Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Analysis Report ExtendedSprint.service

Overview

General Information

Sample Name:ExtendedSprint.service
Analysis ID:154
MD5:3350aeedce516939e8b24d5ae2feddd8
SHA1:075fcc3777a706cae6af9ac514322011ab9a4a14
SHA256:a3e3d54604c990a4ccb7564293ce8c17e4f169a5e145180b418c7ecd305165ab

Most interesting Screenshot:

Detection

Score:52
Range:0 - 100
Whitelisted:false

Signatures

Multi AV Scanner detection for submitted file
Process executable has an extension which is uncommon (probably to disguise the executable)
Contains symbols with suspicious names likely related to networking
Reads the systems OS release and/or type
Uses CFNetwork bundle containing interfaces for network communication (HTTP, sockets, and Bonjour)

Classification

Startup

  • system is macvm-highsierra
  • ExtendedSprint.service (MD5: 3350aeedce516939e8b24d5ae2feddd8) Arguments: /Users/berri/Desktop/ExtendedSprint.service
  • cleanup

Yara Overview

No yara matches

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

barindex
Multi AV Scanner detection for submitted fileShow sources
Source: ExtendedSprint.serviceVirustotal: Detection: 12%Perma Link
Source: submissionMach-O header: dylib_command -> /System/Library/Frameworks/Security.framework/Versions/A/Security
Source: unknownTCP traffic detected without corresponding DNS query: 17.149.240.70
Source: unknownTCP traffic detected without corresponding DNS query: 17.149.240.70
Source: unknownTCP traffic detected without corresponding DNS query: 17.149.240.70
Source: unknownTCP traffic detected without corresponding DNS query: 17.149.240.70
Source: unknownTCP traffic detected without corresponding DNS query: 17.253.57.207
Source: unknownTCP traffic detected without corresponding DNS query: 104.111.215.87
Source: unknownTCP traffic detected without corresponding DNS query: 104.111.215.87
Source: unknownTCP traffic detected without corresponding DNS query: 104.111.215.87
Source: unknownTCP traffic detected without corresponding DNS query: 104.111.215.87
Source: unknownTCP traffic detected without corresponding DNS query: 17.253.57.207
Source: unknownTCP traffic detected without corresponding DNS query: 104.111.215.87
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownUDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknownDNS traffic detected: queries for: m.extendedsprint.com
Source: unknownHTTP traffic detected: POST /a/rep HTTP/1.1Host: m.extendedsprint.comContent-Type: charset=utf-8Content-Length: 174Connection: closeUser-Agent: ExtendedSprint.service (unknown version) CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
Source: /Users/berri/Desktop/ExtendedSprint.service (PID: 573)Reads from socket in process: dataJump to behavior
Source: ExtendedSprint.service, 00000573.00000272.9.000000010da83000.000000010da9e000.r--.sdmpString found in binary or memory: http://crl.apple.com/codesigning.crl0
Source: ExtendedSprint.service, 00000573.00000272.9.000000010da83000.000000010da9e000.r--.sdmpString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: ExtendedSprint.service, 00000573.00000272.9.000000010da83000.000000010da9e000.r--.sdmpString found in binary or memory: http://www.apple.com/appleca/root.crl0
Source: ExtendedSprint.service, 00000573.00000272.9.000000010da83000.000000010da9e000.r--.sdmpString found in binary or memory: http://www.apple.com/certificateauthority0
Source: ExtendedSprint.service, 00000573.00000272.9.000000010da83000.000000010da9e000.r--.sdmpString found in binary or memory: https://www.apple.com/appleca/0
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49238
Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49250
Source: unknownNetwork traffic detected: HTTP traffic on port 49238 -> 443
Source: unknownNetwork traffic detected: HTTP traffic on port 49250 -> 443
Source: /Users/berri/Desktop/ExtendedSprint.service (PID: 573)Writes from socket in process: dataJump to behavior
Source: classification engineClassification label: mal52.evad.macSERVICE@0/0@1/0
Source: submission ExtendedSprint.serviceMach-O symbol: _CFHTTPMessageSetHeaderFieldValue
Source: submission ExtendedSprint.serviceMach-O symbol: _CFHTTPMessageGetResponseStatusCode
Source: submission ExtendedSprint.serviceMach-O symbol: _CFHTTPMessageSetBody
Source: submission ExtendedSprint.serviceMach-O symbol: _CFHTTPMessageCreateRequest
Source: submission ExtendedSprint.serviceMach-O symbol: _objc_msgSend
Source: submission ExtendedSprint.serviceMach-O symbol: __ZNSt12domain_errorD1Ev
Source: submission ExtendedSprint.serviceMach-O symbol: __ZTISt12domain_error
Source: submission ExtendedSprint.serviceMach-O symbol: _CFReadStreamCreateForHTTPRequest
Source: submission ExtendedSprint.serviceMach-O symbol: _kIOMasterPortDefault
Source: submission ExtendedSprint.serviceMach-O symbol: _kCFHTTPVersion1_1
Source: submission ExtendedSprint.serviceMach-O symbol: _kCFStreamPropertyHTTPResponseHeader
Source: submission ExtendedSprint.serviceMach-O symbol: _kCFStreamPropertyHTTPShouldAutoredirect
Source: submission ExtendedSprint.serviceMach-O symbol: __ZTVSt12domain_error
Source: initial sampleMach-O header: dylib_command -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
Source: submissionMach-O header: dylib_command -> /System/Library/Frameworks/Security.framework/Versions/A/Security
Source: /Users/berri/Desktop/ExtendedSprint.service (PID: 573)CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plistJump to behavior

Hooking and other Techniques for Hiding and Protection:

barindex
Process executable has an extension which is uncommon (probably to disguise the executable)Show sources
Source: /Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32 (PID: 573)Process executable with extension: /Users/berri/Desktop/ExtendedSprint.serviceJump to behavior
Source: /Users/berri/Desktop/ExtendedSprint.service (PID: 573)Sysctl requested: kern.ostype (1.1)Jump to behavior
Source: /Users/berri/Desktop/ExtendedSprint.service (PID: 573)Sysctl requested: kern.osrelease (1.2)Jump to behavior

Mitre Att&ck Matrix

Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
Valid AccountsWindows Management InstrumentationPath InterceptionPath InterceptionMasquerading1OS Credential DumpingSystem Information Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel2Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsRootkitLSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol2Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol3Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data

Behavior Graph

Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Number of created Files
  • Shell
  • Is malicious
  • Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

cam-macmac-stand

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

SourceDetectionScannerLabelLink
ExtendedSprint.service13%VirustotalBrowse

Dropped Files

No Antivirus matches

Domains

No Antivirus matches

URLs

SourceDetectionScannerLabelLink
http://m.extendedsprint.com/a/rep0%Avira URL Cloudsafe

Domains and IPs

Contacted Domains

NameIPActiveMaliciousAntivirus DetectionReputation
d1czzonvly6iby.cloudfront.net
52.85.115.83
truefalse
    		high
    m.extendedsprint.com
    		unknown
    		unknownfalse
      		unknown

      Contacted URLs

      NameMaliciousAntivirus DetectionReputation
      http://m.extendedsprint.com/a/repfalse
      • Avira URL Cloud: safe
      		unknown

      Contacted IPs

      • No. of IPs < 25%
      • 25% < No. of IPs < 50%
      • 50% < No. of IPs < 75%
      • 75% < No. of IPs

      Public

      IPDomainCountryFlagASNASN NameMalicious
      17.253.57.207
      		unknownUnited States
      		6185APPLE-AUSTINUSfalse
      52.85.115.83
      		unknownUnited States
      		16509AMAZON-02USfalse
      17.149.240.70
      		unknownUnited States
      		714APPLE-ENGINEERINGUSfalse
      104.111.215.87
      		unknownUnited States
      		16625AKAMAI-ASUSfalse

      General Information

      Joe Sandbox Version:31.0.0 Emerald
      Analysis ID:154
      Start date:08.01.2021
      Start time:00:00:11
      Joe Sandbox Product:CloudBasic
      Overall analysis duration:0h 3m 38s
      Hypervisor based Inspection enabled:false
      Report type:full
      Sample file name:ExtendedSprint.service
      Cookbook file name:defaultmacfilecookbook.jbs
      Analysis system description:Virtual Machine, High Sierra (Office 2016 v16.16, Java 11.0.2+9, Adobe Reader 2019.010.20099)
      Detection:MAL
      Classification:mal52.evad.macSERVICE@0/0@1/0
      Warnings:
      Show All
      • Excluded IPs from analysis (whitelisted): 17.171.98.2
      • Excluded domains from analysis (whitelisted): radarsubmissions.apple.com.akadns.net, radarsubmissions.apple.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa

      Joe Sandbox View / Context

      IPs

      MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
      17.149.240.70pGet hashmaliciousBrowse
        REP er0005147.docGet hashmaliciousBrowse
          BetterTouchTool.zipGet hashmaliciousBrowse
            Alfred_4.3_1205.dmgGet hashmaliciousBrowse
              https://among-modded.com/app.mobileconfigGet hashmaliciousBrowse
                my420.dmgGet hashmaliciousBrowse
                  flashInstaller copy.dmgGet hashmaliciousBrowse
                    FkCodecGet hashmaliciousBrowse
                      104.111.215.87pGet hashmaliciousBrowse

                        Domains

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        d1czzonvly6iby.cloudfront.netpGet hashmaliciousBrowse
                        • 52.85.115.76

                        ASN

                        MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                        APPLE-ENGINEERINGUSpGet hashmaliciousBrowse
                        • 17.149.240.70
                        iGet hashmaliciousBrowse
                        • 17.120.249.110
                        REP er0005147.docGet hashmaliciousBrowse
                        • 17.149.240.70
                        svchost.exeGet hashmaliciousBrowse
                        • 17.48.42.214
                        BetterTouchTool.zipGet hashmaliciousBrowse
                        • 17.149.240.70
                        Alfred_4.3_1205.dmgGet hashmaliciousBrowse
                        • 17.149.240.70
                        https://among-modded.com/app.mobileconfigGet hashmaliciousBrowse
                        • 17.149.240.70
                        my420.dmgGet hashmaliciousBrowse
                        • 17.149.240.70
                        flashInstaller copy.dmgGet hashmaliciousBrowse
                        • 17.149.240.70
                        FkCodecGet hashmaliciousBrowse
                        • 17.149.240.70
                        NormhjTcQb.exeGet hashmaliciousBrowse
                        • 17.156.117.234
                        in3.dmgGet hashmaliciousBrowse
                        • 17.171.27.65
                        https://billychemr324.github.io/santipxzic/index1.html?bbre=aod9435Get hashmaliciousBrowse
                        • 17.248.145.11
                        dialog-ee-x-2.8.1.493.dmgGet hashmaliciousBrowse
                        • 17.171.27.65
                        install.dmgGet hashmaliciousBrowse
                        • 17.171.27.65
                        Player.dmgGet hashmaliciousBrowse
                        • 17.171.27.65
                        http://help-servicee.mlGet hashmaliciousBrowse
                        • 17.248.146.80
                        http://owauth1tadsoh1itndereql1nysa1ier1rnrhnthaesinlp.us-east-2.elasticbeanstalk.com/#jdiaz@eversheds-sutherland.esGet hashmaliciousBrowse
                        • 17.248.146.117
                        Astra.x86Get hashmaliciousBrowse
                        • 17.88.248.2
                        http://test.kunmiskincare.com/index.phpGet hashmaliciousBrowse
                        • 17.248.146.174
                        APPLE-AUSTINUSpGet hashmaliciousBrowse
                        • 17.253.57.203
                        REP er0005147.docGet hashmaliciousBrowse
                        • 17.253.57.202
                        BetterTouchTool.zipGet hashmaliciousBrowse
                        • 17.253.57.208
                        Alfred_4.3_1205.dmgGet hashmaliciousBrowse
                        • 17.253.55.207
                        https://among-modded.com/app.mobileconfigGet hashmaliciousBrowse
                        • 17.253.57.208
                        my420.dmgGet hashmaliciousBrowse
                        • 17.253.57.203
                        flashInstaller copy.dmgGet hashmaliciousBrowse
                        • 17.253.57.204
                        in3.dmgGet hashmaliciousBrowse
                        • 17.253.57.208
                        https://billychemr324.github.io/santipxzic/index1.html?bbre=aod9435Get hashmaliciousBrowse
                        • 17.253.57.202
                        dialog-ee-x-2.8.1.493.dmgGet hashmaliciousBrowse
                        • 17.253.57.204
                        Player.dmgGet hashmaliciousBrowse
                        • 17.253.57.204
                        http://help-servicee.mlGet hashmaliciousBrowse
                        • 17.253.57.208
                        http://owauth1tadsoh1itndereql1nysa1ier1rnrhnthaesinlp.us-east-2.elasticbeanstalk.com/#jdiaz@eversheds-sutherland.esGet hashmaliciousBrowse
                        • 17.253.55.203
                        http://test.kunmiskincare.com/index.phpGet hashmaliciousBrowse
                        • 17.253.57.204
                        AKAMAI-ASUSpGet hashmaliciousBrowse
                        • 104.111.215.87
                        http://23.223.33.195Get hashmaliciousBrowse
                        • 23.223.33.195
                        http://104.126.188.245Get hashmaliciousBrowse
                        • 104.126.188.245
                        Mozi.mGet hashmaliciousBrowse
                        • 23.11.95.110
                        https://hartdistrict-my.sharepoint.com/:w:/g/personal/mdizon_hartdistrict_org/EcmmCdfu1mtEoYBuvYtOs90BEgUjrpXzZM-WsUQSD4k2RQ?e=4%3aWZv5NT&at=9Get hashmaliciousBrowse
                        • 104.103.251.14
                        CryptoTab.exeGet hashmaliciousBrowse
                        • 104.79.90.110
                        https://download.dymo.com/dymo/Software/Win/DLS8Setup.8.7.3.exeGet hashmaliciousBrowse
                        • 104.79.90.110
                        Autodesk_Desktop_App_Bootstrap.exeGet hashmaliciousBrowse
                        • 104.79.88.41
                        malware1.exeGet hashmaliciousBrowse
                        • 84.53.167.113
                        ya.wav.dllGet hashmaliciousBrowse
                        • 2.18.68.31
                        http://o365.techsupport-corp.com/22d1d8eb41?l=46Get hashmaliciousBrowse
                        • 2.16.13.237
                        RRVL3sQSpr.exeGet hashmaliciousBrowse
                        • 23.50.110.154
                        xJbFpiVs1lGet hashmaliciousBrowse
                        • 104.73.204.165
                        https://iofs.typeform.com/to/vj4hQ0pXGet hashmaliciousBrowse
                        • 104.83.114.150
                        http://login.micrasoft-office365.com/a36463f878?l=58Get hashmaliciousBrowse
                        • 104.83.83.17
                        inters64.dllGet hashmaliciousBrowse
                        • 104.79.88.129
                        https://u920579.ct.sendgrid.net/ls/click?upn=Cq4RbLQjlFZUayowJ9tEN6gixmb7UKhyXAXCvMsmbICjFD5DhJprkszpFOyNbgNmq7-2Bq9gyOkpQCauiiQYtKUuzuhRkDdVY3iYQlbf85PPIex1qg1iCLXLRCmn62egy7Kd2WI-2FZe6QjrykO-2BkxUIwg-3D-3Da0Ze_tSu-2BgbrFGsICLGVaAGPqAvBa4uzmGUZNhZ55boO3KRTzNu4GGZepxUqpMzDNq41wULstJA35t6JtnVf2vFtHlmz2-2B31tSDfiBobK3sk93ifRCie1NHPaL2KnBxyzl2a1K3xUYPE-2FZxt6LXV-2FOq7Qf7BGwhC5mooDbh2JB86GzKa1gkvDcq2SJ7XHDp7jJpNK-2FgzsQi2DReRUeTh8TNbzxPb03EO0c0GUBrVxC04FuSc-3DGet hashmaliciousBrowse
                        • 104.74.143.169
                        https://t.yesware.com/tt/ae9851ab7b578dad1289f08bbf450624f7ae3a45/2ee42987f58d2f32bb36ff11a00dd921/2f4e7e35c28c3b7f4958904f5584a915/joom.ag/2VFCGet hashmaliciousBrowse
                        • 23.211.149.25
                        https://evenfair.com/Doc.htmGet hashmaliciousBrowse
                        • 2.18.68.31
                        https://quip.com/bsalAnQMfvNmGet hashmaliciousBrowse
                        • 2.18.69.96
                        AMAZON-02USpGet hashmaliciousBrowse
                        • 52.85.115.76
                        https://r0qp15r0b1rq05rrpbqbrpq5.s3-eu-west-1.amazonaws.com/Ap3dX.html#joetorre@gmail.comGet hashmaliciousBrowse
                        • 52.218.24.160
                        https://survey.alchemer.com/s3/6130663/Check-11-PaymentGet hashmaliciousBrowse
                        • 13.224.194.9
                        https://www.food4rhino.com/app/humanGet hashmaliciousBrowse
                        • 35.158.144.6
                        OKU-010920 SCQ-220920.docGet hashmaliciousBrowse
                        • 13.127.103.42
                        https://www.food4rhino.com/app/elefrontGet hashmaliciousBrowse
                        • 13.225.80.54
                        atikmdag-patcher 1.4.8.exeGet hashmaliciousBrowse
                        • 52.217.99.212
                        http://message.mydopweb.comGet hashmaliciousBrowse
                        • 143.204.202.52
                        http://www.secured-mailsharepoint.online/Get hashmaliciousBrowse
                        • 35.158.107.63
                        SKM_C258201001130020005057.exeGet hashmaliciousBrowse
                        • 75.2.28.59
                        catalogo TAWI group.exeGet hashmaliciousBrowse
                        • 52.41.106.131
                        https://r0qp15r0b1rq05rrpbqbrpq5.s3-eu-west-1.amazonaws.com/Ap3dX.html#orderadmin@roku.comGet hashmaliciousBrowse
                        • 52.218.62.104
                        https://wqi69130.mfs.gg/099mmYlGet hashmaliciousBrowse
                        • 143.204.214.148
                        https://web.tresorit.com/l/JG7xl#7YqXRnhV6spRT3ekJskNawGet hashmaliciousBrowse
                        • 143.204.202.55
                        https://zxcew43nrgjvfejcnwrtjnvfdcsxe3rfc.s3.amazonaws.com/eudjscndfjhvndcsjfergvdcsce34redc.htmlGet hashmaliciousBrowse
                        • 52.217.47.102
                        PolicyUpdate.htmGet hashmaliciousBrowse
                        • 143.204.202.86
                        https://bit.ly/2Jjog0HGet hashmaliciousBrowse
                        • 52.41.3.203
                        https://authrp8r1aaqe1rirqni8aa1er1a.s3.eu-north-1.amazonaws.com/Ap3dX.htmlGet hashmaliciousBrowse
                        • 52.95.169.36
                        Petronas ITQ format.exeGet hashmaliciousBrowse
                        • 52.58.78.16
                        order no. 3643.exeGet hashmaliciousBrowse
                        • 52.58.78.16

                        JA3 Fingerprints

                        No context

                        Dropped Files

                        No context


                        Runtime Messages

                        Command:/Users/berri/Desktop/ExtendedSprint.service
                        Exit Code:0
                        Exit Code Info:
                        Killed:False
                        Standard Output:

                        Standard Error:

                        Created / dropped Files

                        No created / dropped files found

                        Static File Info

                        General

                        File type:Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE>
                        Entropy (8bit):6.332207455668453
                        TrID:
                        • Mac OS X Mach-O 64bit Intel executable (20004/1) 100.00%
                        File name:ExtendedSprint.service
                        File size:434444
                        MD5:3350aeedce516939e8b24d5ae2feddd8
                        SHA1:075fcc3777a706cae6af9ac514322011ab9a4a14
                        SHA256:a3e3d54604c990a4ccb7564293ce8c17e4f169a5e145180b418c7ecd305165ab
                        SHA512:d7f86d2fd67c62cfca145a3ef7b915564aee3fee03ce647d58f7df9b4361ab0eb08e08cc8e030159930698390fe3f1bf022e6eef3b7cbc5d9bf075374c039866
                        SSDEEP:6144:NJJIcPoIZ8YtKITrYP2txP0JLu4KXN4CoRShEM0fTxy+wMMNN0ijkB0:NBjztK2ZtxP68NRoRShEM0bxg
                        File Content Preview:..........................!.........H...__PAGEZERO..........................................................h...__TEXT..........................................................__text..........__TEXT.........................................................
                        Static Mach Info
                        General Information for header 1
                        Endian:<
                        Size:64-bit
                        Architecture:x86_64
                        Filetype:execute
                        Nbr. of load commands:25
                        Entry point:0x45E36
                        segment_command_64 aggregated: 4
                        NameValue
                        segname__PAGEZERO
                        vmaddr0x0
                        vmsize0x100000000
                        fileoff0x0
                        filesize0x0
                        maxprot0x0
                        initprot0x0
                        nsects0
                        flags0x0
                        NameValue
                        segname__TEXT
                        vmaddr0x100000000
                        vmsize0x5D000
                        fileoff0x0
                        filesize0x5D000
                        maxprot0x7
                        initprot0x5
                        nsects10
                        flags0x0
                        Datas
                        sectnamesegnameaddrsizeoffsetalignreloffnrelocflags
                        __text__TEXT0x100001C100x4F8E20x1C100x40x000x80000400
                        __stubs__TEXT0x1000514F20x5E20x514F20x10x000x80000408
                        __stub_helper__TEXT0x100051AD40x9B60x51AD40x20x000x80000400
                        __const__TEXT0x1000524900x4B200x524900x40x000x0
                        __objc_classname__TEXT0x100056FB00x480x56FB00x00x000x2
                        __objc_methname__TEXT0x100056FF80x2280x56FF80x00x000x2
                        __objc_methtype__TEXT0x1000572200x360x572200x00x000x2
                        __cstring__TEXT0x1000572560x55A0x572560x00x000x2
                        __gcc_except_tab__TEXT0x1000577B00x49A80x577B00x20x000x0
                        __unwind_info__TEXT0x10005C1580xEA40x5C1580x20x000x0
                        NameValue
                        segname__DATA
                        vmaddr0x10005D000
                        vmsize0x4000
                        fileoff0x5D000
                        filesize0x4000
                        maxprot0x7
                        initprot0x3
                        nsects15
                        flags0x0
                        Datas
                        sectnamesegnameaddrsizeoffsetalignreloffnrelocflags
                        __nl_symbol_ptr__DATA0x10005D0000x100x5D0000x30x000x6
                        __got__DATA0x10005D0100x2580x5D0100x30x000x6
                        __la_symbol_ptr__DATA0x10005D2680x7D80x5D2680x30x000x7
                        __mod_init_func__DATA0x10005DA400x100x5DA400x30x000x9
                        __const__DATA0x10005DA500x21180x5DA500x40x000x0
                        __cfstring__DATA0x10005FB680xA00x5FB680x30x000x0
                        __objc_nlclslist__DATA0x10005FC080x80x5FC080x30x000x10000000
                        __objc_protolist__DATA0x10005FC100x100x5FC100x30x000x0
                        __objc_imageinfo__DATA0x10005FC200x80x5FC200x20x000x0
                        __objc_const__DATA0x10005FC280x1400x5FC280x30x000x0
                        __objc_selrefs__DATA0x10005FD680x1000x5FD680x30x000x10000005
                        __objc_protorefs__DATA0x10005FE680x100x5FE680x30x000x0
                        __objc_data__DATA0x10005FE780x500x5FE780x30x000x0
                        __data__DATA0x10005FEC80x1480x5FEC80x30x000x0
                        __bss__DATA0x1000600100x3880x00x40x000x1
                        NameValue
                        segname__LINKEDIT
                        vmaddr0x100061000
                        vmsize0x910C
                        fileoff0x61000
                        filesize0x910C
                        maxprot0x7
                        initprot0x1
                        nsects0
                        flags0x0
                        dyld_info_command aggregated: 1
                        NameValue
                        rebase_off397312
                        rebase_size544
                        bind_off397856
                        bind_size4432
                        weak_bind_off402288
                        weak_bind_size1528
                        lazy_bind_off403816
                        lazy_bind_size8976
                        export_off412792
                        export_size1040
                        symtab_command aggregated: 1
                        NameValue
                        symoff414880
                        nsyms361
                        stroff422972
                        strsize11472
                        dysymtab_command aggregated: 1
                        NameValue
                        ilocalsym0
                        nlocalsym1
                        iextdefsym1
                        nextdefsym20
                        iundefsym21
                        nundefsym340
                        tocoff0
                        ntoc0
                        modtaboff0
                        nmodtab0
                        extrefsymoff0
                        nextrefsyms0
                        indirectsymoff420656
                        nindirectsyms579
                        extreloff0
                        nextrel0
                        locreloff0
                        nlocrel0
                        dylinker_command aggregated: 1
                        NameValue
                        name12
                        Datas/usr/lib/dyld
                        uuid_command aggregated: 1
                        NameValue
                        uuidb't\xde\x8f\x93\xc7\x952`\xa6B\xbde"\xb7\xe7\xea'
                        version_min_command aggregated: 1
                        NameValue
                        version657664
                        sdk658944
                        source_version_command aggregated: 1
                        NameValue
                        version0
                        entry_point_command aggregated: 1
                        NameValue
                        entryoff286262
                        stacksize0
                        dylib_command aggregated: 11
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version50.1.0
                        compatibility_version1.0.0
                        Datas/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version275.0.0
                        compatibility_version1.0.0
                        Datas/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version58286.251.4
                        compatibility_version1.0.0
                        Datas/System/Library/Frameworks/Security.framework/Versions/A/Security
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version1252.250.1
                        compatibility_version1.0.0
                        Datas/usr/lib/libSystem.B.dylib
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version1.2.11
                        compatibility_version1.0.0
                        Datas/usr/lib/libz.1.dylib
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version400.9.4
                        compatibility_version1.0.0
                        Datas/usr/lib/libc++.1.dylib
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version1570.15.0
                        compatibility_version300.0.0
                        Datas/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version228.0.0
                        compatibility_version1.0.0
                        Datas/usr/lib/libobjc.A.dylib
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version978.0.7
                        compatibility_version1.0.0
                        Datas/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version1570.15.0
                        compatibility_version150.0.0
                        Datas/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
                        NameValue
                        name24
                        timestampThu Jan 1 01:00:02 1970
                        current_version944.3.0
                        compatibility_version1.0.0
                        Datas/System/Library/Frameworks/CoreServices.framework/Versions/A/CoreServices
                        linkedit_data_command aggregated: 2
                        NameValue
                        dataoff413832
                        datasize952
                        NameValue
                        dataoff414784
                        datasize96
                        Internal Symbols
                        _CFDataCreate
                        _CFDataGetBytes
                        _CFDictionaryCreateMutable
                        _CFDictionarySetValue
                        _CFHTTPMessageCreateRequest
                        _CFHTTPMessageGetResponseStatusCode
                        _CFHTTPMessageSetBody
                        _CFHTTPMessageSetHeaderFieldValue
                        _CFReadStreamClose
                        _CFReadStreamCopyProperty
                        _CFReadStreamCreateForHTTPRequest
                        _CFReadStreamGetStatus
                        _CFReadStreamOpen
                        _CFReadStreamRead
                        _CFReadStreamSetProperty
                        _CFRelease
                        _CFStringCreateWithBytes
                        _CFStringGetCString
                        _CFStringGetCStringPtr
                        _CFStringGetLength
                        _CFURLCopyLastPathComponent
                        _CFURLCreateWithString
                        _CFURLGetString
                        _IOIteratorNext
                        _IOObjectRelease
                        _IORegistryEntryCreateCFProperty
                        _IORegistryEntryGetParentEntry
                        _IOServiceGetMatchingService
                        _IOServiceGetMatchingServices
                        _IOServiceMatching
                        _LSGetApplicationForURL
                        __Block_copy
                        __DefaultRuneLocale
                        __Unwind_Resume
                        __ZNKSt13runtime_error4whatEv
                        __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE4findEcm
                        __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm
                        __ZNKSt3__119__shared_weak_count13__get_deleterERKSt9type_info
                        __ZNKSt3__120__vector_base_commonILb1EE20__throw_length_errorEv
                        __ZNKSt3__120__vector_base_commonILb1EE20__throw_out_of_rangeEv
                        __ZNKSt3__121__basic_string_commonILb1EE20__throw_length_errorEv
                        __ZNKSt3__123__match_any_but_newlineIcE6__execERNS_7__stateIcEE
                        __ZNKSt3__16locale4nameEv
                        __ZNKSt3__16locale9has_facetERNS0_2idE
                        __ZNKSt3__16locale9use_facetERNS0_2idE
                        __ZNKSt3__18ios_base6getlocEv
                        __ZNKSt9exception4whatEv
                        __ZNSt11logic_errorC2EPKc
                        __ZNSt11logic_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE
                        __ZNSt12domain_errorD1Ev
                        __ZNSt12length_errorD1Ev
                        __ZNSt12out_of_rangeD1Ev
                        __ZNSt13exception_ptrC1ERKS_
                        __ZNSt13exception_ptrD1Ev
                        __ZNSt13runtime_errorC1EPKc
                        __ZNSt13runtime_errorC2EPKc
                        __ZNSt13runtime_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE
                        __ZNSt13runtime_errorD1Ev
                        __ZNSt13runtime_errorD2Ev
                        __ZNSt16invalid_argumentD1Ev
                        __ZNSt3__111regex_errorC1ENS_15regex_constants10error_typeE
                        __ZNSt3__111regex_errorD1Ev
                        __ZNSt3__111this_thread9sleep_forERKNS_6chrono8durationIxNS_5ratioILl1ELl1000000000EEEEE
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE5eraseEmm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKcm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEmc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6assignEPKc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6insertEmPKc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6insertEmPKcm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6resizeEmc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7replaceEmmPKcm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7reserveEm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9push_backEc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEaSERKS5_
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEaSEc
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEE4readEPcl
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEE5seekgExNS_8ios_base7seekdirE
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEE5tellgEv
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEE6sentryC1ERS3_b
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEED0Ev
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEED1Ev
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE3putEc
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5flushEv
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5writeEPKcl
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryC1ERS3_
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryD1Ev
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED0Ev
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED1Ev
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEPKv
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEPNS_15basic_streambufIcS2_EE
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEi
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEj
                        __ZNSt3__114basic_iostreamIcNS_11char_traitsIcEEED0Ev
                        __ZNSt3__114basic_iostreamIcNS_11char_traitsIcEEED1Ev
                        __ZNSt3__114basic_iostreamIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__115__get_classnameEPKcb
                        __ZNSt3__115__thread_structC1Ev
                        __ZNSt3__115__thread_structD1Ev
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE4syncEv
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE5imbueERKNS_6localeE
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE5uflowEv
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE6setbufEPcl
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE6xsgetnEPcl
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE6xsputnEPKcl
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE9showmanycEv
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEEC2Ev
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__117__assoc_sub_state10__sub_waitERNS_11unique_lockINS_5mutexEEE
                        __ZNSt3__118condition_variable10notify_allEv
                        __ZNSt3__118condition_variable10notify_oneEv
                        __ZNSt3__118condition_variable15__do_timed_waitERNS_11unique_lockINS_5mutexEEENS_6chrono10time_pointINS5_12system_clockENS5_8durationIxNS_5ratioILl1ELl1000000000EEEEEEE
                        __ZNSt3__118condition_variable4waitERNS_11unique_lockINS_5mutexEEE
                        __ZNSt3__118condition_variableD1Ev
                        __ZNSt3__119__shared_weak_count14__release_weakEv
                        __ZNSt3__119__shared_weak_countD2Ev
                        __ZNSt3__119__thread_local_dataEv
                        __ZNSt3__120__get_collation_nameEPKc
                        __ZNSt3__120__throw_system_errorEiPKc
                        __ZNSt3__14coutE
                        __ZNSt3__14stoiERKNS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEPmi
                        __ZNSt3__15ctypeIcE2idE
                        __ZNSt3__15mutex4lockEv
                        __ZNSt3__15mutex6unlockEv
                        __ZNSt3__15mutexD1Ev
                        __ZNSt3__16__sortIRNS_6__lessIccEEPcEEvT0_S5_T_
                        __ZNSt3__16chrono12steady_clock3nowEv
                        __ZNSt3__16chrono12system_clock3nowEv
                        __ZNSt3__16localeC1ERKS0_
                        __ZNSt3__16localeC1Ev
                        __ZNSt3__16localeD1Ev
                        __ZNSt3__16thread4joinEv
                        __ZNSt3__16threadD1Ev
                        __ZNSt3__17codecvtIcc11__mbstate_tE2idE
                        __ZNSt3__17collateIcE2idE
                        __ZNSt3__18ios_base33__set_badbit_and_consider_rethrowEv
                        __ZNSt3__18ios_base4initEPv
                        __ZNSt3__18ios_base5clearEj
                        __ZNSt3__19basic_iosIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_
                        __ZNSt8bad_castC1Ev
                        __ZNSt8bad_castC2Ev
                        __ZNSt8bad_castD1Ev
                        __ZNSt8bad_castD2Ev
                        __ZNSt9exceptionD1Ev
                        __ZNSt9exceptionD2Ev
                        __ZSt13set_terminatePFvvE
                        __ZSt17rethrow_exceptionSt13exception_ptr
                        __ZSt9terminatev
                        __ZTIN5VV1bR12bad_any_castE
                        __ZTIN5VV1bR16exception_detail10clone_baseE
                        __ZTIN5VV1bR16exception_detail10clone_implINS0_19error_info_injectorINS_12bad_any_castEEEEE
                        __ZTIN5VV1bR16exception_detail19error_info_injectorINS_12bad_any_castEEE
                        __ZTIN5VV1bR9exceptionE
                        __ZTINSt3__111regex_errorE
                        __ZTINSt3__113basic_filebufIcNS_11char_traitsIcEEEE
                        __ZTINSt3__113basic_istreamIcNS_11char_traitsIcEEEE
                        __ZTINSt3__113basic_ostreamIcNS_11char_traitsIcEEEE
                        __ZTINSt3__114basic_iostreamIcNS_11char_traitsIcEEEE
                        __ZTINSt3__114basic_ofstreamIcNS_11char_traitsIcEEEE
                        __ZTINSt3__115basic_streambufIcNS_11char_traitsIcEEEE
                        __ZTINSt3__115basic_stringbufIcNS_11char_traitsIcEENS_9allocatorIcEEEE
                        __ZTINSt3__118basic_stringstreamIcNS_11char_traitsIcEENS_9allocatorIcEEEE
                        __ZTINSt3__119__shared_weak_countE
                        __ZTISt12domain_error
                        __ZTISt12length_error
                        __ZTISt12out_of_range
                        __ZTISt13runtime_error
                        __ZTISt16invalid_argument
                        __ZTISt8bad_cast
                        __ZTISt9bad_alloc
                        __ZTISt9exception
                        __ZTIb
                        __ZTId
                        __ZTIv
                        __ZTIx
                        __ZTSN5VV1bR12bad_any_castE
                        __ZTSN5VV1bR16exception_detail10clone_baseE
                        __ZTSN5VV1bR16exception_detail10clone_implINS0_19error_info_injectorINS_12bad_any_castEEEEE
                        __ZTSN5VV1bR16exception_detail19error_info_injectorINS_12bad_any_castEEE
                        __ZTSN5VV1bR9exceptionE
                        __ZTSNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEE
                        __ZTSNSt3__113basic_filebufIcNS_11char_traitsIcEEEE
                        __ZTSNSt3__114basic_ofstreamIcNS_11char_traitsIcEEEE
                        __ZTSNSt3__115basic_stringbufIcNS_11char_traitsIcEENS_9allocatorIcEEEE
                        __ZTSNSt3__118basic_stringstreamIcNS_11char_traitsIcEENS_9allocatorIcEEEE
                        __ZTVN10__cxxabiv117__class_type_infoE
                        __ZTVN10__cxxabiv119__pointer_type_infoE
                        __ZTVN10__cxxabiv120__function_type_infoE
                        __ZTVN10__cxxabiv120__si_class_type_infoE
                        __ZTVN10__cxxabiv121__vmi_class_type_infoE
                        __ZTVSt12domain_error
                        __ZTVSt12length_error
                        __ZTVSt12out_of_range
                        __ZTVSt16invalid_argument
                        __ZTVSt9exception
                        __ZThn16_NSt3__114basic_iostreamIcNS_11char_traitsIcEEED0Ev
                        __ZThn16_NSt3__114basic_iostreamIcNS_11char_traitsIcEEED1Ev
                        __ZTv0_n24_NSt3__113basic_istreamIcNS_11char_traitsIcEEED0Ev
                        __ZTv0_n24_NSt3__113basic_istreamIcNS_11char_traitsIcEEED1Ev
                        __ZTv0_n24_NSt3__113basic_ostreamIcNS_11char_traitsIcEEED0Ev
                        __ZTv0_n24_NSt3__113basic_ostreamIcNS_11char_traitsIcEEED1Ev
                        __ZTv0_n24_NSt3__114basic_iostreamIcNS_11char_traitsIcEEED0Ev
                        __ZTv0_n24_NSt3__114basic_iostreamIcNS_11char_traitsIcEEED1Ev
                        __ZdaPv
                        __ZdlPv
                        __Znam
                        __Znwm
                        ___CFConstantStringClassReference
                        ___bzero
                        ___cxa_allocate_exception
                        ___cxa_atexit
                        ___cxa_begin_catch
                        ___cxa_end_catch
                        ___cxa_free_exception
                        ___cxa_get_exception_ptr
                        ___cxa_guard_abort
                        ___cxa_guard_acquire
                        ___cxa_guard_release
                        ___cxa_pure_virtual
                        ___cxa_rethrow
                        ___cxa_throw
                        ___error
                        ___gxx_personality_v0
                        ___maskrune
                        ___stack_chk_fail
                        ___stack_chk_guard
                        __dyld_register_func_for_add_image
                        __mh_execute_header
                        __objc_empty_cache
                        __objc_empty_vtable
                        _abort
                        _asctime
                        _asprintf
                        _atof
                        _atoll
                        _bzero
                        _calloc
                        _chdir
                        _chmod
                        _class_addMethod
                        _class_addProperty
                        _class_addProtocol
                        _class_getInstanceMethod
                        _class_getInstanceSize
                        _class_getInstanceVariable
                        _class_getIvarLayout
                        _class_getName
                        _class_getSuperclass
                        _class_isMetaClass
                        _class_replaceMethod
                        _class_respondsToSelector
                        _closedir
                        _crc32
                        _execv
                        _exit
                        _fclose
                        _ferror
                        _fflush
                        _fopen
                        _fork
                        _fread
                        _free
                        _fseek
                        _fseeko
                        _ftello
                        _fwrite
                        _get_crc_table
                        _getcwd
                        _getgid
                        _getgrgid
                        _getgrnam
                        _getpid
                        _getpwnam
                        _getpwuid
                        _getuid
                        _getxattr
                        _gmtime_r
                        _hash_create
                        _hash_search
                        _inflate
                        _inflateEnd
                        _inflateInit2_
                        _ivar_getName
                        _ivar_getOffset
                        _kCFAllocatorDefault
                        _kCFBooleanTrue
                        _kCFCoreFoundationVersionNumber
                        _kCFHTTPVersion1_1
                        _kCFStreamPropertyHTTPResponseHeader
                        _kCFStreamPropertyHTTPShouldAutoredirect
                        _kCFTypeDictionaryKeyCallBacks
                        _kCFTypeDictionaryValueCallBacks
                        _kIOMasterPortDefault
                        _kMDItemWhereFroms
                        _localtime
                        _malloc
                        _memchr
                        _memcmp
                        _memcpy
                        _memmove
                        _memset
                        _method_setImplementation
                        _mkdir
                        _mktime
                        _objc_allocateClassPair
                        _objc_autoreleasePoolPop
                        _objc_autoreleasePoolPush
                        _objc_constructInstance
                        _objc_copyClassNamesForImage
                        _objc_getClass
                        _objc_getMetaClass
                        _objc_getProtocol
                        _objc_getRequiredClass
                        _objc_initializeClassPair
                        _objc_lookUpClass
                        _objc_msgSend
                        _objc_readClassPair
                        _objc_registerClassPair
                        _objc_retain
                        _object_getClass
                        _object_getIndexedIvars
                        _object_getIvar
                        _object_setIvar
                        _opendir$INODE64
                        _proc_pidpath
                        _property_copyAttributeList
                        _protocol_getMethodDescription
                        _protocol_getName
                        _pthread_create
                        _pthread_mutex_lock
                        _pthread_mutex_unlock
                        _pthread_self
                        _pthread_setspecific
                        _putenv
                        _readdir$INODE64
                        _remove
                        _rename
                        _rmdir
                        _sel_getUid
                        _sscanf
                        _stat$INODE64
                        _strcmp
                        _strlen
                        _strncmp
                        _strtod
                        _strtoul
                        _sysctl
                        _syslog
                        _time
                        _unlink
                        _uuid_generate_random
                        _uuid_unparse
                        _waitpid
                        dyld_stub_binder
                        radr://5614542
                        External symbols
                        _CFDataCreate
                        _CFDataGetBytes
                        _CFDictionaryCreateMutable
                        _CFDictionarySetValue
                        _CFHTTPMessageCreateRequest
                        _CFHTTPMessageGetResponseStatusCode
                        _CFHTTPMessageSetBody
                        _CFHTTPMessageSetHeaderFieldValue
                        _CFReadStreamClose
                        _CFReadStreamCopyProperty
                        _CFReadStreamCreateForHTTPRequest
                        _CFReadStreamGetStatus
                        _CFReadStreamOpen
                        _CFReadStreamRead
                        _CFReadStreamSetProperty
                        _CFRelease
                        _CFStringCreateWithBytes
                        _CFStringGetCString
                        _CFStringGetCStringPtr
                        _CFStringGetLength
                        _CFURLCopyLastPathComponent
                        _CFURLCreateWithString
                        _CFURLGetString
                        _IOIteratorNext
                        _IOObjectRelease
                        _IORegistryEntryCreateCFProperty
                        _IORegistryEntryGetParentEntry
                        _IOServiceGetMatchingService
                        _IOServiceGetMatchingServices
                        _IOServiceMatching
                        _LSGetApplicationForURL
                        __Block_copy
                        __Unwind_Resume
                        __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE4findEcm
                        __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm
                        __ZNKSt3__120__vector_base_commonILb1EE20__throw_length_errorEv
                        __ZNKSt3__120__vector_base_commonILb1EE20__throw_out_of_rangeEv
                        __ZNKSt3__121__basic_string_commonILb1EE20__throw_length_errorEv
                        __ZNKSt3__16locale4nameEv
                        __ZNKSt3__16locale9has_facetERNS0_2idE
                        __ZNKSt3__16locale9use_facetERNS0_2idE
                        __ZNKSt3__18ios_base6getlocEv
                        __ZNKSt9exception4whatEv
                        __ZNSt11logic_errorC2EPKc
                        __ZNSt11logic_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE
                        __ZNSt13exception_ptrC1ERKS_
                        __ZNSt13exception_ptrD1Ev
                        __ZNSt13runtime_errorC1EPKc
                        __ZNSt13runtime_errorC2EPKc
                        __ZNSt13runtime_errorC2ERKNSt3__112basic_stringIcNS0_11char_traitsIcEENS0_9allocatorIcEEEE
                        __ZNSt13runtime_errorD2Ev
                        __ZNSt3__111regex_errorC1ENS_15regex_constants10error_typeE
                        __ZNSt3__111this_thread9sleep_forERKNS_6chrono8durationIxNS_5ratioILl1ELl1000000000EEEEE
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE5eraseEmm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKcm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEmc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6assignEPKc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6insertEmPKc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6insertEmPKcm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6resizeEmc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7replaceEmmPKcm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7reserveEm
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9push_backEc
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEaSERKS5_
                        __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEaSEc
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEE4readEPcl
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEE5seekgExNS_8ios_base7seekdirE
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEE5tellgEv
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEE6sentryC1ERS3_b
                        __ZNSt3__113basic_istreamIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE3putEc
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5flushEv
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5writeEPKcl
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryC1ERS3_
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryD1Ev
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEPKv
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEPNS_15basic_streambufIcS2_EE
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEi
                        __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEj
                        __ZNSt3__114basic_iostreamIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__115__get_classnameEPKcb
                        __ZNSt3__115__thread_structC1Ev
                        __ZNSt3__115__thread_structD1Ev
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEEC2Ev
                        __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__117__assoc_sub_state10__sub_waitERNS_11unique_lockINS_5mutexEEE
                        __ZNSt3__118condition_variable10notify_allEv
                        __ZNSt3__118condition_variable10notify_oneEv
                        __ZNSt3__118condition_variable15__do_timed_waitERNS_11unique_lockINS_5mutexEEENS_6chrono10time_pointINS5_12system_clockENS5_8durationIxNS_5ratioILl1ELl1000000000EEEEEEE
                        __ZNSt3__118condition_variable4waitERNS_11unique_lockINS_5mutexEEE
                        __ZNSt3__118condition_variableD1Ev
                        __ZNSt3__119__shared_weak_count14__release_weakEv
                        __ZNSt3__119__shared_weak_countD2Ev
                        __ZNSt3__119__thread_local_dataEv
                        __ZNSt3__120__get_collation_nameEPKc
                        __ZNSt3__120__throw_system_errorEiPKc
                        __ZNSt3__14stoiERKNS_12basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEEPmi
                        __ZNSt3__15mutex4lockEv
                        __ZNSt3__15mutex6unlockEv
                        __ZNSt3__15mutexD1Ev
                        __ZNSt3__16__sortIRNS_6__lessIccEEPcEEvT0_S5_T_
                        __ZNSt3__16chrono12steady_clock3nowEv
                        __ZNSt3__16chrono12system_clock3nowEv
                        __ZNSt3__16localeC1ERKS0_
                        __ZNSt3__16localeC1Ev
                        __ZNSt3__16localeD1Ev
                        __ZNSt3__16thread4joinEv
                        __ZNSt3__16threadD1Ev
                        __ZNSt3__18ios_base33__set_badbit_and_consider_rethrowEv
                        __ZNSt3__18ios_base4initEPv
                        __ZNSt3__18ios_base5clearEj
                        __ZNSt3__19basic_iosIcNS_11char_traitsIcEEED2Ev
                        __ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_
                        __ZNSt8bad_castC1Ev
                        __ZNSt8bad_castC2Ev
                        __ZNSt8bad_castD2Ev
                        __ZNSt9exceptionD1Ev
                        __ZNSt9exceptionD2Ev
                        __ZSt13set_terminatePFvvE
                        __ZSt17rethrow_exceptionSt13exception_ptr
                        __ZSt9terminatev
                        ___bzero
                        ___cxa_allocate_exception
                        ___cxa_atexit
                        ___cxa_begin_catch
                        ___cxa_end_catch
                        ___cxa_free_exception
                        ___cxa_get_exception_ptr
                        ___cxa_guard_abort
                        ___cxa_guard_acquire
                        ___cxa_guard_release
                        ___cxa_rethrow
                        ___cxa_throw
                        ___error
                        ___maskrune
                        ___stack_chk_fail
                        __dyld_register_func_for_add_image
                        _abort
                        _asctime
                        _asprintf
                        _atof
                        _atoll
                        _bzero
                        _calloc
                        _chdir
                        _chmod
                        _class_addMethod
                        _class_addProperty
                        _class_addProtocol
                        _class_getInstanceMethod
                        _class_getInstanceSize
                        _class_getInstanceVariable
                        _class_getIvarLayout
                        _class_getSuperclass
                        _class_isMetaClass
                        _class_replaceMethod
                        _class_respondsToSelector
                        _closedir
                        _crc32
                        _execv
                        _exit
                        _fclose
                        _ferror
                        _fflush
                        _fopen
                        _fork
                        _fread
                        _free
                        _fseek
                        _fseeko
                        _ftello
                        _fwrite
                        _get_crc_table
                        _getcwd
                        _getgid
                        _getgrgid
                        _getgrnam
                        _getpid
                        _getpwnam
                        _getpwuid
                        _getuid
                        _getxattr
                        _gmtime_r
                        _hash_create
                        _hash_search
                        _inflate
                        _inflateEnd
                        _inflateInit2_
                        _ivar_getName
                        _ivar_getOffset
                        _localtime
                        _malloc
                        _memchr
                        _memcmp
                        _memcpy
                        _memmove
                        _memset
                        _method_setImplementation
                        _mkdir
                        _mktime
                        _objc_autoreleasePoolPop
                        _objc_autoreleasePoolPush
                        _objc_constructInstance
                        _objc_getClass
                        _objc_getMetaClass
                        _objc_getProtocol
                        _objc_getRequiredClass
                        _objc_initializeClassPair
                        _objc_lookUpClass
                        _objc_registerClassPair
                        _object_getClass
                        _object_getIvar
                        _object_setIvar
                        _opendir$INODE64
                        _proc_pidpath
                        _property_copyAttributeList
                        _protocol_getMethodDescription
                        _pthread_create
                        _pthread_mutex_lock
                        _pthread_mutex_unlock
                        _pthread_self
                        _pthread_setspecific
                        _putenv
                        _readdir$INODE64
                        _remove
                        _rename
                        _rmdir
                        _sel_getUid
                        _sscanf
                        _stat$INODE64
                        _strcmp
                        _strlen
                        _strncmp
                        _strtod
                        _strtoul
                        _sysctl
                        _syslog
                        _time
                        _unlink
                        _uuid_generate_random
                        _uuid_unparse
                        _waitpid

                        Network Behavior

                        Network Port Distribution

                        TCP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Jan 8, 2021 00:01:03.456618071 CET4925280192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.493647099 CET804925252.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.494635105 CET4925280192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.495887041 CET4925280192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.495973110 CET4925280192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.532915115 CET804925252.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.532968044 CET804925252.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.701834917 CET804925252.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.701903105 CET804925252.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.702462912 CET4925280192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.702559948 CET4925280192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.705391884 CET4925280192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.706317902 CET4925380192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.742384911 CET804925252.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.747570038 CET804925352.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.748234987 CET4925380192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.748584032 CET4925380192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.748828888 CET4925380192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.789769888 CET804925352.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.789830923 CET804925352.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.958710909 CET804925352.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.958777905 CET804925352.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:03.959733963 CET4925380192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.959832907 CET4925380192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:03.960658073 CET4925380192.168.11.1152.85.115.83
                        Jan 8, 2021 00:01:04.001799107 CET804925352.85.115.83192.168.11.11
                        Jan 8, 2021 00:01:06.052772999 CET49238443192.168.11.1117.149.240.70
                        Jan 8, 2021 00:01:06.053177118 CET49238443192.168.11.1117.149.240.70
                        Jan 8, 2021 00:01:06.204987049 CET4434923817.149.240.70192.168.11.11
                        Jan 8, 2021 00:01:06.205085039 CET4434923817.149.240.70192.168.11.11
                        Jan 8, 2021 00:01:06.205224991 CET4434923817.149.240.70192.168.11.11
                        Jan 8, 2021 00:01:06.205694914 CET49238443192.168.11.1117.149.240.70
                        Jan 8, 2021 00:01:06.205703974 CET49238443192.168.11.1117.149.240.70
                        Jan 8, 2021 00:01:28.941379070 CET4924880192.168.11.1117.253.57.207
                        Jan 8, 2021 00:01:28.941379070 CET4924980192.168.11.11104.111.215.87
                        Jan 8, 2021 00:01:28.941479921 CET49250443192.168.11.11104.111.215.87
                        Jan 8, 2021 00:01:28.941941023 CET49250443192.168.11.11104.111.215.87
                        Jan 8, 2021 00:01:28.949385881 CET44349250104.111.215.87192.168.11.11
                        Jan 8, 2021 00:01:28.949445963 CET8049249104.111.215.87192.168.11.11
                        Jan 8, 2021 00:01:28.950330019 CET4924980192.168.11.11104.111.215.87
                        Jan 8, 2021 00:01:28.950428009 CET804924817.253.57.207192.168.11.11
                        Jan 8, 2021 00:01:28.951059103 CET4924880192.168.11.1117.253.57.207
                        Jan 8, 2021 00:01:28.954224110 CET44349250104.111.215.87192.168.11.11
                        Jan 8, 2021 00:01:28.954288006 CET44349250104.111.215.87192.168.11.11
                        Jan 8, 2021 00:01:28.954893112 CET49250443192.168.11.11104.111.215.87

                        UDP Packets

                        TimestampSource PortDest PortSource IPDest IP
                        Jan 8, 2021 00:00:59.715035915 CET6065453192.168.11.111.1.1.1
                        Jan 8, 2021 00:00:59.723352909 CET53606541.1.1.1192.168.11.11
                        Jan 8, 2021 00:01:03.441961050 CET6342853192.168.11.111.1.1.1
                        Jan 8, 2021 00:01:03.453581095 CET53634281.1.1.1192.168.11.11
                        Jan 8, 2021 00:01:34.086795092 CET6491753192.168.11.111.1.1.1
                        Jan 8, 2021 00:01:34.096224070 CET53649171.1.1.1192.168.11.11

                        DNS Queries

                        TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                        Jan 8, 2021 00:01:03.441961050 CET192.168.11.111.1.1.10x6442Standard query (0)m.extendedsprint.comA (IP address)IN (0x0001)

                        DNS Answers

                        TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                        Jan 8, 2021 00:01:03.453581095 CET1.1.1.1192.168.11.110x6442No error (0)m.extendedsprint.comd1czzonvly6iby.cloudfront.netCNAME (Canonical name)IN (0x0001)
                        Jan 8, 2021 00:01:03.453581095 CET1.1.1.1192.168.11.110x6442No error (0)d1czzonvly6iby.cloudfront.net52.85.115.83A (IP address)IN (0x0001)
                        Jan 8, 2021 00:01:03.453581095 CET1.1.1.1192.168.11.110x6442No error (0)d1czzonvly6iby.cloudfront.net52.85.115.76A (IP address)IN (0x0001)
                        Jan 8, 2021 00:01:03.453581095 CET1.1.1.1192.168.11.110x6442No error (0)d1czzonvly6iby.cloudfront.net52.85.115.19A (IP address)IN (0x0001)
                        Jan 8, 2021 00:01:03.453581095 CET1.1.1.1192.168.11.110x6442No error (0)d1czzonvly6iby.cloudfront.net52.85.115.106A (IP address)IN (0x0001)

                        HTTP Request Dependency Graph

                        • m.extendedsprint.com

                        HTTP Packets

                        Session IDSource IPSource PortDestination IPDestination Port
                        0192.168.11.114925252.85.115.8380
                        TimestampkBytes transferredDirectionData
                        Jan 8, 2021 00:01:03.495887041 CET0OUTPOST /a/rep HTTP/1.1
                        Host: m.extendedsprint.com
                        Content-Type: charset=utf-8
                        Content-Length: 174
                        Connection: close
                        User-Agent: ExtendedSprint.service (unknown version) CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
                        Jan 8, 2021 00:01:03.495973110 CET1OUTData Raw: 73 6d 63 32 31 30 30 43 00 00 24 43 00 00 00 34 4f 00 00 43 00 5e 2c 33 59 2e 24 34 58 2a 5f 36 25 24 29 38 5a 31 59 39 2f 2a 5e 41 31 24 25 44 24 28 31 45 5a 2e 2c 35 25 31 58 34 24 2a 29 43 2c 2a 59 43 2d c1 6b 45 5b 0d 7d 36 7b 67 05 37 72 70
                        Data Ascii: smc2100C$C4OC^,3Y.$4X*_6%$)8Z1Y9/*^A1$%D$(1EZ.,5%1X4$*)C,*YC-kE[}6{g7rp^5[2rAD2D2u3krt2s88}uEh1D|q2vopC{zC>4OtCv3J64D<268t9Au
                        Jan 8, 2021 00:01:03.701834917 CET1INHTTP/1.1 200 OK
                        Content-Type: text/html
                        Content-Length: 0
                        Connection: close
                        Cache-Control: no-cache, no-store
                        Pragma: no-cache
                        Expires: -1
                        Server: Microsoft-IIS/8.5
                        X-AspNet-Version: 4.0.30319
                        p3p: CP="CAO PSA OUR"
                        Date: Thu, 07 Jan 2021 23:01:03 GMT
                        X-Cache: Miss from cloudfront
                        Via: 1.1 a481094379fbeeb96ddc8b0f96f0ce91.cloudfront.net (CloudFront)
                        X-Amz-Cf-Pop: HEL50-C2
                        X-Amz-Cf-Id: wzD8BWCVitqtScR2Ak813VOJMyseJzvU15HO_fPLqdsugqPlm6ZOYQ==


                        Session IDSource IPSource PortDestination IPDestination Port
                        1192.168.11.114925352.85.115.8380
                        TimestampkBytes transferredDirectionData
                        Jan 8, 2021 00:01:03.748584032 CET2OUTPOST /a/rep HTTP/1.1
                        Host: m.extendedsprint.com
                        Content-Type: charset=utf-8
                        Content-Length: 169
                        Connection: close
                        User-Agent: ExtendedSprint.service (unknown version) CFNetwork/893.13.1 Darwin/17.3.0 (x86_64)
                        Jan 8, 2021 00:01:03.748828888 CET2OUTData Raw: 73 6d 63 46 31 30 30 30 00 00 24 39 00 00 00 36 49 00 00 33 00 5f 2f 34 29 28 2a 34 59 24 2c 46 58 2d 2f 46 5e 31 2d 36 2e 2a 25 33 31 5d 2a 31 5d 28 31 45 2c 29 5f 34 58 31 2b 34 2e 2c 59 44 2b 2a 2f 32 2f c3 09 38 5b 0a 0d 37 7d 6d 76 34 72 02
                        Data Ascii: smcF1000$96I3_/4)(*4Y$,FX-/F^1-6.*%31]*1](1E,)_4X1+4.,YD+*/2/8[7}mv4r"F\\r9=0=x3tp7kvr6r8Fv70p9suvFop0uw9E6N3r4|L49HFOFOK6t
                        Jan 8, 2021 00:01:03.958710909 CET3INHTTP/1.1 200 OK
                        Content-Type: text/html
                        Content-Length: 0
                        Connection: close
                        Cache-Control: no-cache, no-store
                        Pragma: no-cache
                        Expires: -1
                        Server: Microsoft-IIS/8.5
                        X-AspNet-Version: 4.0.30319
                        p3p: CP="CAO PSA OUR"
                        Date: Thu, 07 Jan 2021 23:01:03 GMT
                        X-Cache: Miss from cloudfront
                        Via: 1.1 3f6ea9dc2daf7899e40c190c4d465fd1.cloudfront.net (CloudFront)
                        X-Amz-Cf-Pop: HEL50-C2
                        X-Amz-Cf-Id: mt4qCLt44z8guTeFs4R1HPNe3K2P477xFdDCQE_m0OgqgEzGI2WEUQ==


                        System Behavior

                        Analysis Process: mono-sgen32 PID: 573 Parent PID: 493

                        General

                        Start time:00:01:02
                        Start date:08/01/2021
                        Path:/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
                        Arguments:n/a
                        File size:3722408 bytes
                        MD5 hash:8910349f44a940d8d79318367855b236

                        Chronological Activities

                        Analysis Process: ExtendedSprint.service PID: 573 Parent PID: 493

                        General

                        Start time:00:01:02
                        Start date:08/01/2021
                        Path:/Users/berri/Desktop/ExtendedSprint.service
                        Arguments:/Users/berri/Desktop/ExtendedSprint.service
                        File size:434444 bytes
                        MD5 hash:3350aeedce516939e8b24d5ae2feddd8

                        Chronological Activities