Arguments:
File size:	105952 bytes
MD5 hash:	40ed6d8f35c9f20484b97582d296398f

Start time (UTC):	07:29:13
Start date (UTC):	27/10/2023
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	43488 bytes
MD5 hash:	d1bb9a4899f0af921e8188218b20d744

Start time (UTC):	07:29:13
Start date (UTC):	27/10/2023
Path:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
Arguments:	/Volumes/AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer
File size:	1750208 bytes
MD5 hash:	dd749d71bc516596b6f4b39e4cbc1c4e

Source: anytrans-ios-official-en-mac.dmg	ReversingLabs: Detection: 30%
Source: anytrans-ios-official-en-mac.dmg	Virustotal: Detection: 24%			Perma Link

Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _IOMasterPort
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _OBJC_CLASS_$_NSHTTPURLResponse
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _OBJC_CLASS_$_NSURLConnection
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _NSSearchPathForDirectoriesInDomains
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _kGULNetworkHTTPStatusCodeNotFound
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _kGULNetworkHTTPStatusCodeNotModified
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _NSURLAuthenticationMethodServerTrust
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _kGULNetworkHTTPStatusCodeUnavailable
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _kGULNetworkHTTPStatusCodeCannotAcceptTraffic
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _kGULNetworkHTTPStatusNoContent
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _kGULNetworkHTTPStatusOK
Source: extracted file from submission: AnyTrans Installer/AnyTrans Installer.app/Contents/MacOS/AnyTrans Installer	Mach-O symbol: _SecItemExport

Description:	Adversaries may modify plist files to run a program during system boot or user login. Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as `/Library/Preferences` (which execute with elevated privileges) and `~/Library/Preferences` (which execute with a user's privileges).
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to mimic features of valid code signatures to increase the chance of deceiving a user, analyst, or tool. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. Adversaries can copy the metadata and signature information from a signed program, then use it as a template for an unsigned program. Files with invalid code signatures will fail digital signature validation checks, but they may appear more legitimate to users and security tools may improperly handle these files.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create, acquire, or steal code signing materials to sign their malware or tools. Code signing provides a level of authenticity on a binary from the developer and a guarantee that the binary has not been tampered with. The certificates used during an operation may be created, acquired, or stolen by the adversary. Unlike Invalid Code Signature , this activity will result in a valid signature.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Access Control ).
Tactics:	Collection, Credential Access
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, User interface
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report anytrans-ios-official-en-mac.dmg

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/Users/berri/Library/Application Support/Google/FIRApp/.dat.nosync038f.C877rf

/Users/berri/Library/Application Support/com.iMobie.AnyTrans-iOS-Installer/AnyTrans Installer/tmp/installer.plist

/Users/berri/Library/Application Support/google-heartbeat-storage/.dat.nosync038f.VN0ZMz

/Users/berri/Library/Application Support/google-heartbeat-storage/.dat.nosync038f.iNYFrX

/Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_event_data/1001/.dat.nosync038f.dBRSCz

/Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_library_data/.dat.nosync038f.jyoiBd

/Users/berri/Library/Caches/google-sdks-events/GDTCORFlatFileStorage/gdt_library_data/.dat.nosync038f.mKxo24

/Users/berri/Library/Keychains/login.keychain-db.sb-6160925d-nmfh2M

/Users/berri/Library/Keychains/login.keychain-db.sb-6160925d-oLwkGW

/dev/null

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsDirectory.db_

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/C/mds/mdsObject.db_

/private/var/folders/ql/8wfqxrtx52n95h35b6cz4nyw0000gn/T/CFNetworkDownload_yDEabQ.tmp

Static File Info

General

CodeSign Information

Archive DMG

Archived Files

Extracted Files

AnyTrans Installer/.DS_Store

AnyTrans Installer/.VolumeIcon.icns

AnyTrans Installer/.en.tiff

AnyTrans Installer/.Trashes/501/.DS_Store

AnyTrans Installer/.fseventsd/ffba01015e473dc8

AnyTrans Installer/.fseventsd/ffba01015e473dc9

AnyTrans Installer/.fseventsd/ffba01015e47429c

AnyTrans Installer/.fseventsd/ffba01015e47429d

AnyTrans Installer/.fseventsd/ffba01015e474642

AnyTrans Installer/.fseventsd/ffba01015e474643

macOS Analysis Report
anytrans-ios-official-en-mac.dmg