Edit tour

macOS Analysis Report
softwareupdate

Overview

General Information

Sample Name:	softwareupdate
Analysis ID:	156493
MD5:	9dc9d317a9b63599bbc1ceba6437226e
SHA1:	ee0678e58868ebd6603cc2e06a134680d2012c1b
SHA256:	f9ad42a9bd9ade188e997845cae1b0587bf496a35c3bffacd20fefe07860a348
Infos:

Detection

DazzleSpy

Score:	64
Range:	0 - 100
Whitelisted:	false

Signatures

Yara detected DazzleSpy

Creates hidden Mach-O files

Writes Mach-O files to hidden directories

Executes hidden files

Contains functionality related to keyboard/mouse events

Contains symbols with suspicious Objective-C names likely related to file search capabilities

Contains symbols with suspicious names likely related to encryption

Contains symbols with suspicious names likely related to networking

Reads the systems hostname

Contains symbols with suspicious Objective-C names likely related to daemon installing capabilities

Detected TCP or UDP traffic on non-standard ports

Creates memory-persistent launch services

Explicitly loads/starts launch services

Contains symbols with suspicious Objective-C names likely related to remote desktop capabilities

Creates user-wide 'launchd' managed services aka launch agents

Creates 'launchd' managed services aka launch agents with bundle ID names to possibly disguise malicious intentions

Creates hidden files, links and/or directories

Executes commands using a shell command-line interpreter

Writes 64-bit Mach-O files to disk

Contains symbols with paths

Classification

General Information

Joe Sandbox Version:
Analysis ID:	156493
Start date:	26.01.2022
Start time:	12:53:31
Joe Sandbox Product:	Cloud
Overall analysis duration:	0h 5m 22s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	softwareupdate
Cookbook file name:	defaultmacfilecookbook.jbs
Analysis system description:	Mac Mini, Mojave (Office 2016, Java JDK 11.0.4, Adobe Reader 2019.012.20034, Flash 32.0.0.223)
Run name:	Potential for more IOCs and behavior
Analysis Mode:	default
Detection:	MAL
Classification:	mal64.troj.spyw.evad.mac@0/3@0/0

Warnings

Excluded domains from analysis (whitelisted): lb._dns-sd._udp.0.0.168.192.in-addr.arpa

Runtime Messages

Command:	/Users/ben/Desktop/softwareupdate
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:
Standard Error:

Process Tree

System is mac-mojave

mono-sgen32 New Fork (PID: 947, Parent: 899)

softwareupdate (MD5: 9dc9d317a9b63599bbc1ceba6437226e) Arguments: /Users/ben/Desktop/softwareupdate

softwareupdate New Fork (PID: 948, Parent: 947)

bash New Fork (PID: 949, Parent: 947)

launchctl (MD5: 3e04cf4fe184467aa2dbf4e4d5c72f3d) Arguments: launchctl load /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist

xpcproxy New Fork (PID: 950, Parent: 1)

softwareupdate (MD5: 9dc9d317a9b63599bbc1ceba6437226e) Arguments: /var/root/.local/softwareupdate 1

cleanup

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
softwareupdate	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security

Dropped Files

Source	Rule	Description	Author	Strings
/private/var/root/.local/.dat.nosync03b3.g06wVm	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000947.00000271.1.0000000101c9a000.0000000101cd0000.r--.sdmp	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security
00000947.00000271.9.0000000101c9a000.0000000101cd0000.r--.sdmp	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security
00000948.00000272.9.0000000101c9a000.0000000101cd0000.r--.sdmp	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security
00000947.00000271.9.0000000101c22000.0000000101c8a000.r-x.sdmp	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security
00000947.00000271.1.0000000101c22000.0000000101c8a000.r-x.sdmp	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security
00000948.00000272.9.0000000101c22000.0000000101c8a000.r-x.sdmp	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security
Process Memory Space: softwareupdate PID: 947	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security
Process Memory Space: softwareupdate PID: 948	JoeSecurity_DazzleSpy	Yara detected DazzleSpy	Joe Security
Click to see the 3 entries

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Source: submission: softwareupdate	Mach-O symbol: +[MethodClass encryptForPlainText:]
Source: submission: softwareupdate	Mach-O symbol: +[MethodClass decryptForEncryption:]
Source: submission: softwareupdate	Mach-O symbol: +[MethodClass encryptForPlainText:]
Source: submission: softwareupdate	Mach-O symbol: +[MethodClass decryptForEncryption:]
Source: submission: softwareupdate	Mach-O symbol: _kVTCompressionPropertyKey_MaxKeyFrameIntervalDuration
Source: submission: softwareupdate	Mach-O symbol: _kVTCompressionPropertyKey_MaxKeyFrameInterval
Source: submission: softwareupdate	Mach-O symbol: _kSecAttrCanEncrypt
Source: submission: softwareupdate	Mach-O symbol: _kSecAttrCanDecrypt
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: +[MethodClass encryptForPlainText:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: +[MethodClass decryptForEncryption:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: +[MethodClass encryptForPlainText:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: +[MethodClass decryptForEncryption:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _kVTCompressionPropertyKey_MaxKeyFrameIntervalDuration
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _kVTCompressionPropertyKey_MaxKeyFrameInterval
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _kSecAttrCanEncrypt
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _kSecAttrCanDecrypt

Source: global traffic

TCP traffic: 192.168.0.51:49668 -> 88.218.192.128:5633

Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128
Source: unknown	TCP traffic detected without corresponding DNS query: 88.218.192.128

Source: softwareupdate, 00000947.00000271.1.000000010acd1000.000000010acf8000.r--.sdmp, softwareupdate, 00000948.00000272.9.000000010acd1000.000000010acf8000.r--.sdmp	String found in binary or memory: http://crl.apple.com/codesigning.crl0
Source: softwareupdate, 00000947.00000271.1.000000010acd1000.000000010acf8000.r--.sdmp, softwareupdate, 00000948.00000272.9.000000010acd1000.000000010acf8000.r--.sdmp, com.apple.softwareupdate.plist.271.dr	String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: softwareupdate, 00000947.00000271.1.000000010acd1000.000000010acf8000.r--.sdmp, softwareupdate, 00000948.00000272.9.000000010acd1000.000000010acf8000.r--.sdmp	String found in binary or memory: http://www.apple.com/appleca/root.crl0
Source: softwareupdate, 00000947.00000271.1.000000010acd1000.000000010acf8000.r--.sdmp, softwareupdate, 00000948.00000272.9.000000010acd1000.000000010acf8000.r--.sdmp	String found in binary or memory: http://www.apple.com/certificateauthority0
Source: softwareupdate, 00000947.00000271.1.000000010acd1000.000000010acf8000.r--.sdmp, softwareupdate, 00000948.00000272.9.000000010acd1000.000000010acf8000.r--.sdmp	String found in binary or memory: https://www.apple.com/appleca/0

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality related to keyboard/mouse events

Source: submission: softwareupdate	Mach-O symbol: _CGEventCreateMouseEvent
Source: submission: softwareupdate	Mach-O symbol: _CGEventCreateMouseEvent
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _CGEventCreateMouseEvent
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _CGEventCreateMouseEvent

Source: classification engine

Classification label: mal64.troj.spyw.evad.mac@0/3@0/0

Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.writePointer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.readPointer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.writePointer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBufferSize
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.readPointer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBufferSize
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeTimer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeTimer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeSource
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeSource
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeQueue
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeQueue
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.userData
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.userData
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.stateIndex
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.stateIndex
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslWriteCachedLength
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslPreBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslWriteCachedLength
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslErrCode
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslPreBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslContext
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslErrCode
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketUrl
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslContext
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketUN
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketUrl
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketUN
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketQueue
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketQueue
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketFDBytesAvailable
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketFDBytesAvailable
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socket6FD
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socket6FD
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socket4FD
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socket4FD
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readTimer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readSource
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readTimer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readQueue
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readSource
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.preBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readQueue
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.lastSSLHandshakeError
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.preBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.flags
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.lastSSLHandshakeError
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.flags
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.delegateQueue
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.delegateQueue
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.delegate
Source: submission: softwareupdate	Mach-O symbol: _connect
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.delegate
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.currentWrite
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.currentWrite
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.currentRead
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.currentRead
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectTimer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterfaceUN
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectTimer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterface6
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterfaceUN
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterface4
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterface6
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.config
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterface4
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.alternateAddressDelay
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.config
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.alternateAddressDelay
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.acceptUNSource
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.acceptUNSource
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.accept6Source
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.accept6Source
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.accept4Source
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.accept4Source
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.IsOnSocketQueueOrTargetQueueKey
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.IsOnSocketQueueOrTargetQueueKey
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_FileSearchClassObject._writeSocketDataBlock
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_FileSearchClassObject._writeSocketDataBlock
Source: submission: softwareupdate	Mach-O symbol: __OBJC_LABEL_PROTOCOL_$_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: __OBJC_LABEL_PROTOCOL_$_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton.root_port
Source: submission: softwareupdate	Mach-O symbol: __OBJC_CLASS_RO_$_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: __OBJC_CLASS_RO_$_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: __OBJC_CLASS_RO_$_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_CLASS_RO_$_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_PROTOCOL_REFS_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_PROTOCOL_REFS_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_PROTOCOL_METHOD_TYPES_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_PROTOCOL_METHOD_TYPES_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_PROTOCOL_INSTANCE_METHODS_OPT_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_PROTOCOL_INSTANCE_METHODS_OPT_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton.root_port
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketReadData
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketPort
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketReadData
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketHost
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketPort
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._socket
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketHost
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._socket
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._isDisconnected
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._isDisconnected
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._connectTimer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_Singleton._connectTimer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_RemoteDesktopClassObject.connectionVideo
Source: submission: softwareupdate	Mach-O symbol: _OBJC_IVAR_$_RemoteDesktopClassObject.connectionVideo
Source: submission: softwareupdate	Mach-O symbol: _kSecAttrServer
Source: submission: softwareupdate	Mach-O symbol: _kIOMasterPortDefault
Source: submission: softwareupdate	Mach-O symbol: _kCFStreamSSLIsServer
Source: submission: softwareupdate	Mach-O symbol: _inet_ntoa
Source: submission: softwareupdate	Mach-O symbol: _inet_addr
Source: submission: softwareupdate	Mach-O symbol: _getsockname
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_PROP_LIST_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_PROP_LIST_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: ___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___45-[GCDAsyncSocket setupWriteTimerWithTimeout:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___44-[GCDAsyncSocket writeData:withTimeout:tag:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___44-[GCDAsyncSocket setupReadTimerWithTimeout:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___44-[GCDAsyncSocket writeData:withTimeout:tag:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___44-[GCDAsyncSocket setupReadTimerWithTimeout:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___44-[GCDAsyncSocket setDelegate:synchronously:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___44-[GCDAsyncSocket setDelegate:synchronously:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___44-[GCDAsyncSocket getDelegate:delegateQueue:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___44-[GCDAsyncSocket getDelegate:delegateQueue:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___43-[GCDAsyncSocket setIPv4PreferredOverIPv6:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___43-[GCDAsyncSocket setIPv4PreferredOverIPv6:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___43-[GCDAsyncSocket setAlternateAddressDelay:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___43-[GCDAsyncSocket setAlternateAddressDelay:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke.640
Source: submission: softwareupdate	Mach-O symbol: ___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke.640
Source: submission: softwareupdate	Mach-O symbol: ___41-[GCDAsyncSocket isIPv4PreferredOverIPv6]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___41-[GCDAsyncSocket isIPv4PreferredOverIPv6]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___40-[GCDAsyncSocket disconnectAfterWriting]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___40-[GCDAsyncSocket disconnectAfterWriting]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___40-[GCDAsyncSocket disconnectAfterReading]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___40-[GCDAsyncSocket disconnectAfterReading]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___39-[GCDAsyncSocket alternateAddressDelay]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___39-[GCDAsyncSocket alternateAddressDelay]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___38-[GCDAsyncSocket startConnectTimeout:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___38-[GCDAsyncSocket completeCurrentWrite]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___38-[GCDAsyncSocket startConnectTimeout:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___37-[GCDAsyncSocket completeCurrentRead]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___38-[GCDAsyncSocket completeCurrentWrite]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___37-[GCDAsyncSocket completeCurrentRead]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke.226
Source: submission: softwareupdate	Mach-O symbol: ___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke.226
Source: submission: softwareupdate	Mach-O symbol: ___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___34-[GCDAsyncSocket connectedAddress]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___34-[GCDAsyncSocket connectedAddress]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___33-[Singleton analysisData:Socket:]_block_invoke.676
Source: submission: softwareupdate	Mach-O symbol: ___33-[Singleton analysisData:Socket:]_block_invoke.672
Source: submission: softwareupdate	Mach-O symbol: ___33-[Singleton analysisData:Socket:]_block_invoke.676
Source: submission: softwareupdate	Mach-O symbol: ___33-[Singleton analysisData:Socket:]_block_invoke.672
Source: submission: softwareupdate	Mach-O symbol: ___33-[Singleton analysisData:Socket:]_block_invoke.586
Source: submission: softwareupdate	Mach-O symbol: ___33-[Singleton analysisData:Socket:]_block_invoke.586
Source: submission: softwareupdate	Mach-O symbol: ___33-[Singleton analysisData:Socket:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___33-[Singleton analysisData:Socket:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___33-[GCDAsyncSocket setIPv6Enabled:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___33-[GCDAsyncSocket setIPv6Enabled:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___33-[GCDAsyncSocket setIPv4Enabled:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___33-[GCDAsyncSocket setIPv4Enabled:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___33-[GCDAsyncSocket flushSSLBuffers]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_INSTANCE_METHODS_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_INSTANCE_METHODS_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_INSTANCE_METHODS_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_INSTANCE_METHODS_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_CLASS_METHODS_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_$_CLASS_METHODS_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: ___33-[GCDAsyncSocket flushSSLBuffers]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___33-[GCDAsyncSocket closeWithError:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___33-[GCDAsyncSocket closeWithError:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___32-[GCDAsyncSocket isDisconnected]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___32-[GCDAsyncSocket isDisconnected]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___32-[GCDAsyncSocket doWriteTimeout]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___32-[GCDAsyncSocket doWriteTimeout]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___32-[GCDAsyncSocket doWriteTimeout]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___32-[GCDAsyncSocket doWriteTimeout]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket isIPv6Enabled]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket isIPv4Enabled]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket isIPv6Enabled]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket doReadTimeout]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket isIPv4Enabled]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket doReadTimeout]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket doReadTimeout]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket delegateQueue]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket doReadTimeout]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket connectedPort]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket delegateQueue]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket connectedPort]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket connectedHost]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___31-[GCDAsyncSocket connectedHost]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___30-[GCDAsyncSocket setUserData:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___30-[GCDAsyncSocket localAddress]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___30-[GCDAsyncSocket setUserData:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___30-[GCDAsyncSocket connectedUrl]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___30-[GCDAsyncSocket localAddress]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___30-[GCDAsyncSocket connectedUrl]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket isConnected]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket isConnected]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket doWriteData]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket doWriteData]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket doWriteData]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket doWriteData]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke_4
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke_4
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke_2.327
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke_2.327
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke.326
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke.326
Source: submission: softwareupdate	Mach-O symbol: ___28-[GCDAsyncSocket doReadData]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___29-[GCDAsyncSocket didConnect:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___28-[GCDAsyncSocket disconnect]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___28-[GCDAsyncSocket doReadData]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___28-[GCDAsyncSocket disconnect]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket startTLS:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket startTLS:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket localPort]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket localPort]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket localHost]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket localHost]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket doReadEOF]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket doReadEOF]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket doAccept:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket doAccept:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket doAccept:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___27-[GCDAsyncSocket doAccept:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___26-[GCDAsyncSocket userData]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___26-[GCDAsyncSocket isSecure]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___26-[GCDAsyncSocket userData]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___26-[GCDAsyncSocket isSecure]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___26-[GCDAsyncSocket delegate]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___26-[GCDAsyncSocket delegate]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___25-[GCDAsyncSocket dealloc]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___25-[GCDAsyncSocket dealloc]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___24-[GCDAsyncSocket isIPv6]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___24-[GCDAsyncSocket isIPv6]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___24-[GCDAsyncSocket isIPv4]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___24-[GCDAsyncSocket isIPv4]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: _SSLSetPeerDomainName
Source: submission: softwareupdate	Mach-O symbol: _SSLSetConnection
Source: submission: softwareupdate	Mach-O symbol: _OBJC_METACLASS_$_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_METACLASS_$_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_METACLASS_$_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: _OBJC_METACLASS_$_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_PROTOCOL_$_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: __OBJC_PROTOCOL_$_GCDAsyncSocketDelegate
Source: submission: softwareupdate	Mach-O symbol: __OBJC_METACLASS_RO_$_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: __OBJC_METACLASS_RO_$_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: __OBJC_METACLASS_RO_$_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: __OBJC_METACLASS_RO_$_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: _OBJC_CLASS_$_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_CLASS_$_GCDAsyncSocketPreBuffer
Source: submission: softwareupdate	Mach-O symbol: _OBJC_CLASS_$_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: _OBJC_CLASS_$_GCDAsyncSocket
Source: submission: softwareupdate	Mach-O symbol: _OBJC_CLASS_$_CWWiFiClient
Source: submission: softwareupdate	Mach-O symbol: _NSSearchPathForDirectoriesInDomains
Source: submission: softwareupdate	Mach-O symbol: _NSPOSIXErrorDomain
Source: submission: softwareupdate	Mach-O symbol: _socket
Source: submission: softwareupdate	Mach-O symbol: _setsockopt
Source: submission: softwareupdate	Mach-O symbol: _objc_msgSendSuper2
Source: submission: softwareupdate	Mach-O symbol: _objc_msgSend_stret
Source: submission: softwareupdate	Mach-O symbol: _objc_msgSend
Source: submission: softwareupdate	Mach-O symbol: _IONotificationPortGetRunLoopSource
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketThreadName
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketThreadName
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLSessionOptionSendOneByteRecord
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLSessionOptionSendOneByteRecord
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLSessionOptionFalseStart
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLSessionOptionFalseStart
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLProtocolVersionMin
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLProtocolVersionMax
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLProtocolVersionMin
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLPeerID
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLProtocolVersionMax
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLDiffieHellmanParameters
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLPeerID
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLCipherSuites
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLDiffieHellmanParameters
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketSSLCipherSuites
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketQueueName
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketQueueName
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketManuallyEvaluateTrust
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketManuallyEvaluateTrust
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketException
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketException
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketErrorDomain
Source: submission: softwareupdate	Mach-O symbol: _GCDAsyncSocketErrorDomain
Source: submission: softwareupdate	Mach-O symbol: ___87+[GCDAsyncSocket socketFromConnectedSocketFD:delegate:delegateQueue:socketQueue:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___79-[GCDAsyncSocket readDataToData:withTimeout:buffer:bufferOffset:maxLength:tag:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___87+[GCDAsyncSocket socketFromConnectedSocketFD:delegate:delegateQueue:socketQueue:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___72-[GCDAsyncSocket readDataWithTimeout:buffer:bufferOffset:maxLength:tag:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___79-[GCDAsyncSocket readDataToData:withTimeout:buffer:bufferOffset:maxLength:tag:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___71-[GCDAsyncSocket readDataToLength:withTimeout:buffer:bufferOffset:tag:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___72-[GCDAsyncSocket readDataWithTimeout:buffer:bufferOffset:maxLength:tag:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___71-[GCDAsyncSocket readDataToLength:withTimeout:buffer:bufferOffset:tag:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke_4
Source: submission: softwareupdate	Mach-O symbol: ___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke_4
Source: submission: softwareupdate	Mach-O symbol: ___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke.434
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke.434
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket connectToAddress:viaInterface:withTimeout:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___66-[GCDAsyncSocket connectToAddress:viaInterface:withTimeout:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___62-[GCDAsyncSocket progressOfWriteReturningTag:bytesDone:total:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___62-[GCDAsyncSocket progressOfWriteReturningTag:bytesDone:total:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___61-[GCDAsyncSocket progressOfReadReturningTag:bytesDone:total:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___61-[GCDAsyncSocket progressOfReadReturningTag:bytesDone:total:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___58-[GCDAsyncSocket setDelegate:delegateQueue:synchronously:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___58-[GCDAsyncSocket setDelegate:delegateQueue:synchronously:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___54-[GCDAsyncSocket setAutoDisconnectOnClosedReadStream:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___54-[GCDAsyncSocket setAutoDisconnectOnClosedReadStream:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___53-[GCDAsyncSocket connectWithAddress4:address6:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___51-[GCDAsyncSocket connectSocket:address:stateIndex:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___53-[GCDAsyncSocket connectWithAddress4:address6:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___51-[GCDAsyncSocket connectSocket:address:stateIndex:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___51-[GCDAsyncSocket connectSocket:address:stateIndex:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___50-[GCDAsyncSocket disconnectAfterReadingAndWriting]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___51-[GCDAsyncSocket connectSocket:address:stateIndex:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___50-[GCDAsyncSocket autoDisconnectOnClosedReadStream]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___50-[GCDAsyncSocket disconnectAfterReadingAndWriting]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___49-[GCDAsyncSocket setDelegateQueue:synchronously:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___50-[GCDAsyncSocket autoDisconnectOnClosedReadStream]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___49-[GCDAsyncSocket connectToUrl:withTimeout:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___49-[GCDAsyncSocket setDelegateQueue:synchronously:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___49-[GCDAsyncSocket connectToUrl:withTimeout:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke_2.208
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke_3
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke_2.208
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke.206
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke_2
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke.206
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke.177
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke.177
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___45-[GCDAsyncSocket setupWriteTimerWithTimeout:]_block_invoke
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.writePointer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.readPointer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.writePointer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBufferSize
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.readPointer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBufferSize
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeTimer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeTimer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeSource
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeSource
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeQueue
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.writeQueue
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.userData
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.userData
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.stateIndex
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.stateIndex
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslWriteCachedLength
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslPreBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslWriteCachedLength
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslErrCode
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslPreBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslContext
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslErrCode
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketUrl
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.sslContext
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketUN
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketUrl
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketUN
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketQueue
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketQueue
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketFDBytesAvailable
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socketFDBytesAvailable
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socket6FD
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socket6FD
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socket4FD
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.socket4FD
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readTimer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readSource
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readTimer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readQueue
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readSource
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.preBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.readQueue
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.lastSSLHandshakeError
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.preBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.flags
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.lastSSLHandshakeError
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.flags
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.delegateQueue
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.delegateQueue
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.delegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _connect
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.delegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.currentWrite
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.currentWrite
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.currentRead
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.currentRead
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectTimer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterfaceUN
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectTimer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterface6
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterfaceUN
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterface4
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterface6
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.config
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.connectInterface4
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.alternateAddressDelay
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.config
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.alternateAddressDelay
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.acceptUNSource
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.acceptUNSource
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.accept6Source
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.accept6Source
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.accept4Source
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.accept4Source
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.IsOnSocketQueueOrTargetQueueKey
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_GCDAsyncSocket.IsOnSocketQueueOrTargetQueueKey
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_FileSearchClassObject._writeSocketDataBlock
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_FileSearchClassObject._writeSocketDataBlock
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_LABEL_PROTOCOL_$_GCDAsyncSocketDelegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_LABEL_PROTOCOL_$_GCDAsyncSocketDelegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton.root_port
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_CLASS_RO_$_GCDAsyncSocketPreBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_CLASS_RO_$_GCDAsyncSocketPreBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_CLASS_RO_$_GCDAsyncSocket
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_CLASS_RO_$_GCDAsyncSocket
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_PROTOCOL_REFS_GCDAsyncSocketDelegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_PROTOCOL_REFS_GCDAsyncSocketDelegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_PROTOCOL_METHOD_TYPES_GCDAsyncSocketDelegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_PROTOCOL_METHOD_TYPES_GCDAsyncSocketDelegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_PROTOCOL_INSTANCE_METHODS_OPT_GCDAsyncSocketDelegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_PROTOCOL_INSTANCE_METHODS_OPT_GCDAsyncSocketDelegate
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton.root_port
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketReadData
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketPort
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketReadData
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketHost
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketPort
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._socket
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._socketHost
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._socket
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._isDisconnected
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._isDisconnected
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._connectTimer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_Singleton._connectTimer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_RemoteDesktopClassObject.connectionVideo
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _OBJC_IVAR_$_RemoteDesktopClassObject.connectionVideo
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _kSecAttrServer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _kIOMasterPortDefault
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _kCFStreamSSLIsServer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _inet_ntoa
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _inet_addr
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: _getsockname
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_PROP_LIST_GCDAsyncSocket
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_PROP_LIST_GCDAsyncSocket
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocketPreBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocket
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocketPreBuffer
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: __OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocket
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: ___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke_3
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: ___45-[GCDAsyncSocket setupWriteTimerWithTimeout:]_block_invoke
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: ___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke_2

Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/ShellClassObject.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/rcry.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/ProcessClassObject.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/RemoteDesktopClassObject.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/KeychainClassObject.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/MouseClassObject.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/FileRecoveryClassObject.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/AutoupdateClassObject.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/FileClassObject.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/exec.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/NSObject+YYModel.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/YYClassInfo.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/Reachability.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/Singleton.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/H264EncodeTool.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/MethodClass.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/GCDAsyncSocket.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/Directory.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/FileSearchClassObject.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/CommandLine/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/CommandLine/main_to.o
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission: softwareupdate	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/libkern/i386/_OSByteOrder.h
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/math.h
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/dispatch/once.h
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/dispatch/queue.h
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/Foundation.framework/Headers/NSObject.h
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/Foundation.framework/Headers/NSRange.h
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/Foundation.framework/Headers/NSGeometry.h
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/CoreGraphics.framework/Headers/CGGeometry.h
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/CoreFoundation.framework/Headers/CFBase.h
Source: submission: softwareupdate	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/CoreFoundation.framework/Headers/CFByteOrder.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/ShellClassObject.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/rcry.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/ProcessClassObject.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/RemoteDesktopClassObject.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/KeychainClassObject.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/MouseClassObject.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/FileRecoveryClassObject.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/AutoupdateClassObject.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/FileClassObject.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/exec.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/NSObject+YYModel.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/YYClassInfo.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/Reachability.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/Singleton.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/H264EncodeTool.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/MethodClass.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/GCDAsyncSocket.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/Directory.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/FileSearchClassObject.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/CommandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/CommandLine/main_to.o
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/libkern/i386/_OSByteOrder.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/math.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/dispatch/once.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/dispatch/queue.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/Foundation.framework/Headers/NSObject.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/Foundation.framework/Headers/NSRange.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/Foundation.framework/Headers/NSGeometry.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/CoreGraphics.framework/Headers/CGGeometry.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/CoreFoundation.framework/Headers/CFBase.h
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: /Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/CoreFoundation.framework/Headers/CFByteOrder.h

Persistence and Installation Behavior

Writes Mach-O files to hidden directories

Source: /Users/ben/Desktop/softwareupdate (PID: 947)

64-bit Mach-O written to hidden directory: /private/var/root/.local/.dat.nosync03b3.g06wVm

Jump to dropped file

Executes hidden files

Source: /usr/libexec/xpcproxy (PID: 950)

File in hidden directory executed: /var/root/.local/softwareupdate /var/root/.local/softwareupdate 1

Jump to behavior

Source: submission: softwareupdate	Mach-O symbol: +[Singleton installDaemon]
Source: submission: softwareupdate	Mach-O symbol: +[Singleton installDaemon]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: +[Singleton installDaemon]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: +[Singleton installDaemon]

Source: /bin/bash (PID: 949)

Launch agent/daemon loaded: launchctl load /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist

Jump to behavior

Source: /Users/ben/Desktop/softwareupdate (PID: 947)

Hidden File created: /var/root/.local/.dat.nosync03b3.g06wVm

Jump to behavior

Source: /Users/ben/Desktop/softwareupdate (PID: 947)

Shell command executed: /bin/bash -c launchctl load /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist

Jump to behavior

Source: /Users/ben/Desktop/softwareupdate (PID: 947)

File written: /private/var/root/.local/.dat.nosync03b3.g06wVm

Jump to dropped file

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/Security.framework/Versions/A/Security
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/Security.framework/Versions/A/Security

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

Source: /Users/ben/Desktop/softwareupdate (PID: 947)

XML plist file created: /private/var/root/Library/LaunchAgents/com.apple.softwareupdate.plist

Jump to dropped file

Source: submission	String containing user path: /Users/XpathX/Pictures/Photos
Source: submission	String containing user path: /Users/XpathX/Desktop
Source: submission	String containing user path: /Users/XpathX/Library/Application Support/MobileSync
Source: submission	String containing user path: /Users/XpathX/Library/Application Support/CallHistoryTransactions
Source: submission	String containing user path: /Users/XpathX/Library/Application Support/com.apple*
Source: submission	String containing user path: /Users/XpathX/Library/Application Support/Knowledge
Source: submission	String containing user path: /Users/XpathX/Library/Application Support/FileProvider
Source: submission	String containing user path: /Users/XpathX/Pictures/Photos Library.photoslibrary
Source: submission	String containing user path: /Users/XpathX/Library/Caches/com.apple*
Source: submission	String containing user path: /Users/XpathX/.Trash
Source: submission	String containing user path: /Users/XpathX/Documents
Source: submission	String containing user path: /Users/XpathX/Downloads
Source: submission	String containing user path: /Users/XpathX/Library/IdentityServices
Source: submission	String containing user path: /Users/XpathX/Library/Caches/CloudKit
Source: submission	String containing user path: /Users/XpathX/Library/Containers/com.apple*
Source: submission	String containing user path: /Users/XpathX/Library/Application Support/AddressBook
Source: submission	String containing user path: /Users/XpathX/Library/Application Support/CallHistoryDB
Source: submission	String containing user path: /Users/XpathX/Library/Autosave Information
Source: submission	String containing user path: /Users/XpathX/Library/Calendars
Source: submission	String containing user path: /Users/XpathX/Library/Messages
Source: submission	String containing user path: /Users/XpathX/Library/HomeKit
Source: submission	String containing user path: /Users/XpathX/Library/Sharing
Source: submission	String containing user path: /Users/XpathX/Library/Mail
Source: submission	String containing user path: /Users/XpathX/Library/Accounts
Source: submission	String containing user path: /Users/XpathX/Library/Safari
Source: submission	String containing user path: /Users/XpathX/Library/Suggestions
Source: submission	String containing user path: /Users/XpathX/Library/PersonalizationPortrait
Source: submission	String containing user path: /Users/XpathX/Library/Metadata/CoreSpotlight
Source: submission	String containing user path: /Users/XpathX/Library/Reminders
Source: submission	String containing user path: /Users/XpathX/Library/Cookies
Source: submission	String containing user path: /Users/wp/aa.txt
Source: submission	String containing user path: /Users/wp/bb.txt
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/exec.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/GCDAsyncSocket.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/CommandLine/
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/CommandLine/main_to.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/MethodClass.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/NSObject+YYModel.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/Singleton.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/YYClassInfo.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/Reachability.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/FileClassObject.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/FileSearchClassObject.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/Directory.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/FileRecoveryClassObject.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/rcry.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/AutoupdateClassObject.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/RemoteDesktopClassObject.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/H264EncodeTool.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/MouseClassObject.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/KeychainClassObject.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/ProcessClassObject.o
Source: submission	String containing user path: /Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/ShellClassObject.o

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/VideoToolbox.framework/Versions/A/VideoToolbox
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/VideoToolbox.framework/Versions/A/VideoToolbox

Source: submission: softwareupdate	Mach-O header: dylib_command -> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics
Source: dropped file: .dat.nosync03b3.g06wVm	Mach-O header: dylib_command -> /System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics

Source: /Users/ben/Desktop/softwareupdate (PID: 947)

Launch agent/daemon created with KeepAlive and/or RunAtLoad, file created: /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist

Jump to behavior

Source: /Users/ben/Desktop/softwareupdate (PID: 947)

Launch agent created File created: /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist

Jump to behavior

Hooking and other Techniques for Hiding and Protection

Creates hidden Mach-O files

Source: /Users/ben/Desktop/softwareupdate (PID: 947)

Hidden Mach-O file written: Mach-O 64 bit: /private/var/root/.local/.dat.nosync03b3.g06wVm

Jump to dropped file

Source: /Users/ben/Desktop/softwareupdate (PID: 947)

Launch agent created File created: /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist

Jump to behavior

Source: /bin/bash (PID: 949)

Sysctl requested: kern.hostname (1.10)

Jump to behavior

Stealing of Sensitive Information

Yara detected DazzleSpy

Source: Yara match	File source: softwareupdate, type: SAMPLE
Source: Yara match	File source: 00000947.00000271.1.0000000101c9a000.0000000101cd0000.r--.sdmp, type: MEMORY
Source: Yara match	File source: 00000947.00000271.9.0000000101c9a000.0000000101cd0000.r--.sdmp, type: MEMORY
Source: Yara match	File source: 00000948.00000272.9.0000000101c9a000.0000000101cd0000.r--.sdmp, type: MEMORY
Source: Yara match	File source: 00000947.00000271.9.0000000101c22000.0000000101c8a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 00000947.00000271.1.0000000101c22000.0000000101c8a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 00000948.00000272.9.0000000101c22000.0000000101c8a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: softwareupdate PID: 947, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: softwareupdate PID: 948, type: MEMORYSTR
Source: Yara match	File source: /private/var/root/.local/.dat.nosync03b3.g06wVm, type: DROPPED

Source: submission: softwareupdate	Mach-O symbol: +[FileClassObject searchFileAttributes:]
Source: submission: softwareupdate	Mach-O symbol: +[FileClassObject searchFileAttributes:]
Source: submission: softwareupdate	Mach-O symbol: ___41-[FileSearchClassObject searchStopAction]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___41-[FileSearchClassObject searchStopAction]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___36-[FileSearchClassObject searchFile:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: ___36-[FileSearchClassObject searchFile:]_block_invoke
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchFile:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchStopAction]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchStopAction]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchString]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchString]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchDict]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchDict]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchDidRead:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchDidRead:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchFile:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setSearchString:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setSearchString:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setSearchTask:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setSearchTask:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchTask]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject searchTask]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setDateFormatter:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setDateFormatter:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setSearchDict:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setSearchDict:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setWriteSocketDataBlock:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject setWriteSocketDataBlock:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject writeSocketData:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject writeSocketData:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject writeSocketDataBlock]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject writeSocketDataBlock]
Source: submission: softwareupdate	Mach-O symbol: -[FileClassObject searchFile:]
Source: submission: softwareupdate	Mach-O symbol: -[FileClassObject searchFile:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject .cxx_destruct]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject .cxx_destruct]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject conditionalFilteringInString:InFormatDict:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject conditionalFilteringInString:InFormatDict:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject keywordSearchDidRead:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject keywordSearchSocketWriteData:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject keywordSearchSocketWriteData:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject dateFormatter]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject dateFormatter]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject findCommandAddPath:addKeyword:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject findCommandAddPath:addKeyword:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject getFileAttributes:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject getFileAttributes:]
Source: submission: softwareupdate	Mach-O symbol: -[FileSearchClassObject keywordSearchDidRead:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: +[FileClassObject searchFileAttributes:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: +[FileClassObject searchFileAttributes:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: ___41-[FileSearchClassObject searchStopAction]_block_invoke
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: ___41-[FileSearchClassObject searchStopAction]_block_invoke
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: ___36-[FileSearchClassObject searchFile:]_block_invoke
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: ___36-[FileSearchClassObject searchFile:]_block_invoke
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchFile:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchStopAction]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchStopAction]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchString]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchString]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchDict]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchDict]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchDidRead:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchDidRead:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchFile:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setSearchString:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setSearchString:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setSearchTask:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setSearchTask:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchTask]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject searchTask]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setDateFormatter:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setDateFormatter:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setSearchDict:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setSearchDict:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setWriteSocketDataBlock:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject setWriteSocketDataBlock:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject writeSocketData:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject writeSocketData:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject writeSocketDataBlock]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject writeSocketDataBlock]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileClassObject searchFile:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileClassObject searchFile:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject .cxx_destruct]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject .cxx_destruct]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject conditionalFilteringInString:InFormatDict:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject conditionalFilteringInString:InFormatDict:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject keywordSearchDidRead:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject keywordSearchSocketWriteData:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject keywordSearchSocketWriteData:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject dateFormatter]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject dateFormatter]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject findCommandAddPath:addKeyword:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject findCommandAddPath:addKeyword:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject getFileAttributes:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject getFileAttributes:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[FileSearchClassObject keywordSearchDidRead:]

Remote Access Functionality

Yara detected DazzleSpy

Source: Yara match	File source: softwareupdate, type: SAMPLE
Source: Yara match	File source: 00000947.00000271.1.0000000101c9a000.0000000101cd0000.r--.sdmp, type: MEMORY
Source: Yara match	File source: 00000947.00000271.9.0000000101c9a000.0000000101cd0000.r--.sdmp, type: MEMORY
Source: Yara match	File source: 00000948.00000272.9.0000000101c9a000.0000000101cd0000.r--.sdmp, type: MEMORY
Source: Yara match	File source: 00000947.00000271.9.0000000101c22000.0000000101c8a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 00000947.00000271.1.0000000101c22000.0000000101c8a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: 00000948.00000272.9.0000000101c22000.0000000101c8a000.r-x.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: softwareupdate PID: 947, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: softwareupdate PID: 948, type: MEMORYSTR
Source: Yara match	File source: /private/var/root/.local/.dat.nosync03b3.g06wVm, type: DROPPED

Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject captureOutput:didOutputSampleBuffer:fromConnection:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject .cxx_destruct]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject .cxx_destruct]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject block]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject block]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject captureOutput:didOutputSampleBuffer:fromConnection:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject fps]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject fps]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject gotEncodedData:isKeyFrame:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject gotEncodedData:isKeyFrame:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject h264Encoder]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject h264Encoder]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject initCaptureSession]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject initCaptureSession]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject displayIndex]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject displayIndex]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject init]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject mouseEventDict:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject mouseEventDict:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject mouse]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject mouse]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject remoteDesktopIsRun]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject remoteDesktopIsRun]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject initEncoder]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject initEncoder]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject init]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setDisplayIndex:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setDisplayIndex:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setFps:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setFps:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setH264Encoder:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setH264Encoder:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject restartRDP]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject restartRDP]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setBlock:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setBlock:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject stopRemoteDesktop]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setMouse:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject setMouse:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject startRemoteDesktop:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject startRemoteDesktop:]
Source: submission: softwareupdate	Mach-O symbol: -[RemoteDesktopClassObject stopRemoteDesktop]
Source: submission: softwareupdate	Mach-O symbol: -[Singleton remoteDesktopClass]
Source: submission: softwareupdate	Mach-O symbol: -[Singleton remoteDesktopClass]
Source: submission: softwareupdate	Mach-O symbol: -[Singleton setRemoteDesktopClass:]
Source: submission: softwareupdate	Mach-O symbol: -[Singleton setRemoteDesktopClass:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject captureOutput:didOutputSampleBuffer:fromConnection:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject .cxx_destruct]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject .cxx_destruct]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject block]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject block]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject captureOutput:didOutputSampleBuffer:fromConnection:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject fps]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject fps]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject gotEncodedData:isKeyFrame:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject gotEncodedData:isKeyFrame:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject h264Encoder]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject h264Encoder]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject initCaptureSession]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject initCaptureSession]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject displayIndex]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject displayIndex]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject init]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject mouseEventDict:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject mouseEventDict:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject mouse]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject mouse]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject remoteDesktopIsRun]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject remoteDesktopIsRun]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject initEncoder]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject initEncoder]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject init]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setDisplayIndex:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setDisplayIndex:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setFps:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setFps:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setH264Encoder:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setH264Encoder:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject restartRDP]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject restartRDP]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setBlock:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setBlock:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject stopRemoteDesktop]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setMouse:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject setMouse:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject startRemoteDesktop:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject startRemoteDesktop:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[RemoteDesktopClassObject stopRemoteDesktop]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[Singleton remoteDesktopClass]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[Singleton remoteDesktopClass]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[Singleton setRemoteDesktopClass:]
Source: dropped file: .dat.nosync03b3.g06wVm.271.dr	Mach-O symbol: -[Singleton setRemoteDesktopClass:]

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	1 Scripting	4 Launch Agent	4 Launch Agent	4 Masquerading	1 GUI Input Capture	1 System Network Configuration Discovery	1 Remote Services	1 GUI Input Capture	Exfiltration Over Other Network Medium	1 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	3 Launch Daemon	3 Launch Daemon	1 Scripting	11 Input Capture	1 File and Directory Discovery	Remote Desktop Protocol	1 Video Capture	Exfiltration Over Bluetooth	1 Non-Standard Port	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 Plist Modification	1 Plist Modification	31 Hidden Files and Directories	Security Account Manager	1 System Information Discovery	SMB/Windows Admin Shares	11 Input Capture	Automated Exfiltration	1 Data Encoding	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Shell
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

⊘No Antivirus matches

Dropped Files

⊘No Antivirus matches

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
88.218.192.128	unknown	Netherlands		209484	ASIANETGB	false

Created / dropped Files

/dev/null

Download File

Process:	/var/root/.local/softwareupdate
File Type:	ASCII text
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.658699861268146
Encrypted:	false
SSDEEP:	3:tXm4RphsD4iIQl0MW1mL5OERowCn:k0mIVB1mlFivn
MD5:	B0527C2005C7B8F1F27ECDE25F6BCAAA
SHA1:	982A337FAC5BBF41A9872BEB40963BED56748C92
SHA-256:	1768C4F6BA32CC7ED400B130D88CADA8943DDE94788CA74571E0BA493DD3AC26
SHA-512:	AB5B204A0F12113EE4FE92FE9533F7409720C0823EB6FFC69C9431FC2DF2CC3504AB4AA55C98249D46200FAE2491BDDF7DD7E2048E3795A47B0B7842A44587F6
Malicious:	false
Reputation:	low
Preview:	2022-01-26 13:54:09.577 softwareupdate[950:16960] start host:88.218.192.128 port:5633 osxrkID:10.0.0.1.

/private/var/root/.local/.dat.nosync03b3.g06wVm

Download File

Process:	/Users/ben/Desktop/softwareupdate
File Type:	Mach-O 64-bit executable
Category:	dropped
Size (bytes):	708720
Entropy (8bit):	5.825583647040574
Encrypted:	false
SSDEEP:	12288:lyhnX0i2dW+D0To7eoozza9HEGuq435PUp2afJRWbSaSA40waqu5QvEfFiQC5hwo:lKqZJ9uq435PC2afJRWbSaSA40waquin
MD5:	9DC9D317A9B63599BBC1CEBA6437226E
SHA1:	EE0678E58868EBD6603CC2E06A134680D2012C1B
SHA-256:	F9AD42A9BD9ADE188E997845CAE1B0587BF496A35C3BFFACD20FEFE07860A348
SHA-512:	D709D9F9B225846AA8EBA2F0B2AD3FB86E9052789F010F1B917E87C69250A8A6418D3C5869B7A88F9D1DB593C8D3CC4B2841615EE1CE083BDC00EC9C2FE765E1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_DazzleSpy, Description: Yara detected DazzleSpy, Source: /private/var/root/.local/.dat.nosync03b3.g06wVm, Author: Joe Security
Reputation:	low
Preview:	................ ......... .........H...__PAGEZERO..............................................................__TEXT..........................................................__text..........__TEXT...........I......p........I..............................__stubs.........__TEXT..........0.......L.......0...............................__stub_helper...__TEXT..........\|...............\|...............................__objc_methname.__TEXT..........`.......uO......`...............................__cstring.......__TEXT...........'......W8.......'..............................__objc_classname__TEXT..........,`..............,`..............................__objc_methtype.__TEXT...........b...............b..............................__const.........__TEXT...........q...............q..............................__gcc_except_tab__TEXT..........Pr..............Pr..............................__ustring.......__TEXT...........x......\|........x..............................__unwind_info...__TEXT..

/private/var/root/Library/LaunchAgents/com.apple.softwareupdate.plist

Download File

Process:	/Users/ben/Desktop/softwareupdate
File Type:	XML document text
Category:	dropped
Size (bytes):	467
Entropy (8bit):	5.174458921417637
Encrypted:	false
SSDEEP:	6:TMVBd/4o+tJCc4EyfdUdBRECcgVvNSvrfh81iXnvT+M6oTCApM0B9svEq7za/SXi:TMHdgo+tJVEdQiCXFMTi0vpB36E8a/SS
MD5:	7BC634BD25D117032D472DD011013D90
SHA1:	309A3FA376E7EB1C50DD525971279C75583BF11B
SHA-256:	DEEB7A29017F3221843148FDEB04081E8B1E7565D574138713F02D7079A08C35
SHA-512:	2C18561344439110D773430B7CF5D47E12BD915BB963D47F4797E6438F11D9BEB4BAA89EABCC6CC9659E7EC4F1BADCD72CCEE0850C71FB190D039D5A6531A715
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">.<plist version="1.0">.<dict>..<key>KeepAlive</key>..<true/>..<key>Label</key>..<string>com.apple.softwareupdate</string>..<key>ProgramArguments</key>..<array>...<string>/var/root/.local/softwareupdate</string>...<string>1</string>..</array>..<key>RunAtLoad</key>..<true/>..<key>SuccessfulExit</key>..<true/>.</dict>.</plist>.

Static File Info

General

File type:	Mach-O 64-bit executable
Entropy (8bit):	5.825583647040574
TrID:	Mac OS X Mach-O 64bit Intel executable (20004/1) 100.00%
File name:	softwareupdate
File size:	708720
MD5:	9dc9d317a9b63599bbc1ceba6437226e
SHA1:	ee0678e58868ebd6603cc2e06a134680d2012c1b
SHA256:	f9ad42a9bd9ade188e997845cae1b0587bf496a35c3bffacd20fefe07860a348
SHA512:	d709d9f9b225846aa8eba2f0b2ad3fb86e9052789f010f1b917e87c69250a8a6418d3c5869b7a88f9d1db593c8d3cc4b2841615ee1ce083bdc00ec9c2fe765e1
SSDEEP:	12288:lyhnX0i2dW+D0To7eoozza9HEGuq435PUp2afJRWbSaSA40waqu5QvEfFiQC5hwo:lKqZJ9uq435PC2afJRWbSaSA40waquin
File Content Preview:	................ ......... .........H...__PAGEZERO..............................................................__TEXT..........................................................__text..........__TEXT...........I......p........I.............................

Static Mach Info

General Information for header 1
Endian:	<
Size:	64-bit
Architecture:	x86_64
Filetype:	execute
Nbr. of load commands:	32
Entry point:	0x22150

segment_command_64 aggregated: 4

Name	Value
segname	__PAGEZERO
vmaddr	0x0
vmsize	0x100000000
fileoff	0x0
filesize	0x0
maxprot	0x0
initprot	0x0
nsects	0
flags	0x0

Name

Value

segname

__TEXT

vmaddr

0x100000000

vmsize

0x68000

fileoff

0x0

filesize

0x68000

maxprot

0x5

initprot

0x5

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__text	__TEXT	0x1000049C0	0x58070	0x49C0	5.6768	0x4	0x0	0	0x80000400
__stubs	__TEXT	0x10005CA30	0x54C	0x5CA30	3.5577	0x1	0x0	0	0x80000408
__stub_helper	__TEXT	0x10005CF7C	0x8E4	0x5CF7C	4.8224	0x2	0x0	0	0x80000400
__objc_methname	__TEXT	0x10005D860	0x4F75	0x5D860	4.9792	0x0	0x0	0	0x2
__cstring	__TEXT	0x1000627D5	0x3857	0x627D5	5.4618	0x0	0x0	0	0x2
__objc_classname	__TEXT	0x10006602C	0x289	0x6602C	5.0684	0x0	0x0	0	0x2
__objc_methtype	__TEXT	0x1000662B5	0xEDD	0x662B5	5.3221	0x0	0x0	0	0x2
__const	__TEXT	0x1000671A0	0xB0	0x671A0	2.1716	0x4	0x0	0	0x0
__gcc_except_tab	__TEXT	0x100067250	0x5C4	0x67250	5.2935	0x2	0x0	0	0x0
__ustring	__TEXT	0x100067814	0x17C	0x67814	5.4377	0x1	0x0	0	0x0
__unwind_info	__TEXT	0x100067990	0x28C	0x67990	5.0734	0x2	0x0	0	0x0
__eh_frame	__TEXT	0x100067C20	0x3D8	0x67C20	3.7263	0x3	0x0	0	0x0

Name

Value

segname

__DATA

vmaddr

0x100068000

vmsize

0x10000

fileoff

0x68000

filesize

0x10000

maxprot

0x3

initprot

0x3

nsects

flags

0x0

Datas

sectname	segname	addr	size	offset	entropy	align	reloff	nreloc	flags
__nl_symbol_ptr	__DATA	0x100068000	0x8	0x68000	-0.0000	0x3	0x0	0	0x6
__got	__DATA	0x100068008	0x360	0x68008	-0.0000	0x3	0x0	0	0x6
__la_symbol_ptr	__DATA	0x100068368	0x710	0x68368	3.2447	0x3	0x0	0	0x7
__const	__DATA	0x100068A78	0xBF8	0x68A78	2.1716	0x3	0x0	0	0x0
__cfstring	__DATA	0x100069670	0x4A60	0x69670	1.8753	0x3	0x0	0	0x0
__objc_classlist	__DATA	0x10006E0D0	0xE0	0x6E0D0	2.8909	0x3	0x0	0	0x10000000
__objc_catlist	__DATA	0x10006E1B0	0x18	0x6E1B0	2.3129	0x3	0x0	0	0x10000000
__objc_protolist	__DATA	0x10006E1C8	0x28	0x6E1C8	2.4116	0x3	0x0	0	0x0
__objc_imageinfo	__DATA	0x10006E1F0	0x8	0x6E1F0	0.5436	0x2	0x0	0	0x0
__objc_const	__DATA	0x10006E1F8	0x6FA8	0x6E1F8	3.3306	0x3	0x0	0	0x0
__objc_selrefs	__DATA	0x1000751A0	0x1430	0x751A0	3.6622	0x3	0x0	0	0x10000005
__objc_classrefs	__DATA	0x1000765D0	0x250	0x765D0	1.4117	0x3	0x0	0	0x10000000
__objc_superrefs	__DATA	0x100076820	0x88	0x76820	2.8196	0x3	0x0	0	0x10000000
__objc_ivar	__DATA	0x1000768A8	0x5A0	0x768A8	1.0969	0x3	0x0	0	0x0
__objc_data	__DATA	0x100076E48	0x8C0	0x76E48	1.2851	0x3	0x0	0	0x0
__data	__DATA	0x100077708	0x228	0x77708	1.6491	0x3	0x0	0	0x0
__bss	__DATA	0x100077930	0x1D8	0x0	-0.0000	0x4	0x0	0	0x1

Name	Value
segname	__LINKEDIT
vmaddr	0x100078000
vmsize	0x38000
fileoff	0x78000
filesize	0x35070
maxprot	0x1
initprot	0x1
nsects	0
flags	0x0

dyld_info_command aggregated: 1

Name	Value
rebase_off	491520
rebase_size	1224
bind_off	492744
bind_size	4952
weak_bind_off	0
weak_bind_size	0
lazy_bind_off	497696
lazy_bind_size	5952
export_off	503648
export_size	32

symtab_command aggregated: 1

Name	Value
symoff	504992
nsyms	5383
stroff	593368
strsize	115352

dysymtab_command aggregated: 1

Name	Value
ilocalsym	0
nlocalsym	4998
iextdefsym	4998
nextdefsym	1
iundefsym	4999
nundefsym	384
tocoff	0
ntoc	0
modtaboff	0
nmodtab	0
extrefsymoff	0
nextrefsyms	0
indirectsymoff	591120
nindirectsyms	561
extreloff	0
nextrel	0
locreloff	0
nlocrel	0

dylinker_command aggregated: 1

Name

Value

name

Datas

/usr/lib/dyld

uuid_command aggregated: 1

Name	Value
uuid	b'\xf9\xc17\x05 \x014\x95\x8e6\xab\xa8\x82MuM'

version_min_command aggregated: 1

Name	Value
version	657920
sdk	721664

source_version_command aggregated: 1

Name	Value
version	0

entry_point_command aggregated: 1

Name	Value
entryoff	139600
stacksize	0

dylib_command aggregated: 18

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/VideoToolbox

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

2.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

275.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1775.118.101

compatibility_version

150.0.0

Datas

/System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1775.118.101

compatibility_version

300.0.0

Datas

/System/Library/Frameworks/Foundation.framework/Versions/C/Foundation

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

23.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/Cocoa.framework/Versions/A/Cocoa

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1237.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/CoreMedia.framework/Versions/A/CoreMedia

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

59754.100.106

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/Security.framework/Versions/A/Security

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1.5.0

compatibility_version

1.2.0

Datas

/System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1109.101.1

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

2022.44.149

compatibility_version

45.0.0

Datas

/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1292.100.5

compatibility_version

1.0.0

Datas

/usr/lib/libSystem.B.dylib

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

54.0.0

compatibility_version

1.0.0

Datas

/System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

1463.4.2

compatibility_version

64.0.0

Datas

/System/Library/Frameworks/CoreGraphics.framework/Versions/A/CoreGraphics

Name

Value

name

timestamp

Thu Jan 1 01:00:02 1970

current_version

228.0.0

compatibility_version

1.0.0

Datas

/usr/lib/libobjc.A.dylib

linkedit_data_command aggregated: 2

Name	Value
dataoff	503680
datasize	1208

Name	Value
dataoff	504888
datasize	104

Internal Symbols

+[Directory bg_uniqueKeys]

+[Directory excludeSearchPath]

+[Directory modelContainerPropertyGenericClass]

+[Exec doShellInCmd:]

+[FileClassObject getFileMD5StrFromPath2:]

+[FileClassObject hashData:]

+[FileClassObject hashFile:]

+[FileClassObject offlineWriteToFile]

+[FileClassObject searchFileAttributes:]

+[GCDAsyncSocket CRData]

+[GCDAsyncSocket CRLFData]

+[GCDAsyncSocket LFData]

+[GCDAsyncSocket ZeroData]

+[GCDAsyncSocket gaiError:]

+[GCDAsyncSocket getHost:port:family:fromAddress:]

+[GCDAsyncSocket getHost:port:fromAddress:]

+[GCDAsyncSocket hostFromAddress:]

+[GCDAsyncSocket hostFromSockaddr4:]

+[GCDAsyncSocket hostFromSockaddr6:]

+[GCDAsyncSocket isIPv4Address:]

+[GCDAsyncSocket isIPv6Address:]

+[GCDAsyncSocket lookupHost:port:error:]

+[GCDAsyncSocket portFromAddress:]

+[GCDAsyncSocket portFromSockaddr4:]

+[GCDAsyncSocket portFromSockaddr6:]

+[GCDAsyncSocket socketFromConnectedSocketFD:delegate:delegateQueue:error:]

+[GCDAsyncSocket socketFromConnectedSocketFD:delegate:delegateQueue:socketQueue:error:]

+[GCDAsyncSocket socketFromConnectedSocketFD:socketQueue:error:]

+[GCDAsyncSocket urlFromSockaddrUN:]

+[KeychainClassObject unzipFile:toPath:]

+[Metadata bg_uniqueKeys]

+[Metadata modelPropertyBlacklist]

+[MethodClass compareOneDay:withAnotherDay:]

+[MethodClass decryptForEncryption:]

+[MethodClass encryptForPlainText:]

+[MethodClass validateTrustResult:]

+[NSArray(YYModel) yy_modelArrayWithClass:array:]

+[NSArray(YYModel) yy_modelArrayWithClass:json:]

+[NSDictionary(YYModel) yy_modelDictionaryWithClass:dictionary:]

+[NSDictionary(YYModel) yy_modelDictionaryWithClass:json:]

+[NSObject(YYModel) _yy_dictionaryWithJSON:]

+[NSObject(YYModel) yy_modelWithDictionary:]

+[NSObject(YYModel) yy_modelWithJSON:]

+[Reachability isIpAddress:]

+[Reachability reachabilityForInternetConnection]

+[Reachability reachabilityForLocalWiFi]

+[Reachability reachabilityWithAddress:]

+[Reachability reachabilityWithHostName:]

+[Reachability reachabilityWithHostname:]

+[Reachability reachabilityWithURL:]

+[Singleton installDaemon]

+[Singleton sharedInstance]

+[YYClassInfo classInfoWithClass:]

+[YYClassInfo classInfoWithClassName:]

+[_YYModelMeta metaWithClass:]

+[_YYModelPropertyMeta metaWithClassInfo:propertyInfo:generic:]

-[AutoupdateClassObject updateCommaindRemotePath:]

-[Directory .cxx_destruct]

-[Directory copyWithZone:]

-[Directory encodeWithCoder:]

-[Directory files]

-[Directory hash]

-[Directory initFolderURL:]

-[Directory initWithCoder:]

-[Directory isEqual:]

-[Directory setFiles:]

-[Directory setUrl:]

-[Directory url]

-[FileClassObject .cxx_destruct]

-[FileClassObject getFileAttributes:]

-[FileClassObject searchClass]

-[FileClassObject searchFile:]

-[FileClassObject searchStopAction]

-[FileClassObject setSearchClass:]

-[FileClassObject writeSocketData:]

-[FileRecoveryClassObject .cxx_destruct]

-[FileRecoveryClassObject delegateDataBlock]

-[FileRecoveryClassObject init]

-[FileRecoveryClassObject listPartition]

-[FileRecoveryClassObject offlineData:ToFileDic:]

-[FileRecoveryClassObject offlineWriteToFile:]

-[FileRecoveryClassObject offline]

-[FileRecoveryClassObject rcry]

-[FileRecoveryClassObject recovery:path:]

-[FileRecoveryClassObject recoveryFromInstream:path:error:]

-[FileRecoveryClassObject scan:timeout:process:finish:]

-[FileRecoveryClassObject setDelegateDataBlock:]

-[FileRecoveryClassObject setOffline:]

-[FileRecoveryClassObject setRcry:]

-[FileRecoveryClassObject setTmpDic:]

-[FileRecoveryClassObject stopScan]

-[FileRecoveryClassObject stream:handleEvent:]

-[FileRecoveryClassObject tmpDic]

-[FileSearchClassObject .cxx_destruct]

-[FileSearchClassObject conditionalFilteringInString:InFormatDict:]

-[FileSearchClassObject dateFormatter]

-[FileSearchClassObject findCommandAddPath:addKeyword:]

-[FileSearchClassObject getFileAttributes:]

-[FileSearchClassObject keywordSearchDidRead:]

-[FileSearchClassObject keywordSearchSocketWriteData:]

-[FileSearchClassObject searchDict]

-[FileSearchClassObject searchDidRead:]

-[FileSearchClassObject searchFile:]

-[FileSearchClassObject searchStopAction]

-[FileSearchClassObject searchString]

-[FileSearchClassObject searchTask]

-[FileSearchClassObject setDateFormatter:]

-[FileSearchClassObject setSearchDict:]

-[FileSearchClassObject setSearchString:]

-[FileSearchClassObject setSearchTask:]

-[FileSearchClassObject setWriteSocketDataBlock:]

-[FileSearchClassObject writeSocketData:]

-[FileSearchClassObject writeSocketDataBlock]

-[GCDAsyncReadPacket .cxx_destruct]

-[GCDAsyncReadPacket ensureCapacityForAdditionalDataOfLength:]

-[GCDAsyncReadPacket initWithData:startOffset:maxLength:timeout:readLength:terminator:tag:]

-[GCDAsyncReadPacket optimalReadLengthWithDefault:shouldPreBuffer:]

-[GCDAsyncReadPacket readLengthForNonTermWithHint:]

-[GCDAsyncReadPacket readLengthForTermWithHint:shouldPreBuffer:]

-[GCDAsyncReadPacket readLengthForTermWithPreBuffer:found:]

-[GCDAsyncReadPacket searchForTermAfterPreBuffering:]

-[GCDAsyncSocket .cxx_destruct]

-[GCDAsyncSocket acceptOnInterface:port:error:]

-[GCDAsyncSocket acceptOnPort:error:]

-[GCDAsyncSocket acceptOnUrl:error:]

-[GCDAsyncSocket alternateAddressDelay]

-[GCDAsyncSocket autoDisconnectOnClosedReadStream]

-[GCDAsyncSocket badConfigError:]

-[GCDAsyncSocket badParamError:]

-[GCDAsyncSocket bindSocket:toInterface:error:]

-[GCDAsyncSocket closeSocket:]

-[GCDAsyncSocket closeUnusedSocket:]

-[GCDAsyncSocket closeWithError:]

-[GCDAsyncSocket completeCurrentRead]

-[GCDAsyncSocket completeCurrentWrite]

-[GCDAsyncSocket connectSocket:address:stateIndex:]

-[GCDAsyncSocket connectTimeoutError]

-[GCDAsyncSocket connectToAddress:error:]

-[GCDAsyncSocket connectToAddress:viaInterface:withTimeout:error:]

-[GCDAsyncSocket connectToAddress:withTimeout:error:]

-[GCDAsyncSocket connectToHost:onPort:error:]

-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]

-[GCDAsyncSocket connectToHost:onPort:withTimeout:error:]

-[GCDAsyncSocket connectToUrl:withTimeout:error:]

-[GCDAsyncSocket connectWithAddress4:address6:error:]

-[GCDAsyncSocket connectWithAddressUN:error:]

-[GCDAsyncSocket connectedAddress]

-[GCDAsyncSocket connectedHost4]

-[GCDAsyncSocket connectedHost6]

-[GCDAsyncSocket connectedHostFromSocket4:]

-[GCDAsyncSocket connectedHostFromSocket6:]

-[GCDAsyncSocket connectedHost]

-[GCDAsyncSocket connectedPort4]

-[GCDAsyncSocket connectedPort6]

-[GCDAsyncSocket connectedPortFromSocket4:]

-[GCDAsyncSocket connectedPortFromSocket6:]

-[GCDAsyncSocket connectedPort]

-[GCDAsyncSocket connectedUrlFromSocketUN:]

-[GCDAsyncSocket connectedUrl]

-[GCDAsyncSocket connectionClosedError]

-[GCDAsyncSocket createSocket:connectInterface:errPtr:]

-[GCDAsyncSocket dealloc]

-[GCDAsyncSocket delegateQueue]

-[GCDAsyncSocket delegate]

-[GCDAsyncSocket didConnect:]

-[GCDAsyncSocket didNotConnect:error:]

-[GCDAsyncSocket disconnectAfterReadingAndWriting]

-[GCDAsyncSocket disconnectAfterReading]

-[GCDAsyncSocket disconnectAfterWriting]

-[GCDAsyncSocket disconnect]

-[GCDAsyncSocket doAccept:]

-[GCDAsyncSocket doConnectTimeout]

-[GCDAsyncSocket doReadData]

-[GCDAsyncSocket doReadEOF]

-[GCDAsyncSocket doReadTimeoutWithExtension:]

-[GCDAsyncSocket doReadTimeout]

-[GCDAsyncSocket doWriteData]

-[GCDAsyncSocket doWriteTimeoutWithExtension:]

-[GCDAsyncSocket doWriteTimeout]

-[GCDAsyncSocket endConnectTimeout]

-[GCDAsyncSocket endCurrentRead]

-[GCDAsyncSocket endCurrentWrite]

-[GCDAsyncSocket errnoError]

-[GCDAsyncSocket errorWithErrno:reason:]

-[GCDAsyncSocket flushSSLBuffers]

-[GCDAsyncSocket getDelegate:delegateQueue:]

-[GCDAsyncSocket getInterfaceAddress4:address6:fromDescription:port:]

-[GCDAsyncSocket getInterfaceAddressFromUrl:]

-[GCDAsyncSocket initWithDelegate:delegateQueue:]

-[GCDAsyncSocket initWithDelegate:delegateQueue:socketQueue:]

-[GCDAsyncSocket initWithSocketQueue:]

-[GCDAsyncSocket init]

-[GCDAsyncSocket isConnected]

-[GCDAsyncSocket isDisconnected]

-[GCDAsyncSocket isIPv4Enabled]

-[GCDAsyncSocket isIPv4PreferredOverIPv6]

-[GCDAsyncSocket isIPv4]

-[GCDAsyncSocket isIPv6Enabled]

-[GCDAsyncSocket isIPv6]

-[GCDAsyncSocket isSecure]

-[GCDAsyncSocket localAddress]

-[GCDAsyncSocket localHost4]

-[GCDAsyncSocket localHost6]

-[GCDAsyncSocket localHostFromSocket4:]

-[GCDAsyncSocket localHostFromSocket6:]

-[GCDAsyncSocket localHost]

-[GCDAsyncSocket localPort4]

-[GCDAsyncSocket localPort6]

-[GCDAsyncSocket localPortFromSocket4:]

-[GCDAsyncSocket localPortFromSocket6:]

-[GCDAsyncSocket localPort]

-[GCDAsyncSocket lookup:didFail:]

-[GCDAsyncSocket lookup:didSucceedWithAddress4:address6:]

-[GCDAsyncSocket markSocketQueueTargetQueue:]

-[GCDAsyncSocket maybeClose]

-[GCDAsyncSocket maybeDequeueRead]

-[GCDAsyncSocket maybeDequeueWrite]

-[GCDAsyncSocket maybeStartTLS]

-[GCDAsyncSocket otherError:]

-[GCDAsyncSocket performBlock:]

-[GCDAsyncSocket preConnectWithInterface:error:]

-[GCDAsyncSocket preConnectWithUrl:error:]

-[GCDAsyncSocket progressOfReadReturningTag:bytesDone:total:]

-[GCDAsyncSocket progressOfWriteReturningTag:bytesDone:total:]

-[GCDAsyncSocket readDataToData:withTimeout:buffer:bufferOffset:maxLength:tag:]

-[GCDAsyncSocket readDataToData:withTimeout:buffer:bufferOffset:tag:]

-[GCDAsyncSocket readDataToData:withTimeout:maxLength:tag:]

-[GCDAsyncSocket readDataToData:withTimeout:tag:]

-[GCDAsyncSocket readDataToLength:withTimeout:buffer:bufferOffset:tag:]

-[GCDAsyncSocket readDataToLength:withTimeout:tag:]

-[GCDAsyncSocket readDataWithTimeout:buffer:bufferOffset:maxLength:tag:]

-[GCDAsyncSocket readDataWithTimeout:buffer:bufferOffset:tag:]

-[GCDAsyncSocket readDataWithTimeout:tag:]

-[GCDAsyncSocket readMaxedOutError]

-[GCDAsyncSocket readTimeoutError]

-[GCDAsyncSocket resumeReadSource]

-[GCDAsyncSocket resumeWriteSource]

-[GCDAsyncSocket setAlternateAddressDelay:]

-[GCDAsyncSocket setAutoDisconnectOnClosedReadStream:]

-[GCDAsyncSocket setDelegate:]

-[GCDAsyncSocket setDelegate:delegateQueue:]

-[GCDAsyncSocket setDelegate:delegateQueue:synchronously:]

-[GCDAsyncSocket setDelegate:synchronously:]

-[GCDAsyncSocket setDelegateQueue:]

-[GCDAsyncSocket setDelegateQueue:synchronously:]

-[GCDAsyncSocket setIPv4Enabled:]

-[GCDAsyncSocket setIPv4PreferredOverIPv6:]

-[GCDAsyncSocket setIPv6Enabled:]

-[GCDAsyncSocket setUserData:]

-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]

-[GCDAsyncSocket setupReadTimerWithTimeout:]

-[GCDAsyncSocket setupWriteTimerWithTimeout:]

-[GCDAsyncSocket socket4FD]

-[GCDAsyncSocket socket6FD]

-[GCDAsyncSocket socketFD]

-[GCDAsyncSocket sslContext]

-[GCDAsyncSocket sslError:]

-[GCDAsyncSocket sslReadWithBuffer:length:]

-[GCDAsyncSocket sslWriteWithBuffer:length:]

-[GCDAsyncSocket ssl_continueSSLHandshake]

-[GCDAsyncSocket ssl_shouldTrustPeer:stateIndex:]

-[GCDAsyncSocket ssl_startTLS]

-[GCDAsyncSocket startConnectTimeout:]

-[GCDAsyncSocket startTLS:]

-[GCDAsyncSocket suspendReadSource]

-[GCDAsyncSocket suspendWriteSource]

-[GCDAsyncSocket synchronouslySetDelegate:]

-[GCDAsyncSocket synchronouslySetDelegate:delegateQueue:]

-[GCDAsyncSocket synchronouslySetDelegateQueue:]

-[GCDAsyncSocket unmarkSocketQueueTargetQueue:]

-[GCDAsyncSocket userData]

-[GCDAsyncSocket usingCFStreamForTLS]

-[GCDAsyncSocket usingSecureTransportForTLS]

-[GCDAsyncSocket writeData:withTimeout:tag:]

-[GCDAsyncSocket writeTimeoutError]

-[GCDAsyncSocketPreBuffer availableBytes]

-[GCDAsyncSocketPreBuffer availableSpace]

-[GCDAsyncSocketPreBuffer dealloc]

-[GCDAsyncSocketPreBuffer didRead:]

-[GCDAsyncSocketPreBuffer didWrite:]

-[GCDAsyncSocketPreBuffer ensureCapacityForWrite:]

-[GCDAsyncSocketPreBuffer getReadBuffer:availableBytes:]

-[GCDAsyncSocketPreBuffer getWriteBuffer:availableSpace:]

-[GCDAsyncSocketPreBuffer initWithCapacity:]

-[GCDAsyncSocketPreBuffer readBuffer]

-[GCDAsyncSocketPreBuffer reset]

-[GCDAsyncSocketPreBuffer writeBuffer]

-[GCDAsyncSpecialPacket .cxx_destruct]

-[GCDAsyncSpecialPacket initWithTLSSettings:]

-[GCDAsyncWritePacket .cxx_destruct]

-[GCDAsyncWritePacket initWithData:timeout:tag:]

-[H264EncodeTool .cxx_destruct]

-[H264EncodeTool currentTimeStr]

-[H264EncodeTool delegate]

-[H264EncodeTool encode:]

-[H264EncodeTool initEncodesetFPS:size:]

-[H264EncodeTool init]

-[H264EncodeTool setDelegate:]

-[H264EncodeTool stopEncode]

-[KeychainClassObject getEmptyKeychainItemString:]

-[KeychainClassObject getKeychain:]

-[KeychainClassObject getKeychainObjectsForSecClass:]

-[KeychainClassObject getPass:cmdTo:]

-[KeychainClassObject getPasswordFromSecKeychainItemRef:]

-[KeychainClassObject printCertificate:]

-[KeychainClassObject printGenericPassword:]

-[KeychainClassObject printIdentity:]

-[KeychainClassObject printInternetPassword:]

-[KeychainClassObject printKey:]

-[KeychainClassObject printResults:ForSecClass:]

-[KeychainClassObject unzipSecurity]

-[Metadata .cxx_destruct]

-[Metadata changeDate]

-[Metadata copyWithZone:]

-[Metadata createDate]

-[Metadata encodeWithCoder:]

-[Metadata hash]

-[Metadata iconBase64]

-[Metadata initName:createDate:changeDate:lastDate:Size:Icon:isFolder:URL:]

-[Metadata initWithCoder:]

-[Metadata isEqual:]

-[Metadata isFolder]

-[Metadata lastDate]

-[Metadata name]

-[Metadata resizedImage:toPixelDimensions:]

-[Metadata setChangeDate:]

-[Metadata setCreateDate:]

-[Metadata setIconBase64:]

-[Metadata setIsFolder:]

-[Metadata setLastDate:]

-[Metadata setName:]

-[Metadata setSize:]

-[Metadata setUrl:]

-[Metadata size]

-[Metadata url]

-[MethodClass .cxx_destruct]

-[MethodClass clearTrace]

-[MethodClass dealloc]

-[MethodClass doShellInCmd:]

-[MethodClass getAllhardwareports]

-[MethodClass getCaroot]

-[MethodClass getDiskFreeSize]

-[MethodClass getDiskSize]

-[MethodClass getDiskSystemSize]

-[MethodClass getIPAddress]

-[MethodClass getInfoDic]

-[MethodClass getSystemDate]

-[MethodClass getSystemVersion]

-[MethodClass getUserName]

-[MethodClass getWifiName]

-[MethodClass init]

-[MethodClass myCustomValidation:]

-[MethodClass pathIsDirectory:]

-[MethodClass serialNumber]

-[MethodClass serverTrustIsVaild:]

-[MethodClass setSerialNumber:]

-[MouseClassObject PostMouseEvent::::]

-[MouseClassObject mouseEventDict:]

-[MouseClassObject postScrollEvent:]

-[NSObject(YYModel) yy_modelCopy]

-[NSObject(YYModel) yy_modelDescription]

-[NSObject(YYModel) yy_modelEncodeWithCoder:]

-[NSObject(YYModel) yy_modelHash]

-[NSObject(YYModel) yy_modelInitWithCoder:]

-[NSObject(YYModel) yy_modelIsEqual:]

-[NSObject(YYModel) yy_modelSetWithDictionary:]

-[NSObject(YYModel) yy_modelSetWithJSON:]

-[NSObject(YYModel) yy_modelToJSONData]

-[NSObject(YYModel) yy_modelToJSONObject]

-[NSObject(YYModel) yy_modelToJSONString]

-[ProcessClassObject processInfo]

-[Reachability .cxx_destruct]

-[Reachability connectionRequired]

-[Reachability currentReachabilityFlags]

-[Reachability currentReachabilityStatus]

-[Reachability currentReachabilityString]

-[Reachability dealloc]

-[Reachability description]

-[Reachability initWithReachabilityRef:]

-[Reachability isConnectionOnDemand]

-[Reachability isConnectionRequired]

-[Reachability isInterventionRequired]

-[Reachability isReachableViaWWAN]

-[Reachability isReachableViaWiFi]

-[Reachability isReachableWithFlags:]

-[Reachability isReachable]

-[Reachability reachabilityBlock]

-[Reachability reachabilityChanged:]

-[Reachability reachabilityFlags]

-[Reachability reachabilityObject]

-[Reachability reachabilityRef]

-[Reachability reachabilitySerialQueue]

-[Reachability reachableBlock]

-[Reachability reachableOnWWAN]

-[Reachability setReachabilityBlock:]

-[Reachability setReachabilityObject:]

-[Reachability setReachabilityRef:]

-[Reachability setReachabilitySerialQueue:]

-[Reachability setReachableBlock:]

-[Reachability setReachableOnWWAN:]

-[Reachability setUnreachableBlock:]

-[Reachability startNotifier]

-[Reachability stopNotifier]

-[Reachability unreachableBlock]

-[Recovery .cxx_destruct]

-[Recovery delegate]

-[Recovery listPartition]

-[Recovery recovery:path:]

-[Recovery recoveryFromInstream:path:error:]

-[Recovery scan:timeout:process:finish:]

-[Recovery setDelegate:]

-[Recovery stopScan]

-[RemoteDesktopClassObject .cxx_destruct]

-[RemoteDesktopClassObject block]

-[RemoteDesktopClassObject captureOutput:didOutputSampleBuffer:fromConnection:]

-[RemoteDesktopClassObject displayIndex]

-[RemoteDesktopClassObject fps]

-[RemoteDesktopClassObject gotEncodedData:isKeyFrame:]

-[RemoteDesktopClassObject h264Encoder]

-[RemoteDesktopClassObject initCaptureSession]

-[RemoteDesktopClassObject initEncoder]

-[RemoteDesktopClassObject init]

-[RemoteDesktopClassObject mouseEventDict:]

-[RemoteDesktopClassObject mouse]

-[RemoteDesktopClassObject remoteDesktopIsRun]

-[RemoteDesktopClassObject restartRDP]

-[RemoteDesktopClassObject setBlock:]

-[RemoteDesktopClassObject setDisplayIndex:]

-[RemoteDesktopClassObject setFps:]

-[RemoteDesktopClassObject setH264Encoder:]

-[RemoteDesktopClassObject setMouse:]

-[RemoteDesktopClassObject startRemoteDesktop:]

-[RemoteDesktopClassObject stopRemoteDesktop]

-[ShellClassObject .cxx_destruct]

-[ShellClassObject didRead:]

-[ShellClassObject myShellBlock]

-[ShellClassObject restartCMD]

-[ShellClassObject setMyShellBlock:]

-[ShellClassObject shellWriteData:]

-[ShellClassObject startPty]

-[ShellClassObject startTask]

-[Singleton .cxx_destruct]

-[Singleton V_ID]

-[Singleton analysisData:Socket:]

-[Singleton certData]

-[Singleton connectTimer]

-[Singleton cutOffSocket]

-[Singleton dataLength]

-[Singleton decodeBufferData:Socket:]

-[Singleton fileClassWriteData:]

-[Singleton fileClass]

-[Singleton handleCaptureSession:]

-[Singleton isDisconnected]

-[Singleton keychainClass]

-[Singleton longConnectToSocket]

-[Singleton method]

-[Singleton nextData]

-[Singleton offlineRecoveryWriteToFile:]

-[Singleton onSocketDidDisconnect:]

-[Singleton poBigFile:]

-[Singleton poError:location:]

-[Singleton powerMessageReceived:withArgument:]

-[Singleton processClass]

-[Singleton recoveryClass]

-[Singleton remoteDesktopClass]

-[Singleton setCertData:]

-[Singleton setConnectTimer:]

-[Singleton setDataLength:]

-[Singleton setFileClass:]

-[Singleton setIsDisconnected:]

-[Singleton setKeychainClass:]

-[Singleton setMethod:]

-[Singleton setNextData:]

-[Singleton setProcessClass:]

-[Singleton setRecoveryClass:]

-[Singleton setRemoteDesktopClass:]

-[Singleton setShellClass:]

-[Singleton setSocket:]

-[Singleton setSocketHost:]

-[Singleton setSocketPort:]

-[Singleton setSocketReadData:]

-[Singleton setTimestamp:]

-[Singleton setUpdateClass:]

-[Singleton setV_ID:]

-[Singleton setVersStr:]

-[Singleton shellClass]

-[Singleton socket:didConnectToHost:port:]

-[Singleton socket:didReadData:withTag:]

-[Singleton socket:didReceiveTrust:completionHandler:]

-[Singleton socket:didWriteDataWithTag:]

-[Singleton socketConnectHost]

-[Singleton socketDidDisconnect:withError:]

-[Singleton socketHost]

-[Singleton socketPort]

-[Singleton socketReadData]

-[Singleton socketWriteData:]

-[Singleton socket]

-[Singleton startPower]

-[Singleton timestamp]

-[Singleton updateClass]

-[Singleton versStr]

-[YYClassInfo .cxx_destruct]

-[YYClassInfo _update]

-[YYClassInfo cls]

-[YYClassInfo initWithClass:]

-[YYClassInfo isMeta]

-[YYClassInfo ivarInfos]

-[YYClassInfo metaCls]

-[YYClassInfo methodInfos]

-[YYClassInfo name]

-[YYClassInfo needUpdate]

-[YYClassInfo propertyInfos]

-[YYClassInfo setNeedUpdate]

-[YYClassInfo superClassInfo]

-[YYClassInfo superCls]

-[YYClassIvarInfo .cxx_destruct]

-[YYClassIvarInfo initWithIvar:]

-[YYClassIvarInfo ivar]

-[YYClassIvarInfo name]

-[YYClassIvarInfo offset]

-[YYClassIvarInfo typeEncoding]

-[YYClassIvarInfo type]

-[YYClassMethodInfo .cxx_destruct]

-[YYClassMethodInfo argumentTypeEncodings]

-[YYClassMethodInfo imp]

-[YYClassMethodInfo initWithMethod:]

-[YYClassMethodInfo method]

-[YYClassMethodInfo name]

-[YYClassMethodInfo returnTypeEncoding]

-[YYClassMethodInfo sel]

-[YYClassMethodInfo typeEncoding]

-[YYClassPropertyInfo .cxx_destruct]

-[YYClassPropertyInfo cls]

-[YYClassPropertyInfo getter]

-[YYClassPropertyInfo initWithProperty:]

-[YYClassPropertyInfo ivarName]

-[YYClassPropertyInfo name]

-[YYClassPropertyInfo property]

-[YYClassPropertyInfo protocols]

-[YYClassPropertyInfo setter]

-[YYClassPropertyInfo typeEncoding]

-[YYClassPropertyInfo type]

-[_YYModelMeta .cxx_destruct]

-[_YYModelMeta initWithClass:]

-[_YYModelPropertyMeta .cxx_destruct]

./Directory.h

./H264EncodeTool.h

./MethodClass.h

./Reachability.h

./Singleton.h

./module/../FileSearchClassObject.h

./rcry.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/CoreFoundation.framework/Headers/CFBase.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/CoreFoundation.framework/Headers/CFByteOrder.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/CoreGraphics.framework/Headers/CGGeometry.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/Foundation.framework/Headers/NSGeometry.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/Foundation.framework/Headers/NSObject.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/System/Library/Frameworks/Foundation.framework/Headers/NSRange.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/dispatch/once.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/dispatch/queue.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/libkern/i386/_OSByteOrder.h

/Applications/Xcode.app/Contents/Developer/Platforms/MacOSX.platform/Developer/SDKs/MacOSX11.3.sdk/usr/include/math.h

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/CommandLine/

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/CommandLine/main_to.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/Directory.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/FileSearchClassObject.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/GCDAsyncSocket.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/H264EncodeTool.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/MethodClass.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/Reachability.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/Singleton.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/NSObject+YYModel.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/YYModel/YYClassInfo.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/exec.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/AutoupdateClassObject.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/FileClassObject.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/FileRecoveryClassObject.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/KeychainClassObject.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/MouseClassObject.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/ProcessClassObject.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/RemoteDesktopClassObject.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/module/ShellClassObject.o

/Users/wangping/pangu/create_source/poke/osxrk_commandLine/rcry.o

AutoupdateClassObject.m

CommandLine/main_to.m

Directory.m

FileClassObject.m

FileRecoveryClassObject.m

FileSearchClassObject.m

GCC_except_table109

GCC_except_table110

GCC_except_table119

GCC_except_table121

GCC_except_table16

GCC_except_table18

GCC_except_table180

GCC_except_table182

GCC_except_table19

GCC_except_table211

GCC_except_table213

GCC_except_table248

GCC_except_table25

GCC_except_table251

GCC_except_table26

GCC_except_table269

GCC_except_table27

GCC_except_table292

GCC_except_table34

GCC_except_table41

GCC_except_table76

GCC_except_table8

GCC_except_table80

GCC_except_table85

GCC_except_table97

GCDAsyncSocket.m

H264EncodeTool.m

KeychainClassObject.m

MethodClass.m

MouseClassObject.m

NSObject+YYModel.m

ProcessClassObject.m

Reachability.m

RemoteDesktopClassObject.m

ShellClassObject.m

Singleton.m

YYClassInfo.m

YYModel/NSObject+YYModel.m

YYModel/YYClassInfo.h

YYModel/YYClassInfo.m

_AVCaptureSessionPreset1280x720

_AVCaptureSessionRuntimeErrorNotification

_AVMediaTypeVideo

_AXIsProcessTrustedWithOptions

_AvailabilityVersionCheck

_CC_MD5

_CC_SHA1

_CC_SHA1_Final

_CC_SHA1_Init

_CC_SHA1_Update

_CFAllocatorGetDefault

_CFArrayApplyFunction

_CFArrayGetCount

_CFArrayGetValueAtIndex

_CFBooleanGetValue

_CFBundleGetVersionNumber

_CFDictionaryApplyFunction

_CFDictionaryContainsKey

_CFDictionaryCreateMutable

_CFDictionaryGetCount

_CFDictionaryGetValue

_CFDictionarySetValue

_CFNumberCreate

_CFRelease

_CFRunLoopAddSource

_CFRunLoopGetCurrent

_CGEventCreateMouseEvent

_CGEventCreateScrollWheelEvent

_CGEventPost

_CGEventSetIntegerValueField

_CGEventSetType

_CGEventSourceCreate

_CGPointMake

_CMBlockBufferGetDataPointer

_CMSampleBufferDataIsReady

_CMSampleBufferGetDataBuffer

_CMSampleBufferGetFormatDescription

_CMSampleBufferGetImageBuffer

_CMSampleBufferGetSampleAttachmentsArray

_CMTimeMake

_CMVideoFormatDescriptionGetH264ParameterSetAtIndex

_CompatibilityDispatchOnceCounter

_DispatchOnceCounter

_GCDAsyncSocketErrorDomain

_GCDAsyncSocketException

_GCDAsyncSocketManuallyEvaluateTrust

_GCDAsyncSocketQueueName

_GCDAsyncSocketSSLCipherSuites

_GCDAsyncSocketSSLDiffieHellmanParameters

_GCDAsyncSocketSSLPeerID

_GCDAsyncSocketSSLProtocolVersionMax

_GCDAsyncSocketSSLProtocolVersionMin

_GCDAsyncSocketSSLSessionOptionFalseStart

_GCDAsyncSocketSSLSessionOptionSendOneByteRecord

_GCDAsyncSocketThreadName

_GetCompatibleVersion

_GetHardwareSerialNumber

_GetHardwareUUID

_Get_UUID_CompatibleV_SerialNumber

_GlobalMajor

_GlobalMinor

_GlobalSubminor

_IOAllowPowerChange

_IOCancelPowerChange

_IONotificationPortGetRunLoopSource

_IOObjectRelease

_IORegisterForSystemPower

_IORegistryEntryCreateCFProperty

_IOServiceGetMatchingService

_IOServiceMatching

_ModelDescription

_ModelDescription.kDescMaxLength

_ModelDescriptionAddIndent

_ModelSetValueForProperty

_ModelSetWithDictionaryFunction

_ModelSetWithPropertyMetaArrayFunction

_ModelToJSONObjectRecursive

_NSCalibratedRGBColorSpace

_NSClassFromString

_NSDefaultRunLoopMode

_NSFileHandleDataAvailableNotification

_NSFileHandleNotificationDataItem

_NSFileHandleReadCompletionNotification

_NSFilePosixPermissions

_NSFileSize

_NSFileSystemFreeSize

_NSFileSystemSize

_NSFullUserName

_NSHomeDirectory

_NSLocalizedDescriptionKey

_NSLocalizedFailureReasonErrorKey

_NSLocalizedRecoverySuggestionErrorKey

_NSLog

_NSPOSIXErrorDomain

_NSPointFromString

_NSRunLoopCommonModes

_NSSearchPathForDirectoriesInDomains

_NSSelectorFromString

_NSStringFromClass

_NSStringFromSelector

_NSURLContentAccessDateKey

_NSURLContentModificationDateKey

_NSURLCreationDateKey

_NSURLEffectiveIconKey

_NSURLFileSizeKey

_NSURLIsDirectoryKey

_NSURLIsPackageKey

_NSURLIsSymbolicLinkKey

_NSURLLocalizedNameKey

_NSURLTypeIdentifierKey

_NSUserName

_NSZeroRect

_OBJC_CLASS_$_AVCaptureScreenInput

_OBJC_CLASS_$_AVCaptureSession

_OBJC_CLASS_$_AVCaptureVideoDataOutput

_OBJC_CLASS_$_AutoupdateClassObject

_OBJC_CLASS_$_CWWiFiClient

_OBJC_CLASS_$_Directory

_OBJC_CLASS_$_Exec

_OBJC_CLASS_$_FileClassObject

_OBJC_CLASS_$_FileRecoveryClassObject

_OBJC_CLASS_$_FileSearchClassObject

_OBJC_CLASS_$_GCDAsyncReadPacket

_OBJC_CLASS_$_GCDAsyncSocket

_OBJC_CLASS_$_GCDAsyncSocketPreBuffer

_OBJC_CLASS_$_GCDAsyncSpecialPacket

_OBJC_CLASS_$_GCDAsyncWritePacket

_OBJC_CLASS_$_H264EncodeTool

_OBJC_CLASS_$_KeychainClassObject

_OBJC_CLASS_$_Metadata

_OBJC_CLASS_$_MethodClass

_OBJC_CLASS_$_MouseClassObject

_OBJC_CLASS_$_NSArray

_OBJC_CLASS_$_NSAssertionHandler

_OBJC_CLASS_$_NSAttributedString

_OBJC_CLASS_$_NSBitmapImageRep

_OBJC_CLASS_$_NSBundle

_OBJC_CLASS_$_NSCharacterSet

_OBJC_CLASS_$_NSData

_OBJC_CLASS_$_NSDate

_OBJC_CLASS_$_NSDateFormatter

_OBJC_CLASS_$_NSDecimalNumber

_OBJC_CLASS_$_NSDictionary

_OBJC_CLASS_$_NSError

_OBJC_CLASS_$_NSException

_OBJC_CLASS_$_NSFileHandle

_OBJC_CLASS_$_NSFileManager

_OBJC_CLASS_$_NSGraphicsContext

_OBJC_CLASS_$_NSImage

_OBJC_CLASS_$_NSInputStream

_OBJC_CLASS_$_NSJSONSerialization

_OBJC_CLASS_$_NSLocale

_OBJC_CLASS_$_NSMutableArray

_OBJC_CLASS_$_NSMutableData

_OBJC_CLASS_$_NSMutableDictionary

_OBJC_CLASS_$_NSMutableSet

_OBJC_CLASS_$_NSMutableString

_OBJC_CLASS_$_NSNotificationCenter

_OBJC_CLASS_$_NSNumber

_OBJC_CLASS_$_NSObject

_OBJC_CLASS_$_NSPipe

_OBJC_CLASS_$_NSProcessInfo

_OBJC_CLASS_$_NSRunLoop

_OBJC_CLASS_$_NSScanner

_OBJC_CLASS_$_NSScreen

_OBJC_CLASS_$_NSSet

_OBJC_CLASS_$_NSString

_OBJC_CLASS_$_NSTask

_OBJC_CLASS_$_NSTimeZone

_OBJC_CLASS_$_NSTimer

_OBJC_CLASS_$_NSURL

_OBJC_CLASS_$_NSUserDefaults

_OBJC_CLASS_$_NSValue

_OBJC_CLASS_$_NSWorkspace

_OBJC_CLASS_$_ProcessClassObject

_OBJC_CLASS_$_Reachability

_OBJC_CLASS_$_Recovery

_OBJC_CLASS_$_RemoteDesktopClassObject

_OBJC_CLASS_$_ShellClassObject

_OBJC_CLASS_$_Singleton

_OBJC_CLASS_$_YYClassInfo

_OBJC_CLASS_$_YYClassIvarInfo

_OBJC_CLASS_$_YYClassMethodInfo

_OBJC_CLASS_$_YYClassPropertyInfo

_OBJC_CLASS_$__YYModelMeta

_OBJC_CLASS_$__YYModelPropertyMeta

_OBJC_EHTYPE_$_NSException

_OBJC_IVAR_$_Directory._files

_OBJC_IVAR_$_Directory._url

_OBJC_IVAR_$_FileClassObject._searchClass

_OBJC_IVAR_$_FileRecoveryClassObject._delegateDataBlock

_OBJC_IVAR_$_FileRecoveryClassObject._offline

_OBJC_IVAR_$_FileRecoveryClassObject._rcry

_OBJC_IVAR_$_FileRecoveryClassObject._tmpDic

_OBJC_IVAR_$_FileSearchClassObject._dateFormatter

_OBJC_IVAR_$_FileSearchClassObject._searchDict

_OBJC_IVAR_$_FileSearchClassObject._searchString

_OBJC_IVAR_$_FileSearchClassObject._searchTask

_OBJC_IVAR_$_FileSearchClassObject._writeSocketDataBlock

_OBJC_IVAR_$_GCDAsyncReadPacket.buffer

_OBJC_IVAR_$_GCDAsyncReadPacket.bufferOwner

_OBJC_IVAR_$_GCDAsyncReadPacket.bytesDone

_OBJC_IVAR_$_GCDAsyncReadPacket.maxLength

_OBJC_IVAR_$_GCDAsyncReadPacket.originalBufferLength

_OBJC_IVAR_$_GCDAsyncReadPacket.readLength

_OBJC_IVAR_$_GCDAsyncReadPacket.startOffset

_OBJC_IVAR_$_GCDAsyncReadPacket.tag

_OBJC_IVAR_$_GCDAsyncReadPacket.term

_OBJC_IVAR_$_GCDAsyncReadPacket.timeout

_OBJC_IVAR_$_GCDAsyncSocket.IsOnSocketQueueOrTargetQueueKey

_OBJC_IVAR_$_GCDAsyncSocket.accept4Source

_OBJC_IVAR_$_GCDAsyncSocket.accept6Source

_OBJC_IVAR_$_GCDAsyncSocket.acceptUNSource

_OBJC_IVAR_$_GCDAsyncSocket.alternateAddressDelay

_OBJC_IVAR_$_GCDAsyncSocket.config

_OBJC_IVAR_$_GCDAsyncSocket.connectInterface4

_OBJC_IVAR_$_GCDAsyncSocket.connectInterface6

_OBJC_IVAR_$_GCDAsyncSocket.connectInterfaceUN

_OBJC_IVAR_$_GCDAsyncSocket.connectTimer

_OBJC_IVAR_$_GCDAsyncSocket.currentRead

_OBJC_IVAR_$_GCDAsyncSocket.currentWrite

_OBJC_IVAR_$_GCDAsyncSocket.delegate

_OBJC_IVAR_$_GCDAsyncSocket.delegateQueue

_OBJC_IVAR_$_GCDAsyncSocket.flags

_OBJC_IVAR_$_GCDAsyncSocket.lastSSLHandshakeError

_OBJC_IVAR_$_GCDAsyncSocket.preBuffer

_OBJC_IVAR_$_GCDAsyncSocket.readQueue

_OBJC_IVAR_$_GCDAsyncSocket.readSource

_OBJC_IVAR_$_GCDAsyncSocket.readTimer

_OBJC_IVAR_$_GCDAsyncSocket.socket4FD

_OBJC_IVAR_$_GCDAsyncSocket.socket6FD

_OBJC_IVAR_$_GCDAsyncSocket.socketFDBytesAvailable

_OBJC_IVAR_$_GCDAsyncSocket.socketQueue

_OBJC_IVAR_$_GCDAsyncSocket.socketUN

_OBJC_IVAR_$_GCDAsyncSocket.socketUrl

_OBJC_IVAR_$_GCDAsyncSocket.sslContext

_OBJC_IVAR_$_GCDAsyncSocket.sslErrCode

_OBJC_IVAR_$_GCDAsyncSocket.sslPreBuffer

_OBJC_IVAR_$_GCDAsyncSocket.sslWriteCachedLength

_OBJC_IVAR_$_GCDAsyncSocket.stateIndex

_OBJC_IVAR_$_GCDAsyncSocket.userData

_OBJC_IVAR_$_GCDAsyncSocket.writeQueue

_OBJC_IVAR_$_GCDAsyncSocket.writeSource

_OBJC_IVAR_$_GCDAsyncSocket.writeTimer

_OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBuffer

_OBJC_IVAR_$_GCDAsyncSocketPreBuffer.preBufferSize

_OBJC_IVAR_$_GCDAsyncSocketPreBuffer.readPointer

_OBJC_IVAR_$_GCDAsyncSocketPreBuffer.writePointer

_OBJC_IVAR_$_GCDAsyncSpecialPacket.tlsSettings

_OBJC_IVAR_$_GCDAsyncWritePacket.buffer

_OBJC_IVAR_$_GCDAsyncWritePacket.bytesDone

_OBJC_IVAR_$_GCDAsyncWritePacket.tag

_OBJC_IVAR_$_GCDAsyncWritePacket.timeout

_OBJC_IVAR_$_H264EncodeTool._delegate

_OBJC_IVAR_$_H264EncodeTool.encodeQueue

_OBJC_IVAR_$_H264EncodeTool.encodingSession

_OBJC_IVAR_$_H264EncodeTool.frameNO

_OBJC_IVAR_$_H264EncodeTool.pps

_OBJC_IVAR_$_H264EncodeTool.sps

_OBJC_IVAR_$_Metadata._changeDate

_OBJC_IVAR_$_Metadata._createDate

_OBJC_IVAR_$_Metadata._iconBase64

_OBJC_IVAR_$_Metadata._isFolder

_OBJC_IVAR_$_Metadata._lastDate

_OBJC_IVAR_$_Metadata._name

_OBJC_IVAR_$_Metadata._size

_OBJC_IVAR_$_Metadata._url

_OBJC_IVAR_$_MethodClass._serialNumber

_OBJC_IVAR_$_Reachability._reachabilityBlock

_OBJC_IVAR_$_Reachability._reachabilityObject

_OBJC_IVAR_$_Reachability._reachabilityRef

_OBJC_IVAR_$_Reachability._reachabilitySerialQueue

_OBJC_IVAR_$_Reachability._reachableBlock

_OBJC_IVAR_$_Reachability._reachableOnWWAN

_OBJC_IVAR_$_Reachability._unreachableBlock

_OBJC_IVAR_$_Recovery._delegate

_OBJC_IVAR_$_RemoteDesktopClassObject._block

_OBJC_IVAR_$_RemoteDesktopClassObject._displayIndex

_OBJC_IVAR_$_RemoteDesktopClassObject._fps

_OBJC_IVAR_$_RemoteDesktopClassObject._h264Encoder

_OBJC_IVAR_$_RemoteDesktopClassObject._mouse

_OBJC_IVAR_$_RemoteDesktopClassObject.captureSession

_OBJC_IVAR_$_RemoteDesktopClassObject.connectionVideo

_OBJC_IVAR_$_ShellClassObject._myShellBlock

_OBJC_IVAR_$_ShellClassObject.curCmdBlock

_OBJC_IVAR_$_ShellClassObject.masterFH_

_OBJC_IVAR_$_ShellClassObject.slaveFH_

_OBJC_IVAR_$_Singleton._V_ID

_OBJC_IVAR_$_Singleton._certData

_OBJC_IVAR_$_Singleton._connectTimer

_OBJC_IVAR_$_Singleton._dataLength

_OBJC_IVAR_$_Singleton._fileClass

_OBJC_IVAR_$_Singleton._isDisconnected

_OBJC_IVAR_$_Singleton._keychainClass

_OBJC_IVAR_$_Singleton._method

_OBJC_IVAR_$_Singleton._nextData

_OBJC_IVAR_$_Singleton._processClass

_OBJC_IVAR_$_Singleton._recoveryClass

_OBJC_IVAR_$_Singleton._remoteDesktopClass

_OBJC_IVAR_$_Singleton._shellClass

_OBJC_IVAR_$_Singleton._socket

_OBJC_IVAR_$_Singleton._socketHost

_OBJC_IVAR_$_Singleton._socketPort

_OBJC_IVAR_$_Singleton._socketReadData

_OBJC_IVAR_$_Singleton._timestamp

_OBJC_IVAR_$_Singleton._updateClass

_OBJC_IVAR_$_Singleton._versStr

_OBJC_IVAR_$_Singleton.notifier

_OBJC_IVAR_$_Singleton.root_port

_OBJC_IVAR_$_YYClassInfo._cls

_OBJC_IVAR_$_YYClassInfo._isMeta

_OBJC_IVAR_$_YYClassInfo._ivarInfos

_OBJC_IVAR_$_YYClassInfo._metaCls

_OBJC_IVAR_$_YYClassInfo._methodInfos

_OBJC_IVAR_$_YYClassInfo._name

_OBJC_IVAR_$_YYClassInfo._needUpdate

_OBJC_IVAR_$_YYClassInfo._propertyInfos

_OBJC_IVAR_$_YYClassInfo._superClassInfo

_OBJC_IVAR_$_YYClassInfo._superCls

_OBJC_IVAR_$_YYClassIvarInfo._ivar

_OBJC_IVAR_$_YYClassIvarInfo._name

_OBJC_IVAR_$_YYClassIvarInfo._offset

_OBJC_IVAR_$_YYClassIvarInfo._type

_OBJC_IVAR_$_YYClassIvarInfo._typeEncoding

_OBJC_IVAR_$_YYClassMethodInfo._argumentTypeEncodings

_OBJC_IVAR_$_YYClassMethodInfo._imp

_OBJC_IVAR_$_YYClassMethodInfo._method

_OBJC_IVAR_$_YYClassMethodInfo._name

_OBJC_IVAR_$_YYClassMethodInfo._returnTypeEncoding

_OBJC_IVAR_$_YYClassMethodInfo._sel

_OBJC_IVAR_$_YYClassMethodInfo._typeEncoding

_OBJC_IVAR_$_YYClassPropertyInfo._cls

_OBJC_IVAR_$_YYClassPropertyInfo._getter

_OBJC_IVAR_$_YYClassPropertyInfo._ivarName

_OBJC_IVAR_$_YYClassPropertyInfo._name

_OBJC_IVAR_$_YYClassPropertyInfo._property

_OBJC_IVAR_$_YYClassPropertyInfo._protocols

_OBJC_IVAR_$_YYClassPropertyInfo._setter

_OBJC_IVAR_$_YYClassPropertyInfo._type

_OBJC_IVAR_$_YYClassPropertyInfo._typeEncoding

_OBJC_IVAR_$__YYModelMeta._allPropertyMetas

_OBJC_IVAR_$__YYModelMeta._classInfo

_OBJC_IVAR_$__YYModelMeta._hasCustomClassFromDictionary

_OBJC_IVAR_$__YYModelMeta._hasCustomTransformFromDictionary

_OBJC_IVAR_$__YYModelMeta._hasCustomTransformToDictionary

_OBJC_IVAR_$__YYModelMeta._hasCustomWillTransformFromDictionary

_OBJC_IVAR_$__YYModelMeta._keyMappedCount

_OBJC_IVAR_$__YYModelMeta._keyPathPropertyMetas

_OBJC_IVAR_$__YYModelMeta._mapper

_OBJC_IVAR_$__YYModelMeta._multiKeysPropertyMetas

_OBJC_IVAR_$__YYModelMeta._nsType

_OBJC_IVAR_$__YYModelPropertyMeta._cls

_OBJC_IVAR_$__YYModelPropertyMeta._genericCls

_OBJC_IVAR_$__YYModelPropertyMeta._getter

_OBJC_IVAR_$__YYModelPropertyMeta._hasCustomClassFromDictionary

_OBJC_IVAR_$__YYModelPropertyMeta._info

_OBJC_IVAR_$__YYModelPropertyMeta._isCNumber

_OBJC_IVAR_$__YYModelPropertyMeta._isKVCCompatible

_OBJC_IVAR_$__YYModelPropertyMeta._isStructAvailableForKeyedArchiver

_OBJC_IVAR_$__YYModelPropertyMeta._mappedToKey

_OBJC_IVAR_$__YYModelPropertyMeta._mappedToKeyArray

_OBJC_IVAR_$__YYModelPropertyMeta._mappedToKeyPath

_OBJC_IVAR_$__YYModelPropertyMeta._name

_OBJC_IVAR_$__YYModelPropertyMeta._next

_OBJC_IVAR_$__YYModelPropertyMeta._nsType

_OBJC_IVAR_$__YYModelPropertyMeta._setter

_OBJC_IVAR_$__YYModelPropertyMeta._type

_OBJC_METACLASS_$_AutoupdateClassObject

_OBJC_METACLASS_$_Directory

_OBJC_METACLASS_$_Exec

_OBJC_METACLASS_$_FileClassObject

_OBJC_METACLASS_$_FileRecoveryClassObject

_OBJC_METACLASS_$_FileSearchClassObject

_OBJC_METACLASS_$_GCDAsyncReadPacket

_OBJC_METACLASS_$_GCDAsyncSocket

_OBJC_METACLASS_$_GCDAsyncSocketPreBuffer

_OBJC_METACLASS_$_GCDAsyncSpecialPacket

_OBJC_METACLASS_$_GCDAsyncWritePacket

_OBJC_METACLASS_$_H264EncodeTool

_OBJC_METACLASS_$_KeychainClassObject

_OBJC_METACLASS_$_Metadata

_OBJC_METACLASS_$_MethodClass

_OBJC_METACLASS_$_MouseClassObject

_OBJC_METACLASS_$_NSObject

_OBJC_METACLASS_$_ProcessClassObject

_OBJC_METACLASS_$_Reachability

_OBJC_METACLASS_$_Recovery

_OBJC_METACLASS_$_RemoteDesktopClassObject

_OBJC_METACLASS_$_ShellClassObject

_OBJC_METACLASS_$_Singleton

_OBJC_METACLASS_$_YYClassInfo

_OBJC_METACLASS_$_YYClassIvarInfo

_OBJC_METACLASS_$_YYClassMethodInfo

_OBJC_METACLASS_$_YYClassPropertyInfo

_OBJC_METACLASS_$__YYModelMeta

_OBJC_METACLASS_$__YYModelPropertyMeta

_SCNetworkReachabilityCreateWithAddress

_SCNetworkReachabilityCreateWithName

_SCNetworkReachabilityGetFlags

_SCNetworkReachabilitySetCallback

_SCNetworkReachabilitySetDispatchQueue

_SSLClose

_SSLCopyPeerTrust

_SSLCreateContext

_SSLGetBufferedReadSize

_SSLHandshake

_SSLRead

_SSLReadFunction

_SSLSetCertificate

_SSLSetConnection

_SSLSetDiffieHellmanParams

_SSLSetEnabledCiphers

_SSLSetIOFuncs

_SSLSetPeerDomainName

_SSLSetPeerID

_SSLSetProtocolVersionMax

_SSLSetProtocolVersionMin

_SSLSetSessionOption

_SSLWrite

_SSLWriteFunction

_SecCertificateCopySubjectSummary

_SecCertificateCreateWithData

_SecIdentityCopyCertificate

_SecItemCopyMatching

_SecKeychainItemCopyContent

_SecKeychainItemFreeContent

_SecPolicyCreateBasicX509

_SecTrustCopyPolicies

_SecTrustEvaluate

_SecTrustSetAnchorCertificates

_SecTrustSetAnchorCertificatesOnly

_SecTrustSetPolicies

_TMReachabilityCallback

_VTCompressionSessionCompleteFrames

_VTCompressionSessionCreate

_VTCompressionSessionEncodeFrame

_VTCompressionSessionInvalidate

_VTCompressionSessionPrepareToEncodeFrames

_VTSessionSetProperty

_YYEncodingGetType

_YYISODateFormatter.formatter

_YYISODateFormatter.onceToken

_YYNSBlockClass.cls

_YYNSBlockClass.onceToken

_YYNSDateFromString.blocks

_YYNSDateFromString.onceToken

_YYNSNumberCreateFromID.dic

_YYNSNumberCreateFromID.dot

_YYNSNumberCreateFromID.onceToken

__Block_object_assign

__Block_object_dispose

__NSConcreteGlobalBlock

__NSConcreteStackBlock

__OBJC_$_CATEGORY_CLASS_METHODS_NSArray_$_YYModel

__OBJC_$_CATEGORY_CLASS_METHODS_NSDictionary_$_YYModel

__OBJC_$_CATEGORY_CLASS_METHODS_NSObject_$_YYModel

__OBJC_$_CATEGORY_INSTANCE_METHODS_NSObject_$_YYModel

__OBJC_$_CATEGORY_NSArray_$_YYModel

__OBJC_$_CATEGORY_NSDictionary_$_YYModel

__OBJC_$_CATEGORY_NSObject_$_YYModel

__OBJC_$_CLASS_METHODS_Directory

__OBJC_$_CLASS_METHODS_Exec

__OBJC_$_CLASS_METHODS_FileClassObject

__OBJC_$_CLASS_METHODS_GCDAsyncSocket

__OBJC_$_CLASS_METHODS_KeychainClassObject

__OBJC_$_CLASS_METHODS_Metadata

__OBJC_$_CLASS_METHODS_MethodClass

__OBJC_$_CLASS_METHODS_Reachability

__OBJC_$_CLASS_METHODS_Singleton

__OBJC_$_CLASS_METHODS_YYClassInfo

__OBJC_$_CLASS_METHODS__YYModelMeta

__OBJC_$_CLASS_METHODS__YYModelPropertyMeta

__OBJC_$_INSTANCE_METHODS_AutoupdateClassObject

__OBJC_$_INSTANCE_METHODS_Directory

__OBJC_$_INSTANCE_METHODS_FileClassObject

__OBJC_$_INSTANCE_METHODS_FileRecoveryClassObject

__OBJC_$_INSTANCE_METHODS_FileSearchClassObject

__OBJC_$_INSTANCE_METHODS_GCDAsyncReadPacket

__OBJC_$_INSTANCE_METHODS_GCDAsyncSocket

__OBJC_$_INSTANCE_METHODS_GCDAsyncSocketPreBuffer

__OBJC_$_INSTANCE_METHODS_GCDAsyncSpecialPacket

__OBJC_$_INSTANCE_METHODS_GCDAsyncWritePacket

__OBJC_$_INSTANCE_METHODS_H264EncodeTool

__OBJC_$_INSTANCE_METHODS_KeychainClassObject

__OBJC_$_INSTANCE_METHODS_Metadata

__OBJC_$_INSTANCE_METHODS_MethodClass

__OBJC_$_INSTANCE_METHODS_MouseClassObject

__OBJC_$_INSTANCE_METHODS_ProcessClassObject

__OBJC_$_INSTANCE_METHODS_Reachability

__OBJC_$_INSTANCE_METHODS_Recovery

__OBJC_$_INSTANCE_METHODS_RemoteDesktopClassObject

__OBJC_$_INSTANCE_METHODS_ShellClassObject

__OBJC_$_INSTANCE_METHODS_Singleton

__OBJC_$_INSTANCE_METHODS_YYClassInfo

__OBJC_$_INSTANCE_METHODS_YYClassIvarInfo

__OBJC_$_INSTANCE_METHODS_YYClassMethodInfo

__OBJC_$_INSTANCE_METHODS_YYClassPropertyInfo

__OBJC_$_INSTANCE_METHODS__YYModelMeta

__OBJC_$_INSTANCE_METHODS__YYModelPropertyMeta

__OBJC_$_INSTANCE_VARIABLES_Directory

__OBJC_$_INSTANCE_VARIABLES_FileClassObject

__OBJC_$_INSTANCE_VARIABLES_FileRecoveryClassObject

__OBJC_$_INSTANCE_VARIABLES_FileSearchClassObject

__OBJC_$_INSTANCE_VARIABLES_GCDAsyncReadPacket

__OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocket

__OBJC_$_INSTANCE_VARIABLES_GCDAsyncSocketPreBuffer

__OBJC_$_INSTANCE_VARIABLES_GCDAsyncSpecialPacket

__OBJC_$_INSTANCE_VARIABLES_GCDAsyncWritePacket

__OBJC_$_INSTANCE_VARIABLES_H264EncodeTool

__OBJC_$_INSTANCE_VARIABLES_Metadata

__OBJC_$_INSTANCE_VARIABLES_MethodClass

__OBJC_$_INSTANCE_VARIABLES_Reachability

__OBJC_$_INSTANCE_VARIABLES_Recovery

__OBJC_$_INSTANCE_VARIABLES_RemoteDesktopClassObject

__OBJC_$_INSTANCE_VARIABLES_ShellClassObject

__OBJC_$_INSTANCE_VARIABLES_Singleton

__OBJC_$_INSTANCE_VARIABLES_YYClassInfo

__OBJC_$_INSTANCE_VARIABLES_YYClassIvarInfo

__OBJC_$_INSTANCE_VARIABLES_YYClassMethodInfo

__OBJC_$_INSTANCE_VARIABLES_YYClassPropertyInfo

__OBJC_$_INSTANCE_VARIABLES__YYModelMeta

__OBJC_$_INSTANCE_VARIABLES__YYModelPropertyMeta

__OBJC_$_PROP_LIST_Directory

__OBJC_$_PROP_LIST_FileClassObject

__OBJC_$_PROP_LIST_FileRecoveryClassObject

__OBJC_$_PROP_LIST_FileSearchClassObject

__OBJC_$_PROP_LIST_GCDAsyncSocket

__OBJC_$_PROP_LIST_H264EncodeTool

__OBJC_$_PROP_LIST_Metadata

__OBJC_$_PROP_LIST_MethodClass

__OBJC_$_PROP_LIST_NSObject

__OBJC_$_PROP_LIST_Reachability

__OBJC_$_PROP_LIST_Recovery

__OBJC_$_PROP_LIST_RemoteDesktopClassObject

__OBJC_$_PROP_LIST_ShellClassObject

__OBJC_$_PROP_LIST_Singleton

__OBJC_$_PROP_LIST_YYClassInfo

__OBJC_$_PROP_LIST_YYClassIvarInfo

__OBJC_$_PROP_LIST_YYClassMethodInfo

__OBJC_$_PROP_LIST_YYClassPropertyInfo

__OBJC_$_PROTOCOL_INSTANCE_METHODS_H264EncodeCallBackDelegate

__OBJC_$_PROTOCOL_INSTANCE_METHODS_NSObject

__OBJC_$_PROTOCOL_INSTANCE_METHODS_OPT_AVCaptureVideoDataOutputSampleBufferDelegate

__OBJC_$_PROTOCOL_INSTANCE_METHODS_OPT_GCDAsyncSocketDelegate

__OBJC_$_PROTOCOL_INSTANCE_METHODS_OPT_NSObject

__OBJC_$_PROTOCOL_INSTANCE_METHODS_OPT_NSStreamDelegate

__OBJC_$_PROTOCOL_METHOD_TYPES_AVCaptureVideoDataOutputSampleBufferDelegate

__OBJC_$_PROTOCOL_METHOD_TYPES_GCDAsyncSocketDelegate

__OBJC_$_PROTOCOL_METHOD_TYPES_H264EncodeCallBackDelegate

__OBJC_$_PROTOCOL_METHOD_TYPES_NSObject

__OBJC_$_PROTOCOL_METHOD_TYPES_NSStreamDelegate

__OBJC_$_PROTOCOL_REFS_AVCaptureVideoDataOutputSampleBufferDelegate

__OBJC_$_PROTOCOL_REFS_GCDAsyncSocketDelegate

__OBJC_$_PROTOCOL_REFS_H264EncodeCallBackDelegate

__OBJC_$_PROTOCOL_REFS_NSStreamDelegate

__OBJC_CLASS_PROTOCOLS_$_FileRecoveryClassObject

__OBJC_CLASS_PROTOCOLS_$_RemoteDesktopClassObject

__OBJC_CLASS_PROTOCOLS_$_Singleton

__OBJC_CLASS_RO_$_AutoupdateClassObject

__OBJC_CLASS_RO_$_Directory

__OBJC_CLASS_RO_$_Exec

__OBJC_CLASS_RO_$_FileClassObject

__OBJC_CLASS_RO_$_FileRecoveryClassObject

__OBJC_CLASS_RO_$_FileSearchClassObject

__OBJC_CLASS_RO_$_GCDAsyncReadPacket

__OBJC_CLASS_RO_$_GCDAsyncSocket

__OBJC_CLASS_RO_$_GCDAsyncSocketPreBuffer

__OBJC_CLASS_RO_$_GCDAsyncSpecialPacket

__OBJC_CLASS_RO_$_GCDAsyncWritePacket

__OBJC_CLASS_RO_$_H264EncodeTool

__OBJC_CLASS_RO_$_KeychainClassObject

__OBJC_CLASS_RO_$_Metadata

__OBJC_CLASS_RO_$_MethodClass

__OBJC_CLASS_RO_$_MouseClassObject

__OBJC_CLASS_RO_$_ProcessClassObject

__OBJC_CLASS_RO_$_Reachability

__OBJC_CLASS_RO_$_Recovery

__OBJC_CLASS_RO_$_RemoteDesktopClassObject

__OBJC_CLASS_RO_$_ShellClassObject

__OBJC_CLASS_RO_$_Singleton

__OBJC_CLASS_RO_$_YYClassInfo

__OBJC_CLASS_RO_$_YYClassIvarInfo

__OBJC_CLASS_RO_$_YYClassMethodInfo

__OBJC_CLASS_RO_$_YYClassPropertyInfo

__OBJC_CLASS_RO_$__YYModelMeta

__OBJC_CLASS_RO_$__YYModelPropertyMeta

__OBJC_LABEL_PROTOCOL_$_AVCaptureVideoDataOutputSampleBufferDelegate

__OBJC_LABEL_PROTOCOL_$_GCDAsyncSocketDelegate

__OBJC_LABEL_PROTOCOL_$_H264EncodeCallBackDelegate

__OBJC_LABEL_PROTOCOL_$_NSObject

__OBJC_LABEL_PROTOCOL_$_NSStreamDelegate

__OBJC_METACLASS_RO_$_AutoupdateClassObject

__OBJC_METACLASS_RO_$_Directory

__OBJC_METACLASS_RO_$_Exec

__OBJC_METACLASS_RO_$_FileClassObject

__OBJC_METACLASS_RO_$_FileRecoveryClassObject

__OBJC_METACLASS_RO_$_FileSearchClassObject

__OBJC_METACLASS_RO_$_GCDAsyncReadPacket

__OBJC_METACLASS_RO_$_GCDAsyncSocket

__OBJC_METACLASS_RO_$_GCDAsyncSocketPreBuffer

__OBJC_METACLASS_RO_$_GCDAsyncSpecialPacket

__OBJC_METACLASS_RO_$_GCDAsyncWritePacket

__OBJC_METACLASS_RO_$_H264EncodeTool

__OBJC_METACLASS_RO_$_KeychainClassObject

__OBJC_METACLASS_RO_$_Metadata

__OBJC_METACLASS_RO_$_MethodClass

__OBJC_METACLASS_RO_$_MouseClassObject

__OBJC_METACLASS_RO_$_ProcessClassObject

__OBJC_METACLASS_RO_$_Reachability

__OBJC_METACLASS_RO_$_Recovery

__OBJC_METACLASS_RO_$_RemoteDesktopClassObject

__OBJC_METACLASS_RO_$_ShellClassObject

__OBJC_METACLASS_RO_$_Singleton

__OBJC_METACLASS_RO_$_YYClassInfo

__OBJC_METACLASS_RO_$_YYClassIvarInfo

__OBJC_METACLASS_RO_$_YYClassMethodInfo

__OBJC_METACLASS_RO_$_YYClassPropertyInfo

__OBJC_METACLASS_RO_$__YYModelMeta

__OBJC_METACLASS_RO_$__YYModelPropertyMeta

__OBJC_PROTOCOL_$_AVCaptureVideoDataOutputSampleBufferDelegate

__OBJC_PROTOCOL_$_GCDAsyncSocketDelegate

__OBJC_PROTOCOL_$_H264EncodeCallBackDelegate

__OBJC_PROTOCOL_$_NSObject

__OBJC_PROTOCOL_$_NSStreamDelegate

__OSSwapInt16

__OSSwapInt32

__Unwind_Resume

___24-[GCDAsyncSocket isIPv4]_block_invoke

___24-[GCDAsyncSocket isIPv6]_block_invoke

___25-[GCDAsyncSocket dealloc]_block_invoke

___25-[H264EncodeTool encode:]_block_invoke

___26-[GCDAsyncSocket delegate]_block_invoke

___26-[GCDAsyncSocket isSecure]_block_invoke

___26-[GCDAsyncSocket userData]_block_invoke

___26-[Singleton recoveryClass]_block_invoke

___27+[Singleton sharedInstance]_block_invoke

___27-[GCDAsyncSocket doAccept:]_block_invoke

___27-[GCDAsyncSocket doAccept:]_block_invoke_2

___27-[GCDAsyncSocket doReadEOF]_block_invoke

___27-[GCDAsyncSocket localHost]_block_invoke

___27-[GCDAsyncSocket localPort]_block_invoke

___27-[GCDAsyncSocket startTLS:]_block_invoke

___28-[GCDAsyncSocket disconnect]_block_invoke

___28-[GCDAsyncSocket doReadData]_block_invoke

___29-[GCDAsyncSocket didConnect:]_block_invoke

___29-[GCDAsyncSocket didConnect:]_block_invoke.326

___29-[GCDAsyncSocket didConnect:]_block_invoke_2

___29-[GCDAsyncSocket didConnect:]_block_invoke_2.327

___29-[GCDAsyncSocket didConnect:]_block_invoke_3

___29-[GCDAsyncSocket didConnect:]_block_invoke_4

___29-[GCDAsyncSocket doWriteData]_block_invoke

___29-[GCDAsyncSocket doWriteData]_block_invoke_2

___29-[GCDAsyncSocket isConnected]_block_invoke

___30+[_YYModelMeta metaWithClass:]_block_invoke

___30-[FileClassObject searchClass]_block_invoke

___30-[GCDAsyncSocket connectedUrl]_block_invoke

___30-[GCDAsyncSocket localAddress]_block_invoke

___30-[GCDAsyncSocket setUserData:]_block_invoke

___30-[_YYModelMeta initWithClass:]_block_invoke

___30-[_YYModelMeta initWithClass:]_block_invoke.124

___30-[_YYModelMeta initWithClass:]_block_invoke.141

___31-[GCDAsyncSocket connectedHost]_block_invoke

___31-[GCDAsyncSocket connectedPort]_block_invoke

___31-[GCDAsyncSocket delegateQueue]_block_invoke

___31-[GCDAsyncSocket doReadTimeout]_block_invoke

___31-[GCDAsyncSocket doReadTimeout]_block_invoke_2

___31-[GCDAsyncSocket isIPv4Enabled]_block_invoke

___31-[GCDAsyncSocket isIPv6Enabled]_block_invoke

___32-[GCDAsyncSocket doWriteTimeout]_block_invoke

___32-[GCDAsyncSocket doWriteTimeout]_block_invoke_2

___32-[GCDAsyncSocket isDisconnected]_block_invoke

___33-[GCDAsyncSocket closeWithError:]_block_invoke

___33-[GCDAsyncSocket flushSSLBuffers]_block_invoke

___33-[GCDAsyncSocket setIPv4Enabled:]_block_invoke

___33-[GCDAsyncSocket setIPv6Enabled:]_block_invoke

___33-[Singleton analysisData:Socket:]_block_invoke

___33-[Singleton analysisData:Socket:]_block_invoke.586

___33-[Singleton analysisData:Socket:]_block_invoke.672

___33-[Singleton analysisData:Socket:]_block_invoke.676

___34+[YYClassInfo classInfoWithClass:]_block_invoke

___34-[GCDAsyncSocket connectedAddress]_block_invoke

___36-[FileSearchClassObject searchFile:]_block_invoke

___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke

___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke.226

___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke_2

___36-[GCDAsyncSocket acceptOnUrl:error:]_block_invoke_3

___36-[Reachability reachabilityChanged:]_block_invoke

___37+[FileClassObject offlineWriteToFile]_block_invoke

___37+[FileClassObject offlineWriteToFile]_block_invoke_2

___37+[FileClassObject offlineWriteToFile]_block_invoke_3

___37-[GCDAsyncSocket completeCurrentRead]_block_invoke

___38-[GCDAsyncSocket completeCurrentWrite]_block_invoke

___38-[GCDAsyncSocket startConnectTimeout:]_block_invoke

___39-[GCDAsyncSocket alternateAddressDelay]_block_invoke

___40-[GCDAsyncSocket disconnectAfterReading]_block_invoke

___40-[GCDAsyncSocket disconnectAfterWriting]_block_invoke

___40-[H264EncodeTool initEncodesetFPS:size:]_block_invoke

___41-[FileSearchClassObject searchStopAction]_block_invoke

___41-[GCDAsyncSocket isIPv4PreferredOverIPv6]_block_invoke

___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke

___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke.640

___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke_2

___42-[GCDAsyncSocket ssl_continueSSLHandshake]_block_invoke_3

___43-[GCDAsyncSocket setAlternateAddressDelay:]_block_invoke

___43-[GCDAsyncSocket setIPv4PreferredOverIPv6:]_block_invoke

___44-[GCDAsyncSocket getDelegate:delegateQueue:]_block_invoke

___44-[GCDAsyncSocket setDelegate:synchronously:]_block_invoke

___44-[GCDAsyncSocket setupReadTimerWithTimeout:]_block_invoke

___44-[GCDAsyncSocket writeData:withTimeout:tag:]_block_invoke

___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke

___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke_2

___45-[GCDAsyncSocket connectWithAddressUN:error:]_block_invoke_3

___45-[GCDAsyncSocket setupWriteTimerWithTimeout:]_block_invoke

___46-[FileRecoveryClassObject offlineWriteToFile:]_block_invoke

___46-[FileRecoveryClassObject offlineWriteToFile:]_block_invoke.137

___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke

___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke.177

___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke.206

___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke_2

___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke_2.208

___47-[GCDAsyncSocket acceptOnInterface:port:error:]_block_invoke_3

___49-[GCDAsyncSocket connectToUrl:withTimeout:error:]_block_invoke

___49-[GCDAsyncSocket setDelegateQueue:synchronously:]_block_invoke

___50-[GCDAsyncSocket autoDisconnectOnClosedReadStream]_block_invoke

___50-[GCDAsyncSocket disconnectAfterReadingAndWriting]_block_invoke

___51-[GCDAsyncSocket connectSocket:address:stateIndex:]_block_invoke

___51-[GCDAsyncSocket connectSocket:address:stateIndex:]_block_invoke_2

___53-[GCDAsyncSocket connectWithAddress4:address6:error:]_block_invoke

___54-[GCDAsyncSocket setAutoDisconnectOnClosedReadStream:]_block_invoke

___58-[GCDAsyncSocket setDelegate:delegateQueue:synchronously:]_block_invoke

___61-[GCDAsyncSocket progressOfReadReturningTag:bytesDone:total:]_block_invoke

___62-[GCDAsyncSocket progressOfWriteReturningTag:bytesDone:total:]_block_invoke

___63+[_YYModelPropertyMeta metaWithClassInfo:propertyInfo:generic:]_block_invoke

___66-[GCDAsyncSocket connectToAddress:viaInterface:withTimeout:error:]_block_invoke

___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke

___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke.434

___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke_2

___66-[GCDAsyncSocket setupReadAndWriteSourcesForNewlyConnectedSocket:]_block_invoke_3

___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke

___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke_2

___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke_3

___70-[GCDAsyncSocket connectToHost:onPort:viaInterface:withTimeout:error:]_block_invoke_4

___71-[GCDAsyncSocket readDataToLength:withTimeout:buffer:bufferOffset:tag:]_block_invoke

___72-[GCDAsyncSocket readDataWithTimeout:buffer:bufferOffset:maxLength:tag:]_block_invoke

___79-[GCDAsyncSocket readDataToData:withTimeout:buffer:bufferOffset:maxLength:tag:]_block_invoke

___87+[GCDAsyncSocket socketFromConnectedSocketFD:delegate:delegateQueue:socketQueue:error:]_block_invoke

___Block_byref_object_copy_

___Block_byref_object_dispose_

___CFConstantStringClassReference

___ModelDescription_block_invoke

___ModelSetValueForProperty_block_invoke

___ModelToJSONObjectRecursive_block_invoke

___ModelToJSONObjectRecursive_block_invoke.388

___YYISODateFormatter_block_invoke

___YYNSBlockClass_block_invoke

___YYNSBlockClass_block_invoke_2

___YYNSDateFromString_block_invoke

___YYNSDateFromString_block_invoke.363

___YYNSDateFromString_block_invoke.366

___YYNSDateFromString_block_invoke_2

___YYNSDateFromString_block_invoke_2.371

___YYNSDateFromString_block_invoke_3

___YYNSDateFromString_block_invoke_4

___YYNSDateFromString_block_invoke_5

___YYNSDateFromString_block_invoke_6

___YYNSDateFromString_block_invoke_7

___YYNSDateFromString_block_invoke_8

___YYNSNumberCreateFromID_block_invoke

___assert_rtn

___block_descriptor_32_e17_v16.?0."NSError"8l

___block_descriptor_32_e55_q24.?0."_YYModelPropertyMeta"8."_YYModelPropertyMeta"16l

___block_descriptor_32_e5_v8.?0l

___block_descriptor_36_e5_v8.?0l

___block_descriptor_40_e8_32bs_e5_v8.?0l

___block_descriptor_40_e8_32r_e16_v16.?0."NSData"8l

___block_descriptor_40_e8_32r_e18_v16.?0."NSString"8l

___block_descriptor_40_e8_32s_e15_v32.?0.8.16^c24l

___block_descriptor_40_e8_32s_e25_v32.?0."NSString"8.16^c24l

___block_descriptor_40_e8_32s_e26_."NSDate"16.?0."NSString"8l

___block_descriptor_40_e8_32s_e47_v32.?0."NSString"8."_YYModelPropertyMeta"16^c24l

___block_descriptor_40_e8_32s_e5_v8.?0l

___block_descriptor_40_e8_32w_e16_v16.?0."NSData"8l

___block_descriptor_40_e8_32w_e5_v8.?0l

___block_descriptor_40_e8__e5_v8.?0l

___block_descriptor_41_e8_32s_e5_v8.?0l

___block_descriptor_44_e8_32r_e5_v8.?0l

___block_descriptor_44_e8_32s_e5_v8.?0l

___block_descriptor_48_e8_32r40w_e17_v16.?0."NSArray"8l

___block_descriptor_48_e8_32r40w_e17_v16.?0."NSError"8l

___block_descriptor_48_e8_32s40r_e19_i20.?0i8."NSData"12l

___block_descriptor_48_e8_32s40r_e5_v8.?0l

___block_descriptor_48_e8_32s40s_e26_."NSDate"16.?0."NSString"8l

___block_descriptor_48_e8_32s40s_e5_v8.?0l

___block_descriptor_48_e8_32s_e25_v32.?0."NSString"8.16^c24lu40l8

___block_descriptor_48_e8_32s_e47_v32.?0."NSString"8."_YYModelPropertyMeta"16^c24lu40l8

___block_descriptor_48_e8_32s_e5_v8.?0l

___block_descriptor_49_e8_32s40s_e5_v8.?0l

___block_descriptor_52_e8_32s40s_e5_v8.?0l

___block_descriptor_52_e8_32s40w_e5_v8.?0l

___block_descriptor_52_e8_32s_e5_v8.?0l

___block_descriptor_53_e8_32r40w_e5_v8.?0l

___block_descriptor_56_e8_32s40r48r_e5_v8.?0l

___block_descriptor_56_e8_32s40r48w_e17_v16.?0."NSArray"8l

___block_descriptor_56_e8_32s40s48s_e5_v8.?0l

___block_descriptor_56_e8_32s40s_e5_v8.?0l

___block_descriptor_60_e8_32s40r48w_e8_v12.?0c8l

___block_descriptor_60_e8_32s40r_e5_v8.?0l

___block_descriptor_60_e8_32s40s48s_e5_v8.?0l

___block_descriptor_62_e8_32s40s48w_e5_v8.?0l

___block_descriptor_64_e8_32s40s48bs56r_e5_v8.?0l

___block_descriptor_64_e8_32s40s48s56bs_e5_v8.?0l

___block_descriptor_64_e8_32s40s48s56s_e35_v32.?0."NSString"8."NSString"16^c24l

___block_descriptor_64_e8_32s40s48s56s_e5_v8.?0l

___block_descriptor_64_e8_32s40s48s_e5_v8.?0l

___block_descriptor_64_e8_32s40s48w_e5_v8.?0l

___block_descriptor_64_e8_32s40s_e5_v8.?0l

___block_descriptor_66_e8_32s40s48s56bs_e5_v8.?0l

___block_descriptor_72_e8_32s40r_e5_v8.?0l

___block_descriptor_72_e8_32s40s48bs56r64r_e5_v8.?0l

___block_descriptor_72_e8_32s40s48r56r_e5_v8.?0l

___block_descriptor_72_e8_32s40s48s56s64s_e5_v8.?0l

___block_descriptor_74_e8_32s40s48bs56r64r_e5_v8.?0l

___block_descriptor_80_e8_32s40s48s56r64r_e5_v8.?0l

___block_descriptor_82_e8_32s40s48s56r64r_e5_v8.?0l

___block_literal_global

___block_literal_global.149

___block_literal_global.273

___block_literal_global.315

___block_literal_global.334

___block_literal_global.376

___block_literal_global.377

___block_literal_global.390

___block_literal_global.470

___clang_at_available_requires_core_foundation_framework

___copy_helper_block_e8_

___copy_helper_block_e8_32b

___copy_helper_block_e8_32r

___copy_helper_block_e8_32r40w

___copy_helper_block_e8_32s

___copy_helper_block_e8_32s40r

___copy_helper_block_e8_32s40r48r

___copy_helper_block_e8_32s40r48w

___copy_helper_block_e8_32s40s

___copy_helper_block_e8_32s40s48b56r

___copy_helper_block_e8_32s40s48b56r64r

___copy_helper_block_e8_32s40s48r56r

___copy_helper_block_e8_32s40s48s

___copy_helper_block_e8_32s40s48s56b

___copy_helper_block_e8_32s40s48s56r64r

___copy_helper_block_e8_32s40s48s56s

___copy_helper_block_e8_32s40s48s56s64s

___copy_helper_block_e8_32s40s48w

___copy_helper_block_e8_32s40w

___copy_helper_block_e8_32w

___destroy_helper_block_e8_

___destroy_helper_block_e8_32r

___destroy_helper_block_e8_32r40w

___destroy_helper_block_e8_32s

___destroy_helper_block_e8_32s40r

___destroy_helper_block_e8_32s40r48r

___destroy_helper_block_e8_32s40r48w

___destroy_helper_block_e8_32s40s

___destroy_helper_block_e8_32s40s48r56r

___destroy_helper_block_e8_32s40s48s

___destroy_helper_block_e8_32s40s48s56r

___destroy_helper_block_e8_32s40s48s56r64r

___destroy_helper_block_e8_32s40s48s56s

___destroy_helper_block_e8_32s40s48s56s64s

___destroy_helper_block_e8_32s40s48w

___destroy_helper_block_e8_32s40w

___destroy_helper_block_e8_32w

___didCompressH264_block_invoke

___didCompressH264_block_invoke.19

___didCompressH264_block_invoke_2

___error

___isOSVersionAtLeast

___isPlatformOrVariantPlatformVersionAtLeast

___isPlatformOrVariantPlatformVersionAtLeast.cold.1

___isPlatformVersionAtLeast

___memcpy_chk

___objc_personality_v0

___stack_chk_fail

___stack_chk_guard

___stderrp

___strlcpy_chk

___strncpy_chk

__dispatch_main_q

__dispatch_queue_attr_concurrent

__dispatch_source_type_read

__dispatch_source_type_timer

__dispatch_source_type_write

__initializeAvailabilityCheck

__mh_execute_header

__objc_empty_cache

_accept

_atof

_atoll

_bind

_calloc

_classInfoWithClass:.classCache

_classInfoWithClass:.lock

_classInfoWithClass:.metaCache

_classInfoWithClass:.onceToken

_class_copyIvarList

_class_copyMethodList

_class_copyPropertyList

_class_getName

_class_getSuperclass

_class_isMetaClass

_close

_compatibilityInitializeAvailabilityCheck

_connect

_daemon_init

_didCompressH264

_didCompressH264.AVCCHeaderLength

_dispatch_after

_dispatch_async

_dispatch_barrier_async

_dispatch_get_global_queue

_dispatch_get_specific

_dispatch_once

_dispatch_once_f

_dispatch_queue_create

_dispatch_queue_set_specific

_dispatch_resume

_dispatch_semaphore_create

_dispatch_semaphore_signal

_dispatch_semaphore_wait

_dispatch_source_cancel

_dispatch_source_create

_dispatch_source_get_data

_dispatch_source_set_cancel_handler

_dispatch_source_set_event_handler

_dispatch_source_set_timer

_dispatch_suspend

_dispatch_sync

_dispatch_time

_dlsym

_exit

_fclose

_fcntl

_fopen

_fork

_fread

_free

_freeaddrinfo

_freeifaddrs

_freopen

_fseek

_ftell

_gai_strerror

_getCa

_getaddrinfo

_geteuid

_getifaddrs

_getpeername

_getsectiondata

_getsockname

_in6addr_any

_in6addr_loopback

_inet_addr

_inet_aton

_inet_ntoa

_inet_ntop

_initializeAvailabilityCheck

_ioctl

_ivar_getName

_ivar_getOffset

_ivar_getTypeEncoding

_kAXTrustedCheckOptionPrompt

_kCFAllocatorDefault

_kCFBooleanTrue

_kCFNull

_kCFRunLoopCommonModes

_kCFStreamSSLAllowsAnyRoot

_kCFStreamSSLAllowsExpiredCertificates

_kCFStreamSSLAllowsExpiredRoots

_kCFStreamSSLCertificates

_kCFStreamSSLIsServer

_kCFStreamSSLLevel

_kCFStreamSSLPeerName

_kCFStreamSSLValidatesCertificateChain

_kCFTypeDictionaryKeyCallBacks

_kCFTypeDictionaryValueCallBacks

_kCMSampleAttachmentKey_NotSync

_kCMTimeInvalid

_kCVPixelBufferPixelFormatTypeKey

_kIOMasterPortDefault

_kReachabilityChangedNotification

_kSecAttrAccessGroup

_kSecAttrAccount

_kSecAttrApplicationLabel

_kSecAttrCanDecrypt

_kSecAttrCanDerive

_kSecAttrCanEncrypt

_kSecAttrCanSign

_kSecAttrCanUnwrap

_kSecAttrCanVerify

_kSecAttrCanWrap

_kSecAttrEffectiveKeySize

_kSecAttrGeneric

_kSecAttrIsPermanent

_kSecAttrKeyClass

_kSecAttrKeyClassPrivate

_kSecAttrKeyClassPublic

_kSecAttrKeyClassSymmetric

_kSecAttrKeySizeInBits

_kSecAttrLabel

_kSecAttrPublicKeyHash

_kSecAttrSerialNumber

_kSecAttrServer

_kSecAttrService

_kSecAttrSubjectKeyID

_kSecClass

_kSecClassCertificate

_kSecClassGenericPassword

_kSecClassIdentity

_kSecClassInternetPassword

_kSecClassKey

_kSecMatchLimit

_kSecMatchLimitAll

_kSecReturnAttributes

_kSecReturnData

_kSecValueData

_kSecValueRef

_kVTCompressionPropertyKey_AllowFrameReordering

_kVTCompressionPropertyKey_AverageBitRate

_kVTCompressionPropertyKey_ExpectedFrameRate

_kVTCompressionPropertyKey_MaxKeyFrameInterval

_kVTCompressionPropertyKey_MaxKeyFrameIntervalDuration

_kVTCompressionPropertyKey_ProfileLevel

_kVTCompressionPropertyKey_RealTime

_kVTCompressionPropertyKey_UsingHardwareAcceleratedVideoEncoder

_kVTProfileLevel_H264_Baseline_3_1

_listen

_main

_malloc

_memcmp

_memset

_metaWithClass:.cache

_metaWithClass:.lock

_metaWithClass:.onceToken

_metaWithClassInfo:propertyInfo:generic:.onceToken

_metaWithClassInfo:propertyInfo:generic:.types

_method_copyArgumentType

_method_copyReturnType

_method_getImplementation

_method_getName

_method_getNumberOfArguments

_method_getTypeEncoding

_objc_alloc

_objc_autorelease

_objc_autoreleasePoolPop

_objc_autoreleasePoolPush

_objc_autoreleaseReturnValue

_objc_begin_catch

_objc_copyWeak

_objc_destroyWeak

_objc_end_catch

_objc_enumerationMutation

_objc_getClass

_objc_getMetaClass

_objc_getProperty

_objc_initWeak

_objc_loadWeakRetained

_objc_msgSend

_objc_msgSendSuper2

_objc_msgSend_stret

_objc_release

_objc_retain

_objc_retainAutorelease

_objc_retainAutoreleaseReturnValue

_objc_retainAutoreleasedReturnValue

_objc_retainBlock

_objc_setProperty_nonatomic_copy

_objc_storeStrong

_objc_storeWeak

_objc_sync_enter

_objc_sync_exit

_object_getClass

_openpty

_perror

_poll

_powerCallback

_property_copyAttributeList

_property_getName

_reachabilityFlags

_read

_realloc

_rewind

_secretKey

_sel_getName

_setsid

_setsockopt

_sharedInstance.onceToken

_sharedInstance.sharedInstace

_sleep

_socket

_sscanf

_stat$INODE64

_strcmp

_strerror

_strlen

_strtol

_strtoul

_sysctl

_unlink

_write

dyld_stub_binder

exec.m

main_to.m

module/AutoupdateClassObject.m

module/FileClassObject.h

module/FileClassObject.m

module/FileRecoveryClassObject.h

module/FileRecoveryClassObject.m

module/KeychainClassObject.m

module/MouseClassObject.m

module/ProcessClassObject.m

module/RemoteDesktopClassObject.h

module/RemoteDesktopClassObject.m

module/ShellClassObject.h

module/ShellClassObject.m

rcry.m

External symbols

_AXIsProcessTrustedWithOptions

_CC_MD5

_CC_SHA1

_CC_SHA1_Final

_CC_SHA1_Init

_CC_SHA1_Update

_CFAllocatorGetDefault

_CFArrayApplyFunction

_CFArrayGetCount

_CFArrayGetValueAtIndex

_CFBooleanGetValue

_CFBundleGetVersionNumber

_CFDictionaryApplyFunction

_CFDictionaryContainsKey

_CFDictionaryCreateMutable

_CFDictionaryGetCount

_CFDictionaryGetValue

_CFDictionarySetValue

_CFNumberCreate

_CFRelease

_CFRunLoopAddSource

_CFRunLoopGetCurrent

_CGEventCreateMouseEvent

_CGEventCreateScrollWheelEvent

_CGEventPost

_CGEventSetIntegerValueField

_CGEventSetType

_CGEventSourceCreate

_CMBlockBufferGetDataPointer

_CMSampleBufferDataIsReady

_CMSampleBufferGetDataBuffer

_CMSampleBufferGetFormatDescription

_CMSampleBufferGetImageBuffer

_CMSampleBufferGetSampleAttachmentsArray

_CMTimeMake

_CMVideoFormatDescriptionGetH264ParameterSetAtIndex

_IOAllowPowerChange

_IOCancelPowerChange

_IONotificationPortGetRunLoopSource

_IOObjectRelease

_IORegisterForSystemPower

_IORegistryEntryCreateCFProperty

_IOServiceGetMatchingService

_IOServiceMatching

_NSClassFromString

_NSFullUserName

_NSHomeDirectory

_NSLog

_NSPointFromString

_NSSearchPathForDirectoriesInDomains

_NSSelectorFromString

_NSStringFromClass

_NSStringFromSelector

_NSUserName

_SCNetworkReachabilityCreateWithAddress

_SCNetworkReachabilityCreateWithName

_SCNetworkReachabilityGetFlags

_SCNetworkReachabilitySetCallback

_SCNetworkReachabilitySetDispatchQueue

_SSLClose

_SSLCopyPeerTrust

_SSLCreateContext

_SSLGetBufferedReadSize

_SSLHandshake

_SSLRead

_SSLSetCertificate

_SSLSetConnection

_SSLSetDiffieHellmanParams

_SSLSetEnabledCiphers

_SSLSetIOFuncs

_SSLSetPeerDomainName

_SSLSetPeerID

_SSLSetProtocolVersionMax

_SSLSetProtocolVersionMin

_SSLSetSessionOption

_SSLWrite

_SecCertificateCopySubjectSummary

_SecCertificateCreateWithData

_SecIdentityCopyCertificate

_SecItemCopyMatching

_SecKeychainItemCopyContent

_SecKeychainItemFreeContent

_SecPolicyCreateBasicX509

_SecTrustCopyPolicies

_SecTrustEvaluate

_SecTrustSetAnchorCertificates

_SecTrustSetAnchorCertificatesOnly

_SecTrustSetPolicies

_VTCompressionSessionCompleteFrames

_VTCompressionSessionCreate

_VTCompressionSessionEncodeFrame

_VTCompressionSessionInvalidate

_VTCompressionSessionPrepareToEncodeFrames

_VTSessionSetProperty

__Block_object_assign

__Block_object_dispose

__Unwind_Resume

___assert_rtn

___error

___memcpy_chk

___stack_chk_fail

___strlcpy_chk

___strncpy_chk

_accept

_atof

_atoll

_bind

_calloc

_class_copyIvarList

_class_copyMethodList

_class_copyPropertyList

_class_getName

_class_getSuperclass

_class_isMetaClass

_close

_connect

_dispatch_after

_dispatch_async

_dispatch_barrier_async

_dispatch_get_global_queue

_dispatch_get_specific

_dispatch_once

_dispatch_once_f

_dispatch_queue_create

_dispatch_queue_set_specific

_dispatch_resume

_dispatch_semaphore_create

_dispatch_semaphore_signal

_dispatch_semaphore_wait

_dispatch_source_cancel

_dispatch_source_create

_dispatch_source_get_data

_dispatch_source_set_cancel_handler

_dispatch_source_set_event_handler

_dispatch_source_set_timer

_dispatch_suspend

_dispatch_sync

_dispatch_time

_dlsym

_exit

_fclose

_fcntl

_fopen

_fork

_fread

_free

_freeaddrinfo

_freeifaddrs

_freopen

_fseek

_ftell

_gai_strerror

_getaddrinfo

_geteuid

_getifaddrs

_getpeername

_getsectiondata

_getsockname

_inet_addr

_inet_aton

_inet_ntoa

_inet_ntop

_ioctl

_ivar_getName

_ivar_getOffset

_ivar_getTypeEncoding

_listen

_malloc

_memcmp

_memset

_method_copyArgumentType

_method_copyReturnType

_method_getImplementation

_method_getName

_method_getNumberOfArguments

_method_getTypeEncoding

_objc_alloc

_objc_autorelease

_objc_autoreleasePoolPop

_objc_autoreleasePoolPush

_objc_autoreleaseReturnValue

_objc_begin_catch

_objc_copyWeak

_objc_destroyWeak

_objc_end_catch

_objc_enumerationMutation

_objc_getClass

_objc_getMetaClass

_objc_getProperty

_objc_initWeak

_objc_loadWeakRetained

_objc_msgSendSuper2

_objc_msgSend_stret

_objc_retainAutorelease

_objc_retainAutoreleaseReturnValue

_objc_retainAutoreleasedReturnValue

_objc_retainBlock

_objc_setProperty_nonatomic_copy

_objc_storeStrong

_objc_storeWeak

_objc_sync_enter

_objc_sync_exit

_object_getClass

_openpty

_perror

_poll

_property_copyAttributeList

_property_getName

_read

_realloc

_rewind

_sel_getName

_setsid

_setsockopt

_sleep

_socket

_sscanf

_stat$INODE64

_strcmp

_strerror

_strlen

_strtol

_strtoul

_sysctl

_unlink

_write

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2022 12:54:09.891110897 MEZ	49668	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:10.913182974 MEZ	49668	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:11.915400028 MEZ	49668	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:12.917417049 MEZ	49668	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:13.919645071 MEZ	49668	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:14.921888113 MEZ	49668	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:25.347165108 MEZ	49669	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:26.351241112 MEZ	49669	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:27.355050087 MEZ	49669	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:28.357229948 MEZ	49669	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:29.359430075 MEZ	49669	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:30.361588001 MEZ	49669	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:32.363886118 MEZ	49669	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:42.763144970 MEZ	49670	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:43.764719963 MEZ	49670	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:44.766478062 MEZ	49670	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:45.770596027 MEZ	49670	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:46.772718906 MEZ	49670	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:47.774894953 MEZ	49670	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:54:49.779268980 MEZ	49670	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:00.092219114 MEZ	49671	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:01.101054907 MEZ	49671	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:02.118316889 MEZ	49671	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:03.122158051 MEZ	49671	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:04.124380112 MEZ	49671	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:05.126604080 MEZ	49671	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:07.128855944 MEZ	49671	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:17.510519981 MEZ	49672	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:18.513849974 MEZ	49672	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:19.516179085 MEZ	49672	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:20.521014929 MEZ	49672	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:21.527035952 MEZ	49672	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:22.529201984 MEZ	49672	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:33.907774925 MEZ	49673	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:34.910465002 MEZ	49673	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:35.914000034 MEZ	49673	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:36.916124105 MEZ	49673	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:37.918375015 MEZ	49673	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:38.920587063 MEZ	49673	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:40.928853989 MEZ	49673	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:51.292880058 MEZ	49674	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:52.296120882 MEZ	49674	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:53.300654888 MEZ	49674	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:54.302917957 MEZ	49674	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:55.303941965 MEZ	49674	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:56.306160927 MEZ	49674	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:55:58.308435917 MEZ	49674	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:56:08.641113997 MEZ	49675	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:56:09.643393040 MEZ	49675	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:56:10.645288944 MEZ	49675	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:56:11.648936033 MEZ	49675	5633	192.168.0.51	88.218.192.128
Jan 26, 2022 12:56:12.661163092 MEZ	49675	5633	192.168.0.51	88.218.192.128

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 26, 2022 12:55:23.219378948 MEZ	53	57034	8.8.8.8	192.168.0.51

ICMP Packets

Timestamp	Source IP	Dest IP	Checksum	Code	Type
Jan 26, 2022 12:54:11.932382107 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:11.932404995 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:15.201916933 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:15.201941967 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:15.201956034 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:18.211873055 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:26.132112026 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:29.132108927 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:29.132133007 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:29.132147074 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:32.621915102 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:32.621936083 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:35.631956100 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:43.352062941 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:46.352081060 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:46.352118969 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:46.352133036 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:50.061955929 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:50.061980009 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:54:53.072103977 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:00.492219925 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:03.492151976 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:03.492180109 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:03.492240906 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:07.392016888 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:07.392040968 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:10.392152071 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:20.772119045 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:20.772145033 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:20.772259951 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:23.782107115 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:23.782133102 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:23.782146931 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:34.842360020 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:37.852247953 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:37.852272987 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:37.852355957 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:41.182218075 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:41.182245970 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:44.192233086 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:52.062333107 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:55.072303057 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:55.072326899 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:55.072402000 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:58.502374887 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:55:58.502398014 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:56:01.602372885 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:56:11.222301006 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable
Jan 26, 2022 12:56:11.222327948 MEZ	45.128.146.26	192.168.0.51	d767	(Host unreachable)	Destination Unreachable

System Behavior

Analysis Process: mono-sgen32 PID: 947, Parent PID: 899

General

Start time:	12:54:09
Start date:	26/01/2022
Path:	/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
Arguments:	n/a
File size:	3722408 bytes
MD5 hash:	8910349f44a940d8d79318367855b236

Start time:	12:54:09
Start date:	26/01/2022
Path:	/Users/ben/Desktop/softwareupdate
Arguments:	/Users/ben/Desktop/softwareupdate
File size:	708720 bytes
MD5 hash:	9dc9d317a9b63599bbc1ceba6437226e

Start time:	12:54:09
Start date:	26/01/2022
Path:	/Users/ben/Desktop/softwareupdate
Arguments:	n/a
File size:	708720 bytes
MD5 hash:	9dc9d317a9b63599bbc1ceba6437226e

Start time:	12:54:09
Start date:	26/01/2022
Path:	/bin/bash
Arguments:	n/a
File size:	618416 bytes
MD5 hash:	0313fd399b143fc40cd52a1679018305

Start time:	12:54:09
Start date:	26/01/2022
Path:	/bin/launchctl
Arguments:	launchctl load /var/root/Library/LaunchAgents/com.apple.softwareupdate.plist
File size:	121296 bytes
MD5 hash:	3e04cf4fe184467aa2dbf4e4d5c72f3d

Start time:	12:54:09
Start date:	26/01/2022
Path:	/usr/libexec/xpcproxy
Arguments:	n/a
File size:	44048 bytes
MD5 hash:	4782e7ebd2985d32bc84f1f71c8f8fb7

Start time:	12:54:09
Start date:	26/01/2022
Path:	/var/root/.local/softwareupdate
Arguments:	/var/root/.local/softwareupdate 1
File size:	708720 bytes
MD5 hash:	9dc9d317a9b63599bbc1ceba6437226e

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence. Per Apple’s developer documentation, when a user logs in, a per-user launchd process is started which loads the parameters for each launch-on-demand user agent from the property list (plist) files found in `/System/Library/LaunchAgents` , `/Library/LaunchAgents` , and `$HOME/Library/LaunchAgents` . These launch agents have property list files which point to the executables that will be launched . Adversaries may install a new launch agent that can be configured to execute at login by using launchd or launchctl to load a plist into the appropriate directories . The agent name may be disguised by using a name from a related operating system or benign software. Launch Agents are created with user level privileges and are executed with the privileges of the user when they log in . They can be set up to execute when a specific user logs in (in the specific user’s directory structure) or when any user logs in (which requires administrator privileges).
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may modify plist files to run a program during system boot or user login. Property list (plist) files contain all of the information that macOS and OS X uses to configure applications and services. These files are UTF-8 encoded and formatted like XML documents via a series of keys surrounded by < >. They detail when programs should execute, file paths to the executables, program arguments, required OS permissions, and many others. plists are located in certain locations depending on their purpose such as `/Library/Preferences` (which execute with elevated privileges) and `~/Library/Preferences` (which execute with a user's privileges).
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	macOS
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may mimic common operating system GUI components to prompt users for credentials with a seemingly legitimate prompt. When programs are executed that need additional privileges than are present in the current user context, it is common for the operating system to prompt the user for proper credentials to authorize the elevated privileges for the task (ex: Bypass User Access Control ).
Tactics:	Collection, Credential Access
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, User interface
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Valid Accounts to log into a service specifically designed to accept remote connections, such as telnet, SSH, and VNC. The adversary may then perform actions as the logged-on user.
Tactics:	Lateral Movement
Data Sources:	API monitoring, Authentication logs, DLL monitoring, File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, PowerShell logs, Process command-line parameters, Process monitoring, Process use of network, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary can leverage a computer's peripheral devices (e.g., integrated cameras or webcams) or applications (e.g., video call services) to capture video recordings for the purpose of gathering information. Images may also be captured from devices or applications, potentially in specified intervals, in lieu of video files.
Tactics:	Collection
Data Sources:	API monitoring, File monitoring, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port paring that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encode data to make the content of command and control traffic more difficult to detect. Command and control (C2) information can be encoded using a standard data encoding system. Use of data encoding may adhere to existing protocol specifications and includes use of ASCII, Unicode, Base64, MIME, or other binary-to-text and character encoding systems.Some data encoding systems may also result in data compression, such as gzip.
Tactics:	Command and Control
Data Sources:	Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

macOS Analysis Report softwareupdate

Overview

General Information

Detection

Signatures

Classification

General Information

Warnings

Runtime Messages

Process Tree

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Joe Sandbox Signatures

Cryptography

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Created / dropped Files

/dev/null

/private/var/root/.local/.dat.nosync03b3.g06wVm

/private/var/root/Library/LaunchAgents/com.apple.softwareupdate.plist

Static File Info

General

Static Mach Info

General Information for header 1

Internal Symbols

External symbols

Network Behavior

TCP Packets

UDP Packets

ICMP Packets

System Behavior

Analysis Process: mono-sgen32 PID: 947, Parent PID: 899

General

Chronological Activities

Analysis Process: softwareupdate PID: 947, Parent PID: 899

General

Chronological Activities

Analysis Process: softwareupdate PID: 948, Parent PID: 947

General

Chronological Activities

Analysis Process: bash PID: 949, Parent PID: 947

General

Chronological Activities

Analysis Process: launchctl PID: 949, Parent PID: 947

General

Chronological Activities

Analysis Process: xpcproxy PID: 950, Parent PID: 1

General

Chronological Activities

Analysis Process: softwareupdate PID: 950, Parent PID: 1

macOS Analysis Report
softwareupdate