Joe Sandbox Cloud Pro Analysis Report

Loading ...

Play interactive tourEdit tour

macOS Analysis Report types-config.ts

Overview

General Information

Sample Name:types-config.ts
Analysis ID:1708605
MD5:e06e06752509f9cd8bc85aa1aa24dba2
SHA1:554aef8bf44e7fa941e1190e41c8770e90f07254
SHA256:1a9a5c797777f37463b44de2b49a7f95abca786db3977dcdac0f79da739c08ac
Infos:

Most interesting Screenshot:

Detection

SysJoker
Score:64
Range:0 - 100
Whitelisted:false

Signatures

Yara detected SysJoker
Found detection on Joe Sandbox Cloud Basic
Writes Mach-O files to untypical directories
Process executable has a file extension which is uncommon (probably to disguise the executable)
Reads the systems hostname
Creates launch services that start only when a logged in GUI user exists
Creates user-wide 'launchd' managed services aka launch agents
Creates 'launchd' managed services aka launch agents with bundle ID names to possibly disguise malicious intentions
Changes permissions of written Mach-O files
Executes commands using a shell command-line interpreter
Executes the "nohup" (no hangup) command used to avoid background terminal process from being killed
Writes FAT Mach-O files to disk
Creates memory-persistent launch services

Classification

General Information

Joe Sandbox Version:34.0.0 Boulder Opal
Analysis ID:1708605
Start date:12.01.2022
Start time:12:24:09
Joe Sandbox Product:Cloud
Overall analysis duration:0h 3m 57s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:types-config.ts
Cookbook file name:macOS - SysJoker - load provided binary as normal user.jbs
Analysis system description:Mac Mini, Big Sur (Office 2019 16.55, Java 1.8.0_311)
Analysis Mode:default
Detection:MAL
Classification:mal64.troj.evad.macTS@0/3@7/0
Warnings:
Show All
  • Excluded IPs from analysis (whitelisted): 80.67.82.72, 80.67.82.80
  • Excluded domains from analysis (whitelisted): lb._dns-sd._udp.0.0.168.192.in-addr.arpa, a1887.dscq.akamai.net, o.lencr.edgesuite.net

Process Tree

  • System is mac-bigsur
  • sudo (MD5: f21c2a2dc106642f7c38801e121c8c86) Arguments: /usr/bin/sudo -u drew /Users/drew/Desktop/types-config.ts
    • sudo New Fork (PID: 856, Parent: 855)
    • types-config.ts (MD5: e06e06752509f9cd8bc85aa1aa24dba2) Arguments: /Users/drew/Desktop/types-config.ts
      • sh New Fork (PID: 857, Parent: 856)
      • bash (MD5: c1edb59ec6a40884fc3c4e201d31b1d5) Arguments: sh -c whoami
      • whoami (MD5: a7145a94a0b3935eed99abc716a33989) Arguments: whoami
      • sh New Fork (PID: 858, Parent: 856)
      • bash (MD5: c1edb59ec6a40884fc3c4e201d31b1d5) Arguments: sh -c cp '/Users/drew/Desktop/types-config.ts' '/Users/drew/Library/MacOsServices/updateMacOs'
      • cp (MD5: 9007c6e0352122c17fbcea99739b716e) Arguments: cp /Users/drew/Desktop/types-config.ts /Users/drew/Library/MacOsServices/updateMacOs
      • sh New Fork (PID: 859, Parent: 856)
      • bash (MD5: c1edb59ec6a40884fc3c4e201d31b1d5) Arguments: sh -c nohup '/Users/drew/Library/MacOsServices/updateMacOs' >/dev/null 2>&1 &
        • bash New Fork (PID: 860, Parent: 859)
        • nohup (MD5: e702c2d1c6eb0f386453aaa563b2380b) Arguments: nohup /Users/drew/Library/MacOsServices/updateMacOs
        • updateMacOs (MD5: e06e06752509f9cd8bc85aa1aa24dba2) Arguments: /Users/drew/Library/MacOsServices/updateMacOs
          • sh New Fork (PID: 861, Parent: 860)
          • bash (MD5: c1edb59ec6a40884fc3c4e201d31b1d5) Arguments: sh -c whoami
          • whoami (MD5: a7145a94a0b3935eed99abc716a33989) Arguments: whoami
  • cleanup

Yara Overview

Initial Sample

SourceRuleDescriptionAuthorStrings
types-config.tsJoeSecurity_SysJokerYara detected SysJokerJoe Security

    Dropped Files

    SourceRuleDescriptionAuthorStrings
    /Users/drew/Library/MacOsServices/updateMacOsJoeSecurity_SysJokerYara detected SysJokerJoe Security

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000856.00000353.1.0000000107a83000.0000000107a9b000.r-x.sdmpJoeSecurity_SysJokerYara detected SysJokerJoe Security
        00000856.00000353.9.0000000107a83000.0000000107a9b000.r-x.sdmpJoeSecurity_SysJokerYara detected SysJokerJoe Security
          00000860.00000364.1.000000010df6a000.000000010df82000.r-x.sdmpJoeSecurity_SysJokerYara detected SysJokerJoe Security
            Process Memory Space: types-config.ts PID: 856JoeSecurity_SysJokerYara detected SysJokerJoe Security
              Process Memory Space: updateMacOs PID: 860JoeSecurity_SysJokerYara detected SysJokerJoe Security

                Jbx Signature Overview

                Click to jump to signature section

                Show All Signature Results
                Source: unknownHTTPS traffic detected: 142.250.186.110:443 -> 192.168.0.52:49386 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 142.250.186.65:443 -> 192.168.0.52:49387 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49388 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49390 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49391 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49392 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49393 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49394 version: TLS 1.2
                Source: unknownDNS traffic detected: queries for: drive.google.com
                Source: /Users/drew/Library/MacOsServices/updateMacOs (PID: 860)Writes from socket in process: dataJump to behavior
                Source: unknownNetwork traffic detected: HTTP traffic on port 49376 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49388
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49387
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49386
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49383
                Source: unknownNetwork traffic detected: HTTP traffic on port 49393 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49382
                Source: unknownNetwork traffic detected: HTTP traffic on port 49391 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49380
                Source: unknownNetwork traffic detected: HTTP traffic on port 49386 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49388 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49380 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49382 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49376
                Source: unknownNetwork traffic detected: HTTP traffic on port 49394 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49394
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49393
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49392
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49391
                Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49390
                Source: unknownNetwork traffic detected: HTTP traffic on port 49392 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49390 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49387 -> 443
                Source: unknownNetwork traffic detected: HTTP traffic on port 49383 -> 443
                Source: unknownTCP traffic detected without corresponding DNS query: 2.16.12.64
                Source: unknownTCP traffic detected without corresponding DNS query: 2.16.12.64
                Source: unknownTCP traffic detected without corresponding DNS query: 2.16.12.64
                Source: unknownTCP traffic detected without corresponding DNS query: 23.203.78.159
                Source: unknownTCP traffic detected without corresponding DNS query: 23.203.78.159
                Source: unknownTCP traffic detected without corresponding DNS query: 23.203.78.159
                Source: unknownTCP traffic detected without corresponding DNS query: 23.203.78.159
                Source: unknownTCP traffic detected without corresponding DNS query: 17.248.145.233
                Source: unknownTCP traffic detected without corresponding DNS query: 17.248.145.233
                Source: unknownTCP traffic detected without corresponding DNS query: 17.248.145.233
                Source: unknownTCP traffic detected without corresponding DNS query: 87.248.100.168
                Source: unknownTCP traffic detected without corresponding DNS query: 87.248.100.168
                Source: unknownTCP traffic detected without corresponding DNS query: 87.248.100.168
                Source: unknownTCP traffic detected without corresponding DNS query: 87.248.100.168
                Source: types-config.ts, 00000856.00000353.1.0000000116fb5000.0000000116fed000.r--.sdmp, updateMacOs, 00000860.00000364.1.0000000115138000.0000000115170000.r--.sdmpString found in binary or memory: http://crl.apple.com/codesigning.crl0
                Source: types-config.ts, com.apple.update.plist.353.dr, updateMacOs.359.drString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
                Source: types-config.ts, 00000856.00000353.1.0000000116fb5000.0000000116fed000.r--.sdmp, updateMacOs, 00000860.00000364.1.0000000115138000.0000000115170000.r--.sdmpString found in binary or memory: http://www.apple.com/appleca/root.crl0
                Source: types-config.ts, updateMacOs.359.drString found in binary or memory: https://drive.google.com/uc?export=download&id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eu
                Source: types-config.ts, updateMacOs.359.drString found in binary or memory: https://drive.google.com/uc?export=download&id=1W64PQQxrwY3XjBnv_QAeBQu-ePr537eus
                Source: null.364.drString found in binary or memory: https://graphic-updater.com
                Source: types-config.ts, 00000856.00000353.1.0000000116fb5000.0000000116fed000.r--.sdmp, updateMacOs, 00000860.00000364.1.0000000115138000.0000000115170000.r--.sdmpString found in binary or memory: https://www.apple.com/appleca/0
                Source: /Users/drew/Library/MacOsServices/updateMacOs (PID: 860)Reads from socket in process: dataJump to behavior
                Source: unknownHTTPS traffic detected: 142.250.186.110:443 -> 192.168.0.52:49386 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 142.250.186.65:443 -> 192.168.0.52:49387 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49388 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49390 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49391 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49392 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49393 version: TLS 1.2
                Source: unknownHTTPS traffic detected: 23.254.131.176:443 -> 192.168.0.52:49394 version: TLS 1.2

                System Summary:

                barindex
                Found detection on Joe Sandbox Cloud BasicShow sources
                Source: types-config.tsJoe Sandbox Cloud Basic: Detection: malicious Score: 56 Threat Name: SysJokerPerma Link
                Source: classification engineClassification label: mal64.troj.evad.macTS@0/3@7/0

                Persistence and Installation Behavior:

                barindex
                Writes Mach-O files to untypical directoriesShow sources
                Source: /bin/cp (PID: 858)FAT Mach-O written to unusual path: /Users/drew/Library/MacOsServices/updateMacOsJump to dropped file
                Source: /Users/drew/Desktop/types-config.ts (PID: 856)Launch agent/daemon created with LimitLoadToSessionType Aqua, file created: /Users/drew/Library/LaunchAgents/com.apple.update.plistJump to behavior
                Source: /bin/cp (PID: 858)Permissions modified for written FAT Mach-O /Users/drew/Library/MacOsServices/updateMacOs: bits: - usr: rx grp: rx all: rwxJump to dropped file
                Source: /Users/drew/Desktop/types-config.ts (PID: 856)Shell command executed: sh -c whoamiJump to behavior
                Source: /Users/drew/Desktop/types-config.ts (PID: 856)Shell command executed: sh -c cp '/Users/drew/Desktop/types-config.ts' '/Users/drew/Library/MacOsServices/updateMacOs'Jump to behavior
                Source: /Users/drew/Desktop/types-config.ts (PID: 856)Shell command executed: sh -c nohup '/Users/drew/Library/MacOsServices/updateMacOs' >/dev/null 2>&1 &Jump to behavior
                Source: /bin/sh (PID: 857)Shell command executed: sh -c whoamiJump to behavior
                Source: /bin/sh (PID: 858)Shell command executed: sh -c cp '/Users/drew/Desktop/types-config.ts' '/Users/drew/Library/MacOsServices/updateMacOs'Jump to behavior
                Source: /bin/sh (PID: 859)Shell command executed: sh -c nohup '/Users/drew/Library/MacOsServices/updateMacOs' >/dev/null 2>&1 &Jump to behavior
                Source: /Users/drew/Library/MacOsServices/updateMacOs (PID: 860)Shell command executed: sh -c whoamiJump to behavior
                Source: /bin/sh (PID: 861)Shell command executed: sh -c whoamiJump to behavior
                Source: /bin/bash (PID: 860)Nohup executable: /usr/bin/nohup -> nohup /Users/drew/Library/MacOsServices/updateMacOsJump to behavior
                Source: /bin/cp (PID: 858)File written: /Users/drew/Library/MacOsServices/updateMacOsJump to dropped file
                Source: /Users/drew/Desktop/types-config.ts (PID: 856)XML plist file created: /Users/drew/Library/LaunchAgents/com.apple.update.plistJump to dropped file
                Source: /Users/drew/Desktop/types-config.ts (PID: 856)Launch agent created File created: /Users/drew/Library/LaunchAgents/com.apple.update.plistJump to behavior
                Source: /Users/drew/Desktop/types-config.ts (PID: 856)Launch agent/daemon created with KeepAlive and/or RunAtLoad, file created: /Users/drew/Library/LaunchAgents/com.apple.update.plistJump to behavior

                Hooking and other Techniques for Hiding and Protection:

                barindex
                Process executable has a file extension which is uncommon (probably to disguise the executable)Show sources
                Source: /usr/bin/sudo (PID: 856)Process executable with extension: /Users/drew/Desktop/types-config.tsJump to behavior
                Source: /Users/drew/Desktop/types-config.ts (PID: 856)Launch agent created File created: /Users/drew/Library/LaunchAgents/com.apple.update.plistJump to behavior
                Source: /bin/bash (PID: 857)Sysctl requested: kern.hostname (1.10)Jump to behavior
                Source: /bin/bash (PID: 858)Sysctl requested: kern.hostname (1.10)Jump to behavior
                Source: /bin/bash (PID: 859)Sysctl requested: kern.hostname (1.10)Jump to behavior
                Source: /bin/bash (PID: 861)Sysctl requested: kern.hostname (1.10)Jump to behavior

                Stealing of Sensitive Information:

                barindex
                Yara detected SysJokerShow sources
                Source: Yara matchFile source: types-config.ts, type: SAMPLE
                Source: Yara matchFile source: 00000856.00000353.1.0000000107a83000.0000000107a9b000.r-x.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000856.00000353.9.0000000107a83000.0000000107a9b000.r-x.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000860.00000364.1.000000010df6a000.000000010df82000.r-x.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: types-config.ts PID: 856, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: updateMacOs PID: 860, type: MEMORYSTR
                Source: Yara matchFile source: /Users/drew/Library/MacOsServices/updateMacOs, type: DROPPED

                Remote Access Functionality:

                barindex
                Yara detected SysJokerShow sources
                Source: Yara matchFile source: types-config.ts, type: SAMPLE
                Source: Yara matchFile source: 00000856.00000353.1.0000000107a83000.0000000107a9b000.r-x.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000856.00000353.9.0000000107a83000.0000000107a9b000.r-x.sdmp, type: MEMORY
                Source: Yara matchFile source: 00000860.00000364.1.000000010df6a000.000000010df82000.r-x.sdmp, type: MEMORY
                Source: Yara matchFile source: Process Memory Space: types-config.ts PID: 856, type: MEMORYSTR
                Source: Yara matchFile source: Process Memory Space: updateMacOs PID: 860, type: MEMORYSTR
                Source: Yara matchFile source: /Users/drew/Library/MacOsServices/updateMacOs, type: DROPPED

                Mitre Att&ck Matrix

                Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
                Valid AccountsScripting1LC_LOAD_DYLIB Addition1LC_LOAD_DYLIB Addition1Masquerading21OS Credential DumpingSystem Information Discovery1Remote ServicesData from Local SystemExfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
                Default AccountsScheduled Task/JobLaunch Agent4Launch Agent4Scripting1LSASS MemoryApplication Window DiscoveryRemote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothNon-Application Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
                Domain AccountsAt (Linux)Launch Daemon2Launch Daemon2Obfuscated Files or InformationSecurity Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationApplication Layer Protocol2Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
                Local AccountsAt (Windows)Plist Modification1Plist Modification1Binary PaddingNTDSSystem Network Configuration DiscoveryDistributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud

                Behavior Graph

                Hide Legend

                Legend:

                • Process
                • Signature
                • Created File
                • DNS/IP Info
                • Is Dropped
                • Number of created Files
                • Shell
                • Is malicious
                • Internet
                behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1708605 Sample: types-config.ts Startdate: 12/01/2022 Architecture: MAC Score: 64 29 87.248.100.168, 443, 49383 YAHOO-IRDGB United Kingdom 2->29 31 graphic-updater.com 23.254.131.176, 443, 49388, 49390 HOSTWINDSUS United States 2->31 33 6 other IPs or domains 2->33 37 Yara detected SysJoker 2->37 39 Found detection on Joe Sandbox Cloud Basic 2->39 10 mono-sgen64 sudo 2->10         started        signatures3 process4 process5 12 sudo types-config.ts 1 10->12         started        signatures6 41 Process executable has a file extension which is uncommon (probably to disguise the executable) 12->41 15 sh bash cp 1 12->15         started        19 sh bash 12->19         started        21 sh bash whoami 12->21         started        process7 file8 27 /Users/drew/Librar...ervices/updateMacOs, Mach-O 15->27 dropped 35 Writes Mach-O files to untypical directories 15->35 23 bash nohup updateMacOs 19->23         started        signatures9 process10 process11 25 sh bash whoami 23->25         started       

                Screenshots

                Thumbnails

                This section contains all screenshots as thumbnails, including those not shown in the slideshow.

                cam-macmac-stand

                Antivirus, Machine Learning and Genetic Malware Detection

                Initial Sample

                No Antivirus matches

                Dropped Files

                No Antivirus matches

                Domains

                No Antivirus matches

                URLs

                No Antivirus matches

                Domains and IPs

                Contacted Domains

                NameIPActiveMaliciousAntivirus DetectionReputation
                graphic-updater.com
                		23.254.131.176
                		truefalse
                  		unknown
                  drive.google.com
                  		142.250.186.110
                  		truefalse
                    		high
                    googlehosted.l.googleusercontent.com
                    		142.250.186.65
                    		truefalse
                      		high
                      doc-0k-2o-docs.googleusercontent.com
                      		unknown
                      		unknownfalse
                        		high
                        r3.o.lencr.org
                        		unknown
                        		unknownfalse
                          		unknown

                          URLs from Memory and Binaries

                          NameSourceMaliciousAntivirus DetectionReputation
                          https://graphic-updater.comnull.364.drfalse
                            		unknown

                            Contacted IPs

                            • No. of IPs < 25%
                            • 25% < No. of IPs < 50%
                            • 50% < No. of IPs < 75%
                            • 75% < No. of IPs

                            Public

                            IPDomainCountryFlagASNASN NameMalicious
                            87.248.100.168
                            		unknownUnited Kingdom
                            		34010YAHOO-IRDGBfalse
                            23.254.131.176
                            		graphic-updater.comUnited States
                            		54290HOSTWINDSUSfalse
                            2.16.12.64
                            		unknownEuropean Union
                            		16625AKAMAI-ASUSfalse
                            142.250.186.110
                            		drive.google.comUnited States
                            		15169GOOGLEUSfalse
                            23.203.78.159
                            		unknownUnited States
                            		16625AKAMAI-ASUSfalse
                            142.250.186.65
                            		googlehosted.l.googleusercontent.comUnited States
                            		15169GOOGLEUSfalse

                            Signature Similarity

                            Sample Distance (10 = nearest)
                            10 9 8 7 6 5 4 3 2 1
                            Samplename Analysis ID SHA256 Similarity

                            Joe Sandbox View / Context

                            IPs

                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                            23.254.131.176WifCphMYfbGet hashmaliciousBrowse
                              XTdh56ustBGet hashmaliciousBrowse
                                JGJ5oOtOKbGet hashmaliciousBrowse
                                  psO5Q4nOUGGet hashmaliciousBrowse
                                    IGFXCUISERVICE.exeGet hashmaliciousBrowse
                                      #SysJoker_n2.exeGet hashmaliciousBrowse
                                        IGFXCUISERVICE.EXEGet hashmaliciousBrowse
                                          867SzVr2XaGet hashmaliciousBrowse

                                            Domains

                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                            graphic-updater.comWifCphMYfbGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            XTdh56ustBGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            JGJ5oOtOKbGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            psO5Q4nOUGGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            IGFXCUISERVICE.exeGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            #SysJoker_n2.exeGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            IGFXCUISERVICE.EXEGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            867SzVr2XaGet hashmaliciousBrowse
                                            • 23.254.131.176

                                            ASN

                                            MatchAssociated Sample Name / URLSHA 256DetectionLinkContext
                                            HOSTWINDSUSWifCphMYfbGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            XTdh56ustBGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            JGJ5oOtOKbGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            psO5Q4nOUGGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            #U266c secured VM.5647.htmlGet hashmaliciousBrowse
                                            • 142.11.222.100
                                            IGFXCUISERVICE.exeGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            #SysJoker_n2.exeGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            IGFXCUISERVICE.EXEGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            867SzVr2XaGet hashmaliciousBrowse
                                            • 23.254.131.176
                                            g6GVx95dFk.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            8ILODCNOM4.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            YjC8YtL5mm.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            AbT54oXloS.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            Pxo6lJ3ixn.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            a5yyNUUUOO.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            1ZXtQq89bt.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            QBPQKYk3Ky.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            drjueN3vt8.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            gxMhx1QlJK.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            G7R312DEIB.xlsGet hashmaliciousBrowse
                                            • 104.168.155.129
                                            AKAMAI-ASUS0DDMOxaqEX.exeGet hashmaliciousBrowse
                                            • 23.203.78.112
                                            a1.docGet hashmaliciousBrowse
                                            • 2.20.156.69
                                            jerusalem.sh4Get hashmaliciousBrowse
                                            • 104.122.194.133
                                            J5RBhmpBtwGet hashmaliciousBrowse
                                            • 104.90.164.244
                                            Aw0o1T3OU3Get hashmaliciousBrowse
                                            • 95.101.248.56
                                            URaNYConxrGet hashmaliciousBrowse
                                            • 184.31.203.177
                                            8NjgFrA0BQGet hashmaliciousBrowse
                                            • 23.9.137.143
                                            6RMtwx02K1Get hashmaliciousBrowse
                                            • 104.98.7.141
                                            b3astmode.x86Get hashmaliciousBrowse
                                            • 104.116.11.203
                                            b3astmode.armGet hashmaliciousBrowse
                                            • 23.199.66.191
                                            u79l78PYyJGet hashmaliciousBrowse
                                            • 95.101.248.15
                                            hoho.x86Get hashmaliciousBrowse
                                            • 23.214.68.217
                                            ZU9VbjUL19Get hashmaliciousBrowse
                                            • 184.30.64.249
                                            arm7Get hashmaliciousBrowse
                                            • 104.126.211.53
                                            x86Get hashmaliciousBrowse
                                            • 104.101.138.146
                                            B7hzcKqR8PGet hashmaliciousBrowse
                                            • 104.71.4.37
                                            Release Message[4722].htmlGet hashmaliciousBrowse
                                            • 23.50.97.168
                                            UgNtYb3T3dGet hashmaliciousBrowse
                                            • 104.84.160.216
                                            nPLk9q5glAGet hashmaliciousBrowse
                                            • 104.115.227.113
                                            UpDfJqcSfsGet hashmaliciousBrowse
                                            • 104.73.199.200
                                            YAHOO-IRDGBpvso3ZXDyY.exeGet hashmaliciousBrowse
                                            • 87.248.100.215
                                            Banco BPM _Copia del pagamento_Pdf.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            PDA.xlsxGet hashmaliciousBrowse
                                            • 87.248.100.215
                                            Informacion del pago.vbsGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            https://msgsndr.com/smtp_email/event/clicked/message/nR8kwFdTPix8UcTr5DoW?url=https%3A%2F%2Fpost-canada-manager.ldc-services.com%2Fpay%2Fca%2FGet hashmaliciousBrowse
                                            • 212.82.100.181
                                            UvGeBNTPpT.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            https://post-canada-manager.ldc-services.com/pay/ca/Get hashmaliciousBrowse
                                            • 212.82.100.181
                                            dHyQ66BhVK.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            rmmLc0TLEs.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            WBGAO0xAUv.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            r5XFZVA30A.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            9syta0IvuY.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            O2owPoPcA7.exeGet hashmaliciousBrowse
                                            • 87.248.100.215
                                            ToFGMplxYQ.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            BHx1bTu75D.exeGet hashmaliciousBrowse
                                            • 87.248.100.215
                                            wklskIAumQ.exeGet hashmaliciousBrowse
                                            • 87.248.100.215
                                            B6WXcbIOpD.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            63rK4V9GI0.exeGet hashmaliciousBrowse
                                            • 87.248.100.216
                                            I3RG004vXg.exeGet hashmaliciousBrowse
                                            • 87.248.100.215
                                            25t8ORqXKy.exeGet hashmaliciousBrowse
                                            • 87.248.100.216

                                            JA3 Fingerprints

                                            No context

                                            Dropped Files

                                            No context


                                            Runtime Messages

                                            Command:sudo -u drew /Users/drew/Desktop/types-config.ts
                                            Exit Code:0
                                            Exit Code Info:
                                            Killed:False
                                            Standard Output:
                                            addToStatup
                                            Standard Error:

                                            Created / dropped Files

                                            /Users/drew/Library/LaunchAgents/com.apple.update.plist
                                            Process:/Users/drew/Desktop/types-config.ts
                                            File Type:XML 1.0 document, ASCII text
                                            Category:dropped
                                            Size (bytes):579
                                            Entropy (8bit):5.021176113008371
                                            Encrypted:false
                                            SSDEEP:12:TMHdgo+tJVEdQiCXFMBiyJd0vOD0er4TRa/S8e2EZy:2dfyiwKJdGecVaRwZy
                                            MD5:DB6B1181719A4315F1CD8EC13131B6B6
                                            SHA1:FA9942FAEFE1F7530385457149A6B5B1811F1CB8
                                            SHA-256:7BDE80AC5268DA84DCE386E73CE6B44B87D61FBD841A563E9D559D8BA2666A14
                                            SHA-512:4151B3D3538ABDA8DAB6A44FB666E0C6A2C3A5CCE6751A46452D6BE01F804B25C47F471FB8F11366274558B95EB5631E6F1D2AA085A96FCDC4AB93F7DC42FD21
                                            Malicious:false
                                            Reputation:low
                                            Preview: <?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>Label</key>..<string>com.apple.update</string>. <key>LimitLoadToSessionType</key>. <string>Aqua</string>..<key>ProgramArguments</key>..<array>...<string>/Users/drew/Library/MacOsServices/updateMacOs</string>..</array>.<key>KeepAlive</key>. <dict>. <key>SuccessfulExit</key>. <true/>. </dict>. <key>RunAtLoad</key>. <true/>.</dict>.</plist>.
                                            /Users/drew/Library/MacOsServices/updateMacOs
                                            Process:/bin/cp
                                            File Type:Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE>] [arm64:Mach-O 64-bit arm64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE>]
                                            Category:dropped
                                            Size (bytes):360176
                                            Entropy (8bit):4.67371613955121
                                            Encrypted:false
                                            SSDEEP:6144:5xw19koSAgvRyrnN5ft9A7pIHWhT5FixbxLZ:CvgMrnN51qaH+T5wl
                                            MD5:E06E06752509F9CD8BC85AA1AA24DBA2
                                            SHA1:554AEF8BF44E7FA941E1190E41C8770E90F07254
                                            SHA-256:1A9A5C797777F37463B44DE2B49A7F95ABCA786DB3977DCDAC0F79DA739C08AC
                                            SHA-512:78A210C5FD1AC8C601FBB4ED226E7AAF1CC5BDA187807BA3020997862FD54B59081F0B7F4FDC720ACFA8E3D6A35DBE9309E0B2FE38088F493A02717A1057A56E
                                            Malicious:true
                                            Yara Hits:
                                            • Rule: JoeSecurity_SysJoker, Description: Yara detected SysJoker, Source: /Users/drew/Library/MacOsServices/updateMacOs, Author: Joe Security
                                            Reputation:low
                                            Preview: ..................@.......................~.............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................
                                            /dev/null
                                            Process:/Users/drew/Library/MacOsServices/updateMacOs
                                            File Type:ASCII text
                                            Category:dropped
                                            Size (bytes):442
                                            Entropy (8bit):5.449112826225266
                                            Encrypted:false
                                            SSDEEP:12:oq2J58phXzDj/LwLK1BizIt9izItSqXpqX6qX2qX2qc:e5OBDnxmImI8sps6s2s2v
                                            MD5:68EA8FBFBF8B41C2BF31561965A48326
                                            SHA1:30DF9A643B9901560C7D086A2A1AFBEDCA0615C8
                                            SHA-256:9C5D489FA3AE84FA9635B27AAA1099578BFD4DA48F6B9BD80F615BC2EC528B09
                                            SHA-512:90C5614A1DF73EECC38396B0ED6A347A24359912CDCC072433B485F741448001C4BD9D5A90EA9C0BF33C259D445A9A70D9DEECE807883D554577A87A2EA9FE96
                                            Malicious:false
                                            Reputation:low
                                            Preview: addToStatup.getUrlAvailable.response: NmsjCSAgWSlhaVMvJz0SQH5+aiUzMCUpKFdqOzEgIjYMI2UhCDxmFg==.domain: https://graphic-updater.com.ip.x.os.serial=drew_x&name=drew&os=os&anti=av&ip=ip&user_token=987217232.response: {"token":"df58cf9d-630a-4d20-9b7e-88da3ded8555"}.token: df58cf9d-630a-4d20-9b7e-88da3ded8555.response: {"data":[]}.s 27.response: {"data":[]}.s 24.response: {"data":[]}.s 28.response: {"data":[]}.s 28.response: {"data":[]}.s 30.

                                            Static File Info

                                            General

                                            File type:Mach-O universal binary with 2 architectures: [x86_64:Mach-O 64-bit x86_64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE>] [arm64:Mach-O 64-bit arm64 executable, flags:<NOUNDEFS|DYLDLINK|TWOLEVEL|WEAK_DEFINES|BINDS_TO_WEAK|PIE>]
                                            Entropy (8bit):4.67371613955121
                                            TrID:
                                            • Mac OS X Universal Binary executable (4004/1) 75.96%
                                            • HSC music composer song (1267/141) 24.04%
                                            File name:types-config.ts
                                            File size:360176
                                            MD5:e06e06752509f9cd8bc85aa1aa24dba2
                                            SHA1:554aef8bf44e7fa941e1190e41c8770e90f07254
                                            SHA256:1a9a5c797777f37463b44de2b49a7f95abca786db3977dcdac0f79da739c08ac
                                            SHA512:78a210c5fd1ac8c601fbb4ed226e7aaf1cc5bda187807ba3020997862fd54b59081f0b7f4fdc720acfa8e3d6a35dbe9309e0b2fe38088f493a02717a1057a56e
                                            SSDEEP:6144:5xw19koSAgvRyrnN5ft9A7pIHWhT5FixbxLZ:CvgMrnN51qaH+T5wl
                                            File Content Preview:..................@.......................~....................................................................................................................................................................................................................

                                            CodeSign Information

                                            ["Executable=/Users/drew/Desktop/types-config.ts","Identifier=test-555549448174817ef4cf398d975b7860466eaec7","Format=Mach-O universal (x86_64 arm64)","CodeDirectory v=20400 size=1510 flags=0x2(adhoc) hashes=36+7 location=embedded","VersionPlatform=1","VersionMin=721664","VersionSDK=721664","Hash type=sha256 size=32","CandidateCDHash sha256=d7b248ed0c9ba2f57477253e00a68503f22fd7ec","CandidateCDHashFull sha256=d7b248ed0c9ba2f57477253e00a68503f22fd7ec4caa8f24976c526335a64f8f","Hash choices=sha256","CMSDigest=d7b248ed0c9ba2f57477253e00a68503f22fd7ec4caa8f24976c526335a64f8f","CMSDigestType=2","Executable Segment base=0","Executable Segment limit=98304","Executable Segment flags=0x1","Page size=4096","CDHash=d7b248ed0c9ba2f57477253e00a68503f22fd7ec","Signature=adhoc","Info.plist=not bound","TeamIdentifier=not set","Sealed Resources=none","Internal requirements count=0 size=12"]
                                            Static Mach Info
                                            General Information for header 1
                                            Endian:<
                                            Size:64-bit
                                            Architecture:x86_64
                                            Filetype:execute
                                            Nbr. of load commands:19
                                            Entry point:0x6884
                                            segment_command_64 aggregated: 5
                                            NameValue
                                            segname__PAGEZERO
                                            vmaddr0x0
                                            vmsize0x100000000
                                            fileoff0x0
                                            filesize0x0
                                            maxprot0x0
                                            initprot0x0
                                            nsects0
                                            flags0x0
                                            NameValue
                                            segname__TEXT
                                            vmaddr0x100000000
                                            vmsize0x18000
                                            fileoff0x0
                                            filesize0x18000
                                            maxprot0x5
                                            initprot0x5
                                            nsects7
                                            flags0x0
                                            Datas
                                            sectnamesegnameaddrsizeoffsetentropyalignreloffnrelocflags
                                            __text__TEXT0x100001EF00x124F70x1EF06.21230x40x000x80000400
                                            __stubs__TEXT0x1000143E80x2400x143E83.33520x10x000x80000408
                                            __stub_helper__TEXT0x1000146280x3A80x146284.52660x20x000x80000400
                                            __gcc_except_tab__TEXT0x1000149D00x129C0x149D06.06750x20x000x0
                                            __const__TEXT0x100015C700x2C00x15C702.48480x40x000x0
                                            __cstring__TEXT0x100015F300x1A7F0x15F305.32350x40x000x2
                                            __unwind_info__TEXT0x1000179B00x6440x179B05.42380x20x000x0
                                            NameValue
                                            segname__DATA_CONST
                                            vmaddr0x100018000
                                            vmsize0x4000
                                            fileoff0x18000
                                            filesize0x4000
                                            maxprot0x3
                                            initprot0x3
                                            nsects3
                                            flags0x10
                                            Datas
                                            sectnamesegnameaddrsizeoffsetentropyalignreloffnrelocflags
                                            __got__DATA_CONST0x1000180000xB80x180000.88620x30x000x6
                                            __mod_init_func__DATA_CONST0x1000180B80x80x180B81.75000x30x000x9
                                            __const__DATA_CONST0x1000180C00x3C80x180C02.48480x30x000x0
                                            NameValue
                                            segname__DATA
                                            vmaddr0x10001C000
                                            vmsize0x4000
                                            fileoff0x1C000
                                            filesize0x4000
                                            maxprot0x3
                                            initprot0x3
                                            nsects3
                                            flags0x0
                                            Datas
                                            sectnamesegnameaddrsizeoffsetentropyalignreloffnrelocflags
                                            __la_symbol_ptr__DATA0x10001C0000x3000x1C0002.71640x30x000x7
                                            __data__DATA0x10001C3000xC0x1C3000.41380x30x000x0
                                            __common__DATA0x10001C3100xF00x0-0.00000x30x000x1
                                            NameValue
                                            segname__LINKEDIT
                                            vmaddr0x100020000
                                            vmsize0xC000
                                            fileoff0x20000
                                            filesize0x8310
                                            maxprot0x1
                                            initprot0x1
                                            nsects0
                                            flags0x0
                                            dyld_info_command aggregated: 1
                                            NameValue
                                            rebase_off131072
                                            rebase_size56
                                            bind_off131128
                                            bind_size1360
                                            weak_bind_off132488
                                            weak_bind_size456
                                            lazy_bind_off132944
                                            lazy_bind_size3752
                                            export_off136696
                                            export_size312
                                            symtab_command aggregated: 1
                                            NameValue
                                            symoff137440
                                            nsyms131
                                            stroff140400
                                            strsize4432
                                            dysymtab_command aggregated: 1
                                            NameValue
                                            ilocalsym0
                                            nlocalsym1
                                            iextdefsym1
                                            nextdefsym7
                                            iundefsym8
                                            nundefsym123
                                            tocoff0
                                            ntoc0
                                            modtaboff0
                                            nmodtab0
                                            extrefsymoff0
                                            nextrefsyms0
                                            indirectsymoff139536
                                            nindirectsyms215
                                            extreloff0
                                            nextrel0
                                            locreloff0
                                            nlocrel0
                                            dylinker_command aggregated: 1
                                            NameValue
                                            name12
                                            Datas/usr/lib/dyld
                                            uuid_command aggregated: 1
                                            NameValue
                                            uuidb'\x81t\x81~\xf4\xcf9\x8d\x97[x`Fn\xae\xc7'
                                            build_version_command aggregated: 1
                                            NameValue
                                            platform1
                                            minos721664
                                            sdk721664
                                            ntools1
                                            Datas.
                                            source_version_command aggregated: 1
                                            NameValue
                                            version0
                                            entry_point_command aggregated: 1
                                            NameValue
                                            entryoff26756
                                            stacksize0
                                            dylib_command aggregated: 3
                                            NameValue
                                            name24
                                            timestampThu Jan 1 01:00:02 1970
                                            current_version9.0.0
                                            compatibility_version7.0.0
                                            Datas/usr/lib/libcurl.4.dylib
                                            NameValue
                                            name24
                                            timestampThu Jan 1 01:00:02 1970
                                            current_version905.6.0
                                            compatibility_version1.0.0
                                            Datas/usr/lib/libc++.1.dylib
                                            NameValue
                                            name24
                                            timestampThu Jan 1 01:00:02 1970
                                            current_version1292.100.5
                                            compatibility_version1.0.0
                                            Datas/usr/lib/libSystem.B.dylib
                                            linkedit_data_command aggregated: 3
                                            NameValue
                                            dataoff137008
                                            datasize360
                                            NameValue
                                            dataoff137368
                                            datasize72
                                            NameValue
                                            dataoff144832
                                            datasize19792
                                            Internal Symbols
                                            __NSGetExecutablePath
                                            __Unwind_Resume
                                            __ZNKSt13runtime_error4whatEv
                                            __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEPKc
                                            __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm
                                            __ZNKSt3__120__vector_base_commonILb1EE20__throw_length_errorEv
                                            __ZNKSt3__121__basic_string_commonILb1EE20__throw_length_errorEv
                                            __ZNKSt3__16locale9has_facetERNS0_2idE
                                            __ZNKSt3__16locale9use_facetERNS0_2idE
                                            __ZNKSt3__18ios_base6getlocEv
                                            __ZNKSt9exception4whatEv
                                            __ZNSt11logic_errorC2EPKc
                                            __ZNSt12length_errorD1Ev
                                            __ZNSt13runtime_errorC1EPKc
                                            __ZNSt13runtime_errorC1ERKS_
                                            __ZNSt13runtime_errorD1Ev
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE5eraseEmm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKcm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6assignEPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6insertEmPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6resizeEmc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9__grow_byEmmmmmm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9push_backEc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEaSERKS5_
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5flushEv
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5writeEPKcl
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryC1ERS3_
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryD1Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED0Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED1Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEi
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE5uflowEv
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE6xsgetnEPcl
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE6xsputnEPKcl
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE9showmanycEv
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEEC2Ev
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__14__fs10filesystem14__current_pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem18__create_directoryERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem8__removeERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem8__statusERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14cerrE
                                            __ZNSt3__14coutE
                                            __ZNSt3__15ctypeIcE2idE
                                            __ZNSt3__16localeC1ERKS0_
                                            __ZNSt3__16localeD1Ev
                                            __ZNSt3__17codecvtIcc11__mbstate_tE2idE
                                            __ZNSt3__18ios_base33__set_badbit_and_consider_rethrowEv
                                            __ZNSt3__18ios_base4initEPv
                                            __ZNSt3__18ios_base5clearEj
                                            __ZNSt3__19basic_iosIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__19to_stringEi
                                            __ZNSt3__19to_stringEm
                                            __ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_
                                            __ZNSt8bad_castC1Ev
                                            __ZNSt8bad_castD1Ev
                                            __ZNSt9exceptionD1Ev
                                            __ZNSt9exceptionD2Ev
                                            __ZSt9terminatev
                                            __ZTINSt3__113basic_filebufIcNS_11char_traitsIcEEEE
                                            __ZTINSt3__113basic_ostreamIcNS_11char_traitsIcEEEE
                                            __ZTINSt3__114basic_ofstreamIcNS_11char_traitsIcEEEE
                                            __ZTINSt3__115basic_streambufIcNS_11char_traitsIcEEEE
                                            __ZTINSt3__117bad_function_callE
                                            __ZTISt12length_error
                                            __ZTISt13runtime_error
                                            __ZTISt8bad_cast
                                            __ZTISt9exception
                                            __ZTSNSt3__113basic_filebufIcNS_11char_traitsIcEEEE
                                            __ZTSNSt3__114basic_ofstreamIcNS_11char_traitsIcEEEE
                                            __ZTSNSt3__117bad_function_callE
                                            __ZTVN10__cxxabiv120__si_class_type_infoE
                                            __ZTVSt12length_error
                                            __ZTVSt9exception
                                            __ZTv0_n24_NSt3__113basic_ostreamIcNS_11char_traitsIcEEED0Ev
                                            __ZTv0_n24_NSt3__113basic_ostreamIcNS_11char_traitsIcEEED1Ev
                                            __ZdaPv
                                            __ZdlPv
                                            __Znam
                                            __Znwm
                                            ___assert_rtn
                                            ___bzero
                                            ___cxa_allocate_exception
                                            ___cxa_atexit
                                            ___cxa_begin_catch
                                            ___cxa_end_catch
                                            ___cxa_free_exception
                                            ___cxa_get_exception_ptr
                                            ___cxa_throw
                                            ___error
                                            ___gxx_personality_v0
                                            ___stack_chk_fail
                                            ___stack_chk_guard
                                            __mh_execute_header
                                            _curl_easy_cleanup
                                            _curl_easy_getinfo
                                            _curl_easy_init
                                            _curl_easy_perform
                                            _curl_easy_setopt
                                            _fclose
                                            _fflush
                                            _fgets
                                            _fopen
                                            _fread
                                            _fseek
                                            _fseeko
                                            _ftello
                                            _fwrite
                                            _localeconv
                                            _memchr
                                            _memcmp
                                            _memcpy
                                            _memmove
                                            _memset
                                            _pclose
                                            _popen
                                            _rand
                                            _sleep
                                            _snprintf
                                            _strlen
                                            _strtod
                                            _strtoll
                                            _strtoull
                                            _system
                                            dyld_stub_binder
                                            radr://5614542
                                            External symbols
                                            __NSGetExecutablePath
                                            __Unwind_Resume
                                            __ZNKSt13runtime_error4whatEv
                                            __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEPKc
                                            __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm
                                            __ZNKSt3__120__vector_base_commonILb1EE20__throw_length_errorEv
                                            __ZNKSt3__121__basic_string_commonILb1EE20__throw_length_errorEv
                                            __ZNKSt3__16locale9has_facetERNS0_2idE
                                            __ZNKSt3__16locale9use_facetERNS0_2idE
                                            __ZNKSt3__18ios_base6getlocEv
                                            __ZNSt11logic_errorC2EPKc
                                            __ZNSt13runtime_errorC1EPKc
                                            __ZNSt13runtime_errorC1ERKS_
                                            __ZNSt13runtime_errorD1Ev
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE5eraseEmm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKcm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6assignEPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6insertEmPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6resizeEmc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9__grow_byEmmmmmm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9push_backEc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEaSERKS5_
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5flushEv
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5writeEPKcl
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryC1ERS3_
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryD1Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEi
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEEC2Ev
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__14__fs10filesystem14__current_pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem18__create_directoryERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem8__removeERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem8__statusERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__16localeC1ERKS0_
                                            __ZNSt3__16localeD1Ev
                                            __ZNSt3__18ios_base33__set_badbit_and_consider_rethrowEv
                                            __ZNSt3__18ios_base4initEPv
                                            __ZNSt3__18ios_base5clearEj
                                            __ZNSt3__19basic_iosIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__19to_stringEi
                                            __ZNSt3__19to_stringEm
                                            __ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_
                                            __ZNSt8bad_castC1Ev
                                            __ZNSt9exceptionD1Ev
                                            __ZNSt9exceptionD2Ev
                                            __ZSt9terminatev
                                            ___assert_rtn
                                            ___bzero
                                            ___cxa_allocate_exception
                                            ___cxa_atexit
                                            ___cxa_begin_catch
                                            ___cxa_end_catch
                                            ___cxa_free_exception
                                            ___cxa_get_exception_ptr
                                            ___cxa_throw
                                            ___error
                                            ___stack_chk_fail
                                            _curl_easy_cleanup
                                            _curl_easy_getinfo
                                            _curl_easy_init
                                            _curl_easy_perform
                                            _curl_easy_setopt
                                            _fclose
                                            _fflush
                                            _fgets
                                            _fopen
                                            _fread
                                            _fseek
                                            _fseeko
                                            _ftello
                                            _fwrite
                                            _localeconv
                                            _memchr
                                            _memcmp
                                            _memcpy
                                            _memmove
                                            _memset
                                            _pclose
                                            _popen
                                            _rand
                                            _sleep
                                            _snprintf
                                            _strlen
                                            _strtod
                                            _strtoll
                                            _strtoull
                                            _system
                                            General Information for header 2
                                            Endian:<
                                            Size:32-bit
                                            Architecture:ARM64
                                            Filetype:execute
                                            Nbr. of load commands:19
                                            Entry point:
                                            segment_command_64 aggregated: 5
                                            NameValue
                                            segname__PAGEZERO
                                            vmaddr0x0
                                            vmsize0x100000000
                                            fileoff0x0
                                            filesize0x0
                                            maxprot0x0
                                            initprot0x0
                                            nsects0
                                            flags0x0
                                            NameValue
                                            segname__TEXT
                                            vmaddr0x100000000
                                            vmsize0x18000
                                            fileoff0x0
                                            filesize0x18000
                                            maxprot0x5
                                            initprot0x5
                                            nsects8
                                            flags0x0
                                            Datas
                                            sectnamesegnameaddrsizeoffsetentropyalignreloffnrelocflags
                                            __text__TEXT0x100001EF00x11F600x1EF06.40520x20x000x80000400
                                            __stubs__TEXT0x100013E500x4800x13E503.86800x20x000x80000408
                                            __stub_helper__TEXT0x1000142D00x4680x142D04.10990x20x000x80000400
                                            __gcc_except_tab__TEXT0x1000147380x13580x147385.41220x20x000x0
                                            __const__TEXT0x100015A900x4480x15A902.47110x40x000x0
                                            __cstring__TEXT0x100015ED80x1A780x15ED85.32410x00x000x2
                                            __unwind_info__TEXT0x1000179500x62C0x179505.23470x20x000x0
                                            __eh_frame__TEXT0x100017F800x800x17F803.34560x30x000x0
                                            NameValue
                                            segname__DATA_CONST
                                            vmaddr0x100018000
                                            vmsize0x4000
                                            fileoff0x18000
                                            filesize0x4000
                                            maxprot0x3
                                            initprot0x3
                                            nsects3
                                            flags0x10
                                            Datas
                                            sectnamesegnameaddrsizeoffsetentropyalignreloffnrelocflags
                                            __got__DATA_CONST0x1000180000xB00x180000.78620x30x000x6
                                            __mod_init_func__DATA_CONST0x1000180B00x80x180B01.75000x30x000x9
                                            __const__DATA_CONST0x1000180B80x3C80x180B82.47110x30x000x0
                                            NameValue
                                            segname__DATA
                                            vmaddr0x10001C000
                                            vmsize0x4000
                                            fileoff0x1C000
                                            filesize0x4000
                                            maxprot0x3
                                            initprot0x3
                                            nsects3
                                            flags0x0
                                            Datas
                                            sectnamesegnameaddrsizeoffsetentropyalignreloffnrelocflags
                                            __la_symbol_ptr__DATA0x10001C0000x3000x1C0002.66750x30x000x7
                                            __data__DATA0x10001C3000xC0x1C3000.41380x30x000x0
                                            __common__DATA0x10001C3100xF00x0-0.00000x30x000x1
                                            NameValue
                                            segname__LINKEDIT
                                            vmaddr0x100020000
                                            vmsize0x8000
                                            fileoff0x20000
                                            filesize0x7EF0
                                            maxprot0x1
                                            initprot0x1
                                            nsects0
                                            flags0x0
                                            dyld_info_command aggregated: 1
                                            NameValue
                                            rebase_off131072
                                            rebase_size56
                                            bind_off131128
                                            bind_size1360
                                            weak_bind_off132488
                                            weak_bind_size120
                                            lazy_bind_off132608
                                            lazy_bind_size3744
                                            export_off136352
                                            export_size32
                                            symtab_command aggregated: 1
                                            NameValue
                                            symoff136752
                                            nsyms125
                                            stroff139608
                                            strsize4160
                                            dysymtab_command aggregated: 1
                                            NameValue
                                            ilocalsym0
                                            nlocalsym1
                                            iextdefsym1
                                            nextdefsym1
                                            iundefsym2
                                            nundefsym123
                                            tocoff0
                                            ntoc0
                                            modtaboff0
                                            nmodtab0
                                            extrefsymoff0
                                            nextrefsyms0
                                            indirectsymoff138752
                                            nindirectsyms214
                                            extreloff0
                                            nextrel0
                                            locreloff0
                                            nlocrel0
                                            dylinker_command aggregated: 1
                                            NameValue
                                            name12
                                            Datas/usr/lib/dyld
                                            uuid_command aggregated: 1
                                            NameValue
                                            uuidb'\xec\x10\xd8Nr?=\x9a\x85$\xcd\xc7\x06t\x9dh'
                                            build_version_command aggregated: 1
                                            NameValue
                                            platform1
                                            minos721664
                                            sdk721664
                                            ntools1
                                            Datas.
                                            source_version_command aggregated: 1
                                            NameValue
                                            version0
                                            entry_point_command aggregated: 1
                                            NameValue
                                            entryoff25300
                                            stacksize0
                                            dylib_command aggregated: 3
                                            NameValue
                                            name24
                                            timestampThu Jan 1 01:00:02 1970
                                            current_version9.0.0
                                            compatibility_version7.0.0
                                            Datas/usr/lib/libcurl.4.dylib
                                            NameValue
                                            name24
                                            timestampThu Jan 1 01:00:02 1970
                                            current_version905.6.0
                                            compatibility_version1.0.0
                                            Datas/usr/lib/libc++.1.dylib
                                            NameValue
                                            name24
                                            timestampThu Jan 1 01:00:02 1970
                                            current_version1292.100.5
                                            compatibility_version1.0.0
                                            Datas/usr/lib/libSystem.B.dylib
                                            linkedit_data_command aggregated: 3
                                            NameValue
                                            dataoff136384
                                            datasize368
                                            NameValue
                                            dataoff136752
                                            datasize0
                                            NameValue
                                            dataoff143776
                                            datasize19792
                                            Internal Symbols
                                            __NSGetExecutablePath
                                            __Unwind_Resume
                                            __ZNKSt13runtime_error4whatEv
                                            __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEPKc
                                            __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm
                                            __ZNKSt3__120__vector_base_commonILb1EE20__throw_length_errorEv
                                            __ZNKSt3__121__basic_string_commonILb1EE20__throw_length_errorEv
                                            __ZNKSt3__16locale9has_facetERNS0_2idE
                                            __ZNKSt3__16locale9use_facetERNS0_2idE
                                            __ZNKSt3__18ios_base6getlocEv
                                            __ZNKSt9exception4whatEv
                                            __ZNSt11logic_errorC2EPKc
                                            __ZNSt12length_errorD1Ev
                                            __ZNSt13runtime_errorC1EPKc
                                            __ZNSt13runtime_errorC1ERKS_
                                            __ZNSt13runtime_errorD1Ev
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE5eraseEmm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKcm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6assignEPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6insertEmPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6resizeEmc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9__grow_byEmmmmmm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9push_backEc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEaSERKS5_
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5flushEv
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5writeEPKcl
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryC1ERS3_
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryD1Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED0Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED1Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEi
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE5uflowEv
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE6xsgetnEPcl
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE6xsputnEPKcl
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEE9showmanycEv
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEEC2Ev
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__14__fs10filesystem14__current_pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem18__create_directoryERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem8__removeERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem8__statusERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14cerrE
                                            __ZNSt3__14coutE
                                            __ZNSt3__15ctypeIcE2idE
                                            __ZNSt3__16localeC1ERKS0_
                                            __ZNSt3__16localeD1Ev
                                            __ZNSt3__17codecvtIcc11__mbstate_tE2idE
                                            __ZNSt3__18ios_base33__set_badbit_and_consider_rethrowEv
                                            __ZNSt3__18ios_base4initEPv
                                            __ZNSt3__18ios_base5clearEj
                                            __ZNSt3__19basic_iosIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__19to_stringEi
                                            __ZNSt3__19to_stringEm
                                            __ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_
                                            __ZNSt8bad_castC1Ev
                                            __ZNSt8bad_castD1Ev
                                            __ZNSt9exceptionD1Ev
                                            __ZNSt9exceptionD2Ev
                                            __ZSt9terminatev
                                            __ZTINSt3__113basic_ostreamIcNS_11char_traitsIcEEEE
                                            __ZTINSt3__115basic_streambufIcNS_11char_traitsIcEEEE
                                            __ZTISt12length_error
                                            __ZTISt13runtime_error
                                            __ZTISt8bad_cast
                                            __ZTISt9exception
                                            __ZTVN10__cxxabiv120__si_class_type_infoE
                                            __ZTVSt12length_error
                                            __ZTVSt9exception
                                            __ZTv0_n24_NSt3__113basic_ostreamIcNS_11char_traitsIcEEED0Ev
                                            __ZTv0_n24_NSt3__113basic_ostreamIcNS_11char_traitsIcEEED1Ev
                                            __ZdaPv
                                            __ZdlPv
                                            __Znam
                                            __Znwm
                                            ___assert_rtn
                                            ___cxa_allocate_exception
                                            ___cxa_atexit
                                            ___cxa_begin_catch
                                            ___cxa_end_catch
                                            ___cxa_free_exception
                                            ___cxa_get_exception_ptr
                                            ___cxa_throw
                                            ___error
                                            ___gxx_personality_v0
                                            ___stack_chk_fail
                                            ___stack_chk_guard
                                            __mh_execute_header
                                            _bzero
                                            _curl_easy_cleanup
                                            _curl_easy_getinfo
                                            _curl_easy_init
                                            _curl_easy_perform
                                            _curl_easy_setopt
                                            _fclose
                                            _fflush
                                            _fgets
                                            _fopen
                                            _fread
                                            _fseek
                                            _fseeko
                                            _ftello
                                            _fwrite
                                            _localeconv
                                            _memchr
                                            _memcmp
                                            _memcpy
                                            _memmove
                                            _memset
                                            _pclose
                                            _popen
                                            _rand
                                            _sleep
                                            _snprintf
                                            _strlen
                                            _strtod
                                            _strtoll
                                            _strtoull
                                            _system
                                            dyld_stub_binder
                                            radr://5614542
                                            External symbols
                                            __NSGetExecutablePath
                                            __Unwind_Resume
                                            __ZNKSt13runtime_error4whatEv
                                            __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEPKc
                                            __ZNKSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE7compareEmmPKcm
                                            __ZNKSt3__120__vector_base_commonILb1EE20__throw_length_errorEv
                                            __ZNKSt3__121__basic_string_commonILb1EE20__throw_length_errorEv
                                            __ZNKSt3__16locale9has_facetERNS0_2idE
                                            __ZNKSt3__16locale9use_facetERNS0_2idE
                                            __ZNKSt3__18ios_base6getlocEv
                                            __ZNSt11logic_errorC2EPKc
                                            __ZNSt13runtime_errorC1EPKc
                                            __ZNSt13runtime_errorC1ERKS_
                                            __ZNSt13runtime_errorD1Ev
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE5eraseEmm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKcm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6assignEPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6insertEmPKc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6resizeEmc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9__grow_byEmmmmmm
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE9push_backEc
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEC1ERKS5_mmRKS4_
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEED1Ev
                                            __ZNSt3__112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEEaSERKS5_
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5flushEv
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE5writeEPKcl
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryC1ERS3_
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEE6sentryD1Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__113basic_ostreamIcNS_11char_traitsIcEEElsEi
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEEC2Ev
                                            __ZNSt3__115basic_streambufIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__14__fs10filesystem14__current_pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem18__create_directoryERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem8__removeERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__14__fs10filesystem8__statusERKNS1_4pathEPNS_10error_codeE
                                            __ZNSt3__16localeC1ERKS0_
                                            __ZNSt3__16localeD1Ev
                                            __ZNSt3__18ios_base33__set_badbit_and_consider_rethrowEv
                                            __ZNSt3__18ios_base4initEPv
                                            __ZNSt3__18ios_base5clearEj
                                            __ZNSt3__19basic_iosIcNS_11char_traitsIcEEED2Ev
                                            __ZNSt3__19to_stringEi
                                            __ZNSt3__19to_stringEm
                                            __ZNSt3__1plIcNS_11char_traitsIcEENS_9allocatorIcEEEENS_12basic_stringIT_T0_T1_EEPKS6_RKS9_
                                            __ZNSt8bad_castC1Ev
                                            __ZNSt9exceptionD1Ev
                                            __ZNSt9exceptionD2Ev
                                            __ZSt9terminatev
                                            ___assert_rtn
                                            ___cxa_allocate_exception
                                            ___cxa_atexit
                                            ___cxa_begin_catch
                                            ___cxa_end_catch
                                            ___cxa_free_exception
                                            ___cxa_get_exception_ptr
                                            ___cxa_throw
                                            ___error
                                            ___stack_chk_fail
                                            _bzero
                                            _curl_easy_cleanup
                                            _curl_easy_getinfo
                                            _curl_easy_init
                                            _curl_easy_perform
                                            _curl_easy_setopt
                                            _fclose
                                            _fflush
                                            _fgets
                                            _fopen
                                            _fread
                                            _fseek
                                            _fseeko
                                            _ftello
                                            _fwrite
                                            _localeconv
                                            _memchr
                                            _memcmp
                                            _memcpy
                                            _memmove
                                            _memset
                                            _pclose
                                            _popen
                                            _rand
                                            _sleep
                                            _snprintf
                                            _strlen
                                            _strtod
                                            _strtoll
                                            _strtoull
                                            _system

                                            Network Behavior

                                            Snort IDS Alerts

                                            TimestampProtocolSIDMessageSource PortDest PortSource IPDest IP
                                            01/12/22-12:26:23.106602UDP254DNS SPOOF query response with TTL of 1 min. and no authority53552588.8.8.8192.168.0.52

                                            Network Port Distribution

                                            TCP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Jan 12, 2022 12:24:32.231246948 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.241853952 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.242077112 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.256373882 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.267055988 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.274384975 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.274410963 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.274426937 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.274507999 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.274525881 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.274919033 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.274972916 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.274981976 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.274987936 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.274991989 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.278945923 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.279345036 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.290148973 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.290174961 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.290450096 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.290532112 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.290663958 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.290761948 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.290774107 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.290779114 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.290889978 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.299557924 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.299864054 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.301451921 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.301554918 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.301703930 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.624437094 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.624461889 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.624478102 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.624774933 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.624813080 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.624820948 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.624953985 CET49386443192.168.0.52142.250.186.110
                                            Jan 12, 2022 12:24:32.640494108 CET44349386142.250.186.110192.168.0.52
                                            Jan 12, 2022 12:24:32.647367954 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.658170938 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.658458948 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.665271044 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.675985098 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.683679104 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.683705091 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.683721066 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.683737040 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.683753014 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.683769941 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.683979034 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.684017897 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.684065104 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.684072971 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.684077978 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.684082985 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.685247898 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.685461044 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.696197033 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.696219921 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.696470022 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.696522951 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.696680069 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.696698904 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.696705103 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.696711063 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.696805954 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.707474947 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.707499027 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.707587004 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.707712889 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.897717953 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.897742987 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.897758007 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.897927999 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.897943974 CET44349387142.250.186.65192.168.0.52
                                            Jan 12, 2022 12:24:32.898065090 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.898103952 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.898112059 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.898117065 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.898122072 CET49387443192.168.0.52142.250.186.65
                                            Jan 12, 2022 12:24:32.911829948 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.041645050 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.041908979 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.050260067 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.180021048 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.180424929 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.180541039 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.180556059 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.180572033 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.180727959 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.180857897 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.180874109 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.180879116 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.181005955 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.181808949 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.182022095 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.282469988 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.412158966 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.412329912 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.412571907 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.412847042 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.542476892 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.581893921 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.582132101 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.583276987 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.717467070 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.717742920 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.726124048 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.860353947 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.860770941 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.860887051 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.860903025 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.860918999 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.860991955 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.861160040 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.861251116 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.861259937 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.861265898 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.862267971 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:33.862412930 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:33.868345022 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:34.002494097 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:34.002696991 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:34.002965927 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:34.003237009 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:34.137397051 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:34.177234888 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:34.177472115 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:38.583427906 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:38.583456039 CET4434938823.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:38.583686113 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:38.583734035 CET49388443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:39.179584980 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:39.179610014 CET4434939023.254.131.176192.168.0.52
                                            Jan 12, 2022 12:24:39.179945946 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:39.180085897 CET49390443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:24:43.596776962 CET443493802.16.12.64192.168.0.52
                                            Jan 12, 2022 12:24:43.596805096 CET443493802.16.12.64192.168.0.52
                                            Jan 12, 2022 12:24:43.597165108 CET49380443192.168.0.522.16.12.64
                                            Jan 12, 2022 12:24:43.597738981 CET49380443192.168.0.522.16.12.64
                                            Jan 12, 2022 12:24:43.598381996 CET49380443192.168.0.522.16.12.64
                                            Jan 12, 2022 12:24:43.606230974 CET443493802.16.12.64192.168.0.52
                                            Jan 12, 2022 12:24:43.606744051 CET443493802.16.12.64192.168.0.52
                                            Jan 12, 2022 12:24:43.722596884 CET4434938223.203.78.159192.168.0.52
                                            Jan 12, 2022 12:24:43.722623110 CET4434938223.203.78.159192.168.0.52
                                            Jan 12, 2022 12:24:43.722918034 CET49382443192.168.0.5223.203.78.159
                                            Jan 12, 2022 12:24:43.723048925 CET49382443192.168.0.5223.203.78.159
                                            Jan 12, 2022 12:24:43.723596096 CET49382443192.168.0.5223.203.78.159
                                            Jan 12, 2022 12:24:43.724293947 CET49382443192.168.0.5223.203.78.159
                                            Jan 12, 2022 12:24:43.734014034 CET4434938223.203.78.159192.168.0.52
                                            Jan 12, 2022 12:24:43.734792948 CET4434938223.203.78.159192.168.0.52
                                            Jan 12, 2022 12:24:46.033637047 CET49376443192.168.0.5217.248.145.233
                                            Jan 12, 2022 12:24:46.035135984 CET49376443192.168.0.5217.248.145.233
                                            Jan 12, 2022 12:24:46.042377949 CET4434937617.248.145.233192.168.0.52
                                            Jan 12, 2022 12:24:46.042404890 CET4434937617.248.145.233192.168.0.52
                                            Jan 12, 2022 12:24:46.042738914 CET49376443192.168.0.5217.248.145.233
                                            Jan 12, 2022 12:24:46.043585062 CET4434937617.248.145.233192.168.0.52
                                            Jan 12, 2022 12:25:01.179893970 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.311676025 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.312136889 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.320502996 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.452182055 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.452580929 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.452701092 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.452718973 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.452733994 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.453093052 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.453130960 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.453138113 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.453142881 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.453252077 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.454189062 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.454626083 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.472460985 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.604696989 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.604720116 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.605209112 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.605523109 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:01.737090111 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.777184963 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:01.777442932 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:06.781450033 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:06.781478882 CET4434939123.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:06.781989098 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:06.782026052 CET49391443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:25.788510084 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:25.922662020 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:25.923172951 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:25.931626081 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.065751076 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.066400051 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.066498041 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.066508055 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.066577911 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.066654921 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.066800117 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.066814899 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.066819906 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.066894054 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.068794012 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.068969965 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.082593918 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.216708899 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.216901064 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.217175007 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.217459917 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:26.351445913 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.408926010 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:26.409413099 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:31.411506891 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:31.411520958 CET4434939223.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:31.411855936 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:31.411900997 CET49392443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.417444944 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.551661968 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:54.552176952 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.560523987 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.694726944 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:54.695301056 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:54.695414066 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:54.695431948 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:54.695493937 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:54.695883036 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.695919991 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.695926905 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.695931911 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.696100950 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.697247028 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:54.697715998 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.757287979 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.891419888 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:54.891525984 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:54.891928911 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:54.892199039 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:25:55.026298046 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:55.081299067 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:25:55.081568003 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:00.086551905 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:00.086580992 CET4434939323.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:00.087068081 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:00.087115049 CET49393443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:19.407533884 CET4434938387.248.100.168192.168.0.52
                                            Jan 12, 2022 12:26:19.407562017 CET4434938387.248.100.168192.168.0.52
                                            Jan 12, 2022 12:26:19.407849073 CET49383443192.168.0.5287.248.100.168
                                            Jan 12, 2022 12:26:19.407938004 CET49383443192.168.0.5287.248.100.168
                                            Jan 12, 2022 12:26:19.408190012 CET49383443192.168.0.5287.248.100.168
                                            Jan 12, 2022 12:26:19.408323050 CET49383443192.168.0.5287.248.100.168
                                            Jan 12, 2022 12:26:19.444021940 CET4434938387.248.100.168192.168.0.52
                                            Jan 12, 2022 12:26:19.444050074 CET4434938387.248.100.168192.168.0.52
                                            Jan 12, 2022 12:26:23.111180067 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.242961884 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.243464947 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.251816988 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.386234999 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.386276960 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.386295080 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.386374950 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.386390924 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.386751890 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.386790037 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.386833906 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.386841059 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.386846066 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.387013912 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.387028933 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.448168993 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.580516100 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.580545902 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.580984116 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.581298113 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:23.712938070 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.763300896 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:23.763818979 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:28.765085936 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:28.765110016 CET4434939423.254.131.176192.168.0.52
                                            Jan 12, 2022 12:26:28.765657902 CET49394443192.168.0.5223.254.131.176
                                            Jan 12, 2022 12:26:28.765702009 CET49394443192.168.0.5223.254.131.176

                                            UDP Packets

                                            TimestampSource PortDest PortSource IPDest IP
                                            Jan 12, 2022 12:24:32.209127903 CET5572653192.168.0.528.8.8.8
                                            Jan 12, 2022 12:24:32.226963997 CET53557268.8.8.8192.168.0.52
                                            Jan 12, 2022 12:24:32.625469923 CET5547153192.168.0.528.8.8.8
                                            Jan 12, 2022 12:24:32.642790079 CET53554718.8.8.8192.168.0.52
                                            Jan 12, 2022 12:24:32.898838043 CET5719253192.168.0.528.8.8.8
                                            Jan 12, 2022 12:24:32.910195112 CET53571928.8.8.8192.168.0.52
                                            Jan 12, 2022 12:24:33.242552042 CET5589453192.168.0.528.8.8.8
                                            Jan 12, 2022 12:24:33.242594957 CET5897253192.168.0.528.8.8.8
                                            Jan 12, 2022 12:24:33.251610994 CET53558948.8.8.8192.168.0.52
                                            Jan 12, 2022 12:24:33.268779039 CET53575188.8.8.8192.168.0.52
                                            Jan 12, 2022 12:25:25.788453102 CET5030153192.168.0.528.8.8.8
                                            Jan 12, 2022 12:25:25.799916029 CET53503018.8.8.8192.168.0.52
                                            Jan 12, 2022 12:26:23.093640089 CET5525853192.168.0.528.8.8.8
                                            Jan 12, 2022 12:26:23.106601954 CET53552588.8.8.8192.168.0.52
                                            Jan 12, 2022 12:26:26.600526094 CET53491688.8.8.8192.168.0.52

                                            DNS Queries

                                            TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                            Jan 12, 2022 12:24:32.209127903 CET192.168.0.528.8.8.80x3e01Standard query (0)drive.google.comA (IP address)IN (0x0001)
                                            Jan 12, 2022 12:24:32.625469923 CET192.168.0.528.8.8.80xaa3Standard query (0)doc-0k-2o-docs.googleusercontent.comA (IP address)IN (0x0001)
                                            Jan 12, 2022 12:24:32.898838043 CET192.168.0.528.8.8.80x86a0Standard query (0)graphic-updater.comA (IP address)IN (0x0001)
                                            Jan 12, 2022 12:24:33.242552042 CET192.168.0.528.8.8.80xf38eStandard query (0)r3.o.lencr.org65IN (0x0001)
                                            Jan 12, 2022 12:24:33.242594957 CET192.168.0.528.8.8.80xa1a8Standard query (0)r3.o.lencr.orgA (IP address)IN (0x0001)
                                            Jan 12, 2022 12:25:25.788453102 CET192.168.0.528.8.8.80xd9deStandard query (0)graphic-updater.comA (IP address)IN (0x0001)
                                            Jan 12, 2022 12:26:23.093640089 CET192.168.0.528.8.8.80x1c6Standard query (0)graphic-updater.comA (IP address)IN (0x0001)

                                            DNS Answers

                                            TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                            Jan 12, 2022 12:24:32.226963997 CET8.8.8.8192.168.0.520x3e01No error (0)drive.google.com142.250.186.110A (IP address)IN (0x0001)
                                            Jan 12, 2022 12:24:32.642790079 CET8.8.8.8192.168.0.520xaa3No error (0)doc-0k-2o-docs.googleusercontent.comgooglehosted.l.googleusercontent.comCNAME (Canonical name)IN (0x0001)
                                            Jan 12, 2022 12:24:32.642790079 CET8.8.8.8192.168.0.520xaa3No error (0)googlehosted.l.googleusercontent.com142.250.186.65A (IP address)IN (0x0001)
                                            Jan 12, 2022 12:24:32.910195112 CET8.8.8.8192.168.0.520x86a0No error (0)graphic-updater.com23.254.131.176A (IP address)IN (0x0001)
                                            Jan 12, 2022 12:24:33.259341955 CET8.8.8.8192.168.0.520xa1a8No error (0)r3.o.lencr.orgo.lencr.edgesuite.netCNAME (Canonical name)IN (0x0001)
                                            Jan 12, 2022 12:25:25.799916029 CET8.8.8.8192.168.0.520xd9deNo error (0)graphic-updater.com23.254.131.176A (IP address)IN (0x0001)
                                            Jan 12, 2022 12:26:23.106601954 CET8.8.8.8192.168.0.520x1c6No error (0)graphic-updater.com23.254.131.176A (IP address)IN (0x0001)

                                            HTTPS Packets

                                            TimestampSource IPSource PortDest IPDest PortSubjectIssuerNot BeforeNot AfterJA3 SSL Client FingerprintJA3 SSL Client Digest
                                            Jan 12, 2022 12:24:32.274525881 CET142.250.186.110443192.168.0.5249386CN=*.google.com CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=USCN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BEMon Nov 29 03:22:33 CET 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020Mon Feb 21 03:22:32 CET 2022 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028771,49200-49196-49192-49188-49172-49162-159-107-57-52393-52392-52394-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,0-11-10-13-16,29-23-24,03faa4ad39f690c4ef1c3160caa375465
                                            CN=GTS CA 1C3, O=Google Trust Services LLC, C=USCN=GTS Root R1, O=Google Trust Services LLC, C=USThu Aug 13 02:00:42 CEST 2020Thu Sep 30 02:00:42 CEST 2027
                                            CN=GTS Root R1, O=Google Trust Services LLC, C=USCN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BEFri Jun 19 02:00:42 CEST 2020Fri Jan 28 01:00:42 CET 2028
                                            Jan 12, 2022 12:24:32.683769941 CET142.250.186.65443192.168.0.5249387CN=*.googleusercontent.com CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=USCN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BEMon Nov 29 04:04:39 CET 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020Mon Feb 21 04:04:38 CET 2022 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028771,49200-49196-49192-49188-49172-49162-159-107-57-52393-52392-52394-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,0-11-10-13-16,29-23-24,03faa4ad39f690c4ef1c3160caa375465
                                            CN=GTS CA 1C3, O=Google Trust Services LLC, C=USCN=GTS Root R1, O=Google Trust Services LLC, C=USThu Aug 13 02:00:42 CEST 2020Thu Sep 30 02:00:42 CEST 2027
                                            CN=GTS Root R1, O=Google Trust Services LLC, C=USCN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BEFri Jun 19 02:00:42 CEST 2020Fri Jan 28 01:00:42 CET 2028
                                            Jan 12, 2022 12:24:33.181808949 CET23.254.131.176443192.168.0.5249388CN=graphic-updater.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Thu Dec 23 11:49:30 CET 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Wed Mar 23 11:49:29 CET 2022 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49200-49196-49192-49188-49172-49162-159-107-57-52393-52392-52394-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,0-11-10-13-16,29-23-24,03faa4ad39f690c4ef1c3160caa375465
                                            CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                            CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                            Jan 12, 2022 12:24:33.862267971 CET23.254.131.176443192.168.0.5249390CN=graphic-updater.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Thu Dec 23 11:49:30 CET 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Wed Mar 23 11:49:29 CET 2022 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49200-49196-49192-49188-49172-49162-159-107-57-52393-52392-52394-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,0-11-10-13-16,29-23-24,03faa4ad39f690c4ef1c3160caa375465
                                            CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                            CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                            Jan 12, 2022 12:25:01.454189062 CET23.254.131.176443192.168.0.5249391CN=graphic-updater.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Thu Dec 23 11:49:30 CET 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Wed Mar 23 11:49:29 CET 2022 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49200-49196-49192-49188-49172-49162-159-107-57-52393-52392-52394-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,0-11-10-13-16,29-23-24,03faa4ad39f690c4ef1c3160caa375465
                                            CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                            CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                            Jan 12, 2022 12:25:26.068794012 CET23.254.131.176443192.168.0.5249392CN=graphic-updater.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Thu Dec 23 11:49:30 CET 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Wed Mar 23 11:49:29 CET 2022 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49200-49196-49192-49188-49172-49162-159-107-57-52393-52392-52394-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,0-11-10-13-16,29-23-24,03faa4ad39f690c4ef1c3160caa375465
                                            CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                            CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                            Jan 12, 2022 12:25:54.697247028 CET23.254.131.176443192.168.0.5249393CN=graphic-updater.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Thu Dec 23 11:49:30 CET 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Wed Mar 23 11:49:29 CET 2022 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49200-49196-49192-49188-49172-49162-159-107-57-52393-52392-52394-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,0-11-10-13-16,29-23-24,03faa4ad39f690c4ef1c3160caa375465
                                            CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                            CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024
                                            Jan 12, 2022 12:26:23.386751890 CET23.254.131.176443192.168.0.5249394CN=graphic-updater.com CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.Thu Dec 23 11:49:30 CET 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021Wed Mar 23 11:49:29 CET 2022 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024771,49200-49196-49192-49188-49172-49162-159-107-57-52393-52392-52394-65413-196-136-129-157-61-53-192-132-49199-49195-49191-49187-49171-49161-158-103-51-190-69-156-60-47-186-65-49169-49159-5-4-49170-49160-22-10-255,0-11-10-13-16,29-23-24,03faa4ad39f690c4ef1c3160caa375465
                                            CN=R3, O=Let's Encrypt, C=USCN=ISRG Root X1, O=Internet Security Research Group, C=USFri Sep 04 02:00:00 CEST 2020Mon Sep 15 18:00:00 CEST 2025
                                            CN=ISRG Root X1, O=Internet Security Research Group, C=USCN=DST Root CA X3, O=Digital Signature Trust Co.Wed Jan 20 20:14:03 CET 2021Mon Sep 30 20:14:03 CEST 2024

                                            System Behavior

                                            Analysis Process: mono-sgen64 PID: 855 Parent PID: 801

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/Library/Frameworks/Mono.framework/Versions/6.12.0/bin/mono-sgen64
                                            Arguments:n/a
                                            File size:4699168 bytes
                                            MD5 hash:98f65da8c6a62423d3f4cda359f06a87

                                            Chronological Activities

                                            Analysis Process: sudo PID: 855 Parent PID: 801

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/usr/bin/sudo
                                            Arguments:/usr/bin/sudo -u drew /Users/drew/Desktop/types-config.ts
                                            File size:1216576 bytes
                                            MD5 hash:f21c2a2dc106642f7c38801e121c8c86

                                            Chronological Activities

                                            Analysis Process: sudo PID: 856 Parent PID: 855

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/usr/bin/sudo
                                            Arguments:n/a
                                            File size:1216576 bytes
                                            MD5 hash:f21c2a2dc106642f7c38801e121c8c86

                                            Chronological Activities

                                            Analysis Process: types-config.ts PID: 856 Parent PID: 855

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/Users/drew/Desktop/types-config.ts
                                            Arguments:/Users/drew/Desktop/types-config.ts
                                            File size:360176 bytes
                                            MD5 hash:e06e06752509f9cd8bc85aa1aa24dba2

                                            Chronological Activities

                                            Analysis Process: sh PID: 857 Parent PID: 856

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/bin/sh
                                            Arguments:n/a
                                            File size:120912 bytes
                                            MD5 hash:8356936fbf1eeb3548896b9206a685a0

                                            Chronological Activities

                                            Analysis Process: bash PID: 857 Parent PID: 856

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/bin/bash
                                            Arguments:sh -c whoami
                                            File size:1296704 bytes
                                            MD5 hash:c1edb59ec6a40884fc3c4e201d31b1d5

                                            Chronological Activities

                                            Analysis Process: whoami PID: 857 Parent PID: 856

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/usr/bin/whoami
                                            Arguments:whoami
                                            File size:121616 bytes
                                            MD5 hash:a7145a94a0b3935eed99abc716a33989

                                            Chronological Activities

                                            Analysis Process: sh PID: 858 Parent PID: 856

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/bin/sh
                                            Arguments:n/a
                                            File size:120912 bytes
                                            MD5 hash:8356936fbf1eeb3548896b9206a685a0

                                            Chronological Activities

                                            Analysis Process: bash PID: 858 Parent PID: 856

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/bin/bash
                                            Arguments:sh -c cp '/Users/drew/Desktop/types-config.ts' '/Users/drew/Library/MacOsServices/updateMacOs'
                                            File size:1296704 bytes
                                            MD5 hash:c1edb59ec6a40884fc3c4e201d31b1d5

                                            Chronological Activities

                                            Analysis Process: cp PID: 858 Parent PID: 856

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/bin/cp
                                            Arguments:cp /Users/drew/Desktop/types-config.ts /Users/drew/Library/MacOsServices/updateMacOs
                                            File size:123264 bytes
                                            MD5 hash:9007c6e0352122c17fbcea99739b716e

                                            Chronological Activities

                                            Analysis Process: sh PID: 859 Parent PID: 856

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/bin/sh
                                            Arguments:n/a
                                            File size:120912 bytes
                                            MD5 hash:8356936fbf1eeb3548896b9206a685a0

                                            Chronological Activities

                                            Analysis Process: bash PID: 859 Parent PID: 856

                                            General

                                            Start time:12:24:30
                                            Start date:12/01/2022
                                            Path:/bin/bash
                                            Arguments:sh -c nohup '/Users/drew/Library/MacOsServices/updateMacOs' >/dev/null 2>&1 &
                                            File size:1296704 bytes
                                            MD5 hash:c1edb59ec6a40884fc3c4e201d31b1d5

                                            Chronological Activities

                                            Analysis Process: bash PID: 860 Parent PID: 859

                                            General

                                            Start time:12:24:31
                                            Start date:12/01/2022
                                            Path:/bin/bash
                                            Arguments:n/a
                                            File size:1296704 bytes
                                            MD5 hash:c1edb59ec6a40884fc3c4e201d31b1d5

                                            Chronological Activities

                                            Analysis Process: nohup PID: 860 Parent PID: 859

                                            General

                                            Start time:12:24:31
                                            Start date:12/01/2022
                                            Path:/usr/bin/nohup
                                            Arguments:nohup /Users/drew/Library/MacOsServices/updateMacOs
                                            File size:121168 bytes
                                            MD5 hash:e702c2d1c6eb0f386453aaa563b2380b

                                            Chronological Activities

                                            Analysis Process: updateMacOs PID: 860 Parent PID: 1

                                            General

                                            Start time:12:24:31
                                            Start date:12/01/2022
                                            Path:/Users/drew/Library/MacOsServices/updateMacOs
                                            Arguments:/Users/drew/Library/MacOsServices/updateMacOs
                                            File size:360176 bytes
                                            MD5 hash:e06e06752509f9cd8bc85aa1aa24dba2

                                            Chronological Activities

                                            Analysis Process: sh PID: 861 Parent PID: 860

                                            General

                                            Start time:12:24:31
                                            Start date:12/01/2022
                                            Path:/bin/sh
                                            Arguments:n/a
                                            File size:120912 bytes
                                            MD5 hash:8356936fbf1eeb3548896b9206a685a0

                                            Chronological Activities

                                            Analysis Process: bash PID: 861 Parent PID: 860

                                            General

                                            Start time:12:24:31
                                            Start date:12/01/2022
                                            Path:/bin/bash
                                            Arguments:sh -c whoami
                                            File size:1296704 bytes
                                            MD5 hash:c1edb59ec6a40884fc3c4e201d31b1d5

                                            Chronological Activities

                                            Analysis Process: whoami PID: 861 Parent PID: 860

                                            General

                                            Start time:12:24:31
                                            Start date:12/01/2022
                                            Path:/usr/bin/whoami
                                            Arguments:whoami
                                            File size:121616 bytes
                                            MD5 hash:a7145a94a0b3935eed99abc716a33989

                                            Chronological Activities