Edit tour

macOS Analysis Report
Constate

Overview

General Information

Sample name:	Constate
Analysis ID:	1538489
MD5:	430d14cbf65aa74fddd7cf3dfb7db4c7
SHA1:	71cd408617e2df20d639c546329fc5a7af8a6a87
SHA256:	6bf38c1dd13ef90742a73bcd5f3700baab068aab96b3e879e58cd6f2b1fcd14b
Infos:

Detection

Score:	56
Range:	0 - 100
Whitelisted:	false

Signatures

Multi AV Scanner detection for submitted file

Denies being traced/debugged (via ptrace PT_DENY_ATTACH)

Machine Learning detection for sample

Contains symbols with suspicious names likely related to encryption

Contains symbols with suspicious names likely related to networking

Moves itself during installation or deletes itself after installation

Process deletes its process image on disk

Reads the systems OS release and/or type

Uses CFNetwork bundle containing interfaces for network communication (HTTP, sockets, and Bonjour)

Classification

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1538489
Start date and time:	2024-10-21 14:08:08 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 4m 2s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Virtual Machine, Mojave (Office 16 16.27, Java 11.0.2+9, Adobe Reader 2019.010.20099)
macOS major version:	10.14
CPU architecture:	x86_64
Analysis Mode:	default
Sample name:	Constate
Detection:	MAL
Classification:	mal56.evad.mac@0/0@2/0

Warnings

Excluded IPs from analysis (whitelisted): 17.171.98.34, 23.199.49.152, 17.253.3.201, 17.253.3.196, 17.36.200.79, 17.253.97.204, 17.253.97.203, 17.253.97.205, 23.58.90.40
Excluded domains from analysis (whitelisted): e11408.d.akamaiedge.net, mesu-cdn.apple.com.akadns.net, lcdn-locator-usuqo.apple.com.akadns.net, updates.cdn-apple.com.akadns.net, e673.dsce9.akamaiedge.net, help-ar.apple.com.edgekey.net, crl.apple.com, lb._dns-sd._udp.0.11.168.192.in-addr.arpa, mesu-cdn.origin-apple.com.akadns.net, lcdn-locator.apple.com.akadns.net, help.origin-apple.com.akadns.net, radarsubmissions.apple.com.akadns.net, lcdn-locator.apple.com, mesu.g.aaplimg.com, updates.g.aaplimg.com, radarsubmissions.apple.com, itunes.apple.com.edgekey.net, help.apple.com, mesu.apple.com, init.itunes.apple.com, updates.cdn-apple.com, init-cdn.itunes-apple.com.akadns.net
VT rate limit hit for: Constate

Runtime Messages

Command:	/Users/bernard/Desktop/Constate
PID:	619
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

System is macvm-mojave

mono-sgen32 New Fork (PID: 619, Parent: 537)

Constate (MD5: 430d14cbf65aa74fddd7cf3dfb7db4c7) Arguments: /Users/bernard/Desktop/Constate

xpcproxy New Fork (PID: 623, Parent: 1)

nsurlstoraged (MD5: 321b0a40e24b45f0af49ba42742b3f64) Arguments: /usr/libexec/nsurlstoraged --privileged

xpcproxy New Fork (PID: 639, Parent: 1)

eficheck (MD5: 328beb81a2263449258057506bb4987f) Arguments: /usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon

cleanup

HTTP traffic detected: POST /se/cu HTTP/1.1Host: www.emidzazi.siteContent-Type: application/jsonConnection: keep-aliveAccept: */*User-Agent: Constate (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)Content-Length: 42Accept-Language: en-usAccept-Encoding: br, gzip, deflate

Source: Constate, 00000619.00000255.9.0000000119861000.000000011988a000.r--.sdmp	String found in binary or memory: http://crl.apple.com/codesigning.crl0
Source: Constate, 00000619.00000255.9.0000000119861000.000000011988a000.r--.sdmp	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: Constate, 00000619.00000255.9.0000000119861000.000000011988a000.r--.sdmp	String found in binary or memory: http://www.apple.com/appleca/root.crl0
Source: Constate, 00000619.00000255.9.0000000119861000.000000011988a000.r--.sdmp	String found in binary or memory: http://www.apple.com/certificateauthority0
Source: Constate, 00000619.00000255.9.0000000119861000.000000011988a000.r--.sdmp	String found in binary or memory: https://www.apple.com/appleca/0

Source: unknown	Network traffic detected: HTTP traffic on port 49351 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49348
Source: unknown	Network traffic detected: HTTP traffic on port 49399 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49401
Source: unknown	Network traffic detected: HTTP traffic on port 49397 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49400
Source: unknown	Network traffic detected: HTTP traffic on port 49406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49408 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49363
Source: unknown	Network traffic detected: HTTP traffic on port 49353 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49355 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49363 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49401 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49348 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49409 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49398 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49355
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49399
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49354
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49398
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49353
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49397
Source: unknown	Network traffic detected: HTTP traffic on port 49405 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49352
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49396
Source: unknown	Network traffic detected: HTTP traffic on port 49407 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49351
Source: unknown	Network traffic detected: HTTP traffic on port 49354 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49396 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49409
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49408
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49407
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49405

Source: unknown	HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49353 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.70.175.13:443 -> 192.168.11.12:49363 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49396 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49397 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49398 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49399 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49400 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49401 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49405 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49406 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49407 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49408 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.131.6:443 -> 192.168.11.12:49409 version: TLS 1.2

Source: classification engine

Classification label: mal56.evad.mac@0/0@2/0

Source: /Users/bernard/Desktop/Constate (PID: 619)

Process image deleted: /Users/bernard/Desktop/Constate

Jump to behavior

Source: /Users/bernard/Desktop/Constate (PID: 619)

CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist

Jump to behavior

Source: submission: Constate

Mach-O header: load_dylib -> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

Source: submission: Constate

Mach-O header: load_dylib -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

Source: submission: Constate

Mach-O header: load_dylib -> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 639)

Random device file read: /dev/random

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Denies being traced/debugged (via ptrace PT_DENY_ATTACH)

Source: /Users/bernard/Desktop/Constate (PID: 619)

PTRACE system call (PT_DENY_ATTACH): PID 619 denies future traces

Jump to behavior

Source: /Users/bernard/Desktop/Constate (PID: 619)

File deleted: /Users/bernard/Desktop/Constate

Jump to behavior

Source: Constate, 00000619.00000255.9.000000010bda0000.000000010bdae000.rw-.sdmp	Binary or memory string: VMware
Source: Constate, 00000619.00000255.9.000000010bdc4000.000000010bdca000.r--.sdmp	Binary or memory string: framework.vmnet
Source: Constate, 00000619.00000255.9.000000010bdc4000.000000010bdca000.r--.sdmp	Binary or memory string: framework.vmnet$
Source: Constate, 00000619.00000255.9.000000010bda0000.000000010bdae000.rw-.sdmp	Binary or memory string: y:qemu

Source: /Users/bernard/Desktop/Constate (PID: 619)	Sysctl requested: kern.ostype (1.1)			Jump to behavior
Source: /Users/bernard/Desktop/Constate (PID: 619)	Sysctl requested: kern.osrelease (1.2)			Jump to behavior

Source: /Users/bernard/Desktop/Constate (PID: 619)

System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	Path Interception	1 Disable or Modify Tools	1 GUI Input Capture	1 Security Software Discovery	Remote Services	1 GUI Input Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	2 File Deletion	LSASS Memory	11 System Information Discovery	Remote Desktop Protocol	Data from Removable Media	2 Non-Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	1 System Network Configuration Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Constate	39%	ReversingLabs	MacOS.Adware.Pirrit
Constate	100%	Joe Sandbox ML

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
searchlb-3b453017ec33bbb9.elb.us-west-2.amazonaws.com	54.70.175.13	true	false	unknown
h3.apis.apple.map.fastly.net	151.101.67.6	true	false	unknown
www.emidzazi.site	unknown	unknown	false	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://www.emidzazi.site/se/cu	false		unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
54.70.175.13	searchlb-3b453017ec33bbb9.elb.us-west-2.amazonaws.com	United States	16509	AMAZON-02US	false
151.101.3.6	unknown	United States	54113	FASTLYUS	false
96.17.64.247	unknown	United States	16625	AKAMAI-ASUS	false
151.101.131.6	unknown	United States	54113	FASTLYUS	false
151.101.195.6	unknown	United States	54113	FASTLYUS	false
151.101.67.6	h3.apis.apple.map.fastly.net	United States	54113	FASTLYUS	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
54.70.175.13	Psoriasis	Get hash	malicious	Unknown	Browse
	Pipidae	Get hash	malicious	Unknown	Browse
	Pipidae.app	Get hash	malicious	Unknown	Browse
	Ravenwise	Get hash	malicious	Unknown	Browse
	Ravenwise	Get hash	malicious	Unknown	Browse
	bfe	Get hash	malicious	Unknown	Browse
	ctapp_230720_b1nt12.zip	Get hash	malicious	Unknown	Browse
	Kx1A2vl0kc	Get hash	malicious	Unknown	Browse
	ctapp_230720_b1nt12.zip	Get hash	malicious	Unknown	Browse
151.101.3.6	sakura	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==	Get hash	malicious	Unknown	Browse
	https://b3dc9.dynv6.net/en-nz/itunes-gift-card-scams	Get hash	malicious	Unknown	Browse
	https://b3dc9.dynv6.net/en-uz/watch	Get hash	malicious	Unknown	Browse
	EACA1218AC7D98866DFE1F45785598942394234D.html	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bxn--dic%C2%ADesisdeba%C2%ADrin%C2%ADas%C2%AD-6%C2%ADu%C2%ADb.%E2%80%8Bor%C2%ADg%2Fsys%2Fcss%2FvzEOd74Ux6iYa/YWxldGhpYS5oZXJtb3NpbGxvQHdyaS5vcmc=	Get hash	malicious	Unknown	Browse
	https://www.rashakhodro.com/o/?c3Y9bzM2NV8xX29uZSZyYW5kPWJ6RkxWV3c9JnVpZD1VU0VSMTUwOTIwMjRVMTUwOTE1NDQ=N0123Ninfo@colemanenv.com	Get hash	malicious	Unknown	Browse
	https://topawardpicks.top	Get hash	malicious	Unknown	Browse
	VFtaM6iwOv	Get hash	malicious	Unknown	Browse
	extracted-pkg.ziphttps://fluencydirect-distro.s3.amazonaws.com/releases.macOS/FluencyDirect-11.0.10.40.pkg	Get hash	malicious	Unknown	Browse
151.101.131.6	https://topawardpicks.top	Get hash	malicious	Unknown	Browse
	https://b3dc9.dynv6.net/en-tj/iphone	Get hash	malicious	Unknown	Browse
	https://b3dc9.dynv6.net/en-uz/mac	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFpWmkQCuyRKVYuXTODipkw1peyOsy7fzch2Qnjjx9TPdQLyq_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOGY47MMsA28ivpkfbUZ4Lg9A-2BpxdwxU5dKnUeajmF4HirYei02RaLjIoVpk4gyUMhgj92hT-2FHMQ8mxdm73E1rDJWG4U3srGJQAD6HJNqRuM2BNyhWi1cyQGPjs9bNnt3sCHX9HQ-2B1vlq1IrWdBpEUzmyiy7qWzbIHuomspNWnTuqZh3GX5k14qG6xYuxyW10TSL-2Fdyl0iPN0SOJtTt8-2FwmWJD-2F8w79oLdqJEekHbPrO-2B0v5UFAy7DfQgXJdU4VdPg-3D	Get hash	malicious	Unknown	Browse
	http://grifon.info/announce?info_hash=%08%95%AE%D1m%DD%1A%0B%CEo%C0%27%3Af%7B%14sf%3FC&peer_id=-AZ5770-SNhwkI5WcC8E&supportcrypto=1&port=51797&azudp=51797&uploaded=0&downloaded=0&left=243670495&corrupt=0&event=started&numwant=75&no_peer_id=1&compact=1&key=j9C8cT74&azver=3(87.236.16.208)	Get hash	malicious	Unknown	Browse
	https://lookerstudio.google.com/reporting/d787ae12-bf74-43b9-af2f-d8d57b4065f6/page/RpuBE?s=t1OjWts8lSQ	Get hash	malicious	Unknown	Browse
	https://l.co.uk	Get hash	malicious	Unknown	Browse
	https://ab5.dultzman.ru/453661207694068nTmWxOZPLYNVYOTMBINCEQSANMABCGVTBFIXRSRIKIYCZTF	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFkILOsO1UnLItklUwD68rhtr94fRPJI4HAEjYZ7vdlgHTiHU_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPRzSyzWe4FlQQyqQA-2BOTqGjWjoN-2BuPm4tzM5LM6f6tO2PXKa74YSjAhzL6onG-2BuKO989bZZj9vupVvXtBWU0qXeI6VZny9p-2FgjssbU9Je1I2RDoZPOLgxX8gxf2-2BzsuoGYoVqnaS5CYR1Z5WEWAcZP0wmQbm4ikqer-2BGrlVppyDdPw-2BxPiObQZTbU2ZeclEy9V5nUC-2BnwlvdDmQwsjghHkHuJFiwInVWpyiCgGFo0uYjlPs3G8hdAgJBJu-2F-2B0K864-3D#ZmluYW5jZUBjbGVhcnZpZXcuYWk=	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFkILOsO1UnLItklUwD68rhtr94fRPJI4HAEjYZ7vdlgHTiHU_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZPRzSyzWe4FlQQyqQA-2BOTqGjWjoN-2BuPm4tzM5LM6f6tO2PXKa74YSjAhzL6onG-2BuKO989bZZj9vupVvXtBWU0qXeI6VZny9p-2FgjssbU9Je1I2RDoZPOLgxX8gxf2-2BzsuoGYoVqnaS5CYR1Z5WEWAcZP0wmQbm4ikqer-2BGrlVppyDdPw-2BxPiObQZTbU2ZeclEy9V5nUC-2BnwlvdDmQwsjghHkHuJFiwInVWpyiCgGFo0uYjlPs3G8hdAgJBJu-2F-2B0K864-3D#ZmluYW5jZUBjbGVhcnZpZXcuYWk=	Get hash	malicious	Unknown	Browse
151.101.195.6	iB8UZgdjgk	Get hash	malicious	CTHULHU STEALER	Browse
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse
	GlobalProtect-6.3.1.pkg	Get hash	malicious	Unknown	Browse
	https://b3dc9.dynv6.net/en-uz/mac	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFpWmkQCuyRKVYuXTODipkw1peyOsy7fzch2Qnjjx9TPdQLyq_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOGY47MMsA28ivpkfbUZ4Lg9A-2BpxdwxU5dKnUeajmF4HirYei02RaLjIoVpk4gyUMhgj92hT-2FHMQ8mxdm73E1rDJWG4U3srGJQAD6HJNqRuM2BNyhWi1cyQGPjs9bNnt3sCHX9HQ-2B1vlq1IrWdBpEUzmyiy7qWzbIHuomspNWnTuqZh3GX5k14qG6xYuxyW10TSL-2Fdyl0iPN0SOJtTt8-2FwmWJD-2F8w79oLdqJEekHbPrO-2B0v5UFAy7DfQgXJdU4VdPg-3D	Get hash	malicious	Unknown	Browse
	EACA1218AC7D98866DFE1F45785598942394234D.html	Get hash	malicious	Unknown	Browse
	http://grifon.info/announce?info_hash=%08%95%AE%D1m%DD%1A%0B%CEo%C0%27%3Af%7B%14sf%3FC&peer_id=-AZ5770-SNhwkI5WcC8E&supportcrypto=1&port=51797&azudp=51797&uploaded=0&downloaded=0&left=243670495&corrupt=0&event=started&numwant=75&no_peer_id=1&compact=1&key=j9C8cT74&azver=3(87.236.16.208)	Get hash	malicious	Unknown	Browse
	https://lookerstudio.google.com/reporting/d787ae12-bf74-43b9-af2f-d8d57b4065f6/page/RpuBE?s=t1OjWts8lSQ	Get hash	malicious	Unknown	Browse
	https://topawardpicks.top	Get hash	malicious	Unknown	Browse
	VFtaM6iwOv	Get hash	malicious	Unknown	Browse
151.101.67.6	iB8UZgdjgk	Get hash	malicious	CTHULHU STEALER	Browse
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse
	sakura	Get hash	malicious	Unknown	Browse
	GlobalProtect-6.3.1.pkg	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==	Get hash	malicious	Unknown	Browse
	https://topawardpicks.top	Get hash	malicious	Unknown	Browse
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFpWmkQCuyRKVYuXTODipkw1peyOsy7fzch2Qnjjx9TPdQLyq_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOGY47MMsA28ivpkfbUZ4Lg9A-2BpxdwxU5dKnUeajmF4HirYei02RaLjIoVpk4gyUMhgj92hT-2FHMQ8mxdm73E1rDJWG4U3srGJQAD6HJNqRuM2BNyhWi1cyQGPjs9bNnt3sCHX9HQ-2B1vlq1IrWdBpEUzmyiy7qWzbIHuomspNWnTuqZh3GX5k14qG6xYuxyW10TSL-2Fdyl0iPN0SOJtTt8-2FwmWJD-2F8w79oLdqJEekHbPrO-2B0v5UFAy7DfQgXJdU4VdPg-3D	Get hash	malicious	Unknown	Browse
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bxn--dic%C2%ADesisdeba%C2%ADrin%C2%ADas%C2%AD-6%C2%ADu%C2%ADb.%E2%80%8Bor%C2%ADg%2Fsys%2Fcss%2FvzEOd74Ux6iYa/YWxldGhpYS5oZXJtb3NpbGxvQHdyaS5vcmc=	Get hash	malicious	Unknown	Browse
	https://lookerstudio.google.com/reporting/d787ae12-bf74-43b9-af2f-d8d57b4065f6/page/RpuBE?s=t1OjWts8lSQ	Get hash	malicious	Unknown	Browse
	https://l.co.uk	Get hash	malicious	Unknown	Browse

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
searchlb-3b453017ec33bbb9.elb.us-west-2.amazonaws.com	Psoriasis	Get hash	malicious	Unknown	Browse	54.70.175.13
	Pipidae	Get hash	malicious	Unknown	Browse	54.70.175.13
	Pipidae.app	Get hash	malicious	Unknown	Browse	54.70.175.13
	Ravenwise	Get hash	malicious	Unknown	Browse	54.70.175.13
	Ravenwise	Get hash	malicious	Unknown	Browse	54.70.175.13
	bfe	Get hash	malicious	Unknown	Browse	54.70.175.13
	ctapp_230720_b1nt12.zip	Get hash	malicious	Unknown	Browse	54.70.175.13
	Kx1A2vl0kc	Get hash	malicious	Unknown	Browse	54.70.175.13
	ctapp_230720_b1nt12.zip	Get hash	malicious	Unknown	Browse	54.70.175.13
h3.apis.apple.map.fastly.net	iB8UZgdjgk	Get hash	malicious	CTHULHU STEALER	Browse	151.101.67.6
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	151.101.131.6
	sakura	Get hash	malicious	Unknown	Browse	151.101.3.6
	GlobalProtect-6.3.1.pkg	Get hash	malicious	Unknown	Browse	151.101.195.6
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==	Get hash	malicious	Unknown	Browse	151.101.3.6
	https://topawardpicks.top	Get hash	malicious	Unknown	Browse	151.101.131.6
	https://b3dc9.dynv6.net/en-tj/iphone	Get hash	malicious	Unknown	Browse	151.101.131.6
	https://b3dc9.dynv6.net/en-nz/itunes-gift-card-scams	Get hash	malicious	Unknown	Browse	151.101.3.6
	https://b3dc9.dynv6.net/en-uz/mac	Get hash	malicious	Unknown	Browse	151.101.195.6
	https://b3dc9.dynv6.net/en-uz/watch	Get hash	malicious	Unknown	Browse	151.101.3.6

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	file.exe	Get hash	malicious	LummaC	Browse	23.50.98.133
	file.exe	Get hash	malicious	LummaC	Browse	95.100.48.249
	Message_2530136.eml	Get hash	malicious	Unknown	Browse	2.19.126.160
	https://www.childkorea.or.kr/bbs/link.html?code=alarm&number=3064&url=https://form.jotform.com/242923371946059	Get hash	malicious	HTMLPhisher	Browse	184.50.112.129
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	23.199.218.33
	file.exe	Get hash	malicious	LummaC, Amadey, Credential Flusher, LummaC Stealer, Stealc	Browse	104.102.49.254
	file.exe	Get hash	malicious	LummaC	Browse	104.102.49.254
FASTLYUS	https://library.wic.ac.uk/upload/~/app/step2.php?id=37602430	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://library.wic.ac.uk/upload/~/app/step3.php?id=5384235	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://www.childkorea.or.kr/bbs/link.html?code=alarm&number=3064&url=https://form.jotform.com/242923371946059	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?	Get hash	malicious	Unknown	Browse	185.199.108.133
	http://www.5movierulz.mom	Get hash	malicious	Unknown	Browse	185.199.110.133
	8NR95Z54o9.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	https://cambridge.pl/testy-poziomujace	Get hash	malicious	Unknown	Browse	151.101.129.229
	http://sustainability-bunnings.com	Get hash	malicious	Unknown	Browse	151.101.194.208
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	151.101.64.84
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	185.199.109.133
AMAZON-02US	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.48
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.48
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	SUNLIGHT ORDER.xls	Get hash	malicious	Unknown	Browse	76.76.21.241
	SUNLIGHT ORDER.xls	Get hash	malicious	Unknown	Browse	76.76.21.22
	file.exe	Get hash	malicious	Credential Flusher	Browse	52.222.236.120
	SUNLIGHT ORDER.xls	Get hash	malicious	Unknown	Browse	76.76.21.93
	https://www.childkorea.or.kr/bbs/link.html?code=alarm&number=3064&url=https://form.jotform.com/242923371946059	Get hash	malicious	HTMLPhisher	Browse	13.224.189.68
	SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe	Get hash	malicious	Unknown	Browse	52.222.236.120
	SecuriteInfo.com.W32.PossibleThreat.17916.5400.exe	Get hash	malicious	Unknown	Browse	52.222.236.120
FASTLYUS	https://library.wic.ac.uk/upload/~/app/step2.php?id=37602430	Get hash	malicious	Unknown	Browse	151.101.130.137
	https://library.wic.ac.uk/upload/~/app/step3.php?id=5384235	Get hash	malicious	Unknown	Browse	151.101.194.137
	https://www.childkorea.or.kr/bbs/link.html?code=alarm&number=3064&url=https://form.jotform.com/242923371946059	Get hash	malicious	HTMLPhisher	Browse	151.101.2.132
	https://s3.us-east-2.amazonaws.com/revealedgceconomies/vdiq197yvi/ImgBurn_822881.exe?	Get hash	malicious	Unknown	Browse	185.199.108.133
	http://www.5movierulz.mom	Get hash	malicious	Unknown	Browse	185.199.110.133
	8NR95Z54o9.js	Get hash	malicious	STRRAT	Browse	199.232.196.209
	https://cambridge.pl/testy-poziomujace	Get hash	malicious	Unknown	Browse	151.101.129.229
	http://sustainability-bunnings.com	Get hash	malicious	Unknown	Browse	151.101.194.208
	https://app.creatopy.com/share/d/qvnqyxdo8o7m	Get hash	malicious	Unknown	Browse	151.101.64.84
	sims-4-updater-v1.3.4.exe	Get hash	malicious	Unknown	Browse	185.199.109.133

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
5c118da645babe52f060d0754256a73c	iB8UZgdjgk	Get hash	malicious	CTHULHU STEALER	Browse	54.70.175.13 151.101.131.6 151.101.195.6
	V6QED2Q1WBYVOPE	Get hash	malicious	Unknown	Browse	54.70.175.13 151.101.131.6 151.101.195.6
	sakura	Get hash	malicious	Unknown	Browse	54.70.175.13 151.101.131.6 151.101.195.6
	GlobalProtect-6.3.1.pkg	Get hash	malicious	Unknown	Browse	54.70.175.13 151.101.131.6 151.101.195.6
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFl1bBkz1ufgENuAZF1ODXRkOEXcot-2BlieaBFtd0IhXM08Jp__OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOxzyaiykDuoFljiX91jkOGF7TGq8s59HY1LfNpqOHr1hEZu4XswpdGfGTbIsw4Mg7Ewx-2FAzTwbYOEI5c5W9xQE63UMPeYSBL2GJwQizVTVETCyjhoaIq4ot5vl7L-2BMO3KbJCX7vVUyT6NGOFhbY99Ap0lxFmjxSsCRRr7CrNGrevXE9jp8IJyovKPHHX6-2FxnVR-2BVdKd5S1Zkq94QkyDWCs9lCPSQ3LNxOSscF1edS7fTz6-2Bswo-2FZW2dAOCyCTKBxs-3D#Ymhhc2thci5zYW1iYXNpdmFuQHNhYW1hLmNvbQ==	Get hash	malicious	Unknown	Browse	54.70.175.13 151.101.131.6 151.101.195.6
	https://topawardpicks.top	Get hash	malicious	Unknown	Browse	54.70.175.13 151.101.131.6 151.101.195.6
	https://clickme.thryv.com/ls/click?upn=u001.Als7cfHaJU2yMdsJgpsIFpWmkQCuyRKVYuXTODipkw1peyOsy7fzch2Qnjjx9TPdQLyq_OEO3HRIZ3eedLymwLhvJt9sqs3j4T3CqpVCO9A0ZKplqH1W1Ad1lCPdQBrRfbSauZPLLCLTYBsXDRt8yGG5FOZ7NK342oFTufTBA9n-2F9XZOGY47MMsA28ivpkfbUZ4Lg9A-2BpxdwxU5dKnUeajmF4HirYei02RaLjIoVpk4gyUMhgj92hT-2FHMQ8mxdm73E1rDJWG4U3srGJQAD6HJNqRuM2BNyhWi1cyQGPjs9bNnt3sCHX9HQ-2B1vlq1IrWdBpEUzmyiy7qWzbIHuomspNWnTuqZh3GX5k14qG6xYuxyW10TSL-2Fdyl0iPN0SOJtTt8-2FwmWJD-2F8w79oLdqJEekHbPrO-2B0v5UFAy7DfQgXJdU4VdPg-3D	Get hash	malicious	Unknown	Browse	54.70.175.13 151.101.131.6 151.101.195.6
	EACA1218AC7D98866DFE1F45785598942394234D.html	Get hash	malicious	Unknown	Browse	54.70.175.13 151.101.131.6 151.101.195.6
	http://grifon.info/announce?info_hash=%08%95%AE%D1m%DD%1A%0B%CEo%C0%27%3Af%7B%14sf%3FC&peer_id=-AZ5770-SNhwkI5WcC8E&supportcrypto=1&port=51797&azudp=51797&uploaded=0&downloaded=0&left=243670495&corrupt=0&event=started&numwant=75&no_peer_id=1&compact=1&key=j9C8cT74&azver=3(87.236.16.208)	Get hash	malicious	Unknown	Browse	54.70.175.13 151.101.131.6 151.101.195.6
	https://www.google.com/url?q=3HOSozuuQiApLjODz3yh&rct=tTPSJ3J3wDFX0jkXyycT&sa=t&esrc=WSECxFgECA0xys8Em2FL&source=&cd=HXUursu8uEcr4eTiw9XH&cad=XpPkDfJ9mfdQ6lDJVS0Y&ved=xjnktlqryYWwZIBRrgvK&uact=&url=amp%2F%E2%80%8Bxn--dic%C2%ADesisdeba%C2%ADrin%C2%ADas%C2%AD-6%C2%ADu%C2%ADb.%E2%80%8Bor%C2%ADg%2Fsys%2Fcss%2FvzEOd74Ux6iYa/YWxldGhpYS5oZXJtb3NpbGxvQHdyaS5vcmc=	Get hash	malicious	Unknown	Browse	54.70.175.13 151.101.131.6 151.101.195.6

Dropped Files

⊘No context

Created / dropped Files

⊘No created / dropped files found

Static File Info

General

File type:	Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS\|DYLDLINK\|TWOLEVEL\|PIE>
Entropy (8bit):	6.122620362557412
TrID:	Mac OS X Mach-O 64-bit Intel executable (4008/2) 50.02% Mac OS X Mach-O 64-bit executable (little-endian) (4004/1) 49.98%
File name:	Constate
File size:	244'136 bytes
MD5:	430d14cbf65aa74fddd7cf3dfb7db4c7
SHA1:	71cd408617e2df20d639c546329fc5a7af8a6a87
SHA256:	6bf38c1dd13ef90742a73bcd5f3700baab068aab96b3e879e58cd6f2b1fcd14b
SHA512:	33069258de295e78677c985c2becabdd067c3ca00c450074e1db04977bd8c55c1004c9b742e4d7cc71a040744cbcfbf15b25eb5929238b43d8346e62390efefc
SSDEEP:	6144:UOffgbCD+EbvfuUiHd2YD5mAqdkcJdosbRWKrfzDB3fIBDbDuGqK+:U8SUiHd2YD04cxbZ3fkuGqL
TLSH:	A63418071317C481D070D6F80BBA9B954B70E24787466B85362472B4EE1BA76BFF0BAD
File Content Preview:	.......................... .........H...__PAGEZERO..............................................................__TEXT..........................................................__text..........__TEXT..........;.......3.......;..............................

Static Mach Info

General Information for header 1
Endian:	little-endian
Size:	64-bit
Architecture:	x86_64
Filetype:	execute
Nbr. of load commands:	22
Entry point:	0x1000038FA

segment_64 load command - aggregated: 4

Name	Value
segname	__PAGEZERO
vmaddr	0x0
vmsize	0x100000000
fileoff	0x0
filesize	0x0
maxprot	0x0
initprot	0x0
nsects	0
flags	0x0

Name

Value

segname

__TEXT

vmaddr

0x100000000

vmsize

0x2B000

fileoff

0x0

filesize

0x2B000

maxprot

0x5

initprot

0x5

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__text	__TEXT	0x100000D3B	0x28533	0xD3B	6.43723176	0	0x0	0	0x80000400
__stubs	__TEXT	0x10002926E	0x22E	0x2926E	3.35965094	1	0x0	0	0x80000400
__stub_helper	__TEXT	0x10002949C	0x3B2	0x2949C	4.47250586	2	0x0	0	0x80000400
__const	__TEXT	0x100029850	0x638	0x29850	3.47092939	4	0x0	0	0x0
__objc_methname	__TEXT	0x100029E88	0xB5B	0x29E88	4.82108948	0	0x0	0	0x0
__cstring	__TEXT	0x10002A9E3	0x3E4	0x2A9E3	5.05935963	0	0x0	0	0x0
__objc_classname	__TEXT	0x10002ADC7	0x49	0x2ADC7	4.18350285	0	0x0	0	0x0
__objc_methtype	__TEXT	0x10002AE10	0x36	0x2AE10	3.43011544	0	0x0	0	0x0
__unwind_info	__TEXT	0x10002AE48	0x1B4	0x2AE48	5.05950245	2	0x0	0	0x0

Name

Value

segname

__DATA

vmaddr

0x10002B000

vmsize

0xF000

fileoff

0x2B000

filesize

0xE000

maxprot

0x3

initprot

0x3

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__nl_symbol_ptr	__DATA	0x10002B000	0x8	0x2B000	-0.00000000	3	0x0	0	0x0
__got	__DATA	0x10002B008	0xB8	0x2B008	-0.00000000	3	0x0	0	0x0
__la_symbol_ptr	__DATA	0x10002B0C0	0x2E8	0x2B0C0	3.06374884	3	0x0	0	0x0
__const	__DATA	0x10002B3A8	0x200	0x2B3A8	1.74591733	3	0x0	0	0x0
__objc_nlclslist	__DATA	0x10002B5A8	0x8	0x2B5A8	2.00000000	3	0x0	0	0x10000000
__objc_protolist	__DATA	0x10002B5B0	0x10	0x2B5B0	2.12500000	3	0x0	0	0x0
__objc_imageinfo	__DATA	0x10002B5C0	0x8	0x2B5C0	0.54356444	2	0x0	0	0x0
__objc_const	__DATA	0x10002B5C8	0x140	0x2B5C8	1.76755302	3	0x0	0	0x0
__objc_selrefs	__DATA	0x10002B708	0x4B8	0x2B708	3.23847084	3	0x0	0	0x10000000
__objc_protorefs	__DATA	0x10002BBC0	0x10	0x2BBC0	2.12500000	3	0x0	0	0x0
__objc_classrefs	__DATA	0x10002BBD0	0xD8	0x2BBD0	-0.00000000	3	0x0	0	0x10000000
__objc_data	__DATA	0x10002BCA8	0x50	0x2BCA8	1.51708304	3	0x0	0	0x0
__data	__DATA	0x10002BD00	0xD018	0x2BD00	4.39544790	4	0x0	0	0x0
__bss	__DATA	0x100038D20	0x360	0x0	0.00000000	4	0x0	0	0x0

Name	Value
segname	__LINKEDIT
vmaddr	0x10003A000
vmsize	0x4000
fileoff	0x39000
filesize	0x29A8
maxprot	0x1
initprot	0x1
nsects	0
flags	0x0

dyld_info_only load command - aggregated: 1

Name	Value
rebase_off	233472
rebase_size	240
bind_off	233712
bind_size	1704
weak_bind_off	0
weak_bind_size	0
lazy_bind_off	235416
lazy_bind_size	2408
export_off	237824
export_size	32

symtab load command - aggregated: 1

Name	Value
symoff	238072
nsyms	143
stroff	241200
strsize	2936

dysymtab load command - aggregated: 1

Name	Value
ilocalsym	0
nlocalsym	1
iextdefsym	1
nextdefsym	1
iundefsym	2
nundefsym	141
tocoff	0
ntoc	0
modtaboff	0
nmodtab	0
extrefsymoff	0
nextrefsyms	0
indirectsymoff	240360
nindirectsyms	210
extreloff	0
nextrel	0
locreloff	0
nlocrel	0

load_dylinker load command - aggregated: 1

Name	Value

uuid load command - aggregated: 1

Name	Value
uuid	866bffcc-826d-3166-a3da-7f94835a7923

version_min_macosx load command - aggregated: 1

Name	Value
version	10.10.0
sdk	14.4.0

source_version load command - aggregated: 1

Name	Value
path	0.0.0.0.0

main load command - aggregated: 1

Name	Value

load_dylib load command - aggregated: 7

Name

Value

compatibility_version

300.0.0

current_version

2420.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

Name

Value

compatibility_version

1.0.0

current_version

228.0.0

timestamp

1970-01-01

Datas

/usr/lib/libobjc.A.dylib

Name

Value

compatibility_version

1.0.0

current_version

1345.100.2

timestamp

1970-01-01

Datas

/usr/lib/libSystem.B.dylib

Name

Value

compatibility_version

45.0.0

current_version

2487.50.124

timestamp

1970-01-01

Datas

/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

Name

Value

compatibility_version

150.0.0

current_version

2420.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

Name

Value

compatibility_version

1.0.0

current_version

275.0.0

timestamp

1970-01-01

Datas

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

Name

Value

compatibility_version

1.0.0

current_version

1300.100.9

timestamp

1970-01-01

Datas

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

rpath load command - aggregated: 1

Name	Value
path	@executable_path/../Frameworks

function_starts load command - aggregated: 1

Name	Value
dataoff	237856
datasize	216

data_in_code load command - aggregated: 1

Name	Value
dataoff	238072
datasize	0

Symbols

Name	Category	Origin	Segment Name	Bind Address	Library Name
__mh_execute_header	EXTERNAL	LC_SYMTAB
radr://5614542	LOCAL	LC_SYMTAB
_CCCryptorCreate	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0C0	/usr/lib/libSystem.B.dylib
_CCCryptorFinal	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0C8	/usr/lib/libSystem.B.dylib
_CCCryptorGetOutputLength	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0D0	/usr/lib/libSystem.B.dylib
_CCCryptorRelease	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0D8	/usr/lib/libSystem.B.dylib
_CCCryptorUpdate	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0E0	/usr/lib/libSystem.B.dylib
_CCHmacFinal	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0E8	/usr/lib/libSystem.B.dylib
_CCHmacInit	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0F0	/usr/lib/libSystem.B.dylib
_CCHmacUpdate	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0F8	/usr/lib/libSystem.B.dylib
_CCKeyDerivationPBKDF	UNDEFINED	LC_SYMTAB	__DATA	0x10002B100	/usr/lib/libSystem.B.dylib
_CC_MD5	UNDEFINED	LC_SYMTAB	__DATA	0x10002B108	/usr/lib/libSystem.B.dylib
_CFDataGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10002B110	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetCount	UNDEFINED	LC_SYMTAB	__DATA	0x10002B118	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFDictionaryGetKeysAndValues	UNDEFINED	LC_SYMTAB	__DATA	0x10002B120	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10002B128	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFRelease	UNDEFINED	LC_SYMTAB	__DATA	0x10002B130	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetCStringPtr	UNDEFINED	LC_SYMTAB	__DATA	0x10002B138	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_CFStringGetTypeID	UNDEFINED	LC_SYMTAB	__DATA	0x10002B140	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_IOIteratorNext	UNDEFINED	LC_SYMTAB	__DATA	0x10002B148	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
_IOObjectRelease	UNDEFINED	LC_SYMTAB	__DATA	0x10002B150	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
_IORegistryEntryCreateCFProperties	UNDEFINED	LC_SYMTAB	__DATA	0x10002B158	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
_IORegistryEntryCreateCFProperty	UNDEFINED	LC_SYMTAB	__DATA	0x10002B160	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
_IORegistryEntryGetChildIterator	UNDEFINED	LC_SYMTAB	__DATA	0x10002B168	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
_IORegistryGetRootEntry	UNDEFINED	LC_SYMTAB	__DATA	0x10002B170	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
_IOServiceGetMatchingService	UNDEFINED	LC_SYMTAB	__DATA	0x10002B178	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
_IOServiceMatching	UNDEFINED	LC_SYMTAB	__DATA	0x10002B180	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
_NSSetUncaughtExceptionHandler	UNDEFINED	LC_SYMTAB	__DATA	0x10002B188	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_NSTemporaryDirectory	UNDEFINED	LC_SYMTAB	__DATA	0x10002B190	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSArray	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC00	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_OBJC_CLASS_$_NSBundle	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC10	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSCharacterSet	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC60	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSData	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC38	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_OBJC_CLASS_$_NSDictionary	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC08	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_OBJC_CLASS_$_NSFileHandle	UNDEFINED	LC_SYMTAB	__DATA	0x10002BBE0	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSFileManager	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC70	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSJSONSerialization	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC20	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSMutableArray	UNDEFINED	LC_SYMTAB	__DATA	0x10002BBD0	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_OBJC_CLASS_$_NSMutableData	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC80	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_OBJC_CLASS_$_NSMutableString	UNDEFINED	LC_SYMTAB	__DATA	0x10002BCA0	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSMutableURLRequest	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC28	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSNull	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC40	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_OBJC_CLASS_$_NSNumber	UNDEFINED	LC_SYMTAB	__DATA	0x10002BBF0	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSPipe	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC50	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSPredicate	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC90	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSProcessInfo	UNDEFINED	LC_SYMTAB	__DATA	0x10002BBE8	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSRunLoop	UNDEFINED	LC_SYMTAB	__DATA	0x10002BBF8	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_OBJC_CLASS_$_NSString	UNDEFINED	LC_SYMTAB	__DATA	0x10002BBD8	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSTask	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC58	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSThread	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC98	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSURL	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC78	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_OBJC_CLASS_$_NSURLComponents	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC88	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSURLQueryItem	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC48	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSURLSession	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC30	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSUUID	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC68	/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation
_OBJC_CLASS_$_NSWorkspace	UNDEFINED	LC_SYMTAB	__DATA	0x10002BC18	/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
__Block_copy	UNDEFINED	LC_SYMTAB	__DATA	0x10002B198	/usr/lib/libSystem.B.dylib
__Block_object_assign	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1A0	/usr/lib/libSystem.B.dylib
__DefaultRuneLocale	UNDEFINED	LC_SYMTAB	__DATA	0x10002B008	/usr/lib/libSystem.B.dylib
__NSConcreteGlobalBlock	UNDEFINED	LC_SYMTAB	__DATA	0x10002B558	/usr/lib/libSystem.B.dylib
__NSConcreteStackBlock	UNDEFINED	LC_SYMTAB	__DATA	0x10002B010	/usr/lib/libSystem.B.dylib
___CFConstantStringClassReference	UNDEFINED	LC_SYMTAB	__DATA	0x1000389B0	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
___bzero	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1A8	/usr/lib/libSystem.B.dylib
___stack_chk_fail	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1B0	/usr/lib/libSystem.B.dylib
___stack_chk_guard	UNDEFINED	LC_SYMTAB	__DATA	0x10002B018	/usr/lib/libSystem.B.dylib
__dyld_register_func_for_add_image	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1B8	/usr/lib/libSystem.B.dylib
__objc_empty_cache	UNDEFINED	LC_SYMTAB	__DATA	0x10002BCE0	/usr/lib/libobjc.A.dylib
__objc_empty_vtable	UNDEFINED	LC_SYMTAB	__DATA	0x10002BCE8	/usr/lib/libobjc.A.dylib
_abort	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1C0	/usr/lib/libSystem.B.dylib
_asprintf	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1C8	/usr/lib/libSystem.B.dylib
_bzero	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1D0	/usr/lib/libSystem.B.dylib
_calloc	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1D8	/usr/lib/libSystem.B.dylib
_class_addMethod	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1E0	/usr/lib/libobjc.A.dylib
_class_addProperty	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1E8	/usr/lib/libobjc.A.dylib
_class_addProtocol	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1F0	/usr/lib/libobjc.A.dylib
_class_getInstanceMethod	UNDEFINED	LC_SYMTAB	__DATA	0x10002B1F8	/usr/lib/libobjc.A.dylib
_class_getInstanceSize	UNDEFINED	LC_SYMTAB	__DATA	0x10002B200	/usr/lib/libobjc.A.dylib
_class_getInstanceVariable	UNDEFINED	LC_SYMTAB	__DATA	0x10002B208	/usr/lib/libobjc.A.dylib
_class_getIvarLayout	UNDEFINED	LC_SYMTAB	__DATA	0x10002B210	/usr/lib/libobjc.A.dylib
_class_getName	UNDEFINED	LC_SYMTAB	__DATA	0x10002B020	/usr/lib/libobjc.A.dylib
_class_getSuperclass	UNDEFINED	LC_SYMTAB	__DATA	0x10002B218	/usr/lib/libobjc.A.dylib
_class_isMetaClass	UNDEFINED	LC_SYMTAB	__DATA	0x10002B220	/usr/lib/libobjc.A.dylib
_class_replaceMethod	UNDEFINED	LC_SYMTAB	__DATA	0x10002B228	/usr/lib/libobjc.A.dylib
_class_respondsToSelector	UNDEFINED	LC_SYMTAB	__DATA	0x10002B230	/usr/lib/libobjc.A.dylib
_dispatch_async	UNDEFINED	LC_SYMTAB	__DATA	0x10002B238	/usr/lib/libSystem.B.dylib
_dispatch_get_global_queue	UNDEFINED	LC_SYMTAB	__DATA	0x10002B240	/usr/lib/libSystem.B.dylib
_exit	UNDEFINED	LC_SYMTAB	__DATA	0x10002B248	/usr/lib/libSystem.B.dylib
_free	UNDEFINED	LC_SYMTAB	__DATA	0x10002B250	/usr/lib/libSystem.B.dylib
_getpid	UNDEFINED	LC_SYMTAB	__DATA	0x10002B258	/usr/lib/libSystem.B.dylib
_hash_create	UNDEFINED	LC_SYMTAB	__DATA	0x10002B260	/usr/lib/libSystem.B.dylib
_hash_search	UNDEFINED	LC_SYMTAB	__DATA	0x10002B268	/usr/lib/libSystem.B.dylib
_ivar_getName	UNDEFINED	LC_SYMTAB	__DATA	0x10002B270	/usr/lib/libobjc.A.dylib
_ivar_getOffset	UNDEFINED	LC_SYMTAB	__DATA	0x10002B278	/usr/lib/libobjc.A.dylib
_kCFAllocatorDefault	UNDEFINED	LC_SYMTAB	__DATA	0x10002B028	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kCFCoreFoundationVersionNumber	UNDEFINED	LC_SYMTAB	__DATA	0x10002B030	/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation
_kIOMasterPortDefault	UNDEFINED	LC_SYMTAB	__DATA	0x10002B038	/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
_malloc	UNDEFINED	LC_SYMTAB	__DATA	0x10002B280	/usr/lib/libSystem.B.dylib
_memcpy	UNDEFINED	LC_SYMTAB	__DATA	0x10002B288	/usr/lib/libSystem.B.dylib
_method_setImplementation	UNDEFINED	LC_SYMTAB	__DATA	0x10002B290	/usr/lib/libobjc.A.dylib
_objc_alloc	UNDEFINED	LC_SYMTAB	__DATA	0x10002B298	/usr/lib/libobjc.A.dylib
_objc_allocateClassPair	UNDEFINED	LC_SYMTAB	__DATA	0x10002B040	/usr/lib/libobjc.A.dylib
_objc_autorelease	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2A0	/usr/lib/libobjc.A.dylib
_objc_autoreleasePoolPop	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2A8	/usr/lib/libobjc.A.dylib
_objc_autoreleasePoolPush	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2B0	/usr/lib/libobjc.A.dylib
_objc_autoreleaseReturnValue	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2B8	/usr/lib/libobjc.A.dylib
_objc_constructInstance	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2C0	/usr/lib/libobjc.A.dylib
_objc_copyClassNamesForImage	UNDEFINED	LC_SYMTAB	__DATA	0x10002B050	/usr/lib/libobjc.A.dylib
_objc_enumerationMutation	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2C8	/usr/lib/libobjc.A.dylib
_objc_getClass	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2D0	/usr/lib/libobjc.A.dylib
_objc_getMetaClass	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2D8	/usr/lib/libobjc.A.dylib
_objc_getProtocol	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2E0	/usr/lib/libobjc.A.dylib
_objc_getRequiredClass	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2E8	/usr/lib/libobjc.A.dylib
_objc_initializeClassPair	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2F0	/usr/lib/libobjc.A.dylib
_objc_loadClassref	UNDEFINED	LC_SYMTAB	__DATA	0x10002B078	/usr/lib/libobjc.A.dylib
_objc_lookUpClass	UNDEFINED	LC_SYMTAB	__DATA	0x10002B2F8	/usr/lib/libobjc.A.dylib
_objc_msgSend	UNDEFINED	LC_SYMTAB	__DATA	0x10002B088	/usr/lib/libobjc.A.dylib
_objc_msgSend_stret	UNDEFINED	LC_SYMTAB	__DATA	0x10002B300	/usr/lib/libobjc.A.dylib
_objc_readClassPair	UNDEFINED	LC_SYMTAB	__DATA	0x10002B090	/usr/lib/libobjc.A.dylib
_objc_registerClassPair	UNDEFINED	LC_SYMTAB	__DATA	0x10002B308	/usr/lib/libobjc.A.dylib
_objc_release	UNDEFINED	LC_SYMTAB	__DATA	0x10002B098	/usr/lib/libobjc.A.dylib
_objc_retain	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0A0	/usr/lib/libobjc.A.dylib
_objc_retainAutorelease	UNDEFINED	LC_SYMTAB	__DATA	0x10002B310	/usr/lib/libobjc.A.dylib
_objc_retainAutoreleaseReturnValue	UNDEFINED	LC_SYMTAB	__DATA	0x10002B318	/usr/lib/libobjc.A.dylib
_objc_retainAutoreleasedReturnValue	UNDEFINED	LC_SYMTAB	__DATA	0x10002B320	/usr/lib/libobjc.A.dylib
_objc_retainBlock	UNDEFINED	LC_SYMTAB	__DATA	0x10002B328	/usr/lib/libobjc.A.dylib
_object_getClass	UNDEFINED	LC_SYMTAB	__DATA	0x10002B330	/usr/lib/libobjc.A.dylib
_object_getIndexedIvars	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0A8	/usr/lib/libobjc.A.dylib
_object_getIvar	UNDEFINED	LC_SYMTAB	__DATA	0x10002B338	/usr/lib/libobjc.A.dylib
_object_setIvar	UNDEFINED	LC_SYMTAB	__DATA	0x10002B340	/usr/lib/libobjc.A.dylib
_property_copyAttributeList	UNDEFINED	LC_SYMTAB	__DATA	0x10002B348	/usr/lib/libobjc.A.dylib
_protocol_getMethodDescription	UNDEFINED	LC_SYMTAB	__DATA	0x10002B350	/usr/lib/libobjc.A.dylib
_protocol_getName	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0B0	/usr/lib/libobjc.A.dylib
_pthread_mutex_lock	UNDEFINED	LC_SYMTAB	__DATA	0x10002B358	/usr/lib/libSystem.B.dylib
_pthread_mutex_unlock	UNDEFINED	LC_SYMTAB	__DATA	0x10002B360	/usr/lib/libSystem.B.dylib
_sel_getUid	UNDEFINED	LC_SYMTAB	__DATA	0x10002B368	/usr/lib/libobjc.A.dylib
_sel_registerName	UNDEFINED	LC_SYMTAB	__DATA	0x10002B370	/usr/lib/libobjc.A.dylib
_signal	UNDEFINED	LC_SYMTAB	__DATA	0x10002B378	/usr/lib/libSystem.B.dylib
_strcmp	UNDEFINED	LC_SYMTAB	__DATA	0x10002B380	/usr/lib/libSystem.B.dylib
_strlen	UNDEFINED	LC_SYMTAB	__DATA	0x10002B388	/usr/lib/libSystem.B.dylib
_strncmp	UNDEFINED	LC_SYMTAB	__DATA	0x10002B390	/usr/lib/libSystem.B.dylib
_sysctl	UNDEFINED	LC_SYMTAB	__DATA	0x10002B398	/usr/lib/libSystem.B.dylib
_sysctlbyname	UNDEFINED	LC_SYMTAB	__DATA	0x10002B3A0	/usr/lib/libSystem.B.dylib
dyld_stub_binder	UNDEFINED	LC_SYMTAB	__DATA	0x10002B0B8	/usr/lib/libSystem.B.dylib

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 14:09:12.574054956 CEST	49354	443	192.168.11.12	151.101.67.6
Oct 21, 2024 14:09:12.582132101 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:12.922713995 CEST	49352	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:12.954813957 CEST	49351	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:13.006392002 CEST	49355	443	192.168.11.12	151.101.3.6
Oct 21, 2024 14:09:13.138783932 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.186090946 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:13.607922077 CEST	49354	443	192.168.11.12	151.101.67.6
Oct 21, 2024 14:09:13.890074015 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.890141010 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.890186071 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.890217066 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.890248060 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:13.890278101 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.890305042 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.890332937 CEST	443	49354	151.101.67.6	192.168.11.12
Oct 21, 2024 14:09:13.890361071 CEST	443	49352	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.890388012 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.890414953 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.890443087 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.890469074 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.890497923 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.890525103 CEST	443	49354	151.101.67.6	192.168.11.12
Oct 21, 2024 14:09:13.890552998 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:13.890628099 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.890659094 CEST	443	49352	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.890862942 CEST	443	49355	151.101.3.6	192.168.11.12
Oct 21, 2024 14:09:13.890911102 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.890957117 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.890999079 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.891815901 CEST	49351	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:13.891865015 CEST	49351	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:13.892010927 CEST	49351	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:13.892014980 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:13.892087936 CEST	49351	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:13.892087936 CEST	49354	443	192.168.11.12	151.101.67.6
Oct 21, 2024 14:09:13.892184973 CEST	49352	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:13.892234087 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.892292023 CEST	49354	443	192.168.11.12	151.101.67.6
Oct 21, 2024 14:09:13.892307043 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:13.892400026 CEST	49352	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:13.892577887 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.892580032 CEST	49355	443	192.168.11.12	151.101.3.6
Oct 21, 2024 14:09:13.893292904 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.897852898 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.897916079 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.898211002 CEST	49352	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:13.898327112 CEST	49354	443	192.168.11.12	151.101.67.6
Oct 21, 2024 14:09:13.898874044 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.900073051 CEST	49355	443	192.168.11.12	151.101.3.6
Oct 21, 2024 14:09:13.900376081 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:13.904333115 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.904392004 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.905080080 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.905436039 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.911185980 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.911252975 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.912592888 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.913703918 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.917927980 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.917990923 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.918580055 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.919960976 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.924815893 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.925811052 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.926551104 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.931318045 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.931382895 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.931927919 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.932177067 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.937941074 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.938004971 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.938498974 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.938981056 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.985922098 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.986007929 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.986038923 CEST	443	49351	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.986629009 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.986685038 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.987457037 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.987885952 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.990139008 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.990201950 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.990859032 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.991025925 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.992377996 CEST	443	49354	151.101.67.6	192.168.11.12
Oct 21, 2024 14:09:13.992424965 CEST	443	49354	151.101.67.6	192.168.11.12
Oct 21, 2024 14:09:13.992454052 CEST	443	49352	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.992695093 CEST	443	49352	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:13.993171930 CEST	49354	443	192.168.11.12	151.101.67.6
Oct 21, 2024 14:09:13.993278027 CEST	49352	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:13.994719982 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:13.994765997 CEST	443	49355	151.101.3.6	192.168.11.12
Oct 21, 2024 14:09:13.994795084 CEST	443	49355	151.101.3.6	192.168.11.12
Oct 21, 2024 14:09:13.995388031 CEST	49355	443	192.168.11.12	151.101.3.6
Oct 21, 2024 14:09:13.995906115 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:13.995984077 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:13.996043921 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:13.996085882 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:13.996117115 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:13.996766090 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.996819019 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:13.997849941 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:13.997849941 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:13.997850895 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:13.998111010 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:14.004900932 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:14.099766970 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:14.194633007 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:14.194680929 CEST	443	49353	151.101.195.6	192.168.11.12
Oct 21, 2024 14:09:14.195703983 CEST	49353	443	192.168.11.12	151.101.195.6
Oct 21, 2024 14:09:14.403131962 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:14.497881889 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:15.930459023 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:15.933131933 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:16.025372028 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:16.025418997 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:16.026954889 CEST	49348	443	192.168.11.12	17.248.199.69
Oct 21, 2024 14:09:16.027447939 CEST	443	49348	17.248.199.69	192.168.11.12
Oct 21, 2024 14:09:19.072334051 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:19.072351933 CEST	443	49363	54.70.175.13	192.168.11.12
Oct 21, 2024 14:09:19.072952986 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:19.074062109 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:19.074074030 CEST	443	49363	54.70.175.13	192.168.11.12
Oct 21, 2024 14:09:19.610466003 CEST	443	49363	54.70.175.13	192.168.11.12
Oct 21, 2024 14:09:19.611345053 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:19.611345053 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:19.632736921 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:19.632818937 CEST	443	49363	54.70.175.13	192.168.11.12
Oct 21, 2024 14:09:19.633842945 CEST	443	49363	54.70.175.13	192.168.11.12
Oct 21, 2024 14:09:19.634346962 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:19.638462067 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:19.641659021 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:19.641866922 CEST	443	49363	54.70.175.13	192.168.11.12
Oct 21, 2024 14:09:20.018160105 CEST	443	49363	54.70.175.13	192.168.11.12
Oct 21, 2024 14:09:20.018397093 CEST	443	49363	54.70.175.13	192.168.11.12
Oct 21, 2024 14:09:20.019129992 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:20.019176960 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:20.025758982 CEST	49363	443	192.168.11.12	54.70.175.13
Oct 21, 2024 14:09:20.025839090 CEST	443	49363	54.70.175.13	192.168.11.12
Oct 21, 2024 14:09:52.578718901 CEST	49396	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.578788042 CEST	443	49396	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:52.579638958 CEST	49396	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.580399990 CEST	49396	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.580450058 CEST	443	49396	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:52.804625988 CEST	443	49396	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:52.805485964 CEST	49396	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.805538893 CEST	49396	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.831001997 CEST	49396	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.831243038 CEST	443	49396	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:52.831734896 CEST	443	49396	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:52.831926107 CEST	49396	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.832164049 CEST	49396	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.856188059 CEST	49397	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.856298923 CEST	443	49397	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:52.857594967 CEST	49397	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.858769894 CEST	49397	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:52.858855963 CEST	443	49397	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.063234091 CEST	443	49397	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.064037085 CEST	49397	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.064083099 CEST	49397	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.077970982 CEST	49397	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.078079939 CEST	443	49397	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.078233957 CEST	443	49397	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.078758001 CEST	49397	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.078852892 CEST	49397	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.113852024 CEST	49398	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.113893032 CEST	443	49398	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.114675999 CEST	49398	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.118249893 CEST	49398	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.118283033 CEST	443	49398	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.257767916 CEST	49399	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.257874966 CEST	443	49399	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.258613110 CEST	49399	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.259924889 CEST	49399	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.260006905 CEST	443	49399	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.318339109 CEST	443	49398	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.320483923 CEST	49398	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.320485115 CEST	49398	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.328686953 CEST	49398	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.328922033 CEST	443	49398	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.329391003 CEST	443	49398	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.329780102 CEST	49398	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.330017090 CEST	49398	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.343185902 CEST	49400	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.343293905 CEST	443	49400	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.343930960 CEST	49400	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.344676971 CEST	49400	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.344772100 CEST	443	49400	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.463350058 CEST	443	49399	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.465095043 CEST	49399	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.465408087 CEST	49399	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.498483896 CEST	49399	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.498728991 CEST	443	49399	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.499166012 CEST	443	49399	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.499385118 CEST	49399	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.503447056 CEST	49399	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.540893078 CEST	49401	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.540975094 CEST	443	49401	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.541588068 CEST	49401	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.542357922 CEST	49401	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.542393923 CEST	443	49401	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.548111916 CEST	443	49400	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.549923897 CEST	49400	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.549925089 CEST	49400	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.556274891 CEST	49400	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.556480885 CEST	443	49400	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.556931973 CEST	443	49400	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.557035923 CEST	49400	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.557682037 CEST	49400	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.744843960 CEST	443	49401	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.745716095 CEST	49401	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.745717049 CEST	49401	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.757916927 CEST	49401	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.758156061 CEST	443	49401	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.758621931 CEST	443	49401	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:53.758935928 CEST	49401	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:53.759670973 CEST	49401	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:54.646897078 CEST	49405	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:54.647011995 CEST	443	49405	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:54.647865057 CEST	49405	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:54.651259899 CEST	49405	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:54.651346922 CEST	443	49405	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:54.852819920 CEST	443	49405	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:54.853770018 CEST	49405	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:54.853770018 CEST	49405	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:54.865688086 CEST	49405	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:54.865835905 CEST	443	49405	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:54.866108894 CEST	443	49405	151.101.131.6	192.168.11.12
Oct 21, 2024 14:09:54.866794109 CEST	49405	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:09:54.866795063 CEST	49405	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:10:09.713572979 CEST	49345	80	192.168.11.12	96.17.64.247
Oct 21, 2024 14:10:09.824476957 CEST	80	49345	96.17.64.247	192.168.11.12
Oct 21, 2024 14:10:09.825248003 CEST	49345	80	192.168.11.12	96.17.64.247
Oct 21, 2024 14:11:14.795773983 CEST	49406	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:14.795885086 CEST	443	49406	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:14.796653986 CEST	49406	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:14.798047066 CEST	49406	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:14.798120022 CEST	443	49406	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.001946926 CEST	443	49406	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.003763914 CEST	49406	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.003922939 CEST	49406	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.011847973 CEST	49406	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.012120962 CEST	443	49406	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.012572050 CEST	443	49406	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.013257980 CEST	49406	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.013530016 CEST	49406	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.026467085 CEST	49407	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.026520967 CEST	443	49407	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.027137041 CEST	49407	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.027837038 CEST	49407	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.027852058 CEST	443	49407	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.229772091 CEST	443	49407	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.230633020 CEST	49407	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.230691910 CEST	49407	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.236927986 CEST	49407	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.237123013 CEST	443	49407	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.237483025 CEST	443	49407	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.237705946 CEST	49407	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.238121986 CEST	49407	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.259488106 CEST	49408	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.259566069 CEST	443	49408	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.260658979 CEST	49408	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.261554003 CEST	49408	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.261598110 CEST	443	49408	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.465714931 CEST	443	49408	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.466674089 CEST	49408	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.466797113 CEST	49408	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.473119020 CEST	49408	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.473249912 CEST	443	49408	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.473597050 CEST	443	49408	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.474076033 CEST	49408	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.474133968 CEST	49408	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.488641024 CEST	49409	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.488713026 CEST	443	49409	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.489547014 CEST	49409	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.490689993 CEST	49409	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.490751982 CEST	443	49409	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.703166962 CEST	443	49409	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.704185963 CEST	49409	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.704242945 CEST	49409	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.710804939 CEST	49409	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.710971117 CEST	443	49409	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.711416006 CEST	443	49409	151.101.131.6	192.168.11.12
Oct 21, 2024 14:11:15.711601973 CEST	49409	443	192.168.11.12	151.101.131.6
Oct 21, 2024 14:11:15.711901903 CEST	49409	443	192.168.11.12	151.101.131.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Oct 21, 2024 14:09:18.938246965 CEST	63022	53	192.168.11.12	1.1.1.1
Oct 21, 2024 14:09:19.068674088 CEST	53	63022	1.1.1.1	192.168.11.12
Oct 21, 2024 14:09:32.197978020 CEST	53	52458	1.1.1.1	192.168.11.12
Oct 21, 2024 14:09:50.070986986 CEST	137	137	192.168.11.12	192.168.11.255
Oct 21, 2024 14:09:50.070986986 CEST	137	137	192.168.11.12	192.168.11.255
Oct 21, 2024 14:09:50.826673031 CEST	137	137	192.168.11.12	192.168.11.255
Oct 21, 2024 14:09:50.826757908 CEST	137	137	192.168.11.12	192.168.11.255
Oct 21, 2024 14:09:51.582830906 CEST	137	137	192.168.11.12	192.168.11.255
Oct 21, 2024 14:11:14.689209938 CEST	64291	53	192.168.11.12	1.1.1.1
Oct 21, 2024 14:11:14.789155006 CEST	53	64291	1.1.1.1	192.168.11.12

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Oct 21, 2024 14:09:18.938246965 CEST	192.168.11.12	1.1.1.1	0xf25a	Standard query (0)	www.emidzazi.site	A (IP address)	IN (0x0001)	false
Oct 21, 2024 14:11:14.689209938 CEST	192.168.11.12	1.1.1.1	0xccbd	Standard query (0)	h3.apis.apple.map.fastly.net	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Oct 21, 2024 14:09:19.068674088 CEST	1.1.1.1	192.168.11.12	0xf25a	No error (0)	www.emidzazi.site	searchlb-3b453017ec33bbb9.elb.us-west-2.amazonaws.com		CNAME (Canonical name)	IN (0x0001)	false
Oct 21, 2024 14:09:19.068674088 CEST	1.1.1.1	192.168.11.12	0xf25a	No error (0)	searchlb-3b453017ec33bbb9.elb.us-west-2.amazonaws.com		54.70.175.13	A (IP address)	IN (0x0001)	false
Oct 21, 2024 14:11:14.789155006 CEST	1.1.1.1	192.168.11.12	0xccbd	No error (0)	h3.apis.apple.map.fastly.net		151.101.67.6	A (IP address)	IN (0x0001)	false
Oct 21, 2024 14:11:14.789155006 CEST	1.1.1.1	192.168.11.12	0xccbd	No error (0)	h3.apis.apple.map.fastly.net		151.101.195.6	A (IP address)	IN (0x0001)	false
Oct 21, 2024 14:11:14.789155006 CEST	1.1.1.1	192.168.11.12	0xccbd	No error (0)	h3.apis.apple.map.fastly.net		151.101.3.6	A (IP address)	IN (0x0001)	false
Oct 21, 2024 14:11:14.789155006 CEST	1.1.1.1	192.168.11.12	0xccbd	No error (0)	h3.apis.apple.map.fastly.net		151.101.131.6	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

www.emidzazi.site

HTTPS Connections

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Oct 21, 2024 14:09:13.996043921 CEST	151.101.195.6	443	192.168.11.12	49353	CN=bag.itunes.apple.com, O=Apple Inc., L=Cupertino, ST=California, C=US, SERIALNUMBER=C0806592, OID.1.3.6.1.4.1.311.60.2.1.2=California, OID.1.3.6.1.4.1.311.60.2.1.3=US, OID.2.5.4.15=Private Organization CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 26 15:47:44 CEST 2024 Wed Apr 29 14:54:50 CEST 2020	Thu Dec 19 19:00:57 CET 2024 Thu Apr 11 01:59:59 CEST 2030	771,49196-49195-49188-49187-49162-49161-52393-49200-49199-49192-49191-49172-49171-52392-157-156-61-60-53-47-49160-49170-10,65281-0-23-13-5-13172-18-16-11-10,29-23-24-25,0	5c118da645babe52f060d0754256a73c
Oct 21, 2024 14:09:13.996043921 CEST	151.101.195.6	443	192.168.11.12	49353	CN=Apple Public EV Server RSA CA 2 - G1, O=Apple Inc., C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Apr 29 14:54:50 CEST 2020	Thu Apr 11 01:59:59 CEST 2030		5c118da645babe52f060d0754256a73c

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port
0	192.168.11.12	49363	54.70.175.13	443

Timestamp	Bytes transferred	Direction	Data
2024-10-21 12:09:19 UTC	275	OUT	POST /se/cu HTTP/1.1 Host: www.emidzazi.site Content-Type: application/json Connection: keep-alive Accept: / User-Agent: Constate (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64) Content-Length: 42 Accept-Language: en-us Accept-Encoding: br, gzip, deflate
2024-10-21 12:09:19 UTC	42	OUT	Data Raw: 7b 22 6d 69 64 22 3a 22 65 66 38 38 61 37 38 30 61 61 64 32 31 64 36 64 32 63 34 34 63 32 36 31 61 37 33 33 30 36 61 61 22 7d Data Ascii: {"mid":"ef88a780aad21d6d2c44c261a73306aa"}
2024-10-21 12:09:20 UTC	165	IN	HTTP/1.1 200 OK Server: nginx/1.10.3 (Ubuntu) Date: Mon, 21 Oct 2024 12:09:19 GMT Content-Type: text/html; charset=utf-8 Content-Length: 1 Connection: close
2024-10-21 12:09:20 UTC	1	IN	Data Raw: 30 Data Ascii: 0

System Behavior

Analysis Process: mono-sgen32 PID: 619, Parent PID: 537

General

Start time (UTC):	12:09:17
Start date (UTC):	21/10/2024
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	-
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Chronological Activities

Analysis Process: Constate PID: 619, Parent PID: 537

General

Start time (UTC):	12:09:17
Start date (UTC):	21/10/2024
Path:	/Users/bernard/Desktop/Constate
Arguments:	/Users/bernard/Desktop/Constate
File size:	244136 bytes
MD5 hash:	430d14cbf65aa74fddd7cf3dfb7db4c7

Chronological Activities

Analysis Process: xpcproxy PID: 623, Parent PID: 1

General

Start time (UTC):	12:09:28
Start date (UTC):	21/10/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Chronological Activities

Analysis Process: nsurlstoraged PID: 623, Parent PID: 1

General

Start time (UTC):	12:09:28
Start date (UTC):	21/10/2024
Path:	/usr/libexec/nsurlstoraged
Arguments:	/usr/libexec/nsurlstoraged --privileged
File size:	246624 bytes
MD5 hash:	321b0a40e24b45f0af49ba42742b3f64

Chronological Activities

Analysis Process: xpcproxy PID: 639, Parent PID: 1

General

Start time (UTC):	12:10:06
Start date (UTC):	21/10/2024
Path:	/usr/libexec/xpcproxy
Arguments:	-
File size:	44048 bytes
MD5 hash:	4764d9eafe6b7dac23253a9f8b7f73d6

Chronological Activities

Analysis Process: eficheck PID: 639, Parent PID: 1

General

Start time (UTC):	12:10:06
Start date (UTC):	21/10/2024
Path:	/usr/libexec/firmwarecheckers/eficheck/eficheck
Arguments:	/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
File size:	74048 bytes
MD5 hash:	328beb81a2263449258057506bb4987f

Source: global traffic	DNS traffic detected: DNS query: www.emidzazi.site
Source: global traffic	DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Account Control ).
Tactics:	Collection, Credential Access
Data Sources:	Command: Command Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Source: submission: Constate	Mach-O symbol: _CCCryptorRelease
Source: submission: Constate	Mach-O symbol: _CCCryptorUpdate
Source: submission: Constate	Mach-O symbol: _CCCryptorFinal
Source: submission: Constate	Mach-O symbol: _CCCryptorGetOutputLength
Source: submission: Constate	Mach-O symbol: _CCCryptorCreate

Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 17.248.199.69
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.247
Source: unknown	TCP traffic detected without corresponding DNS query: 96.17.64.247
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report Constate

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

Static Mach Info

General Information for header 1

Symbols

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTPS Connections

HTTPS Proxied Packets

System Behavior

Analysis Process: mono-sgen32 PID: 619, Parent PID: 537

General

Chronological Activities

Analysis Process: Constate PID: 619, Parent PID: 537

General

Chronological Activities

Analysis Process: xpcproxy PID: 623, Parent PID: 1

General

Chronological Activities

Analysis Process: nsurlstoraged PID: 623, Parent PID: 1

General

Chronological Activities

Analysis Process: xpcproxy PID: 639, Parent PID: 1

General

Chronological Activities

macOS Analysis Report
Constate