macOS Analysis Report
sakura

Overview

General Information

Sample name:	sakura
Analysis ID:	1528894
MD5:	fe0e5087df79cf7e88dc8bf7704260d1
SHA1:	51cd0aa5a6a1dd5472454bd189f37dfd80923aa1
SHA256:	46dbe21f33fba137ed0c97c2216d493ecc54a49272b64eef381fb8e2bcd10eec
Infos:

Detection

Score:	52
Range:	0 - 100
Whitelisted:	false

Signatures

Executes the "scutil" command used to manage network related system configuration parameters

Likely queries the I/O Kit registry to detect VMs by querying the "IOPlatformExpertDevice" class

Queries the unique Apple serial number of the machine

Contains symbols with suspicious names likely related to anti-analysis

Contains symbols with suspicious names likely related to encryption

Contains symbols with suspicious names likely related to networking

Contains symbols with suspicious names likely related to well-known browsers

Creates and/or modifies files and/or directories in common UNIX system configuration directories

Executes commands using a shell command-line interpreter

Executes the "hostname" command used to retrieve the computers name

Executes the "ioreg" command used to gather hardware information (I/O kit registry)

Executes the "uname" command used to read OS and architecture name

Explicitly lists launch services possibly for searching

Queries OS software version with shell command 'sw_vers'

Reads hardware related sysctl values

Reads process information of other processes

Reads the systems OS release and/or type

Reads the systems hostname

Classification

Signatures

Contains symbols with suspicious names likely related to encryption

Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).BlockSize
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).MarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha1.init.0
Source: submission: sakura	Mach-O symbol: _crypto/sha1.useAVX2
Source: submission: sakura	Mach-O symbol: _crypto/sha1.blockAVX2.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha1.init
Source: submission: sakura	Mach-O symbol: _crypto/sha1.block
Source: submission: sakura	Mach-O symbol: _crypto/sha1.blockAMD64.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha1..inittask
Source: submission: sakura	Mach-O symbol: _crypto/sha1.New
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).constSum
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).Write
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).checkSum
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).Sum
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).UnmarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).Reset
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).Size
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).ConstantTimeSum
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).MarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).BlockSize
Source: submission: sakura	Mach-O symbol: _crypto/rsa.mgf1XOR
Source: submission: sakura	Mach-O symbol: _crypto/rsa.nonZeroRandomBytes
Source: submission: sakura	Mach-O symbol: _crypto/rsa.hashPrefixes
Source: submission: sakura	Mach-O symbol: _crypto/rsa.init
Source: submission: sakura	Mach-O symbol: _crypto/rsa.errPublicExponentSmall
Source: submission: sakura	Mach-O symbol: _crypto/rsa.errPublicModulus
Source: submission: sakura	Mach-O symbol: _crypto/rsa.encrypt
Source: submission: sakura	Mach-O symbol: _crypto/rsa.errPublicExponentLarge
Source: submission: sakura	Mach-O symbol: _crypto/rsa.bigZero
Source: submission: sakura	Mach-O symbol: _crypto/rsa.emsaPSSVerify
Source: submission: sakura	Mach-O symbol: _crypto/rsa.bigOne
Source: submission: sakura	Mach-O symbol: _crypto/rsa.VerifyPKCS1v15
Source: submission: sakura	Mach-O symbol: _crypto/rsa.VerifyPSS
Source: submission: sakura	Mach-O symbol: _crypto/rsa.ErrMessageTooLong
Source: submission: sakura	Mach-O symbol: _crypto/rsa.ErrVerification
Source: submission: sakura	Mach-O symbol: _crypto/rsa.EncryptPKCS1v15
Source: submission: sakura	Mach-O symbol: _crypto/rsa.ErrDecryption
Source: submission: sakura	Mach-O symbol: _crypto/rsa.(*PublicKey).Size
Source: submission: sakura	Mach-O symbol: _crypto/rsa..inittask
Source: submission: sakura	Mach-O symbol: _crypto/rsa.(*PublicKey).Equal
Source: submission: sakura	Mach-O symbol: _crypto/rc4.KeySizeError.Error
Source: submission: sakura	Mach-O symbol: _crypto/rc4.NewCipher
Source: submission: sakura	Mach-O symbol: _crypto/rc4..inittask
Source: submission: sakura	Mach-O symbol: _crypto/rc4..stmp_0
Source: submission: sakura	Mach-O symbol: _crypto/rc4.(*Cipher).XORKeyStream
Source: submission: sakura	Mach-O symbol: _crypto/rc4.(*KeySizeError).Error
Source: submission: sakura	Mach-O symbol: _crypto/rand.warnBlocked
Source: submission: sakura	Mach-O symbol: _crypto/rc4.(*Cipher).Reset
Source: submission: sakura	Mach-O symbol: _crypto/rand.init.0
Source: submission: sakura	Mach-O symbol: _crypto/rand.init.1
Source: submission: sakura	Mach-O symbol: _crypto/rand.hideAgainReader.Read
Source: submission: sakura	Mach-O symbol: _crypto/rand.batched
Source: submission: sakura	Mach-O symbol: _crypto/rand.batched.func1
Source: submission: sakura	Mach-O symbol: _crypto/rand.Reader
Source: submission: sakura	Mach-O symbol: _crypto/rand.altGetRandom
Source: submission: sakura	Mach-O symbol: _crypto/rand..stmp_0
Source: submission: sakura	Mach-O symbol: _crypto/rand.Read
Source: submission: sakura	Mach-O symbol: _crypto/rand.(*reader).Read.func1
Source: submission: sakura	Mach-O symbol: _crypto/rand..inittask
Source: submission: sakura	Mach-O symbol: _crypto/rand.(*reader).Read
Source: submission: sakura	Mach-O symbol: _crypto/md5.init.0
Source: submission: sakura	Mach-O symbol: _crypto/rand.(*hideAgainReader).Read
Source: submission: sakura	Mach-O symbol: _crypto/md5.New
Source: submission: sakura	Mach-O symbol: _crypto/md5.block.abi0
Source: submission: sakura	Mach-O symbol: _crypto/md5..inittask
Source: submission: sakura	Mach-O symbol: _crypto/md5..stmp_1
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).Write
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).checkSum
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).Sum
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).UnmarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).Size
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).MarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).Reset
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil.closedChanOnce
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).BlockSize
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil.MaybeReadByte.func1
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil.closedChan
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil..inittask
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil.MaybeReadByte
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521ZeroEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521ToBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521ToMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Square
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Sub
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Mul
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Selectznz
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521FromMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521MinusOneEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521CmovznzU64
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521FromBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Add
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384ToMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384ZeroEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Sub
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384ToBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Selectznz
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Square
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384MinusOneEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Mul
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384FromMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384FromBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256ZeroEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Add
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256Sub
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256ToBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256FromMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256MinusOneEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224ToMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224ZeroEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224ToBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Square
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Sub
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Mul
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Selectznz
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224FromMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224MinusOneEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Add
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224FromBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat..inittask
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.init
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).IsZero
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).SetBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).Equal
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).Invert
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).SetBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Invert
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).IsZero
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Equal
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P256Element).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).IsZero
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).SetBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Equal
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Invert
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521Sqrt
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521SqrtCandidate
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521GeneratorTableOnce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521Polynomial
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521GeneratorTable
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521CheckOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521G
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384SqrtCandidate
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521B
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384Polynomial
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384Sqrt
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384GeneratorTable
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384GeneratorTableOnce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384G
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384B
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384CheckOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Sqrt
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Zero
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256SelectAffine.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Sqr.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256PrecomputedEmbed
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Select.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Polynomial
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Precomputed
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256PointDoubleAsm.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256PointAddAffineAsm.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256PointAddAsm.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdSqr.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256P
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdMul.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdReduce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdBigToLittle.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdLittleToBig.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256One
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Mul.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256NegCond.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256LittleToBig.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256MovCond.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256FromMont.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Inverse
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256BigToLittle.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256CheckOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224SqrtCandidate.func1
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Add
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224SqrtCandidate
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224Polynomial
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224Sqrt
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224GeneratorTableOnce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224MinusOne
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224GGOnce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224GeneratorTable
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224G
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224GG
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224CheckOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.init.0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224B
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.P256OrdInverse
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.init
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.NewP384Point
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.NewP521Point
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.NewP224Point
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.NewP256Point
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec..stmp_3
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec..stmp_5
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec..inittask
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec..stmp_0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*p384Table).Select
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*p521Table).Select
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).generatorTable.func1
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*p224Table).Select
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).generatorTable
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).Select
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).SetBytes
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientKeyExchangeMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshalWithoutBinders
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func8.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func8
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func7
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func7.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func6
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func6.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func4.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func5
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func3.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.2.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func13
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func13.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func11.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func10.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func11
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func10
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).sendClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).sendClientFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerParameters
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).processServerHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).processHelloRetryRequest
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).establishHandshakeKeys
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).handshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).sendFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).checkServerHelloOrHRR
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).readFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).readSessionTicket
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).pickCipherSuite
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).processServerHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).handshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).doFullHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).establishKeys
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).nextTrafficSecret
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).trafficKey
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).extract
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).finishedHash
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).exportKeyingMaterial
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).exportKeyingMaterial.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).expandLabel.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).expandLabel.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).expandLabel
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateVerifyMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).deriveSecret
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateVerifyMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateVerifyMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateStatusMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateVerifyMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateStatusMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateStatusMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateStatusMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.3.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.3.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.2.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsgTLS13).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsgTLS13).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsgTLS13).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*atLeastReader).Read
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*alert).String
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509.UnknownAuthorityError
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).flushChild
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1GeneralizedTime
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1Element
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509/internal/macos.OSStatus
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1Boolean
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509.rfc2821Mailbox
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1BitString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadOptionalASN1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1UTCTime
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1ObjectIdentifier
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1Integer
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.chacha20Constants
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.avx2InitMask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.avx2IncMask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.andMask
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/cipher.gcm
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.errOpen
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.chacha20Poly1305Seal.abi0
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.chacha20Poly1305Open.abi0
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/elliptic.CurveParams
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/ecdsa.PublicKey
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.rol16
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/ecdsa.PrivateKey
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.polyClampMask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.rol8
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/sha256.digest
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.writeUint64
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/sha1.digest
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.useAVX2
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/rc4.Cipher
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.sseIncMask
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/rand.reader
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.setupState
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/tls.xorNonceAEAD
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).callContinuation
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/tls.prefixNonceAEAD
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).addLengthPrefixed
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/tls.atLeastReader
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).AddUint32
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/tls.RecordHeaderError
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.writeWithPadding
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509.HostnameError
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509.CertificateInvalidError
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).callContinuation.func1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..stmp_4
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..stmp_3
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).Open
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20.newUnauthenticatedCipher
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20.hChaCha20
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..stmp_5
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).openGeneric
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).open
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).Seal
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).Overhead
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).sealGeneric
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).seal
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_2
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_10
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_0
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_6
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_4
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_3
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20.(*Cipher).xorKeyStreamBlocksGeneric
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20.(*Cipher).XORKeyStream
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..stmp_2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*alert).Error
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*RecordHeaderError).Error
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*SignatureScheme).String
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*CurveID).String
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Dialer).DialContext
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeRecordLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeRecordLocked.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeHandshakeRecord
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeHandshakeRecord.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeChangeCipherRecord.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).write
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeChangeCipherRecord
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlertLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).verifyServerCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlert
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlert.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).readRecordOrCCS
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).retryReadRecord
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).readHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).readHandshake.jump50
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).readFromUntil
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).maxPayloadSizeForWrite
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).pickTLSVersion
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).loadSession
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).makeClientHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext.func3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext.func4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleRenegotiation
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleRenegotiation.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleNewSessionTicket
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handlePostHandshakeMessage
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleKeyUpdate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleKeyUpdate.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).flush
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).getClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).closeNotify.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).connectionStateLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).closeNotify
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake-fm
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Write.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Write
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Write.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).SetReadDeadline
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).SetWriteDeadline
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).SetDeadline
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Read.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).RemoteAddr
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).LocalAddr
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Read
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).ConnectionState
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).ConnectionState.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Close
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).CloseWrite
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).supportedVersions
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).writeKeyLog
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).mutualVersion
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).Clone
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).Clone.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*CertificateRequestInfo).SupportsCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*ClientAuthType).String
Source: submission: sakura	Mach-O symbol: _crypto/sha512.init.0
Source: submission: sakura	Mach-O symbol: _crypto/sha512.useAVX2
Source: submission: sakura	Mach-O symbol: _crypto/sha512.blockAVX2.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha512.init
Source: submission: sakura	Mach-O symbol: _crypto/sha512.blockAMD64.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha512._K
Source: submission: sakura	Mach-O symbol: _crypto/sha512.block
Source: submission: sakura	Mach-O symbol: _crypto/sha512.New512_224
Source: submission: sakura	Mach-O symbol: _crypto/sha512.New512_256
Source: submission: sakura	Mach-O symbol: _crypto/sha512.New
Source: submission: sakura	Mach-O symbol: _crypto/sha512.New384
Source: submission: sakura	Mach-O symbol: _crypto/sha512..inittask
Source: submission: sakura	Mach-O symbol: _crypto/sha512..stmp_0
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).Write
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).checkSum
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).UnmarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).Size
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).Sum
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).MarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).Reset
Source: submission: sakura	Mach-O symbol: _crypto/sha256.useAVX2
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).BlockSize
Source: submission: sakura	Mach-O symbol: _crypto/sha256.init
Source: submission: sakura	Mach-O symbol: _crypto/sha256.init.0
Source: submission: sakura	Mach-O symbol: _crypto/sha256.block.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha256.New224
Source: submission: sakura	Mach-O symbol: _crypto/sha256.Sum224
Source: submission: sakura	Mach-O symbol: _crypto/sha256..inittask
Source: submission: sakura	Mach-O symbol: _crypto/sha256.New
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).Write
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).checkSum
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).Sum
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).UnmarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).Reset
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).Size
Source: submission: sakura	Mach-O symbol: _sakura-agent/system.EncryptBytes
Source: submission: sakura	Mach-O symbol: _sakura-agent/system.DecryptBytes
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.ScalarMult
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.Params
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.ScalarBaseMult
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.Add
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.IsOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).ScalarMult
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa..inittask
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).Params
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).ScalarBaseMult
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).IsOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).Add
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).Equal
Source: submission: sakura	Mach-O symbol: _crypto/dsa.ErrInvalidPublicKey
Source: submission: sakura	Mach-O symbol: _crypto/dsa.init
Source: submission: sakura	Mach-O symbol: _crypto/des.sBoxes
Source: submission: sakura	Mach-O symbol: _crypto/dsa..inittask
Source: submission: sakura	Mach-O symbol: _crypto/des.permutedChoice1

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49391 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49414 version: TLS 1.2

Contains symbols with suspicious names likely related to networking

Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.(*HttpResponse).Read
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.(*HttpResponse).Read.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.(*HttpResponse).requestCreate
Source: submission: sakura	Mach-O symbol: _syscall.sendtoInet6
Source: submission: sakura	Mach-O symbol: _syscall.sendtoInet4
Source: submission: sakura	Mach-O symbol: _syscall.sendto
Source: submission: sakura	Mach-O symbol: _syscall.sendfile
Source: submission: sakura	Mach-O symbol: _syscall.socket
Source: submission: sakura	Mach-O symbol: _syscall.setsockopt
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.(*HttpService).AddHandlerPOST
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.(*HttpService).Start
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.(*HttpService).Start.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver..stmp_0
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.webserver
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.(*HttpService).Stop
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver..inittask
Source: submission: sakura	Mach-O symbol: _syscall.minRoutingSockaddrLen
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/tasks.GetTasksFromServer.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/tasks.GetTasksFromServer
Source: submission: sakura	Mach-O symbol: _syscall.libc_sendto_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_sendfile_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_setsockopt_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_socket_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_getsockopt_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_getsockname_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_connect_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.getsockopt
Source: submission: sakura	Mach-O symbol: _syscall.getsockname
Source: submission: sakura	Mach-O symbol: _syscall.SocketDisableIPv6
Source: submission: sakura	Mach-O symbol: _syscall.anyToSockaddr
Source: submission: sakura	Mach-O symbol: _syscall.connect
Source: submission: sakura	Mach-O symbol: _syscall.Getsockname
Source: submission: sakura	Mach-O symbol: _syscall.GetsockoptInt
Source: submission: sakura	Mach-O symbol: _syscall.Sendto
Source: submission: sakura	Mach-O symbol: _syscall.Socket
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientKeyExchangeMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshalWithoutBinders
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func8.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func8
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func7
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func7.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func6
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func6.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func4.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func5
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func3.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.2.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func13
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func13.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func11.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func10.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func11
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func10
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).sendClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).sendClientFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerParameters
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).processServerHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).processHelloRetryRequest
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).establishHandshakeKeys
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).handshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).sendFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).checkServerHelloOrHRR
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).readFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).readSessionTicket
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).pickCipherSuite
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).processServerHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).handshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).doFullHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).establishKeys
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).exportKeyingMaterial
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).exportKeyingMaterial.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/system/sys.DomainName
Source: submission: sakura	Mach-O symbol: _sakura-agent/system/sys.DomainName.func1
Source: submission: sakura	Mach-O symbol: _type..eq.github.com/go-ping/ping.Packet
Source: submission: sakura	Mach-O symbol: _sakura-agent/system/session.getActiveDirectoryDomain
Source: submission: sakura	Mach-O symbol: _type..eq.database/sql.dsnConnector
Source: submission: sakura	Mach-O symbol: _sakura-agent/system/service.showMemoryReport
Source: submission: sakura	Mach-O symbol: _type..eq.[4]net/http.http2Setting
Source: submission: sakura	Mach-O symbol: _updateMapping
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlertLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).verifyServerCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlert
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlert.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).makeClientHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).getClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).connectionStateLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake-fm
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).ConnectionState
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).ConnectionState.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*CertificateRequestInfo).SupportsCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*ClientAuthType).String
Source: submission: sakura	Mach-O symbol: _time.sendTime
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.SendRequestToStandAlone.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.SendRequestToStandAlone
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.NewHttpResponse
Source: submission: sakura	Mach-O symbol: _database/sql.dsnConnector.Connect
Source: submission: sakura	Mach-O symbol: _database/sql.connectionRequestQueueSize
Source: submission: sakura	Mach-O symbol: _database/sql.(*dsnConnector).Connect
Source: submission: sakura	Mach-O symbol: _database/sql.(*driverConn).validateConnection
Source: submission: sakura	Mach-O symbol: _database/sql.(*driverConn).validateConnection.func1
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/sessions/remote/truster.ConnectionTruster
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/connection/stun.StunManager
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/connection/stun.StunHandler
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/ping_monitor.remoteSessionData
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/ping.HostInfoData
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/connection/stun.StunServerDTO
Source: submission: sakura	Mach-O symbol: _type..eq.net/http/pprof.profileEntry
Source: submission: sakura	Mach-O symbol: _internal/poll.SendFile.func1
Source: submission: sakura	Mach-O symbol: _internal/poll.SendFile
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).pingDC.func1
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).openNewConnection.func1
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).pingDC
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).openNewConnection
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).connectionOpener
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).connectionCleaner
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).connectionCleanerRunLocked
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).PingContext
Source: submission: sakura	Mach-O symbol: _internal/poll.(*FD).SetsockoptInt.func1
Source: submission: sakura	Mach-O symbol: _internal/poll.(*FD).SetsockoptInt
Source: submission: sakura	Mach-O symbol: _runtime/pprof.(*profileBuilder).readMapping
Source: submission: sakura	Mach-O symbol: _runtime/pprof.(*profileBuilder).pbMapping
Source: submission: sakura	Mach-O symbol: _runtime/pprof.(*profileBuilder).addMapping-fm
Source: submission: sakura	Mach-O symbol: _runtime/pprof.(*profileBuilder).addMapping
Source: submission: sakura	Mach-O symbol: _sqlcipher_check_connection
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2PriorityFrame
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2PingFrame
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2StreamError
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2Setting
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2RSTStreamFrame
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2PriorityParam
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.httpError
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2stickyErrWriter
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2connError
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2WindowUpdateFrame
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.muxEntry
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.maxBytesReader
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.initALPNRequest
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.socksUsernamePassword
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.redirectHandler
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.readTrackingBody
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.onceCloseListener
Source: submission: sakura	Mach-O symbol: _type..eq.net/http/internal.chunkedReader
Source: submission: sakura	Mach-O symbol: _type..eq.net/http/httptrace.GotConnInfo
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.statusError
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.ValidTrailerHeader
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.PunycodeHostPort
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.badTrailer
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.connReader
Source: submission: sakura	Mach-O symbol: _type..eq.net.portLookupResult
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2FrameWriteRequest
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2FrameHeader
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.expectContinueReader
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.connectMethodKey
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2GoAwayError
Source: submission: sakura	Mach-O symbol: _type..eq.internal/profile.Mapping
Source: submission: sakura	Mach-O symbol: _type..eq.internal/profile.mappingKey
Source: submission: sakura	Mach-O symbol: _type..eq.golang.org/x/net/internal/socket.Conn
Source: submission: sakura	Mach-O symbol: _type..eq.golang.org/x/sys/unix.SockaddrUnix
Source: submission: sakura	Mach-O symbol: _type..eq.golang.org/x/sys/unix.SockaddrInet4
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool..dict.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Get
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool..dict.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).ListKeys
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool..dict.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Add
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool..dict.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Remove
Source: submission: sakura	Mach-O symbol: _sakura-agent/config.(*SettingsData).GetServerAddress
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Add
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Get
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Remove
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Unlock
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).ListKeys
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Lock
Source: submission: sakura	Mach-O symbol: _type..eq.vendor/golang.org/x/net/http2/hpack.HeaderField
Source: submission: sakura	Mach-O symbol: _type..eq.vendor/golang.org/x/net/http/httpproxy.domainMatch
Source: submission: sakura	Mach-O symbol: _type..eq.vendor/golang.org/x/net/http2/hpack.pairNameValue
Source: submission: sakura	Mach-O symbol: _type..hash.net/http.connectMethodKey
Source: submission: sakura	Mach-O symbol: _type..hash.internal/profile.mappingKey
Source: submission: sakura	Mach-O symbol: _type..hash.vendor/golang.org/x/net/http2/hpack.pairNameValue
Source: submission: sakura	Mach-O symbol: _type..eq.syscall.SockaddrInet4
Source: submission: sakura	Mach-O symbol: _type..eq.syscall.SockaddrUnix
Source: submission: sakura	Mach-O symbol: _type..eq.vendor/golang.org/x/net/http/httpproxy.Config
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/system/session.ClientNetData
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/sio.HttpResponse
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/idna.mappings
Source: submission: sakura	Mach-O symbol: _reflect.methodReceiver
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/idna.info.appendMapping
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.glob..func1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.huffmanCodeLen
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.huffmanCodes
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.huffmanDecode
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.buildRootHuffmanNode
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.buildRootOnce
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.errNeedMore
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.errVarintOverflow
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.lazyRootHuffmanNode
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.readVarInt
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.staticTable
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.staticTableEntries
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*headerFieldTable).evictOldest
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*headerFieldTable).idToIndex
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*headerFieldTable).search
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*dynamicTable).add
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*dynamicTable).evict
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_0
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.AppendHuffmanString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.DecodingError.Error
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.InvalidIndexError.Error
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.NewDecoder
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.NewEncoder
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.appendHpackString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.ErrInvalidHuffman
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.ErrStringLength
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.HeaderField.String
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.appendIndexedName
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.appendNewName
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.bufPool
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.ipMatch.match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.parseProxy
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.portMap
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).Close
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).decodeString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseDynamicTableSizeUpdate
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).SetEmitFunc
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).Write
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).at
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).callEmit
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseFieldLiteral
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseHeaderFieldRepr
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).readString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*DecodingError).Error
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseFieldIndexed
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*InvalidIndexError).Error
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).SetMaxDynamicTableSize
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).WriteField
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).searchTable
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*HeaderField).String
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.headerValueContainsToken
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).proxyForURL
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).proxyForURL-fm
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).useProxy
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.isTokenTable
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.validHostByte
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*allMatch).match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*cidrMatch).match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*domainMatch).match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*ipMatch).match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.domainMatch.match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.idnaASCII
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.FromEnvironment
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.allMatch.match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.canonicalAddr
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.cidrMatch.match
Source: submission: sakura	Mach-O symbol: _net/http..stmp_40
Source: submission: sakura	Mach-O symbol: _net/http..stmp_41
Source: submission: sakura	Mach-O symbol: _net/http..stmp_42
Source: submission: sakura	Mach-O symbol: _net/http..stmp_43
Source: submission: sakura	Mach-O symbol: _net/http..stmp_44
Source: submission: sakura	Mach-O symbol: _net/http..stmp_45
Source: submission: sakura	Mach-O symbol: _net/http..stmp_46
Source: submission: sakura	Mach-O symbol: _net/http..stmp_47
Source: submission: sakura	Mach-O symbol: _net/http..stmp_48
Source: submission: sakura	Mach-O symbol: _net/http..stmp_49
Source: submission: sakura	Mach-O symbol: _net/http..stmp_5
Source: submission: sakura	Mach-O symbol: _net/http..stmp_50
Source: submission: sakura	Mach-O symbol: _net/http..stmp_51
Source: submission: sakura	Mach-O symbol: _net/http..stmp_52
Source: submission: sakura	Mach-O symbol: _net/http..stmp_53
Source: submission: sakura	Mach-O symbol: _net/http..stmp_54
Source: submission: sakura	Mach-O symbol: _net/http..stmp_55
Source: submission: sakura	Mach-O symbol: _net/http..stmp_56
Source: submission: sakura	Mach-O symbol: _net/http..stmp_57
Source: submission: sakura	Mach-O symbol: _net/http..stmp_58
Source: submission: sakura	Mach-O symbol: _net/http..stmp_59
Source: submission: sakura	Mach-O symbol: _net/http..stmp_60
Source: submission: sakura	Mach-O symbol: _net/http..stmp_61
Source: submission: sakura	Mach-O symbol: _net/http..stmp_62
Source: submission: sakura	Mach-O symbol: _net/http..stmp_63
Source: submission: sakura	Mach-O symbol: _net/http..stmp_64
Source: submission: sakura	Mach-O symbol: _net/http..stmp_65
Source: submission: sakura	Mach-O symbol: _net/http..stmp_66
Source: submission: sakura	Mach-O symbol: _net/http..stmp_67
Source: submission: sakura	Mach-O symbol: _net/http..stmp_68
Source: submission: sakura	Mach-O symbol: _net/http..stmp_69
Source: submission: sakura	Mach-O symbol: _net/http..stmp_7
Source: submission: sakura	Mach-O symbol: _net/http..stmp_70
Source: submission: sakura	Mach-O symbol: _net/http..stmp_71
Source: submission: sakura	Mach-O symbol: _net/http..stmp_72
Source: submission: sakura	Mach-O symbol: _net/http..stmp_73
Source: submission: sakura	Mach-O symbol: _net/http..stmp_74
Source: submission: sakura	Mach-O symbol: _net/http..stmp_75
Source: submission: sakura	Mach-O symbol: _net/http..stmp_9
Source: submission: sakura	Mach-O symbol: _net/http..stmp_96
Source: submission: sakura	Mach-O symbol: _net/http..stmp_97
Source: submission: sakura	Mach-O symbol: _net/http.ConnState.String
Source: submission: sakura	Mach-O symbol: _net/http.DefaultServeMux
Source: submission: sakura	Mach-O symbol: _net/http.DefaultTransport
Source: submission: sakura	Mach-O symbol: _net/http.DetectContentType
Source: submission: sakura	Mach-O symbol: _net/http.ErrAbortHandler
Source: submission: sakura	Mach-O symbol: _net/http.ErrBodyNotAllowed
Source: submission: sakura	Mach-O symbol: _net/http.ErrBodyReadAfterClose
Source: submission: sakura	Mach-O symbol: _net/http.ErrContentLength
Source: submission: sakura	Mach-O symbol: _net/http.ErrHandlerTimeout
Source: submission: sakura	Mach-O symbol: _net/http.ErrHijacked
Source: submission: sakura	Mach-O symbol: _net/http.ErrLineTooLong
Source: submission: sakura	Mach-O symbol: _net/http.ErrMissingBoundary
Source: submission: sakura	Mach-O symbol: _net/http.ErrMissingFile
Source: submission: sakura	Mach-O symbol: _net/http.ErrNoCookie
Source: submission: sakura	Mach-O symbol: _net/http.ErrNoLocation
Source: submission: sakura	Mach-O symbol: _net/http.ErrNotMultipart
Source: submission: sakura	Mach-O symbol: _net/http.ErrNotSupported
Source: submission: sakura	Mach-O symbol: _net/http.ErrServerClosed
Source: submission: sakura	Mach-O symbol: _net/http.ErrSkipAltProtocol
Source: submission: sakura	Mach-O symbol: _net/http.ErrUseLastResponse
Source: submission: sakura	Mach-O symbol: _net/http.ErrWriteAfterFlush
Source: submission: sakura	Mach-O symbol: _net/http.Error
Source: submission: sakura	Mach-O symbol: _net/http.Handler.ServeHTTP-fm
Source: submission: sakura	Mach-O symbol: _net/http.HandlerFunc.ServeHTTP
Source: submission: sakura	Mach-O symbol: _net/http.Header.sortedKeyValues
Source: submission: sakura	Mach-O symbol: _net/http.Header.writeSubset
Source: submission: sakura	Mach-O symbol: _net/http.LocalAddrContextKey
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext.func1
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext.func2
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext.func3
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext.func4
Source: submission: sakura	Mach-O symbol: _net/http.NotFound
Source: submission: sakura	Mach-O symbol: _net/http.ParseHTTPVersion
Source: submission: sakura	Mach-O symbol: _net/http.ProxyFromEnvironment
Source: submission: sakura	Mach-O symbol: _net/http.ReadResponse
Source: submission: sakura	Mach-O symbol: _net/http.Redirect
Source: submission: sakura	Mach-O symbol: _net/http.ServerContextKey
Source: submission: sakura	Mach-O symbol: _net/http.StatusText
Source: submission: sakura	Mach-O symbol: _net/http.aLongTimeAgo
Source: submission: sakura	Mach-O symbol: _net/http.alwaysFalse
Source: submission: sakura	Mach-O symbol: _net/http.appendSorted
Source: submission: sakura	Mach-O symbol: _net/http.appendSorted.func1
Source: submission: sakura	Mach-O symbol: _net/http.appendTime
Source: submission: sakura	Mach-O symbol: _net/http.bodyLocked.Read
Source: submission: sakura	Mach-O symbol: _net/http.bufioFlushWriter.Write
Source: submission: sakura	Mach-O symbol: _net/http.bufioReaderPool
Source: submission: sakura	Mach-O symbol: _net/http.bufioWriter2kPool
Source: submission: sakura	Mach-O symbol: _net/http.bufioWriter4kPool
Source: submission: sakura	Mach-O symbol: _net/http.canonicalAddr
Source: submission: sakura	Mach-O symbol: _net/http.checkConnErrorWriter.Write
Source: submission: sakura	Mach-O symbol: _net/http.cleanPath
Source: submission: sakura	Mach-O symbol: _net/http.cloneOrMakeHeader
Source: submission: sakura	Mach-O symbol: _net/http.colonSpace
Source: submission: sakura	Mach-O symbol: _net/http.connectMethodKey.String
Source: submission: sakura	Mach-O symbol: _net/http.cookieNameSanitizer
Source: submission: sakura	Mach-O symbol: _net/http.copyBufPool
Source: submission: sakura	Mach-O symbol: _net/http.crlf
Source: submission: sakura	Mach-O symbol: _net/http.defaultCheckRedirect
Source: submission: sakura	Mach-O symbol: _connect
Source: submission: sakura	Mach-O symbol: _IOConnectCallStructMethod
Source: submission: sakura	Mach-O symbol: _reflect.(*rtype).exportedMethods
Source: submission: sakura	Mach-O symbol: _reflect.flag.mustBeExportedSlow
Source: submission: sakura	Mach-O symbol: _crypto/tls.hashForServerKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.hasAESGCMHardwareSupport
Source: submission: sakura	Mach-O symbol: _crypto/tls.finishedHash.serverSum
Source: submission: sakura	Mach-O symbol: _crypto/tls.finishedHash.clientSum
Source: submission: sakura	Mach-O symbol: _crypto/tls.finishedHash.hashForClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.errServerKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.errClientKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.defaultSupportedSignatureAlgorithms
Source: submission: sakura	Mach-O symbol: _crypto/tls.clientFinishedLabel
Source: submission: sakura	Mach-O symbol: _sendto
Source: submission: sakura	Mach-O symbol: _crypto/tls._ClientAuthType_index
Source: submission: sakura	Mach-O symbol: _crypto/tls.ClientAuthType.String
Source: submission: sakura	Mach-O symbol: _setsockopt
Source: submission: sakura	Mach-O symbol: _socket
Source: submission: sakura	Mach-O symbol: _recvmsg
Source: submission: sakura	Mach-O symbol: _sendfile
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverKeyExchangeMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverKeyExchangeMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func9
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func9.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func7.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func8
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func6
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func7
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func5.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func5
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func3.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func3.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func2.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func2.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func10.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func10.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func10
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloDoneMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*rsaKeyAgreement).processServerKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloDoneMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*rsaKeyAgreement).generateClientKeyExchange
Source: submission: sakura	Mach-O symbol: _getsockopt
Source: submission: sakura	Mach-O symbol: _getsockname
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*ecdheKeyAgreement).generateClientKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*ecdheKeyAgreement).processServerKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientKeyExchangeMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _syscall.Connect
Source: submission: sakura	Mach-O symbol: _syscall.(*SockaddrUnix).sockaddr
Source: submission: sakura	Mach-O symbol: _syscall.(*SockaddrInet6).sockaddr
Source: submission: sakura	Mach-O symbol: _syscall.(*SockaddrInet4).sockaddr
Source: submission: sakura	Mach-O symbol: _syscall.(*SockaddrDatalink).sockaddr
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameHeader).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameHeader).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameHeader).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameType).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameWriteRequest).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameWriteRequest).replyToWriter
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).ReadFrame
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteContinuation
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteDataPadded
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteGoAway
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteHeaders
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WritePing
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WritePushPromise
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteRSTStream
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteSettings
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteSettingsAck
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteWindowUpdate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).checkFrameOrder
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).endWrite
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).logWrite
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).readMetaFrame
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).readMetaFrame.func1
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).readMetaFrame.func2
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).readMetaFrame.func3
Source: submission: sakura	Mach-O symbol: _net/http.(*http2GoAwayError).Error
Source: submission: sakura	Mach-O symbol: _net/http.(*http2GoAwayFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2GoAwayFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2GoAwayFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).HeaderBlockFragment
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).HeadersEnded
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).HeaderBlockFragment
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).HeadersEnded
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).checkPseudos
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PingFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PingFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PingFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PriorityFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PriorityFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PriorityFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).HeaderBlockFragment
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).HeadersEnded
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2RSTStreamFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2RSTStreamFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2RSTStreamFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Server).ServeConn

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.113.20
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.113.20
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2021/mobileassets/041-40471/B96AF6E1-5FF6-4786-9956-944A1AFE086A/com_apple_MobileAsset_KextDenyList/404087a7302927411b6ea0e05114d2c68355185e.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/062-08173/234EE7F7-CC33-4CD3-85FC-60590A103560/com_apple_MobileAsset_CoreSuggestions/84f6102e2a09dd10dd694d795792a7771b6014fc.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/052-54451/D609556E-69B1-482E-9C33-B2E3510A1311/com_apple_MobileAsset_TimeZoneUpdate/c5a4d0df08e8faecf4faebbbadc4d96a07d9d990.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)

Source: global traffic

DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: /Users/bernard/Desktop/sakura (PID: 620)

Reads from socket in process: data

Jump to behavior

Source: sakura	String found in binary or memory: http://127.0.0.1:1323http://127.0.0.1:4567http://localhost:1323illegal
Source: sakura, 00000750.00000513.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics
Source: sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000705.00000423.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics/softwar/hardwar/window-/antivir/trace/proc
Source: sakura, 00000705.00000423.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics/usr/libexec/AirPlayXPCHelper
Source: sakura, 00000666.00000345.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics/usr/libexec/findmydeviced
Source: sakura, 00000750.00000513.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics/usr/libexec/networkserviceproxy/usr/libexec/keyboardservicesd/usr/sb
Source: sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metricsn/usr/libexec/networkserviceproxy/usr/libexec/keyboardservicesd
Source: sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metricsn/usr/libexec/networkserviceproxy/usr/libexec/keyboardservicesd/usr/s
Source: sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metricsror:
Source: sakura, 00000620.00000255.1.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000661.00000337.1.000000010b55e000.000000010b568000.r--.sdmp, bash, 00000661.00000337.1.000000011442c000.0000000114455000.r--.sdmp, bash, 00000665.00000344.1.000000010fd27000.000000010fd31000.r--.sdmp, bash, 00000665.00000344.1.0000000111bda000.0000000111c03000.r--.sdmp, sakura, 00000666.00000345.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000697.00000407.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000705.00000423.9.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000706.00000426.9.000000010daac000.000000010dad5000.r--.sdmp, bash, 00000706.00000426.9.000000010d4cd000.000000010d4d7000.r--.sdmp, hostname, 00000719.00000452.9.0000000105a69000.0000000105a92000.r--.sdmp, hostname, 00000719.00000452.9.0000000103f41000.0000000103f44000.r--.sdmp, sakura, 00000732.00000477.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000750.00000513.9.000000010d6e3000.000000010d70c000.r--.sdmp	String found in binary or memory: http://crl.apple.com/codesigning.crl0
Source: sakura	String found in binary or memory: http://hw.ncpuinstallinvalidlookup
Source: sakura	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: sakura, 00000620.00000255.1.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000661.00000337.1.000000010b55e000.000000010b568000.r--.sdmp, bash, 00000661.00000337.1.000000011442c000.0000000114455000.r--.sdmp, bash, 00000665.00000344.1.000000010fd27000.000000010fd31000.r--.sdmp, bash, 00000665.00000344.1.0000000111bda000.0000000111c03000.r--.sdmp, sakura, 00000666.00000345.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000697.00000407.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000705.00000423.9.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000706.00000426.9.000000010daac000.000000010dad5000.r--.sdmp, bash, 00000706.00000426.9.000000010d4cd000.000000010d4d7000.r--.sdmp, hostname, 00000719.00000452.9.0000000105a69000.0000000105a92000.r--.sdmp, hostname, 00000719.00000452.9.0000000103f41000.0000000103f44000.r--.sdmp, sakura, 00000732.00000477.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000750.00000513.9.000000010d6e3000.000000010d70c000.r--.sdmp	String found in binary or memory: http://www.apple.com/appleca/root.crl0
Source: sakura, 00000620.00000255.1.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000661.00000337.1.000000010b55e000.000000010b568000.r--.sdmp, bash, 00000661.00000337.1.000000011442c000.0000000114455000.r--.sdmp, bash, 00000665.00000344.1.000000010fd27000.000000010fd31000.r--.sdmp, bash, 00000665.00000344.1.0000000111bda000.0000000111c03000.r--.sdmp, sakura, 00000666.00000345.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000697.00000407.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000705.00000423.9.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000706.00000426.9.000000010daac000.000000010dad5000.r--.sdmp, bash, 00000706.00000426.9.000000010d4cd000.000000010d4d7000.r--.sdmp, hostname, 00000719.00000452.9.0000000105a69000.0000000105a92000.r--.sdmp, hostname, 00000719.00000452.9.0000000103f41000.0000000103f44000.r--.sdmp, sakura, 00000732.00000477.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000750.00000513.9.000000010d6e3000.000000010d70c000.r--.sdmp	String found in binary or memory: http://www.apple.com/certificateauthority0
Source: sakura, 00000620.00000255.1.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000661.00000337.1.000000010b55e000.000000010b568000.r--.sdmp, bash, 00000661.00000337.1.000000011442c000.0000000114455000.r--.sdmp, bash, 00000665.00000344.1.000000010fd27000.000000010fd31000.r--.sdmp, bash, 00000665.00000344.1.0000000111bda000.0000000111c03000.r--.sdmp, sakura, 00000666.00000345.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000697.00000407.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000705.00000423.9.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000706.00000426.9.000000010daac000.000000010dad5000.r--.sdmp, bash, 00000706.00000426.9.000000010d4cd000.000000010d4d7000.r--.sdmp, hostname, 00000719.00000452.9.0000000105a69000.0000000105a92000.r--.sdmp, hostname, 00000719.00000452.9.0000000103f41000.0000000103f44000.r--.sdmp, sakura, 00000732.00000477.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000750.00000513.9.000000010d6e3000.000000010d70c000.r--.sdmp	String found in binary or memory: https://www.apple.com/appleca/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 49412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49383
Source: unknown	Network traffic detected: HTTP traffic on port 49395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49380
Source: unknown	Network traffic detected: HTTP traffic on port 49401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49414
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49413
Source: unknown	Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49411
Source: unknown	Network traffic detected: HTTP traffic on port 49413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49395
Source: unknown	Network traffic detected: HTTP traffic on port 49394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49391
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49383 -> 443

Source: /Users/bernard/Desktop/sakura (PID: 620)

Writes from socket in process: data

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49391 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49414 version: TLS 1.2

Source: classification engine

Classification label: mal52.troj.spyw.evad.mac@0/6@1/0

Contains symbols with suspicious names likely related to well-known browsers

Source: submission: sakura	Mach-O symbol: _unicode.IDS_Binary_Operator
Source: submission: sakura	Mach-O symbol: _unicode.IDS_Trinary_Operator

Persistence and Installation Behavior

Executes the "scutil" command used to manage network related system configuration parameters

Source: /bin/bash (PID: 663)

Scutil executable: /usr/sbin/scutil /usr/sbin/scutil

Jump to behavior

Creates and/or modifies files and/or directories in common UNIX system configuration directories

Source: /Users/bernard/Desktop/sakura (PID: 620)

File created: /etc/machine-id

Jump to behavior

Executes commands using a shell command-line interpreter

Source: /Users/bernard/Desktop/sakura (PID: 624)	Shell command executed: /bin/bash -c /bin/launchctl list \| awk '/sshd\.\|loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 658)	Shell command executed: /bin/bash -c launchctl list \| awk '{if ($3 == 'org.sakura.agent') {print $1}}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 661)	Shell command executed: /bin/bash -c echo show com.apple.opendirectoryd.ActiveDirectory \| /usr/sbin/scutil \| awk -F ':' '/DomainNameDns/ {print $2}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 665)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 671)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 676)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 679)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 682)	Shell command executed: /bin/bash -c /bin/launchctl list \| awk '/sshd\.\|loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 685)	Shell command executed: /bin/bash -c ioreg -rd1 -c IOPlatformExpertDevice\| awk -F '=' '/product-name/ {print $2}' \| sed -e 's\|.'$.$'.*\|\1\|g'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 689)	Shell command executed: /bin/bash -c ioreg -rd1 -c IOPlatformExpertDevice\| awk -F '=' '/IOPlatformSerialNumber/ {print $2}' \| sed -e 's\|.'$.$'.*\|\1\|g'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 699)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 702)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 706)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 709)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 712)	Shell command executed: /bin/bash -c /bin/launchctl list \| awk '/sshd\.\|loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 725)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 728)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 737)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 740)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 743)	Shell command executed: /bin/bash -c /bin/launchctl list \| awk '/sshd\.\|loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 751)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 754)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior

Executes the "hostname" command used to retrieve the computers name

Source: /Users/bernard/Desktop/sakura (PID: 693)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 694)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 695)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 717)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 718)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 719)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 746)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 747)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 748)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior

Explicitly lists launch services possibly for searching

Source: /bin/bash (PID: 625)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 659)	Launch agent/daemon listed: launchctl list	Jump to behavior
Source: /bin/bash (PID: 669)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 677)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 683)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 700)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 707)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 713)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 726)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 738)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 744)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 752)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior

Source: /bin/bash (PID: 626)	Awk executable: /usr/bin/awk -> awk /sshd\.\|loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 660)	Awk executable: /usr/bin/awk -> awk {if ($3 == 'org.sakura.agent') {print $1}}	Jump to behavior
Source: /bin/bash (PID: 664)	Awk executable: /usr/bin/awk -> awk -F : /DomainNameDns/ {print $2}	Jump to behavior
Source: /bin/bash (PID: 670)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 673)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 678)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 681)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 684)	Awk executable: /usr/bin/awk -> awk /sshd\.\|loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 687)	Awk executable: /usr/bin/awk -> awk -F = /product-name/ {print $2}	Jump to behavior
Source: /bin/bash (PID: 691)	Awk executable: /usr/bin/awk -> awk -F = /IOPlatformSerialNumber/ {print $2}	Jump to behavior
Source: /bin/bash (PID: 701)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 704)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 708)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 711)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 714)	Awk executable: /usr/bin/awk -> awk /sshd\.\|loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 727)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 730)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 739)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 742)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 745)	Awk executable: /usr/bin/awk -> awk /sshd\.\|loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 753)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 756)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior

Source: /bin/bash (PID: 688)	Sed executable: /usr/bin/sed -> sed -e s\|.'$.$'.*\|\1\|g			Jump to behavior
Source: /bin/bash (PID: 692)	Sed executable: /usr/bin/sed -> sed -e s\|.'$.$'.*\|\1\|g			Jump to behavior

Source: submission: sakura

Mach-O header: load_dylib -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

Source: submission: sakura

Mach-O header: load_dylib -> /System/Library/Frameworks/Security.framework/Versions/A/Security

Source: /Users/bernard/Desktop/sakura (PID: 620)	Random device file read: /dev/urandom	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Random device file read: /dev/urandom	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 736)	Random device file read: /dev/random	Jump to behavior

Source: /Users/bernard/Desktop/sakura (PID: 620)

Log file created: /opt/sakura/logs/agent.log

Jump to dropped file

Malware Analysis System Evasion

Likely queries the I/O Kit registry to detect VMs by querying the "IOPlatformExpertDevice" class

Source: /Users/bernard/Desktop/sakura (PID: 622)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior
Source: /bin/bash (PID: 686)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior
Source: /bin/bash (PID: 690)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior

Contains symbols with suspicious names likely related to anti-analysis

Source: submission: sakura	Mach-O symbol: _syscall.ptrace1
Source: submission: sakura	Mach-O symbol: _syscall.libc_ptrace_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _type..eq.net/http/httptrace.GotConnInfo
Source: submission: sakura	Mach-O symbol: _ptrace
Source: submission: sakura	Mach-O symbol: _runtime.StopTrace
Source: submission: sakura	Mach-O symbol: _net/http/httptrace..inittask

Source: sakura, 00000666.00000345.9.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: Llocation: Library/Java/JavaVirtualMachines/jdk-11.0.3.jdk
Source: sakura, 00000666.00000345.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000705.00000423.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000732.00000477.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000750.00000513.9.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: location: Library/Java/JavaVirtualMachines/jdk-11.0.3.jdk
Source: sakura, 00000750.00000513.9.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: location: Library/Java/JavaVirtualMachines/jdk-11.0.3.jdk6
Source: sakura, 00000697.00000407.9.000000c000400000.000000c000800000.rw-.sdmp	Binary or memory string: <&_KZZj4ovlohxIyxTjlYSp6uZoOZACCSGbn2FYhKdLRUv6vrH+h2LipSrT4w2X1FE0FkehP3+Sd5JEDMUUCyYk+XUZLEJJ54S+61QRDpkpvHXOvRYvQ+INBODRYnpKERyrzVrp7XkPKhWWndDUqrCh3bWD9k4wIaT6kQbc4cuZAuo46V77JL+4y9CUuE9hmXMOZ+vOrZUAtwS6hDirq1ULwCccsWsW021TIH6IV0AdDPm7jvn1/ndKNMPWy7vjMjwWw3Py+MOeahI4QHGVx6S6O56LOub4/WG8vyh2ipciAtKaLxLXbDe3EUZTt9ra6Z0ZmfDB/H3dcDZcnI0mIGMh+6VyXP4qeYb0ygzNvOOwpi6nW/0sraMSXaPj8FzmgcKJurYO70VQZSZusLImc/U5u2yq5upbPBjCgNIUDMmI9qDGWV0vGtpYspwpCVRJni6LmiedJQAdazrJTTAlC3KE8vY3Us9Wg9C+ueGJbM7YHynIMAHjVnGFCsDIhijIhEwFj9vnSskHqG6/S5qoLMaNdN1cj+uiLQ2ZAbvKRzOwx1l1YWKfEu8YtDb235wvuBvAIZVHCVvu55mKRZSxnVFANYr4q29FjOYz0BiHejXPzTp1B2nnEiaNiLe4HmX9NNmGw9/UPn/SMs9xlmSYqBkKpcpnSiTN4TSl/xbUbsjA7ZVxapxoeQl1VTR7ssGHfsAh1NHC/XP70QmM7f2HTZbkatMVzh9C/Sl5aorI6TkZxxmMryNybVetTfptV/dd6tdt/U+X8iEZT5IQIXuLUMGwfgaUzVQWA7n+wsXDaLmu3Vt78mGNUeKh9EPtjsEGtbLB2wxkhI94ujBeg897BtWYpIPWg6dk1fZ2V3GQEmU6ZxHmsAwKpvqlXqBv4wKSbO3oaXc264agg9umtD7c+pbSg8LmSx8f/TWMZAy1v8KHepAqQkxlmmmmansYjh1ZX1VPoP81ICVY6nAOt6QBBKfyO+fSqu89LTRob4CtAzKjpVUFiXAQ+ETGIuEQqs5m1vz3jD8WGs46H21B79A8F/s+ADlfaUAXIaetj/DapUVJO36ScJkugK4NHT4uh744KWImPF7mqNjlRKoXDFSqP/moOmKom/5yBuLKra0wMUO3KNAFRrf5dn8q6W/Ypy7/PFbEvzPLpZQtbbVWmgGgMv3WQdZDSYDqcCJAzInkfzPM3Zi+Hsa/ZcT9lPP08ku2AjRJgrjolEsqHmi/56yMrtmmSnygcx26G19bOWjDcCI6E6ne2b+57rDH6f3kW2QTvNaWQQnDheXeBqdDLdtp6dCnN8qWpGr2ip/0xZFXFBqrp1t7qkxsJoT1NPS7zJdAQqlvIBvsT3ix5Afcxd/MJ6adXl6jXKbGXOqUIVTJJca9hxGlMRVOWoN4v3p3DnlilJSw+eKwRB5uWw7LQo2tCPNLVHtPl1dQSpuJ4ujnZWoF02/sRnzauKiVh5uI5J4GytFRmUa7+CMbyeBxaUQK7hf/4Awbd8qBYFhZUb3DDMvRnguV5BOBjWDpycyVgxY+dBAfHYEkcLnlfh9YD3+HlMi4glRQVSOyx4Pc/jIxrIruGCYRh+y6SgBs96TseNyggzL/lkO7QQLOK/SbEfvUElclJIOaDgz68i5P2qjjLjaOjwPRGFpfdQszfL6Ouv3LkxdgfOU/Rh3r43uNsyvnGWtdqjz2WmZfZ/aSKBR4BQg7ryOuicbwWKE6Qyt6fzraeL4m8ET5u8meANCHeP0pbWDEdUJwgvyF6TU3xzhdW3x0FWRyyU4Qim37PRn4s/W2vTI30oNfPLOjbAzyExdXkF8fqMZp0lfwz/VS1DB0ZzTeo6ZE/sw+dgqrrKAWLcp3arygWvEhnLyzS2URGuVapWCzUuwoKD4kMzjmt16xJR1SeY3o43/b+6ODBKTBYYvIsdRFahunPruFeBniaGvzCd0wjquPiJk4T6RNMzIuNZAghHzCEv7cK++HJR4OWU3V2u1yz7gg2Su5ZQq2Ph+Rh9fU5smLle4XKqzH2V256w0UGVFVBWtyBTOnCoxb9gQfnHF6dFx4WYMZeVTl2oPHAAFN+AvY6lpQ4gDuQURuumKAiX9y9mtH9jMHrQXu4E4g2I0dD3PA9FLvQg50XGX8FL1wrULpf7AqXSoQcGpOqwaVQVmdQ/0HbHC11TsSEqrVRFB3DkEYwm1hWmNOe52NN9LbG67wxQ9VQk7T26ptdyalqDOa8kPf+/9B+4nISLUZY+A7ewxeS/n8lRD7G/igPOm3X/g6eTOdPnypO26fpeoyUPiMZINyKLR4r8VjfgspeWQDN8i0jhwJr7dbwHGxvnFtz8bJnitmdbxOmeBoo5xGqYO509UeYUqNWrtfGyib8Xqw0mSgViGQhj4NvFMz/ccQoQ3GgA5KLaGTwASvAE1Xb+e34ddAIYRjJMrrDyVEtfB+zYqo3KcSksoLdi/lMfOtWPqWAHDWUAsxSgh7Qm12Wfdjyh68tUEJCGpAFi5UM94EaX2rjruk0d0TtT7OuAOJnoQjfJSrUTWBirZR9Uh4bqdFXX5bgrxSBoEheCBeP2/oUD3QQF4zi4Ke7imgN3HPUXWfI4fzrFAYXs/X+VTjofGCywnjUn2+g6GcSbSOFTMkyAntQcwZbhaQHZAxxOY0Lak03/8iHIZp7DHMQqdDdr1PHZuJf+VU9In5gP87ufXFc2w78MDAgqw==aEJiU6YSQQ2jjJiBR45csNWln1cUoPjHfisrx4xRDS0+towlb4aFSmXeziM9rDqUAhlrzgyCRq1JB6BjTnySpbus7KNYK8ryA/36aGymAw34nWp0N2pgJcvY3tXTnt0qw4mqhlGnyfMt/AMdjvfn3R241D0nlm1878ohr+LYZZ2LlolTvQ3dUdBCBHevynofouxfPBtvWe5a3ztAQT6RsqoaHc+vCrq6Rqe6pxopA92hmecgXxTc8eD9QZaKRCjAEtQN6V8putleKiLgn7KCMOS7Xff92vzGQEZHpU/Y
Source: sakura, 00000697.00000407.9.000000c000400000.000000c000800000.rw-.sdmp	Binary or memory string: KZZj4ovlohxIyxTjlYSp6uZoOZACCSGbn2FYhKdLRUv6vrH+h2LipSrT4w2X1FE0FkehP3+Sd5JEDMUUCyYk+XUZLEJJ54S+61QRDpkpvHXOvRYvQ+INBODRYnpKERyrzVrp7XkPKhWWndDUqrCh3bWD9k4wIaT6kQbc4cuZAuo46V77JL+4y9CUuE9hmXMOZ+vOrZUAtwS6hDirq1ULwCccsWsW021TIH6IV0AdDPm7jvn1/ndKNMPWy7vjMjwWw3Py+MOeahI4QHGVx6S6O56LOub4/WG8vyh2ipciAtKaLxLXbDe3EUZTt9ra6Z0ZmfDB/H3dcDZcnI0mIGMh+6VyXP4qeYb0ygzNvOOwpi6nW/0sraMSXaPj8FzmgcKJurYO70VQZSZusLImc/U5u2yq5upbPBjCgNIUDMmI9qDGWV0vGtpYspwpCVRJni6LmiedJQAdazrJTTAlC3KE8vY3Us9Wg9C+ueGJbM7YHynIMAHjVnGFCsDIhijIhEwFj9vnSskHqG6/S5qoLMaNdN1cj+uiLQ2ZAbvKRzOwx1l1YWKfEu8YtDb235wvuBvAIZVHCVvu55mKRZSxnVFANYr4q29FjOYz0BiHejXPzTp1B2nnEiaNiLe4HmX9NNmGw9/UPn/SMs9xlmSYqBkKpcpnSiTN4TSl/xbUbsjA7ZVxapxoeQl1VTR7ssGHfsAh1NHC/XP70QmM7f2HTZbkatMVzh9C/Sl5aorI6TkZxxmMryNybVetTfptV/dd6tdt/U+X8iEZT5IQIXuLUMGwfgaUzVQWA7n+wsXDaLmu3Vt78mGNUeKh9EPtjsEGtbLB2wxkhI94ujBeg897BtWYpIPWg6dk1fZ2V3GQEmU6ZxHmsAwKpvqlXqBv4wKSbO3oaXc264agg9umtD7c+pbSg8LmSx8f/TWMZAy1v8KHepAqQkxlmmmmansYjh1ZX1VPoP81ICVY6nAOt6QBBKfyO+fSqu89LTRob4CtAzKjpVUFiXAQ+ETGIuEQqs5m1vz3jD8WGs46H21B79A8F/s+ADlfaUAXIaetj/DapUVJO36ScJkugK4NHT4uh744KWImPF7mqNjlRKoXDFSqP/moOmKom/5yBuLKra0wMUO3KNAFRrf5dn8q6W/Ypy7/PFbEvzPLpZQtbbVWmgGgMv3WQdZDSYDqcCJAzInkfzPM3Zi+Hsa/ZcT9lPP08ku2AjRJgrjolEsqHmi/56yMrtmmSnygcx26G19bOWjDcCI6E6ne2b+57rDH6f3kW2QTvNaWQQnDheXeBqdDLdtp6dCnN8qWpGr2ip/0xZFXFBqrp1t7qkxsJoT1NPS7zJdAQqlvIBvsT3ix5Afcxd/MJ6adXl6jXKbGXOqUIVTJJca9hxGlMRVOWoN4v3p3DnlilJSw+eKwRB5uWw7LQo2tCPNLVHtPl1dQSpuJ4ujnZWoF02/sRnzauKiVh5uI5J4GytFRmUa7+CMbyeBxaUQK7hf/4Awbd8qBYFhZUb3DDMvRnguV5BOBjWDpycyVgxY+dBAfHYEkcLnlfh9YD3+HlMi4glRQVSOyx4Pc/jIxrIruGCYRh+y6SgBs96TseNyggzL/lkO7QQLOK/SbEfvUElclJIOaDgz68i5P2qjjLjaOjwPRGFpfdQszfL6Ouv3LkxdgfOU/Rh3r43uNsyvnGWtdqjz2WmZfZ/aSKBR4BQg7ryOuicbwWKE6Qyt6fzraeL4m8ET5u8meANCHeP0pbWDEdUJwgvyF6TU3xzhdW3x0FWRyyU4Qim37PRn4s/W2vTI30oNfPLOjbAzyExdXkF8fqMZp0lfwz/VS1DB0ZzTeo6ZE/sw+dgqrrKAWLcp3arygWvEhnLyzS2URGuVapWCzUuwoKD4kMzjmt16xJR1SeY3o43/b+6ODBKTBYYvIsdRFahunPruFeBniaGvzCd0wjquPiJk4T6RNMzIuNZAghHzCEv7cK++HJR4OWU3V2u1yz7gg2Su5ZQq2Ph+Rh9fU5smLle4XKqzH2V256w0UGVFVBWtyBTOnCoxb9gQfnHF6dFx4WYMZeVTl2oPHAAFN+AvY6lpQ4gDuQURuumKAiX9y9mtH9jMHrQXu4E4g2I0dD3PA9FLvQg50XGX8FL1wrULpf7AqXSoQcGpOqwaVQVmdQ/0HbHC11TsSEqrVRFB3DkEYwm1hWmNOe52NN9LbG67wxQ9VQk7T26ptdyalqDOa8kPf+/9B+4nISLUZY+A7ewxeS/n8lRD7G/igPOm3X/g6eTOdPnypO26fpeoyUPiMZINyKLR4r8VjfgspeWQDN8i0jhwJr7dbwHGxvnFtz8bJnitmdbxOmeBoo5xGqYO509UeYUqNWrtfGyib8Xqw0mSgViGQhj4NvFMz/ccQoQ3GgA5KLaGTwASvAE1Xb+e34ddAIYRjJMrrDyVEtfB+zYqo3KcSksoLdi/lMfOtWPqWAHDWUAsxSgh7Qm12Wfdjyh68tUEJCGpAFi5UM94EaX2rjruk0d0TtT7OuAOJnoQjfJSrUTWBirZR9Uh4bqdFXX5bgrxSBoEheCBeP2/oUD3QQF4zi4Ke7imgN3HPUXWfI4fzrFAYXs/X+VTjofGCywnjUn2+g6GcSbSOFTMkyAntQcwZbhaQHZAxxOY0Lak03/8iHIZp7DHMQqdDdr1PHZuJf+VU9In5gP87ufXFc2w78MDAgqw==aEJiU6YSQQ2jjJiBR45csNWln1cUoPjHfisrx4xRDS0+towlb4aFSmXeziM9rDqUAhlrzgyCRq1JB6BjTnySpbus7KNYK8ryA/36aGymAw34nWp0N2pgJcvY3tXTnt0qw4mqhlGnyfMt/AMdjvfn3R241D0nlm1878ohr+LYZZ2LlolTvQ3dUdBCBHevynofouxfPBtvWe5a3ztAQT6RsqoaHc+vCrq6Rqe6pxopA92hmecgXxTc8eD9QZaKRCjAEtQN6V8putleKiLgn7KCMOS7Xff92vzGQEZHpU/Ygwn
Source: sakura, 00000732.00000477.9.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: location: Library/Java/JavaVirtualMachines/jdk-11.0.3.jdk+

Language, Device and Operating System Detection

Queries the unique Apple serial number of the machine

Source: /Users/bernard/Desktop/sakura (PID: 689)	IOPlatformSerialNumber keyword found in command: /bin/bash /bin/bash -c ioreg -rd1 -c IOPlatformExpertDevice\| awk -F '=' '/IOPlatformSerialNumber/ {print $2}' \| sed -e 's\|.'$.$'.*\|\1\|g'			Jump to behavior
Source: /bin/bash (PID: 691)	IOPlatformSerialNumber keyword found in command: /usr/bin/awk awk -F = /IOPlatformSerialNumber/ {print $2}			Jump to behavior

Executes the "ioreg" command used to gather hardware information (I/O kit registry)

Source: /Users/bernard/Desktop/sakura (PID: 622)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior
Source: /bin/bash (PID: 686)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior
Source: /bin/bash (PID: 690)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior

Queries OS software version with shell command 'sw_vers'

Source: /Users/bernard/Desktop/sakura (PID: 621)

sw_vers executed: sw_vers -productVersion

Jump to behavior

Reads hardware related sysctl values

Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl read request: hw.ncpu (6.3)			Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl read request: hw.memsize (6.24)			Jump to behavior

Reads process information of other processes

Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.615 -> queries PID 615	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.615 -> queries PID 615	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.575 -> queries PID 575	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.575 -> queries PID 575	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.567 -> queries PID 567	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.567 -> queries PID 567	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.546 -> queries PID 546	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.546 -> queries PID 546	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.543 -> queries PID 543	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.543 -> queries PID 543	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.452 -> queries PID 452	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.452 -> queries PID 452	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.389 -> queries PID 389	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.389 -> queries PID 389	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.365 -> queries PID 365	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.365 -> queries PID 365	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.364 -> queries PID 364	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.364 -> queries PID 364	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.362 -> queries PID 362	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.362 -> queries PID 362	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.361 -> queries PID 361	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.361 -> queries PID 361	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.356 -> queries PID 356	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.356 -> queries PID 356	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.341 -> queries PID 341	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.341 -> queries PID 341	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.336 -> queries PID 336	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.336 -> queries PID 336	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.326 -> queries PID 326	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.326 -> queries PID 326	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.325 -> queries PID 325	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.325 -> queries PID 325	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.316 -> queries PID 316	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.316 -> queries PID 316	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.315 -> queries PID 315	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.315 -> queries PID 315	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.313 -> queries PID 313	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.313 -> queries PID 313	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.297 -> queries PID 297	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.297 -> queries PID 297	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.285 -> queries PID 285	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.285 -> queries PID 285	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.284 -> queries PID 284	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.284 -> queries PID 284	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.282 -> queries PID 282	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.282 -> queries PID 282	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.281 -> queries PID 281	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.281 -> queries PID 281	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.280 -> queries PID 280	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.280 -> queries PID 280	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.272 -> queries PID 272	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.272 -> queries PID 272	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.271 -> queries PID 271	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.271 -> queries PID 271	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.267 -> queries PID 267	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.267 -> queries PID 267	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.265 -> queries PID 265	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.265 -> queries PID 265	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.264 -> queries PID 264	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.264 -> queries PID 264	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.262 -> queries PID 262	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.262 -> queries PID 262	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.255 -> queries PID 255	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.255 -> queries PID 255	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.235 -> queries PID 235	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.235 -> queries PID 235	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.231 -> queries PID 231	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.231 -> queries PID 231	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.226 -> queries PID 226	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.226 -> queries PID 226	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.222 -> queries PID 222	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.222 -> queries PID 222	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.218 -> queries PID 218	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.218 -> queries PID 218	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.217 -> queries PID 217	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.217 -> queries PID 217	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.212 -> queries PID 212	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.212 -> queries PID 212	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.210 -> queries PID 210	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.210 -> queries PID 210	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.201 -> queries PID 201	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.201 -> queries PID 201	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.194 -> queries PID 194	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.194 -> queries PID 194	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.190 -> queries PID 190	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.190 -> queries PID 190	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.168 -> queries PID 168	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.168 -> queries PID 168	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.157 -> queries PID 157	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.157 -> queries PID 157	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.155 -> queries PID 155	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.155 -> queries PID 155	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.118 -> queries PID 118	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.118 -> queries PID 118	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.116 -> queries PID 116	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.116 -> queries PID 116	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.96 -> queries PID 96	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.96 -> queries PID 96	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.90 -> queries PID 90	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.90 -> queries PID 90	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.65 -> queries PID 65	Jump to behavior

Reads the systems OS release and/or type

Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior
Source: /usr/bin/uname (PID: 629)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /usr/bin/uname (PID: 629)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior

Reads the systems hostname

Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 624)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/uname (PID: 629)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 658)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 661)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 665)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 671)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 676)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 679)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 682)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 685)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 689)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 693)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 694)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 695)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 699)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 702)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 706)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 709)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 712)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 717)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 718)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 719)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 725)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 728)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 737)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 740)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 743)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 746)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 747)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 748)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 751)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 754)	Sysctl requested: kern.hostname (1.10)	Jump to behavior

Source: /usr/bin/sw_vers (PID: 621)

System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Jump to behavior

Executes the "uname" command used to read OS and architecture name

Source: /Users/bernard/Desktop/sakura (PID: 629)

Uname executable: /usr/bin/uname -> uname -m

Jump to behavior

Screenshots

Network Map

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Contacted Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.3.8	appledownload.map.fastly.net	United States	54113	FASTLYUS	false
104.126.113.20	unknown	United States	16625	AKAMAI-ASUS	false
151.101.3.6	h3.apis.apple.map.fastly.net	United States	54113	FASTLYUS	false
151.101.67.6	unknown	United States	54113	FASTLYUS	false

Contacted Domains

Name	IP	Active
appledownload.map.fastly.net	151.101.3.8	true
h3.apis.apple.map.fastly.net	151.101.3.6	true

Contains symbols with suspicious names likely related to encryption

Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).BlockSize
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).MarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha1.init.0
Source: submission: sakura	Mach-O symbol: _crypto/sha1.useAVX2
Source: submission: sakura	Mach-O symbol: _crypto/sha1.blockAVX2.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha1.init
Source: submission: sakura	Mach-O symbol: _crypto/sha1.block
Source: submission: sakura	Mach-O symbol: _crypto/sha1.blockAMD64.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha1..inittask
Source: submission: sakura	Mach-O symbol: _crypto/sha1.New
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).constSum
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).Write
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).checkSum
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).Sum
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).UnmarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).Reset
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).Size
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).ConstantTimeSum
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).MarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha1.(*digest).BlockSize
Source: submission: sakura	Mach-O symbol: _crypto/rsa.mgf1XOR
Source: submission: sakura	Mach-O symbol: _crypto/rsa.nonZeroRandomBytes
Source: submission: sakura	Mach-O symbol: _crypto/rsa.hashPrefixes
Source: submission: sakura	Mach-O symbol: _crypto/rsa.init
Source: submission: sakura	Mach-O symbol: _crypto/rsa.errPublicExponentSmall
Source: submission: sakura	Mach-O symbol: _crypto/rsa.errPublicModulus
Source: submission: sakura	Mach-O symbol: _crypto/rsa.encrypt
Source: submission: sakura	Mach-O symbol: _crypto/rsa.errPublicExponentLarge
Source: submission: sakura	Mach-O symbol: _crypto/rsa.bigZero
Source: submission: sakura	Mach-O symbol: _crypto/rsa.emsaPSSVerify
Source: submission: sakura	Mach-O symbol: _crypto/rsa.bigOne
Source: submission: sakura	Mach-O symbol: _crypto/rsa.VerifyPKCS1v15
Source: submission: sakura	Mach-O symbol: _crypto/rsa.VerifyPSS
Source: submission: sakura	Mach-O symbol: _crypto/rsa.ErrMessageTooLong
Source: submission: sakura	Mach-O symbol: _crypto/rsa.ErrVerification
Source: submission: sakura	Mach-O symbol: _crypto/rsa.EncryptPKCS1v15
Source: submission: sakura	Mach-O symbol: _crypto/rsa.ErrDecryption
Source: submission: sakura	Mach-O symbol: _crypto/rsa.(*PublicKey).Size
Source: submission: sakura	Mach-O symbol: _crypto/rsa..inittask
Source: submission: sakura	Mach-O symbol: _crypto/rsa.(*PublicKey).Equal
Source: submission: sakura	Mach-O symbol: _crypto/rc4.KeySizeError.Error
Source: submission: sakura	Mach-O symbol: _crypto/rc4.NewCipher
Source: submission: sakura	Mach-O symbol: _crypto/rc4..inittask
Source: submission: sakura	Mach-O symbol: _crypto/rc4..stmp_0
Source: submission: sakura	Mach-O symbol: _crypto/rc4.(*Cipher).XORKeyStream
Source: submission: sakura	Mach-O symbol: _crypto/rc4.(*KeySizeError).Error
Source: submission: sakura	Mach-O symbol: _crypto/rand.warnBlocked
Source: submission: sakura	Mach-O symbol: _crypto/rc4.(*Cipher).Reset
Source: submission: sakura	Mach-O symbol: _crypto/rand.init.0
Source: submission: sakura	Mach-O symbol: _crypto/rand.init.1
Source: submission: sakura	Mach-O symbol: _crypto/rand.hideAgainReader.Read
Source: submission: sakura	Mach-O symbol: _crypto/rand.batched
Source: submission: sakura	Mach-O symbol: _crypto/rand.batched.func1
Source: submission: sakura	Mach-O symbol: _crypto/rand.Reader
Source: submission: sakura	Mach-O symbol: _crypto/rand.altGetRandom
Source: submission: sakura	Mach-O symbol: _crypto/rand..stmp_0
Source: submission: sakura	Mach-O symbol: _crypto/rand.Read
Source: submission: sakura	Mach-O symbol: _crypto/rand.(*reader).Read.func1
Source: submission: sakura	Mach-O symbol: _crypto/rand..inittask
Source: submission: sakura	Mach-O symbol: _crypto/rand.(*reader).Read
Source: submission: sakura	Mach-O symbol: _crypto/md5.init.0
Source: submission: sakura	Mach-O symbol: _crypto/rand.(*hideAgainReader).Read
Source: submission: sakura	Mach-O symbol: _crypto/md5.New
Source: submission: sakura	Mach-O symbol: _crypto/md5.block.abi0
Source: submission: sakura	Mach-O symbol: _crypto/md5..inittask
Source: submission: sakura	Mach-O symbol: _crypto/md5..stmp_1
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).Write
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).checkSum
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).Sum
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).UnmarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).Size
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).MarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).Reset
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil.closedChanOnce
Source: submission: sakura	Mach-O symbol: _crypto/md5.(*digest).BlockSize
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil.MaybeReadByte.func1
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil.closedChan
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil..inittask
Source: submission: sakura	Mach-O symbol: _crypto/internal/randutil.MaybeReadByte
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521ZeroEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521ToBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521ToMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Square
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Sub
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Mul
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Selectznz
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521FromMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521MinusOneEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521CmovznzU64
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521FromBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p521Add
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384ToMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384ZeroEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Sub
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384ToBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Selectznz
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Square
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384MinusOneEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Mul
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384FromMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384FromBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256ZeroEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p384Add
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256Sub
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256ToBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256FromMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p256MinusOneEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224ToMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224ZeroEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224ToBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Square
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Sub
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Mul
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Selectznz
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224FromMontgomery
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224MinusOneEncoding
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224Add
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.p224FromBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat..inittask
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.init
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).IsZero
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).SetBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).Equal
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P521Element).Invert
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).SetBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Invert
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).IsZero
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P384Element).Equal
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P256Element).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).IsZero
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).SetBytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Equal
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec/fiat.(*P224Element).Invert
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521Sqrt
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521SqrtCandidate
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521GeneratorTableOnce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521Polynomial
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521GeneratorTable
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521CheckOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521G
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384SqrtCandidate
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p521B
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384Polynomial
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384Sqrt
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384GeneratorTable
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384GeneratorTableOnce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384G
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384B
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p384CheckOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Sqrt
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Zero
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256SelectAffine.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Sqr.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256PrecomputedEmbed
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Select.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Polynomial
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Precomputed
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256PointDoubleAsm.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256PointAddAffineAsm.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256PointAddAsm.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdSqr.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256P
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdMul.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdReduce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdBigToLittle.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256OrdLittleToBig.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256One
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Mul.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256NegCond.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256LittleToBig.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256MovCond.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256FromMont.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Inverse
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256BigToLittle.abi0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256CheckOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224SqrtCandidate.func1
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p256Add
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224SqrtCandidate
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224Polynomial
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224Sqrt
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224GeneratorTableOnce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224MinusOne
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224GGOnce
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224GeneratorTable
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224G
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224GG
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224CheckOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.init.0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.p224B
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.P256OrdInverse
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.init
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.NewP384Point
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.NewP521Point
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.NewP224Point
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.NewP256Point
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec..stmp_3
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec..stmp_5
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec..inittask
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec..stmp_0
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*p384Table).Select
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*p521Table).Select
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).generatorTable.func1
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*p224Table).Select
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).bytes
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).generatorTable
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).Select
Source: submission: sakura	Mach-O symbol: _crypto/internal/nistec.(*P521Point).SetBytes
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientKeyExchangeMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshalWithoutBinders
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func8.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func8
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func7
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func7.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func6
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func6.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func4.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func5
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func3.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.2.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func13
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func13.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func11.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func10.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func11
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func10
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).sendClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).sendClientFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerParameters
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).processServerHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).processHelloRetryRequest
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).establishHandshakeKeys
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).handshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).sendFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).checkServerHelloOrHRR
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).readFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).readSessionTicket
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).pickCipherSuite
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).processServerHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).handshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).doFullHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).establishKeys
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).nextTrafficSecret
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).trafficKey
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).extract
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).finishedHash
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).exportKeyingMaterial
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).exportKeyingMaterial.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).expandLabel.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).expandLabel.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).expandLabel
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateVerifyMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).deriveSecret
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateVerifyMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateVerifyMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateStatusMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateVerifyMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateStatusMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateStatusMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateStatusMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.3.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.3.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.2.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsgTLS13).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateRequestMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsgTLS13).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsgTLS13).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsgTLS13).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*atLeastReader).Read
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*certificateMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*alert).String
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509.UnknownAuthorityError
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).flushChild
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1GeneralizedTime
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1Element
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509/internal/macos.OSStatus
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1Boolean
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509.rfc2821Mailbox
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1BitString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadOptionalASN1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1UTCTime
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1ObjectIdentifier
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*String).ReadASN1Integer
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.chacha20Constants
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.avx2InitMask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.avx2IncMask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.andMask
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/cipher.gcm
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.errOpen
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.chacha20Poly1305Seal.abi0
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.chacha20Poly1305Open.abi0
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/elliptic.CurveParams
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/ecdsa.PublicKey
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.rol16
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/ecdsa.PrivateKey
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.polyClampMask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.rol8
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/sha256.digest
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.writeUint64
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/sha1.digest
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.useAVX2
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/rc4.Cipher
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.sseIncMask
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/rand.reader
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.setupState
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/tls.xorNonceAEAD
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).callContinuation
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/tls.prefixNonceAEAD
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).addLengthPrefixed
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/tls.atLeastReader
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).AddUint32
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/tls.RecordHeaderError
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.writeWithPadding
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509.HostnameError
Source: submission: sakura	Mach-O symbol: _type..eq.crypto/x509.CertificateInvalidError
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/cryptobyte.(*Builder).callContinuation.func1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..stmp_4
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..stmp_3
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).Open
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20.newUnauthenticatedCipher
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20.hChaCha20
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..stmp_5
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).openGeneric
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).open
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).Seal
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).Overhead
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).sealGeneric
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305.(*chacha20poly1305).seal
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_2
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_10
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_0
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_6
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_4
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20poly1305..stmp_3
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20.(*Cipher).xorKeyStreamBlocksGeneric
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20.(*Cipher).XORKeyStream
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/crypto/chacha20..stmp_2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*alert).Error
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*RecordHeaderError).Error
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*SignatureScheme).String
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*CurveID).String
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Dialer).DialContext
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeRecordLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeRecordLocked.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeHandshakeRecord
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeHandshakeRecord.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeChangeCipherRecord.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).write
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).writeChangeCipherRecord
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlertLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).verifyServerCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlert
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlert.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).readRecordOrCCS
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).retryReadRecord
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).readHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).readHandshake.jump50
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).readFromUntil
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).maxPayloadSizeForWrite
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).pickTLSVersion
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).loadSession
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).makeClientHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext.func3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext.func4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handshakeContext
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleRenegotiation
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleRenegotiation.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleNewSessionTicket
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handlePostHandshakeMessage
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleKeyUpdate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).handleKeyUpdate.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).flush
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).getClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).closeNotify.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).connectionStateLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).closeNotify
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake-fm
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Write.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Write
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Write.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).SetReadDeadline
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).SetWriteDeadline
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).SetDeadline
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Read.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).RemoteAddr
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).LocalAddr
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Read
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).ConnectionState
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).ConnectionState.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).Close
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).CloseWrite
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).supportedVersions
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).writeKeyLog
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).mutualVersion
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).Clone
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Config).Clone.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*CertificateRequestInfo).SupportsCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*ClientAuthType).String
Source: submission: sakura	Mach-O symbol: _crypto/sha512.init.0
Source: submission: sakura	Mach-O symbol: _crypto/sha512.useAVX2
Source: submission: sakura	Mach-O symbol: _crypto/sha512.blockAVX2.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha512.init
Source: submission: sakura	Mach-O symbol: _crypto/sha512.blockAMD64.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha512._K
Source: submission: sakura	Mach-O symbol: _crypto/sha512.block
Source: submission: sakura	Mach-O symbol: _crypto/sha512.New512_224
Source: submission: sakura	Mach-O symbol: _crypto/sha512.New512_256
Source: submission: sakura	Mach-O symbol: _crypto/sha512.New
Source: submission: sakura	Mach-O symbol: _crypto/sha512.New384
Source: submission: sakura	Mach-O symbol: _crypto/sha512..inittask
Source: submission: sakura	Mach-O symbol: _crypto/sha512..stmp_0
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).Write
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).checkSum
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).UnmarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).Size
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).Sum
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).MarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).Reset
Source: submission: sakura	Mach-O symbol: _crypto/sha256.useAVX2
Source: submission: sakura	Mach-O symbol: _crypto/sha512.(*digest).BlockSize
Source: submission: sakura	Mach-O symbol: _crypto/sha256.init
Source: submission: sakura	Mach-O symbol: _crypto/sha256.init.0
Source: submission: sakura	Mach-O symbol: _crypto/sha256.block.abi0
Source: submission: sakura	Mach-O symbol: _crypto/sha256.New224
Source: submission: sakura	Mach-O symbol: _crypto/sha256.Sum224
Source: submission: sakura	Mach-O symbol: _crypto/sha256..inittask
Source: submission: sakura	Mach-O symbol: _crypto/sha256.New
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).Write
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).checkSum
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).Sum
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).UnmarshalBinary
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).Reset
Source: submission: sakura	Mach-O symbol: _crypto/sha256.(*digest).Size
Source: submission: sakura	Mach-O symbol: _sakura-agent/system.EncryptBytes
Source: submission: sakura	Mach-O symbol: _sakura-agent/system.DecryptBytes
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.ScalarMult
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.Params
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.ScalarBaseMult
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.Add
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.PublicKey.IsOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).ScalarMult
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa..inittask
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).Params
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).ScalarBaseMult
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).IsOnCurve
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).Add
Source: submission: sakura	Mach-O symbol: _crypto/ecdsa.(*PublicKey).Equal
Source: submission: sakura	Mach-O symbol: _crypto/dsa.ErrInvalidPublicKey
Source: submission: sakura	Mach-O symbol: _crypto/dsa.init
Source: submission: sakura	Mach-O symbol: _crypto/des.sBoxes
Source: submission: sakura	Mach-O symbol: _crypto/dsa..inittask
Source: submission: sakura	Mach-O symbol: _crypto/des.permutedChoice1

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49391 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49414 version: TLS 1.2

Contains symbols with suspicious names likely related to networking

Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.(*HttpResponse).Read
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.(*HttpResponse).Read.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.(*HttpResponse).requestCreate
Source: submission: sakura	Mach-O symbol: _syscall.sendtoInet6
Source: submission: sakura	Mach-O symbol: _syscall.sendtoInet4
Source: submission: sakura	Mach-O symbol: _syscall.sendto
Source: submission: sakura	Mach-O symbol: _syscall.sendfile
Source: submission: sakura	Mach-O symbol: _syscall.socket
Source: submission: sakura	Mach-O symbol: _syscall.setsockopt
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.(*HttpService).AddHandlerPOST
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.(*HttpService).Start
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.(*HttpService).Start.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver..stmp_0
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.webserver
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver.(*HttpService).Stop
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/webserver..inittask
Source: submission: sakura	Mach-O symbol: _syscall.minRoutingSockaddrLen
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/tasks.GetTasksFromServer.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/models/tasks.GetTasksFromServer
Source: submission: sakura	Mach-O symbol: _syscall.libc_sendto_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_sendfile_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_setsockopt_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_socket_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_getsockopt_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_getsockname_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.libc_connect_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _syscall.getsockopt
Source: submission: sakura	Mach-O symbol: _syscall.getsockname
Source: submission: sakura	Mach-O symbol: _syscall.SocketDisableIPv6
Source: submission: sakura	Mach-O symbol: _syscall.anyToSockaddr
Source: submission: sakura	Mach-O symbol: _syscall.connect
Source: submission: sakura	Mach-O symbol: _syscall.Getsockname
Source: submission: sakura	Mach-O symbol: _syscall.GetsockoptInt
Source: submission: sakura	Mach-O symbol: _syscall.Sendto
Source: submission: sakura	Mach-O symbol: _syscall.Socket
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientKeyExchangeMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).updateBinders.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshalWithoutBinders
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func8.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func9
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func8
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func7
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func7.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func6
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func6.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func4.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func5
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func3.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func15.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.2.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func14
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func13
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func13.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func11.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func12
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func10.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func11
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func10
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHelloMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).sendClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).sendClientFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerParameters
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).processServerHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).readServerCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).processHelloRetryRequest
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).establishHandshakeKeys
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).handshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).sendFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeStateTLS13).checkServerHelloOrHRR
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).readFinished
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).readSessionTicket
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).pickCipherSuite
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).processServerHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).handshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).doFullHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientHandshakeState).establishKeys
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).exportKeyingMaterial
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*cipherSuiteTLS13).exportKeyingMaterial.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/system/sys.DomainName
Source: submission: sakura	Mach-O symbol: _sakura-agent/system/sys.DomainName.func1
Source: submission: sakura	Mach-O symbol: _type..eq.github.com/go-ping/ping.Packet
Source: submission: sakura	Mach-O symbol: _sakura-agent/system/session.getActiveDirectoryDomain
Source: submission: sakura	Mach-O symbol: _type..eq.database/sql.dsnConnector
Source: submission: sakura	Mach-O symbol: _sakura-agent/system/service.showMemoryReport
Source: submission: sakura	Mach-O symbol: _type..eq.[4]net/http.http2Setting
Source: submission: sakura	Mach-O symbol: _updateMapping
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlertLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).verifyServerCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlert
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).sendAlert.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).makeClientHello
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).getClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).connectionStateLocked
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake-fm
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).clientHandshake
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).ConnectionState
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*Conn).ConnectionState.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*CertificateRequestInfo).SupportsCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*ClientAuthType).String
Source: submission: sakura	Mach-O symbol: _time.sendTime
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.SendRequestToStandAlone.func1
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.SendRequestToStandAlone
Source: submission: sakura	Mach-O symbol: _sakura-agent/sio.NewHttpResponse
Source: submission: sakura	Mach-O symbol: _database/sql.dsnConnector.Connect
Source: submission: sakura	Mach-O symbol: _database/sql.connectionRequestQueueSize
Source: submission: sakura	Mach-O symbol: _database/sql.(*dsnConnector).Connect
Source: submission: sakura	Mach-O symbol: _database/sql.(*driverConn).validateConnection
Source: submission: sakura	Mach-O symbol: _database/sql.(*driverConn).validateConnection.func1
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/sessions/remote/truster.ConnectionTruster
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/connection/stun.StunManager
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/connection/stun.StunHandler
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/ping_monitor.remoteSessionData
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/ping.HostInfoData
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/models/network/connection/stun.StunServerDTO
Source: submission: sakura	Mach-O symbol: _type..eq.net/http/pprof.profileEntry
Source: submission: sakura	Mach-O symbol: _internal/poll.SendFile.func1
Source: submission: sakura	Mach-O symbol: _internal/poll.SendFile
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).pingDC.func1
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).openNewConnection.func1
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).pingDC
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).openNewConnection
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).connectionOpener
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).connectionCleaner
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).connectionCleanerRunLocked
Source: submission: sakura	Mach-O symbol: _database/sql.(*DB).PingContext
Source: submission: sakura	Mach-O symbol: _internal/poll.(*FD).SetsockoptInt.func1
Source: submission: sakura	Mach-O symbol: _internal/poll.(*FD).SetsockoptInt
Source: submission: sakura	Mach-O symbol: _runtime/pprof.(*profileBuilder).readMapping
Source: submission: sakura	Mach-O symbol: _runtime/pprof.(*profileBuilder).pbMapping
Source: submission: sakura	Mach-O symbol: _runtime/pprof.(*profileBuilder).addMapping-fm
Source: submission: sakura	Mach-O symbol: _runtime/pprof.(*profileBuilder).addMapping
Source: submission: sakura	Mach-O symbol: _sqlcipher_check_connection
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2PriorityFrame
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2PingFrame
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2StreamError
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2Setting
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2RSTStreamFrame
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2PriorityParam
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.httpError
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2stickyErrWriter
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2connError
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2WindowUpdateFrame
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.muxEntry
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.maxBytesReader
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.initALPNRequest
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.socksUsernamePassword
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.redirectHandler
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.readTrackingBody
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.onceCloseListener
Source: submission: sakura	Mach-O symbol: _type..eq.net/http/internal.chunkedReader
Source: submission: sakura	Mach-O symbol: _type..eq.net/http/httptrace.GotConnInfo
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.statusError
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.ValidTrailerHeader
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.PunycodeHostPort
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.badTrailer
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.connReader
Source: submission: sakura	Mach-O symbol: _type..eq.net.portLookupResult
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2FrameWriteRequest
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2FrameHeader
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.expectContinueReader
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.connectMethodKey
Source: submission: sakura	Mach-O symbol: _type..eq.net/http.http2GoAwayError
Source: submission: sakura	Mach-O symbol: _type..eq.internal/profile.Mapping
Source: submission: sakura	Mach-O symbol: _type..eq.internal/profile.mappingKey
Source: submission: sakura	Mach-O symbol: _type..eq.golang.org/x/net/internal/socket.Conn
Source: submission: sakura	Mach-O symbol: _type..eq.golang.org/x/sys/unix.SockaddrUnix
Source: submission: sakura	Mach-O symbol: _type..eq.golang.org/x/sys/unix.SockaddrInet4
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool..dict.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Get
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool..dict.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).ListKeys
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool..dict.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Add
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool..dict.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Remove
Source: submission: sakura	Mach-O symbol: _sakura-agent/config.(*SettingsData).GetServerAddress
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Add
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Get
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Remove
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Unlock
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).ListKeys
Source: submission: sakura	Mach-O symbol: _sakura-agent/common/pool.(*Pool[string,sakura-agent/models/network/connection/stun.StunServerDTO]).Lock
Source: submission: sakura	Mach-O symbol: _type..eq.vendor/golang.org/x/net/http2/hpack.HeaderField
Source: submission: sakura	Mach-O symbol: _type..eq.vendor/golang.org/x/net/http/httpproxy.domainMatch
Source: submission: sakura	Mach-O symbol: _type..eq.vendor/golang.org/x/net/http2/hpack.pairNameValue
Source: submission: sakura	Mach-O symbol: _type..hash.net/http.connectMethodKey
Source: submission: sakura	Mach-O symbol: _type..hash.internal/profile.mappingKey
Source: submission: sakura	Mach-O symbol: _type..hash.vendor/golang.org/x/net/http2/hpack.pairNameValue
Source: submission: sakura	Mach-O symbol: _type..eq.syscall.SockaddrInet4
Source: submission: sakura	Mach-O symbol: _type..eq.syscall.SockaddrUnix
Source: submission: sakura	Mach-O symbol: _type..eq.vendor/golang.org/x/net/http/httpproxy.Config
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/system/session.ClientNetData
Source: submission: sakura	Mach-O symbol: _type..eq.sakura-agent/sio.HttpResponse
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/idna.mappings
Source: submission: sakura	Mach-O symbol: _reflect.methodReceiver
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/idna.info.appendMapping
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.glob..func1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.huffmanCodeLen
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.huffmanCodes
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.huffmanDecode
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.buildRootHuffmanNode
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.buildRootOnce
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.errNeedMore
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.errVarintOverflow
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.lazyRootHuffmanNode
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.readVarInt
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.staticTable
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.staticTableEntries
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*headerFieldTable).evictOldest
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*headerFieldTable).idToIndex
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*headerFieldTable).search
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*dynamicTable).add
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*dynamicTable).evict
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_0
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack..stmp_1
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.AppendHuffmanString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.DecodingError.Error
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.InvalidIndexError.Error
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.NewDecoder
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.NewEncoder
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.appendHpackString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.ErrInvalidHuffman
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.ErrStringLength
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.HeaderField.String
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.appendIndexedName
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.appendNewName
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.bufPool
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.ipMatch.match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.parseProxy
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.portMap
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).Close
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).decodeString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseDynamicTableSizeUpdate
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).SetEmitFunc
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).Write
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).at
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).callEmit
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseFieldLiteral
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseHeaderFieldRepr
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).readString
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*DecodingError).Error
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Decoder).parseFieldIndexed
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*InvalidIndexError).Error
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).SetMaxDynamicTableSize
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).WriteField
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*Encoder).searchTable
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http2/hpack.(*HeaderField).String
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.headerValueContainsToken
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).proxyForURL
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).proxyForURL-fm
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*config).useProxy
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.isTokenTable
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpguts.validHostByte
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*allMatch).match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*cidrMatch).match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*domainMatch).match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.(*ipMatch).match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy..inittask
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.domainMatch.match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.idnaASCII
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.init
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.FromEnvironment
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.allMatch.match
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.canonicalAddr
Source: submission: sakura	Mach-O symbol: _vendor/golang.org/x/net/http/httpproxy.cidrMatch.match
Source: submission: sakura	Mach-O symbol: _net/http..stmp_40
Source: submission: sakura	Mach-O symbol: _net/http..stmp_41
Source: submission: sakura	Mach-O symbol: _net/http..stmp_42
Source: submission: sakura	Mach-O symbol: _net/http..stmp_43
Source: submission: sakura	Mach-O symbol: _net/http..stmp_44
Source: submission: sakura	Mach-O symbol: _net/http..stmp_45
Source: submission: sakura	Mach-O symbol: _net/http..stmp_46
Source: submission: sakura	Mach-O symbol: _net/http..stmp_47
Source: submission: sakura	Mach-O symbol: _net/http..stmp_48
Source: submission: sakura	Mach-O symbol: _net/http..stmp_49
Source: submission: sakura	Mach-O symbol: _net/http..stmp_5
Source: submission: sakura	Mach-O symbol: _net/http..stmp_50
Source: submission: sakura	Mach-O symbol: _net/http..stmp_51
Source: submission: sakura	Mach-O symbol: _net/http..stmp_52
Source: submission: sakura	Mach-O symbol: _net/http..stmp_53
Source: submission: sakura	Mach-O symbol: _net/http..stmp_54
Source: submission: sakura	Mach-O symbol: _net/http..stmp_55
Source: submission: sakura	Mach-O symbol: _net/http..stmp_56
Source: submission: sakura	Mach-O symbol: _net/http..stmp_57
Source: submission: sakura	Mach-O symbol: _net/http..stmp_58
Source: submission: sakura	Mach-O symbol: _net/http..stmp_59
Source: submission: sakura	Mach-O symbol: _net/http..stmp_60
Source: submission: sakura	Mach-O symbol: _net/http..stmp_61
Source: submission: sakura	Mach-O symbol: _net/http..stmp_62
Source: submission: sakura	Mach-O symbol: _net/http..stmp_63
Source: submission: sakura	Mach-O symbol: _net/http..stmp_64
Source: submission: sakura	Mach-O symbol: _net/http..stmp_65
Source: submission: sakura	Mach-O symbol: _net/http..stmp_66
Source: submission: sakura	Mach-O symbol: _net/http..stmp_67
Source: submission: sakura	Mach-O symbol: _net/http..stmp_68
Source: submission: sakura	Mach-O symbol: _net/http..stmp_69
Source: submission: sakura	Mach-O symbol: _net/http..stmp_7
Source: submission: sakura	Mach-O symbol: _net/http..stmp_70
Source: submission: sakura	Mach-O symbol: _net/http..stmp_71
Source: submission: sakura	Mach-O symbol: _net/http..stmp_72
Source: submission: sakura	Mach-O symbol: _net/http..stmp_73
Source: submission: sakura	Mach-O symbol: _net/http..stmp_74
Source: submission: sakura	Mach-O symbol: _net/http..stmp_75
Source: submission: sakura	Mach-O symbol: _net/http..stmp_9
Source: submission: sakura	Mach-O symbol: _net/http..stmp_96
Source: submission: sakura	Mach-O symbol: _net/http..stmp_97
Source: submission: sakura	Mach-O symbol: _net/http.ConnState.String
Source: submission: sakura	Mach-O symbol: _net/http.DefaultServeMux
Source: submission: sakura	Mach-O symbol: _net/http.DefaultTransport
Source: submission: sakura	Mach-O symbol: _net/http.DetectContentType
Source: submission: sakura	Mach-O symbol: _net/http.ErrAbortHandler
Source: submission: sakura	Mach-O symbol: _net/http.ErrBodyNotAllowed
Source: submission: sakura	Mach-O symbol: _net/http.ErrBodyReadAfterClose
Source: submission: sakura	Mach-O symbol: _net/http.ErrContentLength
Source: submission: sakura	Mach-O symbol: _net/http.ErrHandlerTimeout
Source: submission: sakura	Mach-O symbol: _net/http.ErrHijacked
Source: submission: sakura	Mach-O symbol: _net/http.ErrLineTooLong
Source: submission: sakura	Mach-O symbol: _net/http.ErrMissingBoundary
Source: submission: sakura	Mach-O symbol: _net/http.ErrMissingFile
Source: submission: sakura	Mach-O symbol: _net/http.ErrNoCookie
Source: submission: sakura	Mach-O symbol: _net/http.ErrNoLocation
Source: submission: sakura	Mach-O symbol: _net/http.ErrNotMultipart
Source: submission: sakura	Mach-O symbol: _net/http.ErrNotSupported
Source: submission: sakura	Mach-O symbol: _net/http.ErrServerClosed
Source: submission: sakura	Mach-O symbol: _net/http.ErrSkipAltProtocol
Source: submission: sakura	Mach-O symbol: _net/http.ErrUseLastResponse
Source: submission: sakura	Mach-O symbol: _net/http.ErrWriteAfterFlush
Source: submission: sakura	Mach-O symbol: _net/http.Error
Source: submission: sakura	Mach-O symbol: _net/http.Handler.ServeHTTP-fm
Source: submission: sakura	Mach-O symbol: _net/http.HandlerFunc.ServeHTTP
Source: submission: sakura	Mach-O symbol: _net/http.Header.sortedKeyValues
Source: submission: sakura	Mach-O symbol: _net/http.Header.writeSubset
Source: submission: sakura	Mach-O symbol: _net/http.LocalAddrContextKey
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext.func1
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext.func2
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext.func3
Source: submission: sakura	Mach-O symbol: _net/http.NewRequestWithContext.func4
Source: submission: sakura	Mach-O symbol: _net/http.NotFound
Source: submission: sakura	Mach-O symbol: _net/http.ParseHTTPVersion
Source: submission: sakura	Mach-O symbol: _net/http.ProxyFromEnvironment
Source: submission: sakura	Mach-O symbol: _net/http.ReadResponse
Source: submission: sakura	Mach-O symbol: _net/http.Redirect
Source: submission: sakura	Mach-O symbol: _net/http.ServerContextKey
Source: submission: sakura	Mach-O symbol: _net/http.StatusText
Source: submission: sakura	Mach-O symbol: _net/http.aLongTimeAgo
Source: submission: sakura	Mach-O symbol: _net/http.alwaysFalse
Source: submission: sakura	Mach-O symbol: _net/http.appendSorted
Source: submission: sakura	Mach-O symbol: _net/http.appendSorted.func1
Source: submission: sakura	Mach-O symbol: _net/http.appendTime
Source: submission: sakura	Mach-O symbol: _net/http.bodyLocked.Read
Source: submission: sakura	Mach-O symbol: _net/http.bufioFlushWriter.Write
Source: submission: sakura	Mach-O symbol: _net/http.bufioReaderPool
Source: submission: sakura	Mach-O symbol: _net/http.bufioWriter2kPool
Source: submission: sakura	Mach-O symbol: _net/http.bufioWriter4kPool
Source: submission: sakura	Mach-O symbol: _net/http.canonicalAddr
Source: submission: sakura	Mach-O symbol: _net/http.checkConnErrorWriter.Write
Source: submission: sakura	Mach-O symbol: _net/http.cleanPath
Source: submission: sakura	Mach-O symbol: _net/http.cloneOrMakeHeader
Source: submission: sakura	Mach-O symbol: _net/http.colonSpace
Source: submission: sakura	Mach-O symbol: _net/http.connectMethodKey.String
Source: submission: sakura	Mach-O symbol: _net/http.cookieNameSanitizer
Source: submission: sakura	Mach-O symbol: _net/http.copyBufPool
Source: submission: sakura	Mach-O symbol: _net/http.crlf
Source: submission: sakura	Mach-O symbol: _net/http.defaultCheckRedirect
Source: submission: sakura	Mach-O symbol: _connect
Source: submission: sakura	Mach-O symbol: _IOConnectCallStructMethod
Source: submission: sakura	Mach-O symbol: _reflect.(*rtype).exportedMethods
Source: submission: sakura	Mach-O symbol: _reflect.flag.mustBeExportedSlow
Source: submission: sakura	Mach-O symbol: _crypto/tls.hashForServerKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.hasAESGCMHardwareSupport
Source: submission: sakura	Mach-O symbol: _crypto/tls.finishedHash.serverSum
Source: submission: sakura	Mach-O symbol: _crypto/tls.finishedHash.clientSum
Source: submission: sakura	Mach-O symbol: _crypto/tls.finishedHash.hashForClientCertificate
Source: submission: sakura	Mach-O symbol: _crypto/tls.errServerKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.errClientKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.defaultSupportedSignatureAlgorithms
Source: submission: sakura	Mach-O symbol: _crypto/tls.clientFinishedLabel
Source: submission: sakura	Mach-O symbol: _sendto
Source: submission: sakura	Mach-O symbol: _crypto/tls._ClientAuthType_index
Source: submission: sakura	Mach-O symbol: _crypto/tls.ClientAuthType.String
Source: submission: sakura	Mach-O symbol: _setsockopt
Source: submission: sakura	Mach-O symbol: _socket
Source: submission: sakura	Mach-O symbol: _recvmsg
Source: submission: sakura	Mach-O symbol: _sendfile
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverKeyExchangeMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverKeyExchangeMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func9
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func9.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func7.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func8
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func6
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func7
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func5.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func4
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func5
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func3.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func3.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func2.1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func3
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func2.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func10.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func10.2
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func10
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal.func1.1
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloDoneMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*rsaKeyAgreement).processServerKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*serverHelloDoneMsg).marshal
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*rsaKeyAgreement).generateClientKeyExchange
Source: submission: sakura	Mach-O symbol: _getsockopt
Source: submission: sakura	Mach-O symbol: _getsockname
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*ecdheKeyAgreement).generateClientKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*ecdheKeyAgreement).processServerKeyExchange
Source: submission: sakura	Mach-O symbol: _crypto/tls.(*clientKeyExchangeMsg).unmarshal
Source: submission: sakura	Mach-O symbol: _syscall.Connect
Source: submission: sakura	Mach-O symbol: _syscall.(*SockaddrUnix).sockaddr
Source: submission: sakura	Mach-O symbol: _syscall.(*SockaddrInet6).sockaddr
Source: submission: sakura	Mach-O symbol: _syscall.(*SockaddrInet4).sockaddr
Source: submission: sakura	Mach-O symbol: _syscall.(*SockaddrDatalink).sockaddr
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameHeader).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameHeader).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameHeader).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameType).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameWriteRequest).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2FrameWriteRequest).replyToWriter
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).ReadFrame
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteContinuation
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteDataPadded
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteGoAway
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteHeaders
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WritePing
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WritePushPromise
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteRSTStream
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteSettings
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteSettingsAck
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).WriteWindowUpdate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).checkFrameOrder
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).endWrite
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).logWrite
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).readMetaFrame
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).readMetaFrame.func1
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).readMetaFrame.func2
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Framer).readMetaFrame.func3
Source: submission: sakura	Mach-O symbol: _net/http.(*http2GoAwayError).Error
Source: submission: sakura	Mach-O symbol: _net/http.(*http2GoAwayFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2GoAwayFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2GoAwayFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).HeaderBlockFragment
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).HeadersEnded
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2HeadersFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).HeaderBlockFragment
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).HeadersEnded
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).checkPseudos
Source: submission: sakura	Mach-O symbol: _net/http.(*http2MetaHeadersFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PingFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PingFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PingFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PriorityFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PriorityFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PriorityFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).HeaderBlockFragment
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).HeadersEnded
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2PushPromiseFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2RSTStreamFrame).Header
Source: submission: sakura	Mach-O symbol: _net/http.(*http2RSTStreamFrame).String
Source: submission: sakura	Mach-O symbol: _net/http.(*http2RSTStreamFrame).invalidate
Source: submission: sakura	Mach-O symbol: _net/http.(*http2Server).ServeConn

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 17.253.97.201
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.113.20
Source: unknown	TCP traffic detected without corresponding DNS query: 104.126.113.20
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /2021/mobileassets/041-40471/B96AF6E1-5FF6-4786-9956-944A1AFE086A/com_apple_MobileAsset_KextDenyList/404087a7302927411b6ea0e05114d2c68355185e.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/062-08173/234EE7F7-CC33-4CD3-85FC-60590A103560/com_apple_MobileAsset_CoreSuggestions/84f6102e2a09dd10dd694d795792a7771b6014fc.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /2024/patches/052-54451/D609556E-69B1-482E-9C33-B2E3510A1311/com_apple_MobileAsset_TimeZoneUpdate/c5a4d0df08e8faecf4faebbbadc4d96a07d9d990.zip HTTP/1.1Host: updates.cdn-apple.comAccept: /Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)

Source: global traffic

DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Source: /Users/bernard/Desktop/sakura (PID: 620)

Reads from socket in process: data

Jump to behavior

Source: sakura	String found in binary or memory: http://127.0.0.1:1323http://127.0.0.1:4567http://localhost:1323illegal
Source: sakura, 00000750.00000513.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics
Source: sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000705.00000423.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics/softwar/hardwar/window-/antivir/trace/proc
Source: sakura, 00000705.00000423.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics/usr/libexec/AirPlayXPCHelper
Source: sakura, 00000666.00000345.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics/usr/libexec/findmydeviced
Source: sakura, 00000750.00000513.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metrics/usr/libexec/networkserviceproxy/usr/libexec/keyboardservicesd/usr/sb
Source: sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metricsn/usr/libexec/networkserviceproxy/usr/libexec/keyboardservicesd
Source: sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metricsn/usr/libexec/networkserviceproxy/usr/libexec/keyboardservicesd/usr/s
Source: sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp	String found in binary or memory: http://127.0.0.1:4567/w/metricsror:
Source: sakura, 00000620.00000255.1.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000661.00000337.1.000000010b55e000.000000010b568000.r--.sdmp, bash, 00000661.00000337.1.000000011442c000.0000000114455000.r--.sdmp, bash, 00000665.00000344.1.000000010fd27000.000000010fd31000.r--.sdmp, bash, 00000665.00000344.1.0000000111bda000.0000000111c03000.r--.sdmp, sakura, 00000666.00000345.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000697.00000407.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000705.00000423.9.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000706.00000426.9.000000010daac000.000000010dad5000.r--.sdmp, bash, 00000706.00000426.9.000000010d4cd000.000000010d4d7000.r--.sdmp, hostname, 00000719.00000452.9.0000000105a69000.0000000105a92000.r--.sdmp, hostname, 00000719.00000452.9.0000000103f41000.0000000103f44000.r--.sdmp, sakura, 00000732.00000477.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000750.00000513.9.000000010d6e3000.000000010d70c000.r--.sdmp	String found in binary or memory: http://crl.apple.com/codesigning.crl0
Source: sakura	String found in binary or memory: http://hw.ncpuinstallinvalidlookup
Source: sakura	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: sakura, 00000620.00000255.1.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000661.00000337.1.000000010b55e000.000000010b568000.r--.sdmp, bash, 00000661.00000337.1.000000011442c000.0000000114455000.r--.sdmp, bash, 00000665.00000344.1.000000010fd27000.000000010fd31000.r--.sdmp, bash, 00000665.00000344.1.0000000111bda000.0000000111c03000.r--.sdmp, sakura, 00000666.00000345.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000697.00000407.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000705.00000423.9.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000706.00000426.9.000000010daac000.000000010dad5000.r--.sdmp, bash, 00000706.00000426.9.000000010d4cd000.000000010d4d7000.r--.sdmp, hostname, 00000719.00000452.9.0000000105a69000.0000000105a92000.r--.sdmp, hostname, 00000719.00000452.9.0000000103f41000.0000000103f44000.r--.sdmp, sakura, 00000732.00000477.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000750.00000513.9.000000010d6e3000.000000010d70c000.r--.sdmp	String found in binary or memory: http://www.apple.com/appleca/root.crl0
Source: sakura, 00000620.00000255.1.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000661.00000337.1.000000010b55e000.000000010b568000.r--.sdmp, bash, 00000661.00000337.1.000000011442c000.0000000114455000.r--.sdmp, bash, 00000665.00000344.1.000000010fd27000.000000010fd31000.r--.sdmp, bash, 00000665.00000344.1.0000000111bda000.0000000111c03000.r--.sdmp, sakura, 00000666.00000345.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000697.00000407.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000705.00000423.9.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000706.00000426.9.000000010daac000.000000010dad5000.r--.sdmp, bash, 00000706.00000426.9.000000010d4cd000.000000010d4d7000.r--.sdmp, hostname, 00000719.00000452.9.0000000105a69000.0000000105a92000.r--.sdmp, hostname, 00000719.00000452.9.0000000103f41000.0000000103f44000.r--.sdmp, sakura, 00000732.00000477.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000750.00000513.9.000000010d6e3000.000000010d70c000.r--.sdmp	String found in binary or memory: http://www.apple.com/certificateauthority0
Source: sakura, 00000620.00000255.1.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000661.00000337.1.000000010b55e000.000000010b568000.r--.sdmp, bash, 00000661.00000337.1.000000011442c000.0000000114455000.r--.sdmp, bash, 00000665.00000344.1.000000010fd27000.000000010fd31000.r--.sdmp, bash, 00000665.00000344.1.0000000111bda000.0000000111c03000.r--.sdmp, sakura, 00000666.00000345.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000697.00000407.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000705.00000423.9.000000010d6e3000.000000010d70c000.r--.sdmp, bash, 00000706.00000426.9.000000010daac000.000000010dad5000.r--.sdmp, bash, 00000706.00000426.9.000000010d4cd000.000000010d4d7000.r--.sdmp, hostname, 00000719.00000452.9.0000000105a69000.0000000105a92000.r--.sdmp, hostname, 00000719.00000452.9.0000000103f41000.0000000103f44000.r--.sdmp, sakura, 00000732.00000477.9.000000010d6e3000.000000010d70c000.r--.sdmp, sakura, 00000750.00000513.9.000000010d6e3000.000000010d70c000.r--.sdmp	String found in binary or memory: https://www.apple.com/appleca/0

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49402
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 49412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49414 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49383
Source: unknown	Network traffic detected: HTTP traffic on port 49395 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49391 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49380
Source: unknown	Network traffic detected: HTTP traffic on port 49401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49380 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49414
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49411 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49413
Source: unknown	Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49411
Source: unknown	Network traffic detected: HTTP traffic on port 49413 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49395
Source: unknown	Network traffic detected: HTTP traffic on port 49394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49394
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49391
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49383 -> 443

Source: /Users/bernard/Desktop/sakura (PID: 620)

Writes from socket in process: data

Jump to behavior

Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49380 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49383 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49391 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49394 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49395 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.67.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.8:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49413 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49414 version: TLS 1.2

Source: classification engine

Classification label: mal52.troj.spyw.evad.mac@0/6@1/0

Contains symbols with suspicious names likely related to well-known browsers

Source: submission: sakura	Mach-O symbol: _unicode.IDS_Binary_Operator
Source: submission: sakura	Mach-O symbol: _unicode.IDS_Trinary_Operator

Persistence and Installation Behavior

Executes the "scutil" command used to manage network related system configuration parameters

Source: /bin/bash (PID: 663)

Scutil executable: /usr/sbin/scutil /usr/sbin/scutil

Jump to behavior

Creates and/or modifies files and/or directories in common UNIX system configuration directories

Source: /Users/bernard/Desktop/sakura (PID: 620)

File created: /etc/machine-id

Jump to behavior

Executes commands using a shell command-line interpreter

Source: /Users/bernard/Desktop/sakura (PID: 624)	Shell command executed: /bin/bash -c /bin/launchctl list \| awk '/sshd\.\|loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 658)	Shell command executed: /bin/bash -c launchctl list \| awk '{if ($3 == 'org.sakura.agent') {print $1}}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 661)	Shell command executed: /bin/bash -c echo show com.apple.opendirectoryd.ActiveDirectory \| /usr/sbin/scutil \| awk -F ':' '/DomainNameDns/ {print $2}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 665)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 671)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 676)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 679)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 682)	Shell command executed: /bin/bash -c /bin/launchctl list \| awk '/sshd\.\|loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 685)	Shell command executed: /bin/bash -c ioreg -rd1 -c IOPlatformExpertDevice\| awk -F '=' '/product-name/ {print $2}' \| sed -e 's\|.'$.$'.*\|\1\|g'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 689)	Shell command executed: /bin/bash -c ioreg -rd1 -c IOPlatformExpertDevice\| awk -F '=' '/IOPlatformSerialNumber/ {print $2}' \| sed -e 's\|.'$.$'.*\|\1\|g'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 699)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 702)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 706)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 709)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 712)	Shell command executed: /bin/bash -c /bin/launchctl list \| awk '/sshd\.\|loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 725)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 728)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 737)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 740)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 743)	Shell command executed: /bin/bash -c /bin/launchctl list \| awk '/sshd\.\|loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 751)	Shell command executed: /bin/bash -c /bin/launchctl list\|awk '/^[0-9]+.*loginwindow\./ {print $1}'	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 754)	Shell command executed: /bin/bash -c /bin/launchctl procinfo \|awk '/session id/, /flags/ {print}'	Jump to behavior

Executes the "hostname" command used to retrieve the computers name

Source: /Users/bernard/Desktop/sakura (PID: 693)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 694)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 695)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 717)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 718)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 719)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 746)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 747)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 748)	Hostname executable: /bin/hostname -> hostname -f	Jump to behavior

Explicitly lists launch services possibly for searching

Source: /bin/bash (PID: 625)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 659)	Launch agent/daemon listed: launchctl list	Jump to behavior
Source: /bin/bash (PID: 669)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 677)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 683)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 700)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 707)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 713)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 726)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 738)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 744)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior
Source: /bin/bash (PID: 752)	Launch agent/daemon listed: /bin/launchctl list	Jump to behavior

Source: /bin/bash (PID: 626)	Awk executable: /usr/bin/awk -> awk /sshd\.\|loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 660)	Awk executable: /usr/bin/awk -> awk {if ($3 == 'org.sakura.agent') {print $1}}	Jump to behavior
Source: /bin/bash (PID: 664)	Awk executable: /usr/bin/awk -> awk -F : /DomainNameDns/ {print $2}	Jump to behavior
Source: /bin/bash (PID: 670)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 673)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 678)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 681)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 684)	Awk executable: /usr/bin/awk -> awk /sshd\.\|loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 687)	Awk executable: /usr/bin/awk -> awk -F = /product-name/ {print $2}	Jump to behavior
Source: /bin/bash (PID: 691)	Awk executable: /usr/bin/awk -> awk -F = /IOPlatformSerialNumber/ {print $2}	Jump to behavior
Source: /bin/bash (PID: 701)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 704)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 708)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 711)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 714)	Awk executable: /usr/bin/awk -> awk /sshd\.\|loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 727)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 730)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 739)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 742)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior
Source: /bin/bash (PID: 745)	Awk executable: /usr/bin/awk -> awk /sshd\.\|loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 753)	Awk executable: /usr/bin/awk -> awk /^[0-9]+.*loginwindow\./ {print $1}	Jump to behavior
Source: /bin/bash (PID: 756)	Awk executable: /usr/bin/awk -> awk /session id/, /flags/ {print}	Jump to behavior

Source: /bin/bash (PID: 688)	Sed executable: /usr/bin/sed -> sed -e s\|.'$.$'.*\|\1\|g			Jump to behavior
Source: /bin/bash (PID: 692)	Sed executable: /usr/bin/sed -> sed -e s\|.'$.$'.*\|\1\|g			Jump to behavior

Source: submission: sakura

Mach-O header: load_dylib -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

Source: submission: sakura

Mach-O header: load_dylib -> /System/Library/Frameworks/Security.framework/Versions/A/Security

Source: /Users/bernard/Desktop/sakura (PID: 620)	Random device file read: /dev/urandom	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Random device file read: /dev/urandom	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Random device file read: /dev/urandom	Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 736)	Random device file read: /dev/random	Jump to behavior

Source: /Users/bernard/Desktop/sakura (PID: 620)

Log file created: /opt/sakura/logs/agent.log

Jump to dropped file

Malware Analysis System Evasion

Likely queries the I/O Kit registry to detect VMs by querying the "IOPlatformExpertDevice" class

Source: /Users/bernard/Desktop/sakura (PID: 622)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior
Source: /bin/bash (PID: 686)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior
Source: /bin/bash (PID: 690)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior

Contains symbols with suspicious names likely related to anti-analysis

Source: submission: sakura	Mach-O symbol: _syscall.ptrace1
Source: submission: sakura	Mach-O symbol: _syscall.libc_ptrace_trampoline.abi0
Source: submission: sakura	Mach-O symbol: _type..eq.net/http/httptrace.GotConnInfo
Source: submission: sakura	Mach-O symbol: _ptrace
Source: submission: sakura	Mach-O symbol: _runtime.StopTrace
Source: submission: sakura	Mach-O symbol: _net/http/httptrace..inittask

Source: sakura, 00000666.00000345.9.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: Llocation: Library/Java/JavaVirtualMachines/jdk-11.0.3.jdk
Source: sakura, 00000666.00000345.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000697.00000407.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000705.00000423.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000732.00000477.9.000000c000000000.000000c000400000.rw-.sdmp, sakura, 00000750.00000513.9.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: location: Library/Java/JavaVirtualMachines/jdk-11.0.3.jdk
Source: sakura, 00000750.00000513.9.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: location: Library/Java/JavaVirtualMachines/jdk-11.0.3.jdk6
Source: sakura, 00000697.00000407.9.000000c000400000.000000c000800000.rw-.sdmp	Binary or memory string: <&_KZZj4ovlohxIyxTjlYSp6uZoOZACCSGbn2FYhKdLRUv6vrH+h2LipSrT4w2X1FE0FkehP3+Sd5JEDMUUCyYk+XUZLEJJ54S+61QRDpkpvHXOvRYvQ+INBODRYnpKERyrzVrp7XkPKhWWndDUqrCh3bWD9k4wIaT6kQbc4cuZAuo46V77JL+4y9CUuE9hmXMOZ+vOrZUAtwS6hDirq1ULwCccsWsW021TIH6IV0AdDPm7jvn1/ndKNMPWy7vjMjwWw3Py+MOeahI4QHGVx6S6O56LOub4/WG8vyh2ipciAtKaLxLXbDe3EUZTt9ra6Z0ZmfDB/H3dcDZcnI0mIGMh+6VyXP4qeYb0ygzNvOOwpi6nW/0sraMSXaPj8FzmgcKJurYO70VQZSZusLImc/U5u2yq5upbPBjCgNIUDMmI9qDGWV0vGtpYspwpCVRJni6LmiedJQAdazrJTTAlC3KE8vY3Us9Wg9C+ueGJbM7YHynIMAHjVnGFCsDIhijIhEwFj9vnSskHqG6/S5qoLMaNdN1cj+uiLQ2ZAbvKRzOwx1l1YWKfEu8YtDb235wvuBvAIZVHCVvu55mKRZSxnVFANYr4q29FjOYz0BiHejXPzTp1B2nnEiaNiLe4HmX9NNmGw9/UPn/SMs9xlmSYqBkKpcpnSiTN4TSl/xbUbsjA7ZVxapxoeQl1VTR7ssGHfsAh1NHC/XP70QmM7f2HTZbkatMVzh9C/Sl5aorI6TkZxxmMryNybVetTfptV/dd6tdt/U+X8iEZT5IQIXuLUMGwfgaUzVQWA7n+wsXDaLmu3Vt78mGNUeKh9EPtjsEGtbLB2wxkhI94ujBeg897BtWYpIPWg6dk1fZ2V3GQEmU6ZxHmsAwKpvqlXqBv4wKSbO3oaXc264agg9umtD7c+pbSg8LmSx8f/TWMZAy1v8KHepAqQkxlmmmmansYjh1ZX1VPoP81ICVY6nAOt6QBBKfyO+fSqu89LTRob4CtAzKjpVUFiXAQ+ETGIuEQqs5m1vz3jD8WGs46H21B79A8F/s+ADlfaUAXIaetj/DapUVJO36ScJkugK4NHT4uh744KWImPF7mqNjlRKoXDFSqP/moOmKom/5yBuLKra0wMUO3KNAFRrf5dn8q6W/Ypy7/PFbEvzPLpZQtbbVWmgGgMv3WQdZDSYDqcCJAzInkfzPM3Zi+Hsa/ZcT9lPP08ku2AjRJgrjolEsqHmi/56yMrtmmSnygcx26G19bOWjDcCI6E6ne2b+57rDH6f3kW2QTvNaWQQnDheXeBqdDLdtp6dCnN8qWpGr2ip/0xZFXFBqrp1t7qkxsJoT1NPS7zJdAQqlvIBvsT3ix5Afcxd/MJ6adXl6jXKbGXOqUIVTJJca9hxGlMRVOWoN4v3p3DnlilJSw+eKwRB5uWw7LQo2tCPNLVHtPl1dQSpuJ4ujnZWoF02/sRnzauKiVh5uI5J4GytFRmUa7+CMbyeBxaUQK7hf/4Awbd8qBYFhZUb3DDMvRnguV5BOBjWDpycyVgxY+dBAfHYEkcLnlfh9YD3+HlMi4glRQVSOyx4Pc/jIxrIruGCYRh+y6SgBs96TseNyggzL/lkO7QQLOK/SbEfvUElclJIOaDgz68i5P2qjjLjaOjwPRGFpfdQszfL6Ouv3LkxdgfOU/Rh3r43uNsyvnGWtdqjz2WmZfZ/aSKBR4BQg7ryOuicbwWKE6Qyt6fzraeL4m8ET5u8meANCHeP0pbWDEdUJwgvyF6TU3xzhdW3x0FWRyyU4Qim37PRn4s/W2vTI30oNfPLOjbAzyExdXkF8fqMZp0lfwz/VS1DB0ZzTeo6ZE/sw+dgqrrKAWLcp3arygWvEhnLyzS2URGuVapWCzUuwoKD4kMzjmt16xJR1SeY3o43/b+6ODBKTBYYvIsdRFahunPruFeBniaGvzCd0wjquPiJk4T6RNMzIuNZAghHzCEv7cK++HJR4OWU3V2u1yz7gg2Su5ZQq2Ph+Rh9fU5smLle4XKqzH2V256w0UGVFVBWtyBTOnCoxb9gQfnHF6dFx4WYMZeVTl2oPHAAFN+AvY6lpQ4gDuQURuumKAiX9y9mtH9jMHrQXu4E4g2I0dD3PA9FLvQg50XGX8FL1wrULpf7AqXSoQcGpOqwaVQVmdQ/0HbHC11TsSEqrVRFB3DkEYwm1hWmNOe52NN9LbG67wxQ9VQk7T26ptdyalqDOa8kPf+/9B+4nISLUZY+A7ewxeS/n8lRD7G/igPOm3X/g6eTOdPnypO26fpeoyUPiMZINyKLR4r8VjfgspeWQDN8i0jhwJr7dbwHGxvnFtz8bJnitmdbxOmeBoo5xGqYO509UeYUqNWrtfGyib8Xqw0mSgViGQhj4NvFMz/ccQoQ3GgA5KLaGTwASvAE1Xb+e34ddAIYRjJMrrDyVEtfB+zYqo3KcSksoLdi/lMfOtWPqWAHDWUAsxSgh7Qm12Wfdjyh68tUEJCGpAFi5UM94EaX2rjruk0d0TtT7OuAOJnoQjfJSrUTWBirZR9Uh4bqdFXX5bgrxSBoEheCBeP2/oUD3QQF4zi4Ke7imgN3HPUXWfI4fzrFAYXs/X+VTjofGCywnjUn2+g6GcSbSOFTMkyAntQcwZbhaQHZAxxOY0Lak03/8iHIZp7DHMQqdDdr1PHZuJf+VU9In5gP87ufXFc2w78MDAgqw==aEJiU6YSQQ2jjJiBR45csNWln1cUoPjHfisrx4xRDS0+towlb4aFSmXeziM9rDqUAhlrzgyCRq1JB6BjTnySpbus7KNYK8ryA/36aGymAw34nWp0N2pgJcvY3tXTnt0qw4mqhlGnyfMt/AMdjvfn3R241D0nlm1878ohr+LYZZ2LlolTvQ3dUdBCBHevynofouxfPBtvWe5a3ztAQT6RsqoaHc+vCrq6Rqe6pxopA92hmecgXxTc8eD9QZaKRCjAEtQN6V8putleKiLgn7KCMOS7Xff92vzGQEZHpU/Y
Source: sakura, 00000697.00000407.9.000000c000400000.000000c000800000.rw-.sdmp	Binary or memory string: KZZj4ovlohxIyxTjlYSp6uZoOZACCSGbn2FYhKdLRUv6vrH+h2LipSrT4w2X1FE0FkehP3+Sd5JEDMUUCyYk+XUZLEJJ54S+61QRDpkpvHXOvRYvQ+INBODRYnpKERyrzVrp7XkPKhWWndDUqrCh3bWD9k4wIaT6kQbc4cuZAuo46V77JL+4y9CUuE9hmXMOZ+vOrZUAtwS6hDirq1ULwCccsWsW021TIH6IV0AdDPm7jvn1/ndKNMPWy7vjMjwWw3Py+MOeahI4QHGVx6S6O56LOub4/WG8vyh2ipciAtKaLxLXbDe3EUZTt9ra6Z0ZmfDB/H3dcDZcnI0mIGMh+6VyXP4qeYb0ygzNvOOwpi6nW/0sraMSXaPj8FzmgcKJurYO70VQZSZusLImc/U5u2yq5upbPBjCgNIUDMmI9qDGWV0vGtpYspwpCVRJni6LmiedJQAdazrJTTAlC3KE8vY3Us9Wg9C+ueGJbM7YHynIMAHjVnGFCsDIhijIhEwFj9vnSskHqG6/S5qoLMaNdN1cj+uiLQ2ZAbvKRzOwx1l1YWKfEu8YtDb235wvuBvAIZVHCVvu55mKRZSxnVFANYr4q29FjOYz0BiHejXPzTp1B2nnEiaNiLe4HmX9NNmGw9/UPn/SMs9xlmSYqBkKpcpnSiTN4TSl/xbUbsjA7ZVxapxoeQl1VTR7ssGHfsAh1NHC/XP70QmM7f2HTZbkatMVzh9C/Sl5aorI6TkZxxmMryNybVetTfptV/dd6tdt/U+X8iEZT5IQIXuLUMGwfgaUzVQWA7n+wsXDaLmu3Vt78mGNUeKh9EPtjsEGtbLB2wxkhI94ujBeg897BtWYpIPWg6dk1fZ2V3GQEmU6ZxHmsAwKpvqlXqBv4wKSbO3oaXc264agg9umtD7c+pbSg8LmSx8f/TWMZAy1v8KHepAqQkxlmmmmansYjh1ZX1VPoP81ICVY6nAOt6QBBKfyO+fSqu89LTRob4CtAzKjpVUFiXAQ+ETGIuEQqs5m1vz3jD8WGs46H21B79A8F/s+ADlfaUAXIaetj/DapUVJO36ScJkugK4NHT4uh744KWImPF7mqNjlRKoXDFSqP/moOmKom/5yBuLKra0wMUO3KNAFRrf5dn8q6W/Ypy7/PFbEvzPLpZQtbbVWmgGgMv3WQdZDSYDqcCJAzInkfzPM3Zi+Hsa/ZcT9lPP08ku2AjRJgrjolEsqHmi/56yMrtmmSnygcx26G19bOWjDcCI6E6ne2b+57rDH6f3kW2QTvNaWQQnDheXeBqdDLdtp6dCnN8qWpGr2ip/0xZFXFBqrp1t7qkxsJoT1NPS7zJdAQqlvIBvsT3ix5Afcxd/MJ6adXl6jXKbGXOqUIVTJJca9hxGlMRVOWoN4v3p3DnlilJSw+eKwRB5uWw7LQo2tCPNLVHtPl1dQSpuJ4ujnZWoF02/sRnzauKiVh5uI5J4GytFRmUa7+CMbyeBxaUQK7hf/4Awbd8qBYFhZUb3DDMvRnguV5BOBjWDpycyVgxY+dBAfHYEkcLnlfh9YD3+HlMi4glRQVSOyx4Pc/jIxrIruGCYRh+y6SgBs96TseNyggzL/lkO7QQLOK/SbEfvUElclJIOaDgz68i5P2qjjLjaOjwPRGFpfdQszfL6Ouv3LkxdgfOU/Rh3r43uNsyvnGWtdqjz2WmZfZ/aSKBR4BQg7ryOuicbwWKE6Qyt6fzraeL4m8ET5u8meANCHeP0pbWDEdUJwgvyF6TU3xzhdW3x0FWRyyU4Qim37PRn4s/W2vTI30oNfPLOjbAzyExdXkF8fqMZp0lfwz/VS1DB0ZzTeo6ZE/sw+dgqrrKAWLcp3arygWvEhnLyzS2URGuVapWCzUuwoKD4kMzjmt16xJR1SeY3o43/b+6ODBKTBYYvIsdRFahunPruFeBniaGvzCd0wjquPiJk4T6RNMzIuNZAghHzCEv7cK++HJR4OWU3V2u1yz7gg2Su5ZQq2Ph+Rh9fU5smLle4XKqzH2V256w0UGVFVBWtyBTOnCoxb9gQfnHF6dFx4WYMZeVTl2oPHAAFN+AvY6lpQ4gDuQURuumKAiX9y9mtH9jMHrQXu4E4g2I0dD3PA9FLvQg50XGX8FL1wrULpf7AqXSoQcGpOqwaVQVmdQ/0HbHC11TsSEqrVRFB3DkEYwm1hWmNOe52NN9LbG67wxQ9VQk7T26ptdyalqDOa8kPf+/9B+4nISLUZY+A7ewxeS/n8lRD7G/igPOm3X/g6eTOdPnypO26fpeoyUPiMZINyKLR4r8VjfgspeWQDN8i0jhwJr7dbwHGxvnFtz8bJnitmdbxOmeBoo5xGqYO509UeYUqNWrtfGyib8Xqw0mSgViGQhj4NvFMz/ccQoQ3GgA5KLaGTwASvAE1Xb+e34ddAIYRjJMrrDyVEtfB+zYqo3KcSksoLdi/lMfOtWPqWAHDWUAsxSgh7Qm12Wfdjyh68tUEJCGpAFi5UM94EaX2rjruk0d0TtT7OuAOJnoQjfJSrUTWBirZR9Uh4bqdFXX5bgrxSBoEheCBeP2/oUD3QQF4zi4Ke7imgN3HPUXWfI4fzrFAYXs/X+VTjofGCywnjUn2+g6GcSbSOFTMkyAntQcwZbhaQHZAxxOY0Lak03/8iHIZp7DHMQqdDdr1PHZuJf+VU9In5gP87ufXFc2w78MDAgqw==aEJiU6YSQQ2jjJiBR45csNWln1cUoPjHfisrx4xRDS0+towlb4aFSmXeziM9rDqUAhlrzgyCRq1JB6BjTnySpbus7KNYK8ryA/36aGymAw34nWp0N2pgJcvY3tXTnt0qw4mqhlGnyfMt/AMdjvfn3R241D0nlm1878ohr+LYZZ2LlolTvQ3dUdBCBHevynofouxfPBtvWe5a3ztAQT6RsqoaHc+vCrq6Rqe6pxopA92hmecgXxTc8eD9QZaKRCjAEtQN6V8putleKiLgn7KCMOS7Xff92vzGQEZHpU/Ygwn
Source: sakura, 00000732.00000477.9.000000c000000000.000000c000400000.rw-.sdmp	Binary or memory string: location: Library/Java/JavaVirtualMachines/jdk-11.0.3.jdk+

Language, Device and Operating System Detection

Queries the unique Apple serial number of the machine

Source: /Users/bernard/Desktop/sakura (PID: 689)	IOPlatformSerialNumber keyword found in command: /bin/bash /bin/bash -c ioreg -rd1 -c IOPlatformExpertDevice\| awk -F '=' '/IOPlatformSerialNumber/ {print $2}' \| sed -e 's\|.'$.$'.*\|\1\|g'			Jump to behavior
Source: /bin/bash (PID: 691)	IOPlatformSerialNumber keyword found in command: /usr/bin/awk awk -F = /IOPlatformSerialNumber/ {print $2}			Jump to behavior

Executes the "ioreg" command used to gather hardware information (I/O kit registry)

Source: /Users/bernard/Desktop/sakura (PID: 622)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior
Source: /bin/bash (PID: 686)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior
Source: /bin/bash (PID: 690)	IOreg executable: /usr/sbin/ioreg ioreg -rd1 -c IOPlatformExpertDevice	Jump to behavior

Queries OS software version with shell command 'sw_vers'

Source: /Users/bernard/Desktop/sakura (PID: 621)

sw_vers executed: sw_vers -productVersion

Jump to behavior

Reads hardware related sysctl values

Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl read request: hw.ncpu (6.3)			Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl read request: hw.memsize (6.24)			Jump to behavior

Reads process information of other processes

Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.615 -> queries PID 615	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.615 -> queries PID 615	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.575 -> queries PID 575	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.575 -> queries PID 575	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.567 -> queries PID 567	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.567 -> queries PID 567	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.546 -> queries PID 546	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.546 -> queries PID 546	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.543 -> queries PID 543	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.543 -> queries PID 543	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.452 -> queries PID 452	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.452 -> queries PID 452	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.389 -> queries PID 389	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.389 -> queries PID 389	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.365 -> queries PID 365	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.365 -> queries PID 365	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.364 -> queries PID 364	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.364 -> queries PID 364	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.362 -> queries PID 362	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.362 -> queries PID 362	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.361 -> queries PID 361	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.361 -> queries PID 361	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.356 -> queries PID 356	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.356 -> queries PID 356	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.341 -> queries PID 341	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.341 -> queries PID 341	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.336 -> queries PID 336	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.336 -> queries PID 336	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.326 -> queries PID 326	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.326 -> queries PID 326	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.325 -> queries PID 325	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.325 -> queries PID 325	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.316 -> queries PID 316	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.316 -> queries PID 316	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.315 -> queries PID 315	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.315 -> queries PID 315	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.313 -> queries PID 313	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.313 -> queries PID 313	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.297 -> queries PID 297	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.297 -> queries PID 297	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.285 -> queries PID 285	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.285 -> queries PID 285	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.284 -> queries PID 284	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.284 -> queries PID 284	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.282 -> queries PID 282	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.282 -> queries PID 282	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.281 -> queries PID 281	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.281 -> queries PID 281	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.280 -> queries PID 280	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.280 -> queries PID 280	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.272 -> queries PID 272	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.272 -> queries PID 272	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.271 -> queries PID 271	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.271 -> queries PID 271	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.267 -> queries PID 267	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.267 -> queries PID 267	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.265 -> queries PID 265	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.265 -> queries PID 265	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.264 -> queries PID 264	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.264 -> queries PID 264	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.262 -> queries PID 262	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.262 -> queries PID 262	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.255 -> queries PID 255	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.255 -> queries PID 255	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.235 -> queries PID 235	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.235 -> queries PID 235	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.231 -> queries PID 231	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.231 -> queries PID 231	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.226 -> queries PID 226	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.226 -> queries PID 226	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.222 -> queries PID 222	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.222 -> queries PID 222	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.218 -> queries PID 218	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.218 -> queries PID 218	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.217 -> queries PID 217	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.217 -> queries PID 217	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.212 -> queries PID 212	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.212 -> queries PID 212	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.210 -> queries PID 210	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.210 -> queries PID 210	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.201 -> queries PID 201	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.201 -> queries PID 201	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.194 -> queries PID 194	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.194 -> queries PID 194	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.190 -> queries PID 190	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.190 -> queries PID 190	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.168 -> queries PID 168	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.168 -> queries PID 168	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.157 -> queries PID 157	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.157 -> queries PID 157	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.155 -> queries PID 155	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.155 -> queries PID 155	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.118 -> queries PID 118	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.118 -> queries PID 118	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.116 -> queries PID 116	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.116 -> queries PID 116	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.96 -> queries PID 96	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.96 -> queries PID 96	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.90 -> queries PID 90	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.procargs2 (1.49) only found for 1.49.90 -> queries PID 90	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.proc.pid (1.14.1) only found for 1.14.1.65 -> queries PID 65	Jump to behavior

Reads the systems OS release and/or type

Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior
Source: /usr/bin/uname (PID: 629)	Sysctl requested: kern.ostype (1.1)	Jump to behavior
Source: /usr/bin/uname (PID: 629)	Sysctl requested: kern.osrelease (1.2)	Jump to behavior

Reads the systems hostname

Source: /Users/bernard/Desktop/sakura (PID: 620)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 624)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /usr/bin/uname (PID: 629)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 658)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 661)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 665)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 671)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 676)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 679)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 682)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 685)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 689)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 693)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 694)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 695)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 699)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 702)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 706)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 709)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 712)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 717)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 718)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 719)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 725)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 728)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 737)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 740)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 743)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 746)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 747)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/hostname (PID: 748)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 751)	Sysctl requested: kern.hostname (1.10)	Jump to behavior
Source: /bin/bash (PID: 754)	Sysctl requested: kern.hostname (1.10)	Jump to behavior

Source: /usr/bin/sw_vers (PID: 621)

System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Jump to behavior

Executes the "uname" command used to read OS and architecture name

Source: /Users/bernard/Desktop/sakura (PID: 629)

Uname executable: /usr/bin/uname -> uname -m

Jump to behavior

ID:	1528894
Product:	CloudBasic
Start time:	12:24:59
Start date:	08.10.2024
Sample:	sakura
Cookbook:	defaultmacfilecookbook.jbs
System description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
Architecture:	MAC
MD5:	fe0e5087df79cf7e88dc8bf7704260d1
SHA1:	51cd0aa5a6a1dd5472454bd189f37dfd80923aa1
SHA256:	46dbe21f33fba137ed0c97c2216d493ecc54a49272b64eef381fb8e2bcd10eec
Filetype:	Mac OS X Mach-O 64-bit Intel executable (4008/2) 50.02%

Name	Type	MD5	SHA1	SHA256
/opt/sakura/data.db	data	4F545E6D119E3D59C0E8CB33E299476B	EEF7F2970C90DE13CE5DEDEAAE3CDC5719656B2A	B2D7C364B36DACF6D27973A56FB553DAC9E556563AE65CC0228B571317F4BB38
/opt/sakura/data.db-journal	data	66358FCCE3076EB27125B8CFFEB508AD	ED65C30D21AED8C1661A2D056CF52674E8362004	07F5C606392221A8D85D9C0D97E88DEB057D46EE8B4CAD1087F13ACAB6684117
/opt/sakura/data.db-shm	data	7DEA362B3FAC8E00956A4952A3D4F474	05FE405753166F125559E7C9AC558654F107C7E9	AF5570F5A1810B7AF78CAF4BC70A660F0DF51E42BAF91D4DE5B2328DE0E83DFC
/opt/sakura/data.db-wal	SQLite Write-Ahead Log, version 3007000	DF26A8C08B16F4BF4BAB1FF3C2E0EE5F	F5D160FD7B9A0E1DA911BC5DEF314F58932C0EC0	0E1BCA077A49E631951639675CCAC67ECC0F87CA0CC0BCCBF9664124F2746DBE
/opt/sakura/logs/agent.log	Unicode text, UTF-8 text	A2406F003BA6BAABC534717C32A2BFFA	7EF84AD353AB23A4699687F4D95E3D0F6CF27475	2F608CE34C184B80671752A7CBB5814D01AF50EFBE348E0BA0B30F0AAA55E567
/private/etc/machine-id	ASCII text	D72FFC9DE2BACE79C62F4A677A3FB827	CD6E3B0DA9E8CCA6CD417BA2DE9F8732BC76C2C8	3799B513E89A41A637900F2604A91A9CD16453DA88B7750F711A34F6E2246CBF

macOS Analysis Report
sakura

Overview

General Information

Detection

Signatures

Classification

Signatures

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

macOS Analysis Report sakura

Overview

General Information

Detection

Signatures

Classification

Signatures

Cryptography

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Malware Analysis System Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Screenshots

Network Map

Contacted Public IPs

Contacted Domains

macOS Analysis Report
sakura