{ "type": "URL", "indicator": "https://bjoern.hoehrmann.de/utf-8/decoder/dfa/", "general": { "sections": [ "general", "url_list", "http_scans", "screenshot" ], "indicator": "https://bjoern.hoehrmann.de/utf-8/decoder/dfa/", "type": "url", "type_title": "URL", "validation": [], "base_indicator": { "id": 3985824786, "indicator": "https://bjoern.hoehrmann.de/utf-8/decoder/dfa/", "type": "URL", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 2, "pulses": [ { "id": "67f33233092ab19b74879403", "name": "MacOS M2 Chip Infiltration: Game Center & XBOX Pod Game & Chat Server", "description": "pulse explores a variety of files, objects, and functions that could be associated with different system components, libraries, and protocols. It highlights a wide range of potential vulnerabilities that may exist in software related to system functions, APIs, data handling, and device interactions, including issues in devices like game controllers, HID devices, and platform-specific services (such as Apple and Android). The pulse references several components across different platforms (macOS, iOS, ARM architectures, and others), with a focus on low-level code, encryption libraries, system utilities, and network protocols like TCP, IP, and Bluetooth. The identified vulnerabilities could involve buffer overflows, deprecated functions, improper memory handling, and potential exploit vectors related to system security, performance, and integrity.", "modified": "2025-05-07T02:03:20.735000", "created": "2025-04-07T02:02:27.322000", "tags": [ "helper macro", "param", "param inccache", "kerberos", "ccache", "api function", "ccapi", "api version", "param ioccache", "ccacheserver", "win32", "null", "code", "win64", "error", "union", "ccapideprecated", "ccacheapi", "ccapiv2h", "apple", "export", "united", "ccache api", "cplusplus", "x8664", "typedef", "patheq", "none", "popen", "terminate", "false", "winenv", "winexe", "frozen", "winservice", "python", "posixthreads", "pyhavecondvar", "ntthreads", "vista", "pyemulatedwincv", "ntddivista", "semaphore", "pycondt", "win7", "pybuildcore", "fall", "copyright", "technology", "all rights", "reserved", "america", "government", "within that", "klprincipal", "klloginoptions", "inpassword", "klboolean", "klindex inindex", "login", "klstatus", "kerberos login", "inst", "regexp", "typeof e", "function", "typeof t", "typeof o", "width", "typeof", "pseudo", "body", "sticky", "date", "class", "this", "void", "accept", "span", "krb5callconv", "apoptsreserved", "tktflgreserved", "kdcoptreserved", "krb5data", "eblock", "krb5address", "krb5keyblock", "service", "realm", "format", "general", "internal", "entropy", "mask", "mcpeerid", "mcsession", "property", "protocol", "create", "nsuinteger", "notifies", "mcsession api", "interface", "bonjour", "ascii lowercase", "abc company", "section", "bonjour txt", "mcextern", "attribute", "mcextern extern", "mcexternweak", "nsenum", "nsinteger", "mcerrorcode", "mcerrorunknown", "mcerrortimedout", "bonjour apis", "stop", "peer", "example", "tags", "session", "nsprogress", "nserror", "nsstring", "nsurl", "nsarray", "note", "ui element", "utf8 encoding", "nscopying", "nsdictionary", "webpackrequire", "webpackexports", "object", "adobe systems", "adobe", "incorporated", "dissemination", "touchmove", "window", "launch", "close", "core", "webview", "nwebpackrequire", "arraybuffer", "name", "typedarray", "prototype", "string", "number", "nvar", "meta", "infinity", "generator", "zero", "epsilon", "observer", "android", "freeze", "trim", "canvas", "simple", "bind", "fast", "next", "patch", "rest", "middle", "find", "enumerate", "facebook", "executor", "apiunavailable", "gamecontroller", "gcbuttoninput", "gcswitchinput", "nsobject", "apiavailable", "hid device", "cfstr", "iohiddeviceref", "boolean value", "c iohidmanager", "iohidmanager", "c iohiddevice", "issequential", "bool sequential", "bool canwrap", "nsset", "nsunavailable", "gcswitchelement", "bool", "share button", "xbox controller", "xbox elite", "xbox series", "gcxboxgamepad", "gcpoint2", "gcpoint2make", "gcpoint2 p", "cfinline bool", "gcpoint2equal", "gcpoint2 point1", "gcpoint2 point2", "gcrelativeinput", "isanalog", "bool analog", "hasinclude", "gcaxis2dinput", "gcpoint2 value", "gcaxiselement", "certain", "gcaxisinput", "gcbuttonelement", "gccontroller", "nsnotification", "chhapticengine", "gcmicrogamepad", "input", "menu button", "gcdevicelight", "gccolor", "x axis", "xvalue", "developers", "functionality", "options button", "sf symbols", "elements", "gcdevice", "gctouchstate", "gctouchstateup", "apideprecated", "gckeyboard", "gcmouse", "nsswiftname", "gcdevicebattery", "battery level", "direction pad", "directionapad", "thumbstick", "gcdevicecursor", "a controller", "gccolor color", "gcinputbuttona", "gcinputbuttonb", "button b", "check", "a element", "c nil", "nsenumerator", "siri remote", "equivalent", "down", "left", "right", "kindof", "handle button", "c device", "immediate input", "dualsense", "positional", "sony dualsense", "gcmotion", "dualshock", "uievent", "controllers", "uikit user", "uiview", "method", "nsdata", "axes", "nsdata source", "return", "nullable", "nsdata object", "button", "shoulder", "extended", "gamepad profile", "nsdata api", "gcgamepad", "sizeof", "standard", "gckeyboardinput", "keyboard", "nsstring const", "controller", "back buttons", "game controller", "back", "keypad", "delete", "insert", "home", "right arrow", "left arrow", "down arrow", "up arrow", "korean", "backspace", "alongside", "gckeyuparrow", "gckeycode const", "lang1", "gclinearinput", "gcquaternion", "gcacceleration", "y axis", "z axis", "gcmouse mouse", "gcmouse class", "mice", "gcmouseinput", "mouse profile", "scroll", "nsdata instance", "a alias", "press", "micro profile", "siri remotes", "b button", "a gcinput", "button a", "nsoptions", "examining", "c sfsymbolsname", "apple tv", "remote", "control center", "a set", "game", "gcracingwheel", "gcbundlewithpid", "gcinputbuttonx", "gcinputbuttony", "gcinputshifter", "gckeya", "gckeyb", "gckeybackslash", "rawvalue", "apple swift", "o librarylevel", "swift import", "element", "indices", "iterator", "subsequence", "kerberoscomerr", "const", "permission", "mit software", "suitability", "athena", "openvision", "gssdllimp", "gssapigenerich", "this software", "purpose", "disclaims all", "warranties with", "regard to", "constraint", "kerberosprofile", "krb5profileh", "const names", "newvalue", "1429577728l", "gnuc", "mach", "omuint32", "gssapikrb5h", "form", "uid form", "client function", "asrep", "including", "preauth", "db entry", "free", "pointer", "rock", "neither", "direct", "damage", "minorstatus", "gssbuffert", "gssctxidt", "gssoid", "gssnamet", "gsscredidt", "gssoidset", "gssapi", "first", "alcapi", "alcapientry", "alcboolean", "targetosmac", "alcdevice", "alcenum param", "alalch", "alcchar", "alcsizei", "capture", "but not", "limited", "openal cross", "apple computer", "redistribution", "is provided", "type", "alvoid", "alint", "openal", "aluint sid", "alenum", "alint value", "aluint property", "alvoid nonnull", "alfloat", "write", "openalopenalh", "umbrella header", "alenum param", "alapi", "aluint bid", "alsizei", "alfloat value", "alapientry", "aluint", "verify", "play", "speed", "bits", "albuffer3i", "albufferdata", "albufferf", "albufferfv", "albufferi", "albufferiv", "aldistancemodel", "aldopplerfactor", "algetbooleanv", "algetbuffer3f", "iousbhostdevice", "iousbhostobject", "iousbhostpipe", "iousbhoststream", "iousbhost", "brief", "usb host", "bool yes", "bool no", "advance", "iousbhostfamily", "kernel", "ioreturn status", "nsnumber", "ioreturn error", "usb device", "select", "commands", "enqueue", "nsmutabledata", "field", "enum", "options", "retrieve", "iosource", "current address", "bos descriptor", "extract", "a descriptor", "license", "io request", "abort", "discussion", "stream", "please", "swift api", "iousbbitrange", "iousbbitrange64", "iousbbit", "client", "usb controller", "usb descriptor", "unknown", "critical", "refer", "link", "send", "same", "common ui", "bluetooth", "service browser", "option", "1001", "cfstringref", "deprecated", "macos", "returns", "abstract", "nswindow", "creates", "mac os", "uuids", "uuid", "sdp service", "nsimage", "nsview", "mpasskeystring", "nsmutablearray", "uuid array", "ioreturn", "runmodal", "group", "command", "byte", "masks", "pduid", "l2cap", "range", "opcode", "packet", "major", "local", "profiles", "iobluetooth", "framework", "support", "host controller", "rfcomm", "minor class", "pseudoclass", "specific device", "headset", "peripheral", "desktop", "glasses", "device reset", "no hci", "hci controller", "returns number", "variable number", "packdata", "cstring", "pass", "path", "deprecated in", "obex session", "obexsessionref", "rfcomm channel", "obex", "does not", "l2cap channel", "inrefcon", "device", "length", "obex spec", "error code", "make", "headerid", "april", "alarm", "avrcplog", "audiolog", "bccmd16touint16", "bccmd16touint8", "bccmd32touint32", "hfplog", "obexcreatevcard", "obexsessionget", "uint16tobccmd16", "intents", "created", "andrea gottardo", "inimage", "intentsui", "project version", "inshortcut", "ibdesignable", "invoiceshortcut", "nsbundle", "siri", "beralloct", "berbvarrayadd", "berbvarrayfree", "berbvdup", "berbvecadd", "berbvecfree", "berbvfree", "berdump", "berdup", "berdupbv", "ldap", "vdspinput1", "vectorsize", "iirchannel", "osvkerndsplib", "pragmaonce", "paul chang", "fri mar", "original code", "apple operating", "modifications", "apple public", "source license", "version", "lframesize", "i386", "picify", "callmcount", "nonlazystub", "align", "roundtostack", "leaf", "import", "carnegie mellon", "carnegie", "inline void", "software", "school", "august", "xnuarchi386selh", "next computer", "mike demoney", "bruce martin", "state segment", "nxswappedfloat", "osswapint32", "inline float", "inline double", "osswapint64", "armlimitsh", "arm64", "useclangtypes", "bsdarmtypesh", "int8t", "gnuc typedef", "uint8t", "ansi c", "ansi", "use wchart", "armmcontexth", "mcontextt", "armparamh", "round", "darwinsizet", "darwinalign", "uint32t", "darwinalign32", "warranties", "a particular", "university", "armarch6zk", "armarch6k", "armarch4t", "armarch4", "http", "capbitnb", "legacy", "armfeatureflag", "california", "notice", "berkeley", "limited to", "define", "useclanglimits", "lp64", "ansisource", "darwincsource", "longmin", "ulongmax", "parameter", "vmmemcoherent", "vmmemearlyack", "vmmeminner", "vmmemrt", "vmmemguarded", "armmemorytypesh", "armpalroutinesh", "read", "struct", "booleant", "cluster", "devbsize", "mclbytes", "unix system", "laboratories", "devbshift", "thumb", "armv5", "armv7", "cache", "neon", "swift", "bsdarmprofileh", "xxx todo", "block", "mcount", "mcountinit", "mcountenter", "splhigh", "armthreadh", "armtraph", "dflssiz", "targetososx", "maxssiz", "rliminfinity", "maxcsiz", "bsdarmvmparamh", "dfldsiz", "maxdsiz", "xxx stack", "armsignal", "int64t", "armmachtypesh", "int32t", "methods", "thread", "hasapplepac", "atmatmtypesh", "libkernlocksh", "fortifysource", "libkerncopyioh", "sizedby", "darwinosinline", "stdcversion", "osswapint16", "libkerncrch", "blockexport", "vaargs", "blockrelease", "blockh", "collection", "blockcopy", "ososbaseh", "base", "byteoffset", "host endianess", "generic host", "generic", "osmalloc", "osmalloctag tag", "osmalloctag", "pci device", "uint32", "uint32 mask", "safecastptr", "sint32", "osaddatomic64", "uint8", "libkern c", "internal error", "core osreturn", "libkern", "values", "pragmamark", "kexts", "kext", "c string", "grab", "osostypesh", "boolean", "unsignedwide", "uint32 hi", "buildtime value", "libkernversionh", "versionmajor", "versionminor", "versionvariant", "versionrevision", "ostype", "osrelease", "libkernsysctlh", "instructions", "data cache", "future", "rbleft", "rbright", "rbgetparent", "splayright", "splayleft", "rbsetcolor", "rbblack", "rbgetcolor", "comp", "main", "stdc", "msdos", "windows", "sys16bit", "zlibdll", "zextern", "zconfh", "model", "zextern int", "zstreamerror", "znull", "zbuferror", "zmemerror", "zstreamend", "zdataerror", "zfinish", "enough", "possible", "trailer", "compiler", "countedby", "sparta", "osatomic", "ipcipctypesh", "ipcobjectnull", "ipcobjectdead", "osreturn", "nfskrpch", "xdrbuf", "xdrbuf xbp", "xbptr", "xbleft", "tlen", "lval", "xbcleanup", "xbtype", "xbflags", "nfsargsversion", "file", "packed", "nfshz", "mount", "term", "restrict", "stats", "nfsbitmapset", "nfsver3", "nfsxunsigned", "attr", "nfsprogram", "nfssmallfh", "which", "from", "mark", "obsolete", "ip address", "iaddrt", "netinetbootph", "nvmaxtext", "magic", "etheraddrlen", "target", "byteorder", "bigendian", "littleendian", "dest", "igmp", "ushort", "inpcbptr", "inpcblistentry", "ipsec", "pcbs", "cookie", "netinetinstath", "minimal", "result", "arp packet", "icmpparamprob", "icmpredirect", "address", "ditto", "ip filter", "ipv4", "ip packet", "inject", "wifi", "server", "tcpmaxnotifyack", "wired", "ecn setup", "notify", "slow", "definitions", "tcptmax", "retransmit", "mptcp", "tcpsclosewait", "tcpsestablished", "tcpstimewait", "tcpseq", "timer drift", "sack", "char", "icmp", "synack", "tcpoptnop", "syndata", "ver", "internet", "iopcidevice", "constant", "perst", "localonly", "iooptionbits", "optional access", "ioservice", "open", "pcidriverkith", "osmetaclassbase", "iorpc rpc", "auditpipeiobase", "auditsdeviobase", "ioctls", "data", "the software", "stdargh", "hasincludenext", "eli friedman", "as is", "hack", "atomic", "atomicseqcst", "clangstdatomich", "stdchosted", "stdboolh", "needwintt", "stddefh", "hasbuiltin", "const src", "xnumembersize", "const dst", "wcharmax", "wcharmin", "limits", "kernelstdinth", "lp64 typedef", "intmaxc", "uintmaxc", "ptrauth", "olddata", "value", "declkey", "abi pointer", "c function", "float16", "fltevalmethod", "legacy bsd", "c standard", "sincospi", "cosp", "x8664monotonich", "staticifentry", "hasmte", "vmmemorytypesh", "vmwimgdefault", "wimg", "extvectortype", "utilfunction", "aligned", "srcptr", "vmpmaph", "vmdyldpagerh", "vmvmfaulth", "vmvmmaph", "development", "debug", "vmvmoptionsh", "vmvmpageouth", "kasantbi", "machvmmemtagh", "given", "vmmemtagptrsize", "vmmemtagtagsize", "copy", "vmsharedregionh", "vfsvfssupporth", "veclib", "master", "world wide", "various", "veclibtypes", "carbonlib", "availability", "carbon", "noncarbon cfm", "vbasicops", "shift", "vforceh", "vdsplength n", "realp", "nonnull", "vector", "dspsplitcomplex", "ieee", "dspcomplex", "uuiduuidh", "uuiddefine", "public", "uuid library", "kernelserver", "simpleroutine", "undkey", "execution", "strings array", "user", "title string", "info", "1024", "xmldatat", "undreplyref", "kernsuccess", "osaction", "targetosiphone", "istargetvendor", "targetcpux8664", "targetosunix", "targetcpuppc", "targetcpuppc64", "targetcpux86", "targetrtmaccfm", "bridge", "svflags", "svpavreal", "svpavreify", "xpvav", "svany", "avfillp", "for apidoc", "mutableav", "avrealoff", "pltopenv", "stmtstart", "stmtend", "copfile", "plcurstackinfo", "copfilegv", "cophinthashget", "loop", "stack", "beware", "orig", "loops", "this file", "the build", "plbitcount", "u8 value", "cvflags", "xpvcv", "mutableptr", "perlcore", "cvgv", "cvfile", "cvfmethod", "cvflvalue", "cvfconst", "anon", "doinit extconst", "ebcdic", "extconst u8", "index", "ascii platform", "confusingly", "u8 pla2e", "pla2e", "u8 ple2a", "guard", "declspec", "extconst", "ext externc", "init", "larry wall", "gnu general", "readme file", "multiplicity", "plsawampersand", "do not", "perliogetc", "perlioputc", "perliostdoutf", "perlio", "perlfeatureh", "featuresubbit", "featuremyrefbit", "featurefcbit", "featureisabit", "featuresaybit", "featurestatebit", "featuretrybit", "hintfeaturemask", "ffspace", "process", "ffdecimal", "ffend", "gvgp", "gvflags", "gvnamehek", "svtype", "gvegv", "gvstash", "gvxpvgv", "svtpvgv", "svtpvlv", "super", "edit directly", "djgpp", "bitbucket", "perlsysinitbody", "perlioinit", "perlsystermbody", "w macros", "wexitstatus", "shpath", "mkdir", "rotl64", "rotl32", "rotate x", "rotr32", "can64bithash", "rotr64", "ivsize", "u8to16le", "rotluv", "rotruv", "sbox32maxlen", "plhashstate", "perlhash", "perl", "usehashseed", "perlseenhvfunch", "perlhashseed", "siphash24", "siphash13", "seed", "c program", "c type", "c compiler", "gcc attribute", "longsize", "c preprocessor", "install", "kill", "cont", "thus", "ext declspec", "dext", "for apidocitem", "utf8", "ascii", "fitsin8bits", "nativetolatin1", "strwithlen", "u8 end", "test", "poison", "february", "cray", "prior", "behaviour", "except", "alpha", "perlvar", "perlvari", "perlvara", "padoffset", "true", "pmop", "hooks", "hook", "sv invlist", "perlinregcompc", "svcur", "perlinopc", "tointernalsize", "svtinvlist", "invlistlen", "strlen", "hvaux", "heklen", "svook", "hekutf8", "hekkey", "hekflags", "mutablehv", "hvnameheknn", "gosh", "leave", "iperlsock", "plsock", "iperlstdio", "plstdio", "iperlproc", "plproc", "iperllio", "pllio", "perlimplicitsys", "plink", "keypackage", "keyend", "keysub", "keydump", "keylog", "keysend", "keystate", "perlioclose", "perlmemcollxfrm", "nativetoneed", "plclocaleobj", "plno", "plwarnall", "plwarnnone", "plyes", "plzero", "plc9utf8dfatab", "nomathoms", "perlintokec", "perlinutf8c", "perlinsvc", "perlinregexecc", "debugging", "perlinlocalec", "pfinet", "snoop", "ccprint", "ccgraph", "cccharnamecont", "ccascii", "ccwordchar", "ccalphanumeric", "ccidfirst", "ccquotemeta", "ccalpha", "cccased", "ordinal", "magicvtablemax", "extra", "regex match", "env hash", "isa array", "debugger", "sig hash", "available", "shadow", "array length", "magic mg", "sv sv", "mgftainteddir", "hefsvkey", "mutablesv", "ssizet", "mgvtbl entry", "mgfbytes", "perlmagicsv 0", "special", "perlmagicarylen", "perlmagicrhash", "extra data", "perlmagicpos", "perlmagicsymtab", "provides", "dtrace probes", "stdioh", "stdioincluded", "sfioversion", "rxfpmfcharset", "rxfpmfmultiline", "rxfpmffold", "rxfpmfextended", "rxfpmfnocapture", "rxfpmfkeepcopy", "flags", "rxfpmfstrict", "ocshift", "plop", "perlbitfield16", "baseop op", "useithreads", "pmfonce", "padop", "perlcknull", "perlckfun", "opparg1mask", "opparg4mask", "opparg2mask", "perlckftst", "perlppftrowned", "perlckbitop", "perlckcmp", "perlcklfun", "dump", "chroot", "syscall", "flip", "undef", "crypt", "push", "stub", "trans", "predec", "flop", "prtf", "shutdown", "perlcontext cx", "perlmemlog", "c pointer", "cxtype", "logic", "toavamg", "tohvamg", "opftrread", "oplt", "opincmp", "opbitand", "opsbitor", "opsend", "opgetpeername", "opfteexec", "opftbinary", "opclose", "plparser", "yylex", "lexshared", "position", "repl", "memsize", "malloct", "perlmallocctlh", "uv nfree", "uv ntotal", "iv topbucket", "iv totalsbrk", "iv minbucket", "level", "plcomppad", "plcurpad", "uvxf", "ptr2uv", "avarray", "padnameflags", "plcopseqmax", "padlistarray", "c array", "padnametype", "incpushperl5lib", "appllibexp", "privlibexp", "defineincmacros", "perlfsversion", "perl5lib", "sitearchexp", "perllanginfoh", "hasnllanginfo", "ilanginfo", "codeset", "codeset 1", "dtfmt", "dtfmt 2", "dfmt", "dfmt 3", "sipround", "u8to64le", "fallthrough", "uint64c", "perlsiphashfnc", "siprounds", "strlen inlen", "sipfinalrounds", "could", "configure", "plout", "mine001", "argv", "plin", "localpatchcount", "perlapih", "xs code", "portingglossary", "first version", "brand", "symbols", "haswcrtomb", "perlionotstdio", "perlcallconv", "perlio f", "perlioh", "usestdio", "case", "bufsiz", "sizet", "perlstability", "perltypedefs", "perldtracehin", "perlloadedfile", "perlloadingfile", "perlopentry", "perlphasechange", "perlsubentry", "perlsubreturn", "generated", "perlcallconv iv", "sizet count", "sv arg", "mode", "perliofuncs tab", "stdchar", "perliolistt", "sv args", "mutex", "perlinterpreter", "sigsize", "perlioisstdio", "perlcallconv op", "perldokv", "perlppaassign", "perlppabs", "perlppaccept", "perlppadd", "perlppaeach", "perlppaelem", "public license", "free software", "foundation", "yydebug", "bison", "bareword", "funcmeth", "arrow", "targ", "pushs", "tops", "does", "xsub", "pops", "xpushs", "erange", "perlreentrapi", "perlreentrapi0", "hostentsize", "getgrentrproto", "getpwentrproto", "getnetentrproto", "grentbuffer", "grentsize", "hostenterrno", "redebugflag", "debugvtest", "debugr", "u16 nextoff", "argset", "u8 type", "nextoff", "strings", "problem", "june", "invert", "perlfpclass", "longdoublekind", "plstatusvalue", "pldebug", "numclasses", "locale", "grok", "pragma", "dword", "attack", "little", "lynx", "done", "reany", "rxpextflags", "rxextflags", "checkpoint cp", "rxftaintedseen", "rxfcopydone", "plsavestackix", "plsavestack", "plsavestackmax", "ssmaxpush", "enter", "debugscope", "state", "u32 state", "debugsbox32hash", "sbox32warn5", "line", "mutexunlock", "mutexinit", "noop", "mutexlock", "condinit", "detach", "panic", "usetm64", "should", "bsd extension", "configuration", "time64debug", "int64t nv", "gnu extension", "perltime64h", "time64t", "int64t int64", "int64 time64t", "i32 year", "tm64", "hastmtmgmtoff", "decide", "svpvx", "svgmagic", "bonk", "anything", "turn", "crash", "fstat", "perlmicro", "hasioctl", "hasutime", "hasgroup", "haspasswd", "usemybinmode", "idirent", "likely", "generated code", "utfebcdic", "unicode", "step", "ufeff", "u00a0", "u00df", "u00b5", "ufffd", "u017f", "u0300", "unlikely", "nativeutf8toi8", "utf8skip", "nativetouni", "lazy", "extrasize", "regnodemax", "exact", "match", "whilem", "anyof", "curly", "trie", "curlym", "eval", "star", "perlutilh", "hsmapiverlen", "hsxsverlenmax", "hskeyp", "tools", "sv vs", "perlversionlt", "svpvxnolenconst", "perlckwarner", "u32 err", "scroakxsusage", "pluumap", "warnings", "categories", "plcurcop", "perlckwarn", "perlckwarnd", "perlwarnisset", "perlwarnoff", "perlwarnbit", "xsversion", "xsreturn", "perlxshandshake", "plstackbase", "hskey", "zaphod32mix", "u8to32le", "zaphod32warn4", "zaphod32warn3", "zaphod32warn6", "perlform", "i8tonativeutf8", "warnutf8", "myshift", "c extension", "libs", "cflags", "afkuserlog", "kafkeventcancel", "kafkeventerror", "adamsbagmanager", "adjinglerequest", "isinternalbuild", "kickmcxdforuid", "loadappkit", "ardconfig", "authenticator", "dsauthenticator", "dsnode", "dsrecord", "hostconfig", "addtofront", "calcslope", "copyarray", "createcachenode", "defaultebecurve", "deletecache", "disablehcucache", "dumpcache", "dumpoutputhcu", "enablet1sim", "ascagent", "ascagentproxy", "asdevice", "ddrangecompare", "wdosloglauncher", "wdoslogprotocol", "findchar", "ddasllogger", "ddfilelogger", "ddlog", "ddlogfileinfo", "ddlogmessage", "ddloggernode", "mkurlparser", "mkerrordomain", "mkintegerhash", "mklonghash", "mkmaprectinset", "mkmaprectnull", "mkmaprectoffset", "mkmaprectworld", "mkmapsizeworld", "kextensionnonui", "wkarraycreate", "wkbooleancreate", "wkcontextcreate", "wkdatacreate", "wkdatagettypeid", "wkdoublecreate", "wkframecopyurl", "wkgettypeid", "wkimagecreate", "wkpagecandelete", "webkit", "methodkind", "wkerrordomain", "by apple", "document", "a block", "wkcontentworld", "wkwebview", "javascript", "wkerrorcode", "wkerrorunknown", "nsswiftasync", "wkswiftasync", "wkcookiepolicy", "nshttpcookie", "whether", "wknavigation", "wkdownload", "decides", "mime type", "wkscriptmessage", "wkframeinfo", "information", "url scheme", "wkcontentmode", "wkuserscript", "wkextern", "media", "promise", "fulfill", "cgfloat", "targetoswatch", "sign", "password", "provider", "uicontrol", "nscontrol", "opaque user", "apple id", "nsstring user", "asuseragerange", "initiate", "asauthorization", "confirms", "apple upgrade", "nserrorenum", "operation", "relying party", "targetosvision", "a byte", "nsdata userid", "relying", "a string", "asapiavailable", "http response", "authorization", "oauth", "saml", "nsdata readdata", "bool didwrite", "a cose", "nsstring name", "bool appid", "targetosxr", "a state", "a json", "web token", "private seckeys", "nsstring appid", "mdm profile", "nsurl url", "returns yes", "lacontext", "asswiftsendable", "keychain", "cose algorithm", "ecdsa", "sha256", "cose curve", "p256", "nsinteger rank", "enables", "bool success", "remove", "call", "complete", "prepare", "attempt", "list", "nsextension", "settings", "initializes", "a key", "extensions", "hash", "json", "initialize", "nsstring origin", "settings app", "urls", "https urls", "safari", "cancel", "nsuuid uuid", "asextern extern", "asextern", "nsswiftsendable", "uiwindow", "propertykind", "gkplayer", "n tags", "gkerrordomain", "gamecenter", "targetosios", "targetostv", "nsavailable", "gkachievement", "local player", "view", "present", "optional", "gkbaseplayer", "game center", "uiimage", "app store", "gkchallenge", "gklocalplayer", "nsdeprecated", "a singleton", "gkcloudplayer", "returns nil", "nsdeprecatedmac", "internal2", "internal3", "internal4", "gkscore", "gkextern", "gkextern extern", "gkexternweak", "gkerrorcode", "gkerrorunknown", "gkerrorunderage", "friendplayer", "standard view", "nsresponder", "parentwindow", "ibaction", "gkgamesession", "apis", "gkplayer player", "nsinteger score", "nsdate date", "gkleaderboard", "connect", "nsinteger value", "load", "gktransporttype", "nsstring title", "loads array", "localized", "gkmatch", "gkmatchrequest", "gkinvite", "gksession", "gksession api", "gamekit", "asynchronously", "welcome", "nstimeinterval", "delegate", "delivery", "gksenddatamode", "gksessionmode", "gkphotosize", "callbacks", "gkmatchdelegate", "gksavedgame", "default value", "gksessionerror", "gkvoicechat", "participant", "voice chat", "clienta" ], "references": [ "CredentialsCache.h", "CredentialsCache2.h", "config.xml", "popen_spawn_win32.py", "pycore_condvar.h", "Kerberos.h", "KerberosLogin.h", "plugin.js", "krb5.h", "MultipeerConnectivity.tbd", "MCBrowserViewController.h", "MCNearbyServiceAdvertiser.h", "MCError.h", "MCAdvertiserAssistant.h", "MCNearbyServiceBrowser.h", "MultipeerConnectivity.apinotes", "MultipeerConnectivity.h", "MCSession.h", "MCPeerID.h", "canvas.html", "capture_0.bundle.js", "capture_resize.js", "GCRacingWheelInput.h", "GCSyntheticDeviceKeys.h", "GCSwitchPositionInput.h", "GCSteeringWheelElement.h", "GCSwitchElement.h", "GCTouchedStateInput.h", "GCXboxGamepad.h", "GCTypes.h", "GCRelativeInput.h", "GameController.h", "GCAxis2DInput.h", "GCAxisElement.h", "GCAxisInput.h", "GCButtonElement.h", "GCController.h", "GCColor.h", "GCControllerAxisInput.h", "GCControllerDirectionPad.h", "GCControllerInput.h", "GCControllerElement.h", "GCControllerTouchpad.h", "GCDevice.h", "GCDeviceBattery.h", "GCDeviceCursor.h", "GCDeviceHaptics.h", "GCDeviceLight.h", "GCDevicePhysicalInputState.h", "GCDevicePhysicalInputStateDiff.h", "GCDirectionalGamepad.h", "GCDirectionPadElement.h", "GCDevicePhysicalInput.h", "GCDualSenseAdaptiveTrigger.h", "GCDualSenseGamepad.h", "GCDualShockGamepad.h", "GCEventViewController.h", "GCExtendedGamepadSnapshot.h", "GCExtern.h", "GCExtendedGamepad.h", "GCGamepadSnapshot.h", "GCGearShifterElement.h", "GCGamepad.h", "GCKeyboard.h", "GCInputNames.h", "GCControllerButtonInput.h", "GCKeyNames.h", "GCKeyboardInput.h", "GCKeyCodes.h", "GCLinearInput.h", "GCMotion.h", "GCMouse.h", "GCMouseInput.h", "GCMicroGamepadSnapshot.h", "GCPhysicalInputElement.h", "GCMicroGamepad.h", "GCPhysicalInputProfile.h", "GCPhysicalInputSource.h", "GCPressedStateInput.h", "GCProductCategories.h", "GCRacingWheel.h", "GameController.tbd", "arm64e-apple-macos.swiftinterface", "x86_64-apple-macos.swiftinterface", "module.modulemap", "com_err.h", "gssapi_generic.h", "locate_plugin.h", "profile.h", "gssapi_krb5.h", "preauth_plugin.h", "gssapi.h", "alc.h", "oalStaticBufferExtension.h", "oalMacOSX_OALExtensions.h", "OpenAL.h", "al.h", "OpenAL.tbd", "IOUSBHost.tbd", "IOUSBHostCIEndpointStateMachine.h", "IOUSBHostCIControllerStateMachine.h", "IOUSBHost.h", "IOUSBHostCIPortStateMachine.h", "IOUSBHostCIDeviceStateMachine.h", "IOUSBHostControllerInterfaceHelpers.h", "IOUSBHostDevice.h", "IOUSBHostControllerInterface.h", "IOUSBHostDefinitions.h", "IOUSBHostInterface.h", "IOUSBHostIOSource.h", "AppleUSBDescriptorParsing.h", "IOUSBHostStream.h", "IOUSBHostObject.h", "IOUSBHostControllerInterfaceDefinitions.h", "IOUSBHostPipe.h", "IOBluetoothUIUserLib.h", "IOBluetoothUI.h", "IOBluetoothObjectPushUIController.h", "IOBluetoothDeviceSelectorController.h", "IOBluetoothPasskeyDisplay.h", "IOBluetoothPairingController.h", "IOBluetoothServiceBrowserController.h", "IOBluetoothUI.tbd", "Bluetooth.h", "IOBluetooth.h", "BluetoothAssignedNumbers.h", "IOBluetoothTypes.h", "IOBluetoothUtilities.h", "OBEXBluetooth.h", "IOBluetoothUserLib.h", "OBEX.h", "IOBluetooth.tbd", "INImage+IntentsUI.h", "IntentsUI.h", "INUIAddVoiceShortcutButton.h", "IntentsUI.apinotes", "INUIEditVoiceShortcutViewController.h", "INUIAddVoiceShortcutViewController.h", "LDAP.tbd", "OSvKernDSPLib.h", "cpu.h", "asm_help.h", "desc.h", "pio.h", "io.h", "sel.h", "reg_help.h", "tss.h", "table.h", "byte_order.h", "_limits.h", "_types.h", "_mcontext.h", "_param.h", "_endian.h", "arch.h", "cpuid_internal.h", "cpu_capabilities_public.h", "arm_features.inc", "endian.h", "locks.h", "limits.h", "atomic.h", "machine_cpuid.h", "memory_types.h", "pal_routines.h", "machine_routines.h", "param.h", "cpuid.h", "thread.h", "trap.h", "vmparam.h", "signal.h", "types.h", "AFKMemoryDescriptorOptions.h", "machine_machdep.h", "atm_types.h", "copyio.h", "_OSByteOrder.h", "crc.h", "Block.h", "OSBase.h", "OSByteOrder.h", "OSDebug.h", "OSMalloc.h", "OSAtomic.h", "OSReturn.h", "OSKextLib.h", "OSTypes.h", "version.h", "sysctl.h", "tree.h", "zconf.h", "zlib.h", "libkern.h", "kdp_callout.h", "kdp_en_debugger.h", "ipc_types.h", "krpc.h", "rpcv2.h", "xdr_subs.h", "nfs.h", "nfsproto.h", "bootp.h", "if_ether.h", "icmp6.h", "icmp_var.h", "igmp_var.h", "igmp.h", "in_pcb.h", "in_stat.h", "in_private.h", "in_arp.h", "in_var.h", "in_systm.h", "ip_var.h", "ip_icmp.h", "kpi_ipfilter.h", "ip6.h", "tcp_private.h", "ip.h", "tcp_timer.h", "tcp_fsm.h", "udp_var.h", "tcp_seq.h", "tcpip.h", "udp.h", "tcp_var.h", "tcp.h", "IOPCIFamilyDefinitions.h", "IOPCIDevice.iig", "PCIDriverKit.h", "IOPCIDevice.h", "audit_ioctl.h", "stdarg.h", "stdatomic.h", "stdbool.h", "stddef.h", "string.h", "stdint.h", "ptrauth.h", "math.h", "monotonic.h", "static_if.h", "machine_kpc.h", "machine_remote_time.h", "ipc_pthread_priority_types.h", "lz4_assembly_select.h", "vm_compressor_algorithms.h", "lz4.h", "pmap.h", "vm_dyld_pager.h", "vm_far.h", "vm_fault.h", "vm_map.h", "lz4_constants.h", "vm_options.h", "vm_pageout.h", "vm_memtag.h", "vm_shared_region.h", "vm_kern.h", "vfs_support.h", "vecLib.h", "vecLibTypes.h", "vBasicOps.h", "vForce.h", "vDSP.h", "uuid.h", "UNDReply.defs", "UNDRequest.defs", "KUNCUserNotifications.h", "UNDTypes.defs", "UNDTypes.h", "TargetConditionals.h", "apfs_boot_mount.tbd", "av.h", "cop.h", "bitcount.h", "cv.h", "ebcdic_tables.h", "EXTERN.h", "embedvar.h", "fakesdio.h", "feature.h", "form.h", "gv.h", "git_version.h", "dosish.h", "hv_macro.h", "hv_func.h", "config.h", "INTERN.h", "handy.h", "intrpvar.h", "invlist_inline.h", "hv.h", "iperlsys.h", "keywords.h", "libperl.tbd", "embed.h", "l1_char_class_tab.h", "mg_data.h", "mg_raw.h", "mg.h", "mg_vtable.h", "mydtrace.h", "nostdio.h", "op_reg_common.h", "op.h", "opcode.h", "inline.h", "overload.h", "opnames.h", "parser.h", "malloc_ctl.h", "pad.h", "perl_inc_macro.h", "perl_langinfo.h", "perl_siphash.h", "patchlevel.h", "perlapi.h", "metaconfig.h", "perlio.h", "perldtrace.h", "perliol.h", "perlvars.h", "perlsdio.h", "pp_proto.h", "perly.h", "pp.h", "reentr.h", "regcomp.h", "perl.h", "regexp.h", "scope.h", "sbox32_hash.h", "time64_config.h", "time64.h", "sv.h", "unixish.h", "uconfig.h", "utfebcdic.h", "unicode_constants.h", "utf8.h", "regnodes.h", "util.h", "vutil.h", "uudmap.h", "warnings.h", "XSUB.h", "zaphod32_hash.h", "encode.h", "python-3.9.pc", "python-3.9-embed.pc", "python3-embed.pc", "python3.pc", "AFKUser.tbd", "AdID.tbd", "Admin.tbd", "AirPlayReceiver.tbd", "AppSandbox.tbd", "ASEProcessing.tbd", "AuthenticationServicesCore.tbd", "WebGPU.tbd", "WebDriver.tbd", "MapKit.tbd", "SwiftUI.swiftoverlay", "WebKit.tbd", "WebKit.apinotes", "WKBackForwardList.h", "NSAttributedString.h", "WebKit.h", "WKBackForwardListItem.h", "WKContentRuleList.h", "WKContentRuleListStore.h", "WKContextMenuElementInfo.h", "WKDataDetectorTypes.h", "WKContentWorld.h", "WKError.h", "WKFoundation.h", "WKFindResult.h", "WKHTTPCookieStore.h", "WKFrameInfo.h", "WKNavigation.h", "WKFindConfiguration.h", "WKNavigationDelegate.h", "WKNavigationResponse.h", "WKOpenPanelParameters.h", "WebKitLegacy.h", "WKPreviewActionItem.h", "WKNavigationAction.h", "WKPreferences.h", "WKPreviewActionItemIdentifiers.h", "WKPreviewElementInfo.h", "WKProcessPool.h", "WKDownload.h", "WKPDFConfiguration.h", "WKScriptMessage.h", "WKSecurityOrigin.h", "WKScriptMessageHandler.h", "WKSnapshotConfiguration.h", "WKUIDelegate.h", "WKURLSchemeTask.h", "WKWebpagePreferences.h", "WKUserContentController.h", "WKWebsiteDataStore.h", "WKWebsiteDataRecord.h", "WKUserScript.h", "WKURLSchemeHandler.h", "WKWebViewConfiguration.h", "WKWebView.h", "WKScriptMessageHandlerWithReply.h", "WKWindowFeatures.h", "WKDownloadDelegate.h", "ASAccountAuthenticationModificationController.h", "ASAccountAuthenticationModificationViewController.h", "ASAuthorization.h", "ASAuthorizationAppleIDButton.h", "ASAccountAuthenticationModificationRequest.h", "ASAuthorizationAppleIDProvider.h", "ASAuthorizationAppleIDRequest.h", "ASAuthorizationAppleIDCredential.h", "ASAuthorizationController.h", "ASAuthorizationCredential.h", "ASAccountAuthenticationModificationExtensionContext.h", "ASAuthorizationError.h", "ASAuthorizationCustomMethod.h", "ASAuthorizationPasswordRequest.h", "ASAuthorizationOpenIDRequest.h", "ASAuthorizationPlatformPublicKeyCredentialDescriptor.h", "ASAuthorizationPlatformPublicKeyCredentialProvider.h", "ASAccountAuthenticationModificationReplacePasswordWithSignInWithAppleRequest.h", "ASAccountAuthenticationModificationUpgradePasswordToStrongPasswordRequest.h", "ASAuthorizationPlatformPublicKeyCredentialRegistrationRequest.h", "ASAuthorizationPlatformPublicKeyCredentialRegistration.h", "ASAuthorizationProvider.h", "ASAuthorizationPlatformPublicKeyCredentialAssertion.h", "ASAuthorizationPublicKeyCredentialAssertion.h", "ASAuthorizationPublicKeyCredentialAssertionRequest.h", "ASAuthorizationPublicKeyCredentialConstants.h", "ASAuthorizationProviderExtensionAuthorizationResult.h", "ASAuthorizationPublicKeyCredentialDescriptor.h", "ASAuthorizationPublicKeyCredentialLargeBlobAssertionOutput.h", "ASAuthorizationPasswordProvider.h", "ASAuthorizationPublicKeyCredentialLargeBlobRegistrationInput.h", "ASAuthorizationPublicKeyCredentialParameters.h", "ASAuthorizationPublicKeyCredentialLargeBlobRegistrationOutput.h", "ASAuthorizationPublicKeyCredentialRegistration.h", "ASAuthorizationPublicKeyCredentialRegistrationRequest.h", "ASAuthorizationPublicKeyCredentialLargeBlobAssertionInput.h", "ASAuthorizationSecurityKeyPublicKeyCredentialAssertion.h", "ASAuthorizationRequest.h", "ASAuthorizationPlatformPublicKeyCredentialAssertionRequest.h", "ASAuthorizationSecurityKeyPublicKeyCredentialProvider.h", "ASAuthorizationSingleSignOnCredential.h", "ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor.h", "ASAuthorizationSecurityKeyPublicKeyCredentialAssertionRequest.h", "ASAuthorizationSecurityKeyPublicKeyCredentialRegistration.h", "ASAuthorizationSingleSignOnProvider.h", "ASAuthorizationWebBrowserExternallyAuthenticatableRequest.h", "ASAuthorizationWebBrowserPlatformPublicKeyCredentialAssertionRequest.h", "ASAuthorizationWebBrowserPlatformPublicKeyCredentialRegistrationRequest.h", "ASAuthorizationWebBrowserPublicKeyCredentialManager.h", "ASAuthorizationWebBrowserPlatformPublicKeyCredential.h", "ASAuthorizationWebBrowserSecurityKeyPublicKeyCredentialAssertionRequest.h", "ASAuthorizationWebBrowserSecurityKeyPublicKeyCredentialRegistrationRequest.h", "ASCOSEConstants.h", "ASCredentialIdentity.h", "ASAuthorizationSingleSignOnRequest.h", "ASCredentialIdentityStore.h", "ASAuthorizationWebBrowserSecurityKeyPublicKeyCredentialProvider.h", "ASCredentialProviderExtensionContext.h", "ASCredentialProviderViewController.h", "ASAuthorizationSecurityKeyPublicKeyCredentialRegistrationRequest.h", "ASCredentialServiceIdentifier.h", "ASExtensionErrors.h", "ASAuthorizationProviderExtensionAuthorizationRequest.h", "ASCredentialRequest.h", "ASAuthorizationWebBrowserPlatformPublicKeyCredentialProvider.h", "ASPasskeyAssertionCredential.h", "ASPasskeyCredentialRequest.h", "ASPasskeyCredentialRequestParameters.h", "ASCredentialIdentityStoreState.h", "ASPasskeyRegistrationCredential.h", "ASPasswordCredential.h", "ASPublicKeyCredential.h", "ASPasskeyCredentialIdentity.h", "ASPublicKeyCredentialClientData.h", "ASSettingsHelper.h", "ASWebAuthenticationSessionCallback.h", "ASWebAuthenticationSession.h", "ASWebAuthenticationSessionRequest.h", "ASWebAuthenticationSessionWebBrowserSessionManager.h", "AuthenticationServices.h", "ASFoundation.h", "AuthenticationServices.apinotes", "ASWebAuthenticationSessionWebBrowserSessionHandling.h", "ASPasswordCredentialIdentity.h", "ASPasswordCredentialRequest.h", "GameKit.apinotes", "GKAccessPoint.h", "GameKit.h", "GKAchievement.h", "GKAchievementViewController.h", "GKBasePlayer.h", "GKAchievementDescription.h", "GKChallengeEventHandler.h", "GKCloudPlayer.h", "GKChallengesViewController.h", "GKChallenge.h", "GKDefines.h", "GKError.h", "GKEventListener.h", "GKFriendRequestComposeViewController.h", "GKDialogController.h", "GKGameSessionEventListener.h", "GKGameSessionError.h", "GKGameCenterViewController.h", "GKGameSessionSharingViewController.h", "GKLeaderboardEntry.h", "GKLeaderboard.h", "GKLeaderboardScore.h", "GKGameSession.h", "GKLeaderboardSet.h", "GKLocalPlayer.h", "GKLeaderboardViewController.h", "GKMatch.h", "GKMatchmaker.h", "GKMatchmakerViewController.h", "GKPeerPickerController.h", "GKNotificationBanner.h", "GKPublicConstants.h", "GKPlayer.h", "GKPublicProtocols.h", "GKSavedGameListener.h", "GKScore.h", "GKSessionError.h", "GKVoiceChat.h", "GKTurnBasedMatchmakerViewController.h", "GKSession.h", "GKTurnBasedMatch.h", "GKSavedGame.h", "GKVoiceChatService.h" ], "public": 1, "adversary": "Turla Group, FIN7, APT34, APT28, DragonForce Malaysia Hacker Group, Indonesia Islamic Warriors Counc", "targeted_countries": [ "United States of America", "India", "Australia" ], "malware_families": [ { "id": "OSAtomic", "display_name": "OSAtomic", "target": null }, { "id": "OSReturn", "display_name": "OSReturn", "target": null }, { "id": "Ver", "display_name": "Ver", "target": null }, { "id": "Internet", "display_name": "Internet", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 39, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1968, "domain": 526, "FileHash-SHA256": 207, "hostname": 972, "email": 55, "FileHash-SHA1": 9, "FileHash-MD5": 4, "CVE": 2, "CIDR": 10 }, "indicator_count": 3753, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66f9ae71e7d4851280fa367f", "name": "The Jane Doe Syndrome Files: Credential Dumping and Data Exfiltration", "description": "This pulse outlines a series of techniques (Tactics) utilized in a cyber intrusion targeting Jane Doe's MacBook. These techniques span various stages of the attack lifecycle, including credential dumping (T1003), system discovery (T1016, T1082), and data exfiltration methods (T1114, T1560). The attacker employed advanced obfuscation strategies (T1027) and input capture methods (T1056) to maintain persistence and evade detection, while also utilizing command and scripting interpreters (T1059) to execute malicious commands.\n\nFurthermore, the adversary manipulated system tokens (T1134) and leveraged remote access software (T1219) to control the compromised system. Techniques for data destruction (T1485) and artifact hiding (T1564) indicate a concerted effort to cover tracks and minimize detection.\n\nBy examining these techniques, we can better understand the methods used in this intrusion, facilitating enhanced detection and prevention strategies for future incidents.", "modified": "2024-11-08T00:03:35.782000", "created": "2024-09-29T19:45:53.583000", "tags": [ "autogenerated", "please", "class", "hp laserjet", "duplexer", "modify", "printer", "description", "location", "share", "printer make", "ppd file", "model", "driver", "ipp everywhere", "printers", "hardware", "baud rate", "parity", "odd data", "flow control", "software", "rtscts", "dtrdsr", "input", "type", "name", "value", "hidden", "delete class", "form", "h2 class", "warning", "p align", "allow", "advanced", "use kerberos", "save", "max clients", "maximum", "metadata", "documents", "max log", "img src", "width", "height", "align", "absmiddle", "indicator", "status", "printername", "idle", "edit", "cupsdconf", "error", "blockquote", "unknown", "h3 class", "jobs", "help jobs", "helptitle", "qtext", "topic", "bmtext", "qptext", "cups", "search", "online help", "documents all", "hold job", "server default", "shared", "test page", "pause class", "accept jobs", "move all", "jobs cancel", "all jobs", "class delete", "cancel", "move job", "destination", "release", "reprint", "action", "method", "name user", "size pages", "state control", "jobid", "withheld", "held", "change settings", "label", "input type", "select name", "multiple size", "option", "inches feet", "table", "submit", "set default", "prev", "next", "last", "accept", "options", "default", "delete printer", "form action", "pause", "reject", "resume", "print", "self test", "pause printer", "location make", "model status", "test", "please stand", "allowed users", "prevent", "whichjobs", "standard rom", "standard", "copyright", "standard font", "cups ppd", "easy software", "apache license", "license", "symbol special", "deskjet", "cups sample", "hplaserjet", "laserjet", "hpdeskjet", "hpdeskjet2", "epson", "stylus color", "stylus photo", "escp", "epson9pin", "zebra", "dymo3x0", "dymo", "labelwriter", "advance", "leading", "move", "black", "gold", "rotate", "never", "cyan", "yellow", "turn", "long edge", "edge", "oversize", "address", "b1jis b1", "adobe", "small", "image", "apple mime", "xhtml", "pict string", "cgimageio", "radiance", "fujifilm", "preview", "os x", "colorsync", "airprint", "do not", "this file", "it is", "you install", "versions of", "base mime", "format", "postscript", "language", "pattern match", "ras2", "pwgraster", "comment", "attr", "group", "attr language", "attr integer", "attr name", "attributes", "attr keyword", "post", "resource admin", "operation", "group operation", "create", "withvalue", "display", "d recipienturi", "expect", "tv d", "member", "createjob", "senddocument", "create faxout", "get list", "display jobname", "cupsgetdevices", "get job", "expect jobstate", "job template", "get printer", "cupsgetppd", "cupsgetppds", "get ppd", "attr text", "product", "psversion", "version", "message", "hello", "cupsgetprinters", "beep", "sound", "count", "ingroup", "oftype keyword", "oftype integer", "oftype text", "oftype charset", "oftype enum", "az09", "withallvalues", "mediaregex", "oftype", "print file", "printjob", "test printjob", "file", "ippurischeme", "member integer", "print test", "printuri", "post resource", "validatejob", "validate", "printjob group", "repeatmatch", "choice", "envelope", "resolution", "modelname", "inputslot", "pcfilename", "modelnumber", "attribute", "false", "darkness", "media", "generic", "mark", "dark", "tear", "cupsbanner show", "header printer", "footer printer", "notice cups", "header cover", "page footer", "cover page", "header top", "secret footer", "top secret", "header secret", "footer secret", "vzefibootloader", "nsunavailable", "virtualization", "base class", "vzbootloader", "network device", "initialize", "host network", "property", "return", "define", "nsarray", "bsd name", "ethernet", "vzconsoledevice", "console port", "defines", "a directory", "vzexport extern", "apiavailable", "bool", "nsenum", "nsinteger", "local file", "raw format", "nsurl", "nserror", "file handle", "storage device", "nserror error", "nsfilehandle", "boot loader", "efi rom", "efi boot", "vzerrorcode", "vzerrordomain", "error type", "nserror domain", "vzerrorsave", "nbd server", "nbd client", "nsoptions", "nsuinteger", "nsswiftname", "nvram", "write", "sorcvbuf", "sosndbuf", "mtu value", "data", "data sent", "true", "graphics", "intel", "indicate", "enable", "nsdata", "opaque", "host audio", "host output", "host input", "cgsize", "new display", "protocol", "unix domain", "socket", "rosetta", "caching", "rosetta daemon", "nsstring", "abstract socket", "rosetta support", "linux", "arm64", "availability", "download", "vzmacaddress", "mac address", "a vzmacaddress", "linux kernel", "ram disk", "linux boot", "a mac", "configuration", "mac hardware", "describes", "mac platform", "mac keyboard", "usb keyboard", "mac machine", "apple silicon", "rosetta runtime", "nsobject", "handle", "init", "url property", "whether", "recovery", "block", "nullable", "load", "mac trackpad", "usb pointing", "cpus", "overwrite", "nsdictionary", "directory share", "check", "namemax", "vznetworkdevice", "nbd url", "nbd uniform", "nbd protocol", "url error", "nat attachment", "a network", "nvm express", "nsscreen", "nssize", "serial port", "directory", "spice agent", "spice guest", "a console", "vzsocketdevice", "vzstoragedevice", "vzexport", "usb controller", "vzusbcontroller", "usb device", "device uuid", "nsuuid uuid", "usb mass", "vzusbdevice", "virtio block", "device", "storage storage", "virtio console", "delegate object", "a class", "extra care", "virtio entropy", "nsstring name", "array", "virtio file", "system device", "discussion", "nsstring tag", "port", "bool isconsole", "a virtio", "virtio graphics", "virtio gpu", "virtio", "port array", "utf8", "virtio network", "macaddress", "virtio socket", "close", "does nothing", "virtio sound", "nsarray streams", "pointer", "device input", "a pcm", "audio stream", "source", "sink", "device output", "device stream", "memory balloon", "target memory", "return yes", "start", "stop", "usb xhci", "automatically", "nsview", "virtual machine", "cpucount", "verify", "apple swift", "o librarylevel", "swift", "cachingoptions", "vzaudiodevice", "vzdebugstub", "swiftname", "targetosiphone", "targetososx", "targetosios", "apple computer", "targetostv", "targetosvision", "targetostvos", "targetosxr", "vtbaseh", "vtint32point", "vtint32size", "iphonena", "apiunavailable", "vtexport const", "abstract", "cfstringref", "readwrite", "cfnumber", "cfboolean", "optional", "null", "macos", "cmnullable", "pass null", "call", "video toolbox", "contains", "cmtime duration", "cvimagebuffer", "vterrorsh", "cfoptions", "12914", "uint32", "osstatus", "12900", "12901", "12902", "12903", "17690", "vtexport", "encoder", "zero", "alpha", "requires", "cmsamplebuffer", "prototype", "osstatus status", "cfrelease", "cvpixelbuffer", "iosurface", "hdr metadata", "hdr per", "frame metadata", "cf type", "cfretain", "a mechanism", "cmbridgedtype", "interface", "specifies", "a reference", "pixel rotation", "session", "a pixel", "cf object", "vtframesilo", "returns", "vtframesiloh", "vtframesiloref", "pass", "pixel transfer", "vtexport void", "media extension", "video raw", "processors", "standard video", "metal device", "metal", "rawprocessors", "cfstring", "copy", "vtsessionh", "cfdictionaryref", "apis", "vtsessionref", "raw processor", "a cfdictionary", "cfswiftname", "vtutilitiesh", "cgimage", "builds", "cfarrayref", "raw processing", "list", "list element", "cfdictionaries", "skipper", "vdspdftexecute", "vdspdftexecuted", "vdspdftzop", "vdspfft16copv", "vdspfft16zopv", "vdspfft32copv", "vdspfft32zopv", "vdspbiquad", "vdspbiquadd", "vdspbiquadm", "project version", "created", "elana stettin", "apple", "swextern", "title", "typedef", "param", "nsstring title", "represents", "nsitemprovider", "const", "swhidden extern", "swdefines", "swextern extern", "sha256 hash", "merkle tree", "sociallayer", "swperson", "devin clary", "swaction", "sbappcontext", "sbapplocator", "sbapplication", "sbelementarray", "sbobject", "scriptingbridge", "objecttype", "finder", "bridge", "index", "apple event", "target", "urls", "locator", "scripting", "desctype", "receiver", "track", "code", "sccontentfilter", "bgra format", "rgha format", "const nonnull", "nserrorenum", "nsurl outputurl", "avfiletypempeg4", "provides", "scwindow", "scdisplay", "cgrect frame", "bool indicating", "pixel", "scstream", "control center", "takes", "cfdictionary", "rbhash", "initvmrandom", "initvmtranscode", "initarray", "initbarevm", "initbignum", "initcomplex", "initcont", "initdir", "initfile", "libxml", "require", "cfpropertylist", "xml parser", "libxmlparser", "xml file", "plist", "cfplisterror", "exception", "format error", "easy", "kruse", "mit license", "standarderror", "cfformaterror", "cftypeerror", "nokogiri", "parserinterface", "cftype", "cfdate", "cfinteger", "blob", "ruby string", "uidfixnum", "ruby integer", "date", "format constant", "formatbinary", "formatxml", "magicnumber", "enumerator", "cfdata", "ruby", "example", "john", "path", "plainparser", "ascii", "cfreal", "importplain", "escapechar", "read", "length", "utf16be", "cfarray", "offsetsize", "integer", "rexml", "rexmlparser", "float", "appledtd plist", "dom node", "prefix", "config", "item", "bindir", "libruby", "rubypath", "fileoperations", "arch", "installer", "template", "install", "major", "yesno", "todo", "kwargs", "makefiles", "miniportile", "cmakecmd", "configure", "cmakefile", "cmake", "keyringname", "debug", "targetos", "ldflags", "gpgexe", "digest", "stdout", "patch", "installerror", "savefile", "task", "packages", "dlext", "minero aoki", "rubyversion", "loaderror", "sqlite3", "was sqlite3", "apiobjects", "database", "pragmas", "resultset", "sqlite3ruby faq", "sqliteruby faq", "value klass", "qnil", "sqliteok", "sqliteerror", "sqliteinternal", "sqliteperm", "sqliteabort", "sqlitebusy", "sqlitelocked", "datagetstruct", "int2num", "main", "done", "stringvalueptr", "note", "sqlite3ruby", "sqlite3rubyptr", "unused", "gnuc", "lclint", "usasciip", "utf8p", "utf16lep", "utf16le", "utf16bep", "sqlite3stmtruby", "rubyplatform", "darwin", "rcarchs", "libpkgconfig", "pkgconfigpath", "pkgconf", "mswin", "cflags", "install sqlite3", "int2fix", "rbignumlen", "sizeofbdigits", "charbit", "bdigit", "bmax", "value unused", "sqliteopenuri", "open", "requireopendb", "nilp", "qtrue", "id2sym", "requireopenstmt", "donep", "rstringlen", "num2int", "attrs", "deal", "xsd module", "xmlparser", "nokogiri xml", "simply", "rubyengine", "slop decorator", "css3 selector", "xpath", "nokogiri class", "parse", "html", "xml document", "0x30", "0x41", "0x61", "gumbogentable", "gumboasciicntrl", "gumboasciispace", "gumboasciidigit", "constfn", "gumboasciih", "gumboasciialpha", "gumboasciialnum", "c0 control", "gumbocharrefh", "gumboattributeh", "gumboattribute", "craig barnes", "google inc", "as is", "basis", "or conditions", "any kind", "gumboerrorh", "gumbotag", "additional", "gumbovector", "encoding", "gumboerrparser", "gumboerrortype", "html tag", "minwordlength", "maxwordlength", "maxhashvalue", "ansic code", "m100 n", "computed", "totalkeywords", "minhashvalue", "doctype", "capacity", "doctype system", "sourcelength", "sourcetext", "silence", "html5", "a struct", "text", "gumbo", "gumboh", "anything", "gumboparserh", "output", "library", "oopstyle", "gumboparser", "const localname", "string", "ietfdtd html", "w3cdtd html", "level", "html strict", "terminator", "final", "buffer", "gnucatleast", "hasattribute", "macrosh", "printf", "returnsnonnull", "win32", "unusedifndebug", "malloc", "pure", "m100", "gumbotaglookuph", "gumbotag tag", "taghashslot", "gumbotagunknown", "gumbotokentypeh", "gumbotokencdata", "gumbotokennull", "gumbotokeneof", "gumbotokentype", "gumbotaglast", "position", "gumbotokenizerh", "struct", "gumbotoken", "spec", "stack", "emittoken", "continue", "current", "utf8iterator", "utf8accept", "parser", "html5 spec", "rest", "gumboutf8h", "unicode code", "html5 parser", "utf8 decoding", "func", "gumbodebug", "gumboutilh", "utility", "debug wrapper", "script", "attribute value", "comment end", "doctype name", "cdata section", "rcdata end", "rawtext end", "initialcapacity", "gumboalloc", "vector", "memmove", "gumbovectorh", "initializes", "ownership", "stringvaluecstr", "rtest", "xmlchar", "html document", "nokogiristrnew2", "html4", "value get", "qfalse", "a list", "value list", "attrsdepr", "attrsopt", "chunk", "pushparser", "xmlsax", "value chunk", "w3c dom", "xmlelementnode", "finds", "qundef", "value val", "value args", "value exc", "libxml2patches", "rbconfig", "packagerootdir", "cppflags", "libs", "dldflags", "nokogiri test", "attributedecl", "defaultvalue", "atype", "tree", "ctxt", "noreturn", "xmldocptr doc", "private", "nokogirinative", "nokogiristrnew", "xmldoc", "value setvalue", "value content", "xmlchar value", "xmlnode cur", "content", "cdata", "cdata element", "value argv", "value rbnode", "document", "value document", "value getname", "pcdata", "element", "mult", "datawrapstruct", "value ctxtval", "mydoc", "userdata", "encodinghandler", "value key", "delete", "elementdecl", "id iddocument", "etype", "value prefix", "orig", "externalid", "systemid", "nodenr", "xmlnodeset", "nodeset", "nodetab", "xmldtd", "value hash", "publicid", "notation", "hash", "rbfuncall", "parseargs", "xmlnode", "without", "href", "xmlns", "namespace node", "nodes", "value rbreader", "relaxng schema", "relaxng", "value name", "nokogirisaxself", "rbivget", "rbstrorqnil", "xmlchar name", "xmlparserctxt", "text element", "value string", "schema", "xmlschema", "context", "stringval", "wrapper", "emp0001n", "emp0002n", "xslt", "handler", "handlerstate", "checktype", "tarray", "id documentid", "comment element", "node", "first", "prop", "typeerror", "gc", "pkpublicchannel", "pkpushpayload", "pkpushregistry", "pkpushtypevoip", "pushkit", "object", "pkpushtype type", "forward", "http", "apple push", "pkexport extern", "nsstringenum", "payload data", "voip", "json format", "callkit", "pkpushtype", "framework", "apps", "push", "odsessioncreate", "odattributemap", "odconfiguration", "odcontext", "odmappings", "odmoduleentry", "odnode", "odquery", "odrecord", "odrecordmap", "nsavailablemac", "original code", "nsstring value", "custom", "modifications", "apple public", "source license", "of any", "nsavailable", "nsrunloop", "objc", "sets", "odsession", "sfauthorization", "will", "odsessionref", "cfexport", "odqueryref", "odnoderef", "cfexport bool", "odrecordref", "cfdataref", "cfexport const", "utf8 encoding", "odattributetype", "odrecordtype", "attribute type", "local", "realm", "cftyperef", "odnodegetdsref", "odnodegettypeid", "odrecorddelete", "odtriggercancel", "odnodeinit", "odquerycreate", "odqueryinit", "odsessioninit", "albuffer3i", "albufferdata", "albufferf", "albufferfv", "albufferi", "albufferiv", "aldistancemodel", "aldopplerfactor", "algetbooleanv", "algetbuffer3f", "alcapi", "alcapientry", "alcboolean", "targetosmac", "alcdevice", "alcenum param", "alalch", "alcchar", "alcsizei", "capture", "alenum param", "alapi", "aluint sid", "alfloat", "aluint bid", "alsizei", "alint", "alfloat value", "alapientry", "aluint", "play", "speed", "bits", "alutapi alvoid", "alvoid data", "alsizei size", "alsizei freq", "gnu library", "general public", "aluth", "alenum format", "openalopenalh", "umbrella header", "alvoid", "openal", "alvoid nonnull", "alenum", "roger beep", "sendable", "preconcurrency", "rawvalue", "network import", "failure", "service", "must", "number", "stride", "brief", "descriptor", "matrix", "mtlpackedfloat3", "infinity", "metalversion", "minimum point", "maximum point", "interpolation", "translation", "offset", "acceleration", "declare", "prior", "insert", "nonnull", "nsrange", "mtldevice", "t argname", "mtlstructtype", "mtlarraytype", "mtltype", "mtlpointertype", "instance", "methodkind", "swiftprivate", "mtlbuffer", "nullability", "mtlcommandqueue", "mtlresource", "mtlresidencyset", "command encoder", "individual", "mtlexport", "xcode", "gpu trace", "apideprecated", "mtlcapturescope", "remarks", "mtlallocation", "metal command", "mtldispatchtype", "mtlorigin", "mtlsize", "mtlblitoption", "flush", "gpu work", "marks", "specify", "mtlinline", "mtlintern", "stdcversion", "mtlextern", "definition", "inline", "nsstring label", "stencil", "defaults", "allocate", "typical", "nsprocessinfo", "mtldrawable", "present", "cftimeinterval", "gpustarttime", "gpuendtime", "mtlcountersh", "mtlcounter", "mtlcounterset", "mtllibrary", "a container", "mtlfence", "mtldatatype", "default usage", "mtlfunction", "mtllogcontainer", "mtlsharedevent", "mtlevent", "synchronously", "a function", "cpu cache", "requiredsize", "behavior", "mtlheap", "query device", "dispatch", "metal shading", "language guide", "raytriangle", "vends", "groups", "encodes", "mtliofilehandle", "mtlextern sizet", "mtlextern void", "mtlstoreaction", "mtlloglevel", "enum", "mtlmutability", "astcetc2bc", "normal", "astc", "clamptoedge", "depth", "mtlcoordinate2d", "nsnumber", "controls", "mtlclearcolor", "adds", "mtlregion", "cpu mapping", "mtltexture", "mtlindextype", "filter option", "clamp", "mtlrenderstages", "draw", "mtlstepfunction", "vertex", "compute", "gpu resource", "nsuinteger x", "identify", "nsuinteger y", "nsuinteger z", "mtlsize size", "mtlvertexformat", "nsuintegermax", "mtlpixelformat", "mtltexturetype", "slice", "swiftui", "coregraphics", "swift import", "previewregistry", "libraryitem", "category", "dict", "apple root", "code signing", "public", "uus10u", "GUANGZHOU FIVE SIX TECHNOLOGY", "Havana Syndrome", "Aishah Lazim", "Al-Arqam", "Brooklyn" ], "references": [ "httpd.exp", "metadata.json", "add-class.tmpl", "choose-make.tmpl", "choose-model.tmpl", "choose-device.tmpl", "add-printer.tmpl", "choose-serial.tmpl", "class-added.tmpl", "choose-uri.tmpl", "class-confirm.tmpl", "admin.tmpl", "class-deleted.tmpl", "class-modified.tmpl", "classes-header.tmpl", "command.tmpl", "classes.tmpl", "edit-config.tmpl", "error-op.tmpl", "class-jobs-header.tmpl", "error.tmpl", "header.tmpl", "help-header.tmpl", "help-printable.tmpl", "help-trailer.tmpl", "job-hold.tmpl", "class.tmpl", "job-cancel.tmpl", "job-move.tmpl", "job-moved.tmpl", "job-release.tmpl", "job-restart.tmpl", "list-available-printers.tmpl", "jobs.tmpl", "norestart.tmpl", "option-boolean.tmpl", "option-header.tmpl", "option-conflict.tmpl", "option-pickmany.tmpl", "option-pickone.tmpl", "modify-printer.tmpl", "option-trailer.tmpl", "pager.tmpl", "printer-cancel-jobs.tmpl", "printer-added.tmpl", "printer-accept.tmpl", "printer-configured.tmpl", "printer-default.tmpl", "printer-confirm.tmpl", "printer-deleted.tmpl", "printer-jobs-header.tmpl", "printer-modified.tmpl", "jobs-header.tmpl", "printer-stop.tmpl", "modify-class.tmpl", "printer-reject.tmpl", "printers-header.tmpl", "printer-start.tmpl", "printer.tmpl", "printers.tmpl", "set-printer-options-trailer.tmpl", "test-page.tmpl", "restart.tmpl", "users.tmpl", "set-printer-options-header.tmpl", "search.tmpl", "trailer.tmpl", "font.defs", "hp.h", "epson.h", "label.h", "raster.defs", "media.defs", "apple.types", "apple.convs", "mime.convs", "mime.types", "cancel-current-job.test", "create-job-sheets.test", "create-job.test", "create-job-format.test", "create-job-timeout.test", "create-printer-subscription.test", "cups-create-local-printer.test", "fax-job.test", "get-completed-jobs.test", "get-devices.test", "get-job-attributes.test", "get-job-attributes2.test", "get-notifications.test", "get-jobs.test", "get-job-template-attributes.test", "get-ppd-printer.test", "get-ppds-drv-only.test", "get-ppd.test", "get-ppds-make-and-model.test", "get-ppds-make.test", "get-ppds-product.test", "get-ppds-psversion.test", "get-ppds-language.test", "get-printer-description-attributes.test", "get-ppds.test", "get-printer-attributes.test", "get-subscriptions.test", "identify-printer-display.test", "get-printers-printer-id.test", "identify-printer-multiple.test", "get-printers.test", "identify-printer.test", "get-printer-attributes-suite.test", "ipp-2.0.test", "ipp-2.2.test", "ipp-backend.test", "ipp-2.1.test", "print-job-and-wait.test", "print-job-deflate.test", "print-job-hold.test", "print-job-gzip.test", "ipp-1.1.test", "print-job-manual.test", "print-job-password.test", "print-job.test", "print-job-media-col.test", "print-uri.test", "print-job-letter.test", "set-attrs-hold.test", "validate-job.test", "ipp-everywhere.test", "sample.drv", "testprint", "classified", "standard", "topsecret", "secret", "confidential", "unclassified", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "nfs.conf", "nsmb.conf", "xtab", "6015FED9-D723-4332-87D9-C478CF341407.aamdownload", "AuraService-fda-test", "com.adobe.acrobat.rna.AcroCefBrowserLock.DC", "ExmanProcessMutex", "proxy.xml", "A53749AF-3855-4842-A1E7-4AEFA60BD2AC", "XPdb-wal", "VZBootLoader.h", "VZAudioInputStreamSource.h", "VZBridgedNetworkDeviceAttachment.h", "VZAudioOutputStreamSink.h", "VZBridgedNetworkInterface.h", "VZConsoleDeviceConfiguration.h", "VZConsoleDevice.h", "VZConsolePortConfiguration.h", "VZDirectorySharingDevice.h", "VZDirectoryShare.h", "VZDefines.h", "VZDiskImageStorageDeviceAttachment.h", "VZDiskSynchronizationMode.h", "VZDiskBlockDeviceStorageDeviceAttachment.h", "Virtualization.h", "VZDirectorySharingDeviceConfiguration.h", "VZEntropyDeviceConfiguration.h", "VZEFIBootLoader.h", "VZError.h", "VZEFIVariableStore.h", "VZFileHandleNetworkDeviceAttachment.h", "VZFileHandleSerialPortAttachment.h", "VZFileSerialPortAttachment.h", "VZGraphicsDevice.h", "VZGenericPlatformConfiguration.h", "VZGenericMachineIdentifier.h", "VZGraphicsDeviceConfiguration.h", "VZGraphicsDisplayConfiguration.h", "VZHostAudioOutputStreamSink.h", "VZKeyboardConfiguration.h", "VZHostAudioInputStreamSource.h", "VZGraphicsDisplay.h", "VZAudioDeviceConfiguration.h", "VZLinuxRosettaUnixSocketCachingOptions.h", "VZLinuxRosettaAbstractSocketCachingOptions.h", "VZLinuxRosettaDirectoryShare.h", "VZMACAddress.h", "VZLinuxBootLoader.h", "VZMacGraphicsDevice.h", "VZMacGraphicsDisplay.h", "VZMacGraphicsDeviceConfiguration.h", "VZMacHardwareModel.h", "VZMacKeyboardConfiguration.h", "VZMacMachineIdentifier.h", "VZMacOSBootLoader.h", "VZLinuxRosettaCachingOptions.h", "VZMacOSInstaller.h", "VZMacOSVirtualMachineStartOptions.h", "VZMacOSRestoreImage.h", "VZMacTrackpadConfiguration.h", "VZMacOSConfigurationRequirements.h", "VZMemoryBalloonDevice.h", "VZMemoryBalloonDeviceConfiguration.h", "VZMacAuxiliaryStorage.h", "VZMultipleDirectoryShare.h", "VZMacPlatformConfiguration.h", "VZNetworkDevice.h", "VZNetworkBlockDeviceStorageDeviceAttachment.h", "VZNATNetworkDeviceAttachment.h", "VZNetworkDeviceAttachment.h", "VZPlatformConfiguration.h", "VZPointingDeviceConfiguration.h", "VZNetworkDeviceConfiguration.h", "VZSharedDirectory.h", "VZSerialPortAttachment.h", "VZNVMExpressControllerDeviceConfiguration.h", "VZMacGraphicsDisplayConfiguration.h", "VZSerialPortConfiguration.h", "VZSingleDirectoryShare.h", "VZSpiceAgentPortAttachment.h", "VZSocketDeviceConfiguration.h", "VZSocketDevice.h", "VZStorageDevice.h", "VZStorageDeviceAttachment.h", "VZStorageDeviceConfiguration.h", "VZUSBControllerConfiguration.h", "VZUSBDeviceConfiguration.h", "VZUSBMassStorageDevice.h", "VZUSBKeyboardConfiguration.h", "VZUSBController.h", "VZUSBDevice.h", "VZVirtioBlockDeviceConfiguration.h", "VZUSBScreenCoordinatePointingDeviceConfiguration.h", "VZUSBMassStorageDeviceConfiguration.h", "VZVirtioConsoleDevice.h", "VZVirtioConsoleDeviceConfiguration.h", "VZVirtioConsoleDeviceSerialPortConfiguration.h", "VZVirtioEntropyDeviceConfiguration.h", "VZVirtioConsolePort.h", "VZVirtioConsolePortConfigurationArray.h", "VZVirtioFileSystemDevice.h", "VZVirtioConsolePortConfiguration.h", "VZVirtioGraphicsDevice.h", "VZVirtioGraphicsDeviceConfiguration.h", "VZVirtioGraphicsScanout.h", "VZVirtioGraphicsScanoutConfiguration.h", "VZVirtioConsolePortArray.h", "VZVirtioFileSystemDeviceConfiguration.h", "VZVirtioNetworkDeviceConfiguration.h", "VZVirtioSocketConnection.h", "VZVirtioSocketDevice.h", "VZVirtioSoundDeviceConfiguration.h", "VZVirtioSocketListener.h", "VZVirtioSoundDeviceInputStreamConfiguration.h", "VZVirtioSocketDeviceConfiguration.h", "VZVirtioSoundDeviceOutputStreamConfiguration.h", "VZVirtioSoundDeviceStreamConfiguration.h", "VZVirtioTraditionalMemoryBalloonDeviceConfiguration.h", "VZVirtualMachineDelegate.h", "VZVirtualMachineStartOptions.h", "VZVirtioTraditionalMemoryBalloonDevice.h", "VZVirtualMachine.h", "VZXHCIControllerConfiguration.h", "VZVirtualMachineView.h", "VZVirtualMachineConfiguration.h", "VZXHCIController.h", "x86_64-apple-macos.swiftinterface", "arm64e-apple-macos.swiftinterface", "module.modulemap", "Virtualization.tbd", "VideoToolbox.apinotes", "VideoToolbox.h", "VTBase.h", "VTDecompressionProperties.h", "VTCompressionSession.h", "VTErrors.h", "VTCompressionProperties.h", "VTDecompressionSession.h", "VTHDRPerFrameMetadataGenerationSession.h", "VTMultiPassStorage.h", "VTPixelRotationSession.h", "VTFrameSilo.h", "VTPixelRotationProperties.h", "VTPixelTransferSession.h", "VTProfessionalVideoWorkflow.h", "VTRAWProcessingProperties.h", "VTPixelTransferProperties.h", "VTSession.h", "VTUtilities.h", "VTVideoEncoderList.h", "VTRAWProcessingSession.h", "libvDSP.tbd", "SharedWithYouCore.h", "SWAction.h", "SWCollaborationActionHandler.h", "SWCollaborationCoordinator.h", "SWCollaborationMetadata.h", "SWCollaborationOption.h", "SWCollaborationOptionsPickerGroup.h", "SWCollaborationOptionsGroup.h", "SWCollaborationShareOptions.h", "SWDefines.h", "SWPersonIdentity.h", "SWPerson.h", "SWStartCollaborationAction.h", "SWPersonIdentityProof.h", "SWUpdateCollaborationParticipantsAction.h", "SharedWithYouCore.tbd", "ScriptingBridge.tbd", "SBElementArray.h", "ScriptingBridge.apinotes", "ScriptingBridge.h", "SBApplication.h", "SBObject.h", "SCScreenshotManager.h", "SCError.h", "SCRecordingOutput.h", "ScreenCaptureKit.h", "SCShareableContent.h", "SCContentSharingPicker.h", "SCStream.h", "Ruby.tbd", "rbLibXMLParser.rb", "rbCFPlistError.rb", "rbNokogiriParser.rb", "rbCFTypes.rb", "rbCFPropertyList.rb", "rbPlainCFPropertyList.rb", "rbBinaryCFPropertyList.rb", "rbREXMLParser.rb", "cfpropertylist.rb", "setup.rb", "libxml.rb", "xml.rb", "mini_portile_cmake.rb", "version.rb", "mini_portile.rb", "sqlite3.rb", "faq.rb", "exception.c", "backup.h", "backup.c", "database.h", "exception.h", "sqlite3_ruby.h", "statement.h", "extconf.rb", "sqlite3.c", "database.c", "statement.c", "nokogiri.rb", "ascii.c", "ascii.h", "char_ref.h", "attribute.h", "attribute.c", "error.h", "foreign_attrs.c", "insertion_mode.h", "error.c", "gumbo.h", "parser.h", "replacement.h", "parser.c", "string_buffer.h", "string_buffer.c", "string_piece.c", "macros.h", "svg_attrs.c", "tag_lookup.h", "svg_tags.c", "tag_lookup.c", "token_type.h", "tag.c", "token_buffer.h", "token_buffer.c", "tokenizer.h", "tokenizer.c", "utf8.c", "utf8.h", "util.c", "util.h", "tokenizer_states.h", "vector.c", "vector.h", "html4_document.c", "html4_entity_lookup.c", "html4_element_description.c", "html4_sax_push_parser.c", "libxml2_backwards_compat.c", "nokogiri.c", "test_global_handlers.c", "xml_attribute_decl.c", "nokogiri.h", "xml_attr.c", "xml_cdata.c", "xml_document_fragment.c", "xml_document.c", "xml_element_content.c", "html4_sax_parser_context.c", "xml_encoding_handler.c", "xml_element_decl.c", "xml_entity_decl.c", "xml_node_set.c", "xml_dtd.c", "gumbo.c", "xml_namespace.c", "xml_processing_instruction.c", "xml_reader.c", "xml_relax_ng.c", "xml_entity_reference.c", "xml_sax_parser.c", "xml_sax_push_parser.c", "xml_sax_parser_context.c", "xml_text.c", "xml_schema.c", "xml_xpath_context.c", "xslt_stylesheet.c", "xml_syntax_error.c", "xml_comment.c", "xml_node.c", "PushKit.tbd", "PKPushCredentials.h", "PKDefines.h", "PKPushPayload.h", "PushKit.h", "PKPushRegistry.h", "PushKit.apinotes", "OpenDirectory.tbd", "ODAttributeMap.h", "ODMappings.h", "NSOpenDirectory.h", "ODConfiguration.h", "ODQuery.h", "ODNode.h", "OpenDirectory.h", "ODRecordMap.h", "ODSession.h", "ODModuleEntry.h", "ODRecord.h", "CFODContext.h", "CFODSession.h", "CFOpenDirectory.h", "CFODQuery.h", "CFODNode.h", "CFODRecord.h", "CFOpenDirectoryConstants.h", "CFOpenDirectory.tbd", "OpenAL.tbd", "alc.h", "al.h", "alut.h", "OpenAL.h", "MacOSX_OALExtensions.h", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "SwiftUI.swiftoverlay", "MTLAccelerationStructure.h", "Metal.h", "MTLAccelerationStructureTypes.h", "MTLAccelerationStructureCommandEncoder.h", "MTLArgumentEncoder.h", "MTLArgument.h", "MTLBinaryArchive.h", "Metal.apinotes", "MTLBlitPass.h", "MTLBuffer.h", "MTLCaptureManager.h", "MTLCaptureScope.h", "MTLAllocation.h", "MTLCommandEncoder.h", "MTLCommandBuffer.h", "MTLComputePass.h", "MTLBlitCommandEncoder.h", "MTLCommandQueue.h", "MTLDefines.h", "MTLDepthStencil.h", "MTLComputePipeline.h", "MTLDeviceCertification.h", "MTLDrawable.h", "MTLCounters.h", "MTLComputeCommandEncoder.h", "MTLDynamicLibrary.h", "MTLFence.h", "MTLFunctionConstantValues.h", "MTLFunctionDescriptor.h", "MTLFunctionLog.h", "MTLFunctionHandle.h", "MTLEvent.h", "MTLFunctionStitching.h", "MTLHeap.h", "MTLDevice.h", "MTLIndirectCommandBuffer.h", "MTLIntersectionFunctionTable.h", "MTLIOCommandQueue.h", "MTLLinkedFunctions.h", "MTLIOCommandBuffer.h", "MTLIOCompressor.h", "MTLParallelRenderCommandEncoder.h", "MTLLogState.h", "MTLPipeline.h", "MTLLibrary.h", "MTLPixelFormat.h", "MTLRasterizationRate.h", "MTLRenderPass.h", "MTLRenderPipeline.h", "MTLResidencySet.h", "MTLResourceStateCommandEncoder.h", "MTLResourceStatePass.h", "MTLResource.h", "MTLIndirectCommandEncoder.h", "MTLSampler.h", "MTLRenderCommandEncoder.h", "MTLStageInputOutputDescriptor.h", "MTLVisibleFunctionTable.h", "MTLTypes.h", "MTLVertexDescriptor.h", "MTLTexture.h", "WebKit.arm64e.bridgesupport", "WebKit.bridgesupport" ], "public": 1, "adversary": "DragonForce Hacker Group Malaysia", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "VZBootLoader", "display_name": "VZBootLoader", "target": null }, { "id": "TypeError", "display_name": "TypeError", "target": null }, { "id": "GC", "display_name": "GC", "target": null }, { "id": "CFTypeRef", "display_name": "CFTypeRef", "target": null } ], "attack_ids": [ { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1135", "name": "Network Share Discovery", "display_name": "T1135 - Network Share Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1550", "name": "Use Alternate Authentication Material", "display_name": "T1550 - Use Alternate Authentication Material" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 346, "FileHash-SHA256": 272, "domain": 110, "hostname": 101, "email": 1, "CVE": 2, "FileHash-SHA1": 1 }, "indicator_count": 833, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "570 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "references": [ "GCExtendedGamepad.h", "ASAccountAuthenticationModificationRequest.h", "GKGameSessionSharingViewController.h", "get-printer-attributes.test", "ASAuthorizationPasswordProvider.h", "VZMacOSBootLoader.h", "PKDefines.h", "warnings.h", "WKWebsiteDataRecord.h", "ASAuthorizationOpenIDRequest.h", "perl_siphash.h", "lz4_constants.h", "mini_portile.rb", "VTDecompressionSession.h", "get-ppd-printer.test", "VZVirtioTraditionalMemoryBalloonDeviceConfiguration.h", "libvDSP.tbd", "ODAttributeMap.h", "search.tmpl", "GCDevice.h", "token_buffer.c", "pad.h", "PKPushPayload.h", "GCDevicePhysicalInputStateDiff.h", "class.tmpl", "MTLEvent.h", "regcomp.h", "MTLDevice.h", "WKURLSchemeTask.h", "ptrauth.h", "OSDebug.h", "GKSavedGameListener.h", "python3.pc", "vector.c", "hv_func.h", "ASCredentialProviderViewController.h", "zaphod32_hash.h", "GCProductCategories.h", "python-3.9-embed.pc", "VZAudioInputStreamSource.h", "xml_element_content.c", "CFOpenDirectory.tbd", "VTPixelTransferProperties.h", "tcp_seq.h", "vDSP.h", "VZVirtualMachineView.h", "VTCompressionSession.h", "printer.tmpl", "python3-embed.pc", "vm_map.h", "ASAuthorizationPlatformPublicKeyCredentialProvider.h", "Ruby.tbd", "CFODRecord.h", "WebKitLegacy.h", "OSReturn.h", "GCDirectionalGamepad.h", "perldtrace.h", "VZVirtioSoundDeviceOutputStreamConfiguration.h", "CFOpenDirectoryConstants.h", "SWCollaborationOption.h", "font.defs", "ASAuthorizationSecurityKeyPublicKeyCredentialAssertion.h", "MTLCounters.h", "GCInputNames.h", "print-job-letter.test", "arch.h", "command.tmpl", "GCMouse.h", "ipc_pthread_priority_types.h", "bootp.h", "ASAccountAuthenticationModificationController.h", "GCMotion.h", "ASAuthorizationPublicKeyCredentialLargeBlobAssertionOutput.h", "MTLResource.h", "printers.tmpl", "l1_char_class_tab.h", "CFODSession.h", "ASCredentialIdentityStore.h", "GCAxisElement.h", "job-move.tmpl", "VZUSBController.h", "ScriptingBridge.apinotes", "INUIAddVoiceShortcutButton.h", "types.h", "html4_element_description.c", "MTLFunctionConstantValues.h", "ASAuthorizationPublicKeyCredentialRegistrationRequest.h", "patchlevel.h", "IOBluetoothUI.h", "GCPhysicalInputElement.h", "python-3.9.pc", "string.h", "ASAuthorizationSecurityKeyPublicKeyCredentialAssertionRequest.h", "insertion_mode.h", "IOBluetooth.tbd", "GKPeerPickerController.h", "macros.h", "capture_0.bundle.js", "MTLLogState.h", "capture_resize.js", "GCEventViewController.h", "mini_portile_cmake.rb", "ip_icmp.h", "WKNavigationDelegate.h", "ASAuthorizationSingleSignOnProvider.h", "VZError.h", "regnodes.h", "vutil.h", "VTFrameSilo.h", "html4_entity_lookup.c", "GCDeviceHaptics.h", "ASAuthorizationError.h", "WKSnapshotConfiguration.h", "raster.defs", "IntentsUI.h", "ASAccountAuthenticationModificationReplacePasswordWithSignInWithAppleRequest.h", "nfsproto.h", "WebKit.tbd", "error.c", "MTLLibrary.h", "VZVirtioGraphicsDeviceConfiguration.h", "regexp.h", "WKError.h", "ASAuthorizationAppleIDRequest.h", "mime.types", "get-ppds-psversion.test", "tag_lookup.c", "VZConsoleDeviceConfiguration.h", "icmp_var.h", "SCError.h", "xml_entity_reference.c", "GCExtendedGamepadSnapshot.h", "GCPressedStateInput.h", "printer-added.tmpl", "VZVirtioSoundDeviceInputStreamConfiguration.h", "nokogiri.c", "GKFriendRequestComposeViewController.h", "unixish.h", "secret", "VZMacOSVirtualMachineStartOptions.h", "VZStorageDevice.h", "cfpropertylist.rb", "GCDevicePhysicalInput.h", "IOUSBHostStream.h", "gumbo.h", "ASAuthorizationAppleIDProvider.h", "MTLVertexDescriptor.h", "ascii.h", "MTLComputePass.h", "asm_help.h", "tree.h", "nokogiri.h", "xslt_stylesheet.c", "perlio.h", "WKFindResult.h", "ip_var.h", "backup.c", "AppSandbox.tbd", "arm64e-apple-macos.swiftinterface", "gssapi_krb5.h", "GCDualShockGamepad.h", "IOBluetoothPasskeyDisplay.h", "vm_dyld_pager.h", "VZPlatformConfiguration.h", "GKBasePlayer.h", "error.tmpl", "GKLeaderboardSet.h", "IOUSBHostCIPortStateMachine.h", "form.h", "handy.h", "stdarg.h", "WKSecurityOrigin.h", "IOBluetoothPairingController.h", "printers-header.tmpl", "VZAudioOutputStreamSink.h", "VZNetworkDevice.h", "VTPixelRotationSession.h", "PushKit.h", "opnames.h", "admin.tmpl", "GCTouchedStateInput.h", "MTLResourceStatePass.h", "add-class.tmpl", "cv.h", "MTLStageInputOutputDescriptor.h", "XPdb-wal", "xml_cdata.c", "MTLTypes.h", "VZUSBMassStorageDevice.h", "SWCollaborationActionHandler.h", "WKFrameInfo.h", "PKPushRegistry.h", "kpi_ipfilter.h", "A53749AF-3855-4842-A1E7-4AEFA60BD2AC", "standard", "SharedWithYouCore.tbd", "IOBluetoothObjectPushUIController.h", "GCRelativeInput.h", "MTLLinkedFunctions.h", "feature.h", "ASPasswordCredentialRequest.h", "GKCloudPlayer.h", "Kerberos.h", "print-job-and-wait.test", "GKScore.h", "VZVirtioConsolePortArray.h", "MTLAccelerationStructureTypes.h", "SharedWithYouCore.h", "IOUSBHostDevice.h", "krb5.h", "x86_64-apple-ios-macabi.swiftinterface", "ASAuthorizationPublicKeyCredentialParameters.h", "Block.h", "IOUSBHostObject.h", "VZVirtioSocketDevice.h", "GCControllerButtonInput.h", "ASAuthorizationWebBrowserPlatformPublicKeyCredentialAssertionRequest.h", "topsecret", "SWCollaborationOptionsGroup.h", "uudmap.h", "WebKit.arm64e.bridgesupport", "TargetConditionals.h", "GCPhysicalInputSource.h", "job-cancel.tmpl", "GKLeaderboardScore.h", "print-job-gzip.test", "xml_processing_instruction.c", "MultipeerConnectivity.tbd", "Virtualization.h", "SCStream.h", "GCDualSenseAdaptiveTrigger.h", "GCControllerTouchpad.h", "attribute.c", "get-ppds-make.test", "keywords.h", "users.tmpl", "ODModuleEntry.h", "print-job.test", "MCSession.h", "GCDualSenseGamepad.h", "SWCollaborationMetadata.h", "ODNode.h", "GCDeviceBattery.h", "GCAxis2DInput.h", "ip6.h", "get-jobs.test", "nfs.conf", "GKMatch.h", "VZDirectorySharingDeviceConfiguration.h", "create-job-sheets.test", "ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor.h", "op.h", "SWPersonIdentity.h", "fakesdio.h", "io.h", "ascii.c", "GKChallenge.h", "MTLDefines.h", "WKDownloadDelegate.h", "util.c", "printer-accept.tmpl", "alut.h", "cups-create-local-printer.test", "limits.h", "class-deleted.tmpl", "ASSettingsHelper.h", "fax-job.test", "get-ppds-product.test", "apple.convs", "tokenizer_states.h", "SWAction.h", "ipp-2.2.test", "gumbo.c", "KUNCUserNotifications.h", "mg_vtable.h", "printer-cancel-jobs.tmpl", "GCGearShifterElement.h", "icmp6.h", "ASAuthorizationAppleIDButton.h", "print-job-deflate.test", "VZVirtioFileSystemDeviceConfiguration.h", "GameKit.apinotes", "ip.h", "bitcount.h", "IOPCIFamilyDefinitions.h", "WKPreviewElementInfo.h", "preauth_plugin.h", "vm_far.h", "VZVirtioSoundDeviceStreamConfiguration.h", "create-printer-subscription.test", "OBEXBluetooth.h", "param.h", "xml_text.c", "if_ether.h", "pp_proto.h", "ASCredentialServiceIdentifier.h", "GKTurnBasedMatch.h", "VZFileSerialPortAttachment.h", "apfs_boot_mount.tbd", "VZHostAudioInputStreamSource.h", "WebKit.bridgesupport", "MTLRenderPipeline.h", "get-subscriptions.test", "WKContentRuleList.h", "memory_types.h", "string_buffer.h", "MacOSX_OALExtensions.h", "GCMicroGamepadSnapshot.h", "thread.h", "CredentialsCache.h", "OSAtomic.h", "database.c", "INUIEditVoiceShortcutViewController.h", "PushKit.apinotes", "NSOpenDirectory.h", "modify-printer.tmpl", "MTLIntersectionFunctionTable.h", "AFKMemoryDescriptorOptions.h", "ScreenCaptureKit.h", "EXTERN.h", "utf8.c", "vBasicOps.h", "ipp-backend.test", "tcp_timer.h", "xml_document_fragment.c", "ASAuthorizationWebBrowserPlatformPublicKeyCredential.h", "ASFoundation.h", "av.h", "VZGenericPlatformConfiguration.h", "nsmb.conf", "tcpip.h", "MCError.h", "WKPDFConfiguration.h", "in_systm.h", "IOPCIDevice.iig", "opcode.h", "VZGraphicsDisplay.h", "uuid.h", "sqlite3.c", "popen_spawn_win32.py", "rbCFPropertyList.rb", "VZVirtioNetworkDeviceConfiguration.h", "notify.conf", "MTLCommandQueue.h", "MTLDepthStencil.h", "ASAuthorizationPublicKeyCredentialLargeBlobRegistrationOutput.h", "GKMatchmaker.h", "VTSession.h", "SWCollaborationCoordinator.h", "exception.c", "classes-header.tmpl", "rbPlainCFPropertyList.rb", "LDAP.tbd", "gssapi.h", "IOUSBHostInterface.h", "vecLibTypes.h", "ASPasskeyRegistrationCredential.h", "VZMultipleDirectoryShare.h", "arm_features.inc", "SBApplication.h", "ASAccountAuthenticationModificationExtensionContext.h", "printer-default.tmpl", "copyio.h", "ASAccountAuthenticationModificationUpgradePasswordToStrongPasswordRequest.h", "MTLBuffer.h", "ODConfiguration.h", "VTDecompressionProperties.h", "pp.h", "attribute.h", "GCKeyboard.h", "GCButtonElement.h", "rbREXMLParser.rb", "ASExtensionErrors.h", "stddef.h", "vm_kern.h", "validate-job.test", "sample.drv", "WKPreferences.h", "AuraService-fda-test", "VZDirectorySharingDevice.h", "GCSwitchElement.h", "database.h", "VZUSBControllerConfiguration.h", "GCSteeringWheelElement.h", "AppleUSBDescriptorParsing.h", "GKLeaderboardEntry.h", "VZMacHardwareModel.h", "IOUSBHostIOSource.h", "canvas.html", "ASEProcessing.tbd", "WKWebViewConfiguration.h", "ntp_opendirectory.conf", "Bluetooth.h", "VideoToolbox.h", "reentr.h", "VZNVMExpressControllerDeviceConfiguration.h", "GCMouseInput.h", "pycore_condvar.h", "IOBluetoothUI.tbd", "reg_help.h", "stdatomic.h", "VZPointingDeviceConfiguration.h", "pal_routines.h", "math.h", "SBElementArray.h", "WKFindConfiguration.h", "vm_options.h", "SWUpdateCollaborationParticipantsAction.h", "option-header.tmpl", "GKAchievementViewController.h", "VZDiskImageStorageDeviceAttachment.h", "malloc_ctl.h", "ASAuthorizationPublicKeyCredentialDescriptor.h", "VZVirtioSocketDeviceConfiguration.h", "_types.h", "VZDiskSynchronizationMode.h", "label.h", "CFODNode.h", "ASAuthorizationCredential.h", "embedvar.h", "class-jobs-header.tmpl", "rpcv2.h", "set-printer-options-header.tmpl", "xml_attr.c", "in_arp.h", "identify-printer-display.test", "faq.rb", "WKUserContentController.h", "VZMacGraphicsDevice.h", "mg_raw.h", "mg_data.h", "ASWebAuthenticationSessionWebBrowserSessionHandling.h", "AuthenticationServices.apinotes", "GKSavedGame.h", "set-printer-options-trailer.tmpl", "SWPersonIdentityProof.h", "WKDownload.h", "cpuid.h", "vForce.h", "invlist_inline.h", "VZVirtioConsolePortConfiguration.h", "PCIDriverKit.h", "VZGraphicsDisplayConfiguration.h", "vector.h", "get-completed-jobs.test", "print-uri.test", "job-release.tmpl", "GKSessionError.h", "VZVirtioTraditionalMemoryBalloonDevice.h", "IOUSBHostCIEndpointStateMachine.h", "MTLAccelerationStructure.h", "ASCOSEConstants.h", "GKPublicConstants.h", "ipp-1.1.test", "rbBinaryCFPropertyList.rb", "MTLFence.h", "jobs-header.tmpl", "ipp-everywhere.test", "zconf.h", "VZUSBMassStorageDeviceConfiguration.h", "PKPushCredentials.h", "ODMappings.h", "GCXboxGamepad.h", "profile.h", "tss.h", "SWPerson.h", "list-available-printers.tmpl", "vm_pageout.h", "MTLArgumentEncoder.h", "SWCollaborationShareOptions.h", "GCControllerInput.h", "printer-modified.tmpl", "inline.h", "MTLFunctionStitching.h", "table.h", "vm_shared_region.h", "nostdio.h", "MTLIOCommandBuffer.h", "xml_encoding_handler.c", "VZSingleDirectoryShare.h", "tag.c", "get-job-attributes.test", "IOUSBHostCIControllerStateMachine.h", "IOUSBHostControllerInterfaceDefinitions.h", "UNDTypes.h", "tcp.h", "gssapi_generic.h", "igmp.h", "cop.h", "option-trailer.tmpl", "VZLinuxRosettaCachingOptions.h", "html4_sax_push_parser.c", "VZSharedDirectory.h", "tcp_fsm.h", "WKScriptMessageHandler.h", "xml_sax_parser_context.c", "VZVirtualMachine.h", "GCGamepadSnapshot.h", "pmap.h", "VTCompressionProperties.h", "kdp_callout.h", "printer-start.tmpl", "epson.h", "in_private.h", "CredentialsCache2.h", "VZVirtioSocketListener.h", "rbCFPlistError.rb", "MTLRenderPass.h", "cpu.h", "BluetoothAssignedNumbers.h", "tcp_private.h", "uconfig.h", "tokenizer.h", "AdID.tbd", "VZVirtualMachineStartOptions.h", "WKContentWorld.h", "VZXHCIControllerConfiguration.h", "OpenDirectory.tbd", "VZDiskBlockDeviceStorageDeviceAttachment.h", "lz4.h", "ASAuthorizationPublicKeyCredentialConstants.h", "ASAuthorizationPublicKeyCredentialLargeBlobAssertionInput.h", "svg_attrs.c", "ASAuthorizationAppleIDCredential.h", "VZMacMachineIdentifier.h", "xml_xpath_context.c", "header.tmpl", "VZUSBDevice.h", "config.xml", "oalMacOSX_OALExtensions.h", "WKContextMenuElementInfo.h", "get-notifications.test", "WKUIDelegate.h", "ASAuthorizationPublicKeyCredentialAssertion.h", "ASAuthorizationPlatformPublicKeyCredentialAssertionRequest.h", "ASWebAuthenticationSession.h", "embed.h", "nokogiri.rb", "xml_sax_parser.c", "sel.h", "VZVirtioConsoleDeviceSerialPortConfiguration.h", "MTLFunctionLog.h", "job-hold.tmpl", "option-boolean.tmpl", "VTBase.h", "plugin.js", "VZStorageDeviceConfiguration.h", "ASAuthorizationRequest.h", "statement.c", "vm_memtag.h", "ASAuthorizationSecurityKeyPublicKeyCredentialRegistration.h", "VZSerialPortAttachment.h", "ODSession.h", "MTLCommandEncoder.h", "perlapi.h", "VTPixelRotationProperties.h", "error-op.tmpl", "MTLAllocation.h", "ASWebAuthenticationSessionWebBrowserSessionManager.h", "ASAuthorizationPlatformPublicKeyCredentialRegistration.h", "GCKeyboardInput.h", "config.h", "media.defs", "html4_document.c", "GameKit.h", "VZMemoryBalloonDevice.h", "MTLComputePipeline.h", "IOUSBHostDefinitions.h", "WKNavigationResponse.h", "VZDirectoryShare.h", "vfs_support.h", "xml_dtd.c", "VZGraphicsDevice.h", "hv.h", "ASPasskeyCredentialRequestParameters.h", "GKVoiceChat.h", "VZVirtioSocketConnection.h", "VZVirtioConsolePortConfigurationArray.h", "GCDeviceCursor.h", "IOBluetoothUIUserLib.h", "VZStorageDeviceAttachment.h", "VZVirtioFileSystemDevice.h", "MTLIndirectCommandEncoder.h", "VZVirtioConsoleDeviceConfiguration.h", "VZVirtualMachineDelegate.h", "replacement.h", "in_pcb.h", "vmparam.h", "stdint.h", "GKPlayer.h", "igmp_var.h", "ASPasswordCredentialIdentity.h", "xtab", "pager.tmpl", "udp.h", "ipp-2.1.test", "ASAuthorizationPublicKeyCredentialLargeBlobRegistrationInput.h", "print-job-hold.test", "VZMacOSRestoreImage.h", "string_buffer.c", "ODRecordMap.h", "iperlsys.h", "ASAuthorizationPublicKeyCredentialAssertionRequest.h", "CFODContext.h", "cpu_capabilities_public.h", "machine_machdep.h", "crc.h", "VZMacKeyboardConfiguration.h", "alc.h", "WKScriptMessage.h", "get-ppds.test", "MTLBlitPass.h", "option-pickone.tmpl", "com_err.h", "locks.h", "choose-make.tmpl", "VZMacGraphicsDeviceConfiguration.h", "get-job-attributes2.test", "GKGameSession.h", "machine_remote_time.h", "static_if.h", "ASAuthorizationPlatformPublicKeyCredentialDescriptor.h", "printer-jobs-header.tmpl", "VZKeyboardConfiguration.h", "ASAuthorizationWebBrowserSecurityKeyPublicKeyCredentialAssertionRequest.h", "class-confirm.tmpl", "xml.rb", "printer-stop.tmpl", "VZFileHandleSerialPortAttachment.h", "INUIAddVoiceShortcutViewController.h", "ASAuthorizationPlatformPublicKeyCredentialRegistrationRequest.h", "VZMacOSInstaller.h", "html4_sax_parser_context.c", "udp_var.h", "MapKit.tbd", "ASPasskeyAssertionCredential.h", "byte_order.h", "classes.tmpl", "_mcontext.h", "extconf.rb", "VTHDRPerFrameMetadataGenerationSession.h", "Virtualization.tbd", "parser.c", "UNDRequest.defs", "MCAdvertiserAssistant.h", "MTLDynamicLibrary.h", "machine_cpuid.h", "get-ppd.test", "OSBase.h", "GCDeviceLight.h", "in_stat.h", "perlvars.h", "monotonic.h", "lz4_assembly_select.h", "WebKit.h", "hp.h", "perl_inc_macro.h", "vm_compressor_algorithms.h", "arm64e-apple-ios-macabi.swiftinterface", "ASAuthorizationWebBrowserPlatformPublicKeyCredentialProvider.h", "atm_types.h", "GCMicroGamepad.h", "ASAuthorizationSingleSignOnCredential.h", "VZFileHandleNetworkDeviceAttachment.h", "IOBluetoothDeviceSelectorController.h", "metadata.json", "UNDReply.defs", "VZMacTrackpadConfiguration.h", "exception.h", "VZSpiceAgentPortAttachment.h", "stdbool.h", "SCScreenshotManager.h", "IOUSBHost.h", "ASCredentialRequest.h", "GKNotificationBanner.h", "rbNokogiriParser.rb", "ASAccountAuthenticationModificationViewController.h", "printer-configured.tmpl", "xdr_subs.h", "restart.tmpl", "get-printer-description-attributes.test", "xml_sax_push_parser.c", "xml_schema.c", "VZUSBScreenCoordinatePointingDeviceConfiguration.h", "choose-device.tmpl", "metaconfig.h", "foreign_attrs.c", "test_global_handlers.c", "testprint", "OSTypes.h", "WKPreviewActionItemIdentifiers.h", "GCControllerAxisInput.h", "VZDefines.h", "VZBridgedNetworkDeviceAttachment.h", "VZEFIVariableStore.h", "GCRacingWheelInput.h", "_param.h", "hv_macro.h", "WKFoundation.h", "endian.h", "VZNATNetworkDeviceAttachment.h", "machine_routines.h", "SCContentSharingPicker.h", "desc.h", "zlib.h", "time64.h", "GKGameSessionError.h", "IOBluetoothServiceBrowserController.h", "VZNetworkDeviceAttachment.h", "ASAuthorizationPasswordRequest.h", "WKHTTPCookieStore.h", "job-restart.tmpl", "GKEventListener.h", "rbLibXMLParser.rb", "option-conflict.tmpl", "6015FED9-D723-4332-87D9-C478CF341407.aamdownload", "Metal.apinotes", "Metal.h", "IOUSBHostPipe.h", "GKPublicProtocols.h", "IOUSBHostCIDeviceStateMachine.h", "WKProcessPool.h", "trap.h", "oalStaticBufferExtension.h", "MTLAccelerationStructureCommandEncoder.h", "MTLFunctionHandle.h", "cancel-current-job.test", "GKGameSessionEventListener.h", "GCDevicePhysicalInputState.h", "GCControllerElement.h", "VZHostAudioOutputStreamSink.h", "VZMacAuxiliaryStorage.h", "xml_namespace.c", "IOUSBHostControllerInterface.h", "mg.h", "class-modified.tmpl", "_endian.h", "get-devices.test", "xml_attribute_decl.c", "ipc_types.h", "GCKeyCodes.h", "VTVideoEncoderList.h", "GCColor.h", "MTLBinaryArchive.h", "MCPeerID.h", "IOUSBHostControllerInterfaceHelpers.h", "vm_fault.h", "OSByteOrder.h", "setup.rb", "GCController.h", "gv.h", "VZConsolePortConfiguration.h", "VZGenericMachineIdentifier.h", "VZVirtioGraphicsDevice.h", "GKAchievementDescription.h", "sqlite3.rb", "AuthenticationServicesCore.tbd", "modify-class.tmpl", "WKWindowFeatures.h", "VZVirtualMachineConfiguration.h", "MTLCaptureManager.h", "MTLPixelFormat.h", "VTErrors.h", "jobs.tmpl", "ASPasswordCredential.h", "VZLinuxRosettaAbstractSocketCachingOptions.h", "error.h", "ASAuthorizationWebBrowserPublicKeyCredentialManager.h", "printer-reject.tmpl", "SCRecordingOutput.h", "SWStartCollaborationAction.h", "INImage+IntentsUI.h", "xml_reader.c", "class-added.tmpl", "WKWebView.h", "util.h", "perly.h", "WKDataDetectorTypes.h", "GKLocalPlayer.h", "dosish.h", "sbox32_hash.h", "MTLArgument.h", "intrpvar.h", "ASAuthorizationWebBrowserExternallyAuthenticatableRequest.h", "GKAccessPoint.h", "VTMultiPassStorage.h", "VZMacPlatformConfiguration.h", "time64_config.h", "x86_64-apple-macos.swiftinterface", "VideoToolbox.apinotes", "MTLHeap.h", "IOUSBHost.tbd", "GCAxisInput.h", "VTUtilities.h", "create-job.test", "module.modulemap", "perl.h", "help-header.tmpl", "printer-deleted.tmpl", "MTLBlitCommandEncoder.h", "locate_plugin.h", "Admin.tbd", "choose-model.tmpl", "libperl.tbd", "xml_entity_decl.c", "xml_document.c", "WKUserScript.h", "VZMemoryBalloonDeviceConfiguration.h", "ASAuthorizationPlatformPublicKeyCredentialAssertion.h", "WKContentRuleListStore.h", "VZVirtioConsolePort.h", "MTLDeviceCertification.h", "identify-printer.test", "ASAuthorizationWebBrowserPlatformPublicKeyCredentialRegistrationRequest.h", "GKAchievement.h", "OSKextLib.h", "norestart.tmpl", "create-job-timeout.test", "VZNetworkBlockDeviceStorageDeviceAttachment.h", "MTLDrawable.h", "SWDefines.h", "ASAuthorizationPublicKeyCredentialRegistration.h", "IOPCIDevice.h", "IOBluetooth.h", "WebDriver.tbd", "token_type.h", "WKNavigationAction.h", "MTLIOCompressor.h", "XSUB.h", "httpd.exp", "tcp_var.h", "unclassified", "WKPreviewActionItem.h", "WKURLSchemeHandler.h", "MTLIndirectCommandBuffer.h", "AFKUser.tbd", "get-ppds-make-and-model.test", "choose-serial.tmpl", "tag_lookup.h", "print-job-manual.test", "GKDefines.h", "VZUSBDeviceConfiguration.h", "GKError.h", "VZUSBKeyboardConfiguration.h", "CFOpenDirectory.h", "test-page.tmpl", "GCSyntheticDeviceKeys.h", "ASAuthorizationWebBrowserSecurityKeyPublicKeyCredentialRegistrationRequest.h", "ASPasskeyCredentialIdentity.h", "GCKeyNames.h", "VTRAWProcessingProperties.h", "WKWebsiteDataStore.h", "PushKit.tbd", "signal.h", "unicode_constants.h", "ASAuthorizationWebBrowserSecurityKeyPublicKeyCredentialProvider.h", "classified", "choose-uri.tmpl", "GKLeaderboardViewController.h", "OSMalloc.h", "machine_kpc.h", "al.h", "SCShareableContent.h", "create-job-format.test", "OpenAL.h", "ScriptingBridge.tbd", "IOBluetoothTypes.h", "audit_ioctl.h", "utf8.h", "ASAuthorizationProviderExtensionAuthorizationResult.h", "get-ppds-language.test", "GKLeaderboard.h", "GKSession.h", "sv.h", "print-job-media-col.test", "VZBridgedNetworkInterface.h", "version.h", "VTProfessionalVideoWorkflow.h", "VZGraphicsDeviceConfiguration.h", "GKChallengeEventHandler.h", "char_ref.h", "VZMacGraphicsDisplayConfiguration.h", "libxml2_backwards_compat.c", "krpc.h", "IntentsUI.apinotes", "get-printer-attributes-suite.test", "MTLIOCommandQueue.h", "perliol.h", "GameController.h", "GKDialogController.h", "xml_node.c", "encode.h", "GCGamepad.h", "perlsdio.h", "VZEntropyDeviceConfiguration.h", "GCSwitchPositionInput.h", "ASAuthorizationSingleSignOnRequest.h", "OpenDirectory.h", "VZMacOSConfigurationRequirements.h", "VZVirtioSoundDeviceConfiguration.h", "MTLFunctionDescriptor.h", "MTLTexture.h", "WKBackForwardList.h", "ASPublicKeyCredentialClientData.h", "_limits.h", "VZVirtioGraphicsScanout.h", "IOBluetoothUserLib.h", "rbCFTypes.rb", "WKScriptMessageHandlerWithReply.h", "trailer.tmpl", "VZVirtioGraphicsScanoutConfiguration.h", "VZMacGraphicsDisplay.h", "VZEFIBootLoader.h", "GCDirectionPadElement.h", "get-ppds-drv-only.test", "ASPasskeyCredentialRequest.h", "option-pickmany.tmpl", "WKOpenPanelParameters.h", "statement.h", "INTERN.h", "in_var.h", "WebGPU.tbd", "backup.h", "MultipeerConnectivity.h", "MultipeerConnectivity.apinotes", "VZSocketDevice.h", "MTLResidencySet.h", "GameController.tbd", "string_piece.c", "help-printable.tmpl", "MCNearbyServiceBrowser.h", "ODQuery.h", "ASAuthorizationProvider.h", "ASAuthorizationSecurityKeyPublicKeyCredentialProvider.h", "mime.convs", "VZLinuxRosettaDirectoryShare.h", "parser.h", "MTLCommandBuffer.h", "help-trailer.tmpl", "OSvKernDSPLib.h", "OpenAL.tbd", "OBEX.h", "ASAuthorization.h", "VZSocketDeviceConfiguration.h", "tokenizer.c", "KerberosLogin.h", "MCBrowserViewController.h", "MTLComputeCommandEncoder.h", "VZBootLoader.h", "VTRAWProcessingSession.h", "token_buffer.h", "ASAuthorizationController.h", "get-printers-printer-id.test", "utfebcdic.h", "GKVoiceChatService.h", "cpuid_internal.h", "ASCredentialIdentityStoreState.h", "VZMACAddress.h", "xml_syntax_error.c", "xml_relax_ng.c", "VZConsoleDevice.h", "_OSByteOrder.h", "get-job-template-attributes.test", "confidential", "WebKit.apinotes", "print-job-password.test", "ASAuthorizationProviderExtensionAuthorizationRequest.h", "VTPixelTransferSession.h", "GKTurnBasedMatchmakerViewController.h", "VZSerialPortConfiguration.h", "atomic.h", "ASWebAuthenticationSessionRequest.h", "GKChallengesViewController.h", "IOBluetoothUtilities.h", "SwiftUI.swiftoverlay", "AuthenticationServices.h", "WKBackForwardListItem.h", "apple.types", "MTLVisibleFunctionTable.h", "VZLinuxRosettaUnixSocketCachingOptions.h", "libkern.h", "GCControllerDirectionPad.h", "MCNearbyServiceAdvertiser.h", "vecLib.h", "job-moved.tmpl", "set-attrs-hold.test", "ebcdic_tables.h", "ASPublicKeyCredential.h", "WKWebpagePreferences.h", "edit-config.tmpl", "VZNetworkDeviceConfiguration.h", "MTLPipeline.h", "git_version.h", "NSAttributedString.h", "GKGameCenterViewController.h", "ODRecord.h", "scope.h", "ScriptingBridge.h", "MTLSampler.h", "ASCredentialIdentity.h", "com.adobe.acrobat.rna.AcroCefBrowserLock.DC", "VZVirtioEntropyDeviceConfiguration.h", "GCExtern.h", "nfs.h", "xml_element_decl.c", "MTLRasterizationRate.h", "identify-printer-multiple.test", "libxml.rb", "ASAuthorizationSecurityKeyPublicKeyCredentialRegistrationRequest.h", "GCLinearInput.h", "VZAudioDeviceConfiguration.h", "ASWebAuthenticationSessionCallback.h", "xml_comment.c", "overload.h", "kdp_en_debugger.h", "op_reg_common.h", "SBObject.h", "MTLCaptureScope.h", "svg_tags.c", "get-printers.test", "MTLResourceStateCommandEncoder.h", "add-printer.tmpl", "ASCredentialProviderExtensionContext.h", "VZVirtioConsoleDevice.h", "proxy.xml", "MTLParallelRenderCommandEncoder.h", "pio.h", "UNDTypes.defs", "sysctl.h", "VZLinuxBootLoader.h", "VZVirtioBlockDeviceConfiguration.h", "xml_node_set.c", "GCTypes.h", "WKNavigation.h", "ipp-2.0.test", "ntp.conf", "CFODQuery.h", "MTLRenderCommandEncoder.h", "printer-confirm.tmpl", "perl_langinfo.h", "sqlite3_ruby.h", "VZXHCIController.h", "ASAuthorizationCustomMethod.h", "GKMatchmakerViewController.h", "version.rb", "mydtrace.h", "AirPlayReceiver.tbd", "ExmanProcessMutex", "SWCollaborationOptionsPickerGroup.h", "GCRacingWheel.h", "GCPhysicalInputProfile.h" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [], "unique_indicators": 0 }, "other": { "adversary": [ "Turla Group, FIN7, APT34, APT28, DragonForce Malaysia Hacker Group, Indonesia Islamic Warriors Counc", "DragonForce Hacker Group Malaysia" ], "malware_families": [ "Internet", "Ver", "Vzbootloader", "Osreturn", "Cftyperef", "Gc", "Osatomic", "Typeerror" ], "industries": [ "Media" ], "unique_indicators": 4277 } } }, "false_positive": [], "alexa": "http://www.alexa.com/siteinfo/hoehrmann.de", "whois": "http://whois.domaintools.com/hoehrmann.de", "domain": "hoehrmann.de", "hostname": "bjoern.hoehrmann.de" }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 2, "pulses": [ { "id": "67f33233092ab19b74879403", "name": "MacOS M2 Chip Infiltration: Game Center & XBOX Pod Game & Chat Server", "description": "pulse explores a variety of files, objects, and functions that could be associated with different system components, libraries, and protocols. It highlights a wide range of potential vulnerabilities that may exist in software related to system functions, APIs, data handling, and device interactions, including issues in devices like game controllers, HID devices, and platform-specific services (such as Apple and Android). The pulse references several components across different platforms (macOS, iOS, ARM architectures, and others), with a focus on low-level code, encryption libraries, system utilities, and network protocols like TCP, IP, and Bluetooth. The identified vulnerabilities could involve buffer overflows, deprecated functions, improper memory handling, and potential exploit vectors related to system security, performance, and integrity.", "modified": "2025-05-07T02:03:20.735000", "created": "2025-04-07T02:02:27.322000", "tags": [ "helper macro", "param", "param inccache", "kerberos", "ccache", "api function", "ccapi", "api version", "param ioccache", "ccacheserver", "win32", "null", "code", "win64", "error", "union", "ccapideprecated", "ccacheapi", "ccapiv2h", "apple", "export", "united", "ccache api", "cplusplus", "x8664", "typedef", "patheq", "none", "popen", "terminate", "false", "winenv", "winexe", "frozen", "winservice", "python", "posixthreads", "pyhavecondvar", "ntthreads", "vista", "pyemulatedwincv", "ntddivista", "semaphore", "pycondt", "win7", "pybuildcore", "fall", "copyright", "technology", "all rights", "reserved", "america", "government", "within that", "klprincipal", "klloginoptions", "inpassword", "klboolean", "klindex inindex", "login", "klstatus", "kerberos login", "inst", "regexp", "typeof e", "function", "typeof t", "typeof o", "width", "typeof", "pseudo", "body", "sticky", "date", "class", "this", "void", "accept", "span", "krb5callconv", "apoptsreserved", "tktflgreserved", "kdcoptreserved", "krb5data", "eblock", "krb5address", "krb5keyblock", "service", "realm", "format", "general", "internal", "entropy", "mask", "mcpeerid", "mcsession", "property", "protocol", "create", "nsuinteger", "notifies", "mcsession api", "interface", "bonjour", "ascii lowercase", "abc company", "section", "bonjour txt", "mcextern", "attribute", "mcextern extern", "mcexternweak", "nsenum", "nsinteger", "mcerrorcode", "mcerrorunknown", "mcerrortimedout", "bonjour apis", "stop", "peer", "example", "tags", "session", "nsprogress", "nserror", "nsstring", "nsurl", "nsarray", "note", "ui element", "utf8 encoding", "nscopying", "nsdictionary", "webpackrequire", "webpackexports", "object", "adobe systems", "adobe", "incorporated", "dissemination", "touchmove", "window", "launch", "close", "core", "webview", "nwebpackrequire", "arraybuffer", "name", "typedarray", "prototype", "string", "number", "nvar", "meta", "infinity", "generator", "zero", "epsilon", "observer", "android", "freeze", "trim", "canvas", "simple", "bind", "fast", "next", "patch", "rest", "middle", "find", "enumerate", "facebook", "executor", "apiunavailable", "gamecontroller", "gcbuttoninput", "gcswitchinput", "nsobject", "apiavailable", "hid device", "cfstr", "iohiddeviceref", "boolean value", "c iohidmanager", "iohidmanager", "c iohiddevice", "issequential", "bool sequential", "bool canwrap", "nsset", "nsunavailable", "gcswitchelement", "bool", "share button", "xbox controller", "xbox elite", "xbox series", "gcxboxgamepad", "gcpoint2", "gcpoint2make", "gcpoint2 p", "cfinline bool", "gcpoint2equal", "gcpoint2 point1", "gcpoint2 point2", "gcrelativeinput", "isanalog", "bool analog", "hasinclude", "gcaxis2dinput", "gcpoint2 value", "gcaxiselement", "certain", "gcaxisinput", "gcbuttonelement", "gccontroller", "nsnotification", "chhapticengine", "gcmicrogamepad", "input", "menu button", "gcdevicelight", "gccolor", "x axis", "xvalue", "developers", "functionality", "options button", "sf symbols", "elements", "gcdevice", "gctouchstate", "gctouchstateup", "apideprecated", "gckeyboard", "gcmouse", "nsswiftname", "gcdevicebattery", "battery level", "direction pad", "directionapad", "thumbstick", "gcdevicecursor", "a controller", "gccolor color", "gcinputbuttona", "gcinputbuttonb", "button b", "check", "a element", "c nil", "nsenumerator", "siri remote", "equivalent", "down", "left", "right", "kindof", "handle button", "c device", "immediate input", "dualsense", "positional", "sony dualsense", "gcmotion", "dualshock", "uievent", "controllers", "uikit user", "uiview", "method", "nsdata", "axes", "nsdata source", "return", "nullable", "nsdata object", "button", "shoulder", "extended", "gamepad profile", "nsdata api", "gcgamepad", "sizeof", "standard", "gckeyboardinput", "keyboard", "nsstring const", "controller", "back buttons", "game controller", "back", "keypad", "delete", "insert", "home", "right arrow", "left arrow", "down arrow", "up arrow", "korean", "backspace", "alongside", "gckeyuparrow", "gckeycode const", "lang1", "gclinearinput", "gcquaternion", "gcacceleration", "y axis", "z axis", "gcmouse mouse", "gcmouse class", "mice", "gcmouseinput", "mouse profile", "scroll", "nsdata instance", "a alias", "press", "micro profile", "siri remotes", "b button", "a gcinput", "button a", "nsoptions", "examining", "c sfsymbolsname", "apple tv", "remote", "control center", "a set", "game", "gcracingwheel", "gcbundlewithpid", "gcinputbuttonx", "gcinputbuttony", "gcinputshifter", "gckeya", "gckeyb", "gckeybackslash", "rawvalue", "apple swift", "o librarylevel", "swift import", "element", "indices", "iterator", "subsequence", "kerberoscomerr", "const", "permission", "mit software", "suitability", "athena", "openvision", "gssdllimp", "gssapigenerich", "this software", "purpose", "disclaims all", "warranties with", "regard to", "constraint", "kerberosprofile", "krb5profileh", "const names", "newvalue", "1429577728l", "gnuc", "mach", "omuint32", "gssapikrb5h", "form", "uid form", "client function", "asrep", "including", "preauth", "db entry", "free", "pointer", "rock", "neither", "direct", "damage", "minorstatus", "gssbuffert", "gssctxidt", "gssoid", "gssnamet", "gsscredidt", "gssoidset", "gssapi", "first", "alcapi", "alcapientry", "alcboolean", "targetosmac", "alcdevice", "alcenum param", "alalch", "alcchar", "alcsizei", "capture", "but not", "limited", "openal cross", "apple computer", "redistribution", "is provided", "type", "alvoid", "alint", "openal", "aluint sid", "alenum", "alint value", "aluint property", "alvoid nonnull", "alfloat", "write", "openalopenalh", "umbrella header", "alenum param", "alapi", "aluint bid", "alsizei", "alfloat value", "alapientry", "aluint", "verify", "play", "speed", "bits", "albuffer3i", "albufferdata", "albufferf", "albufferfv", "albufferi", "albufferiv", "aldistancemodel", "aldopplerfactor", "algetbooleanv", "algetbuffer3f", "iousbhostdevice", "iousbhostobject", "iousbhostpipe", "iousbhoststream", "iousbhost", "brief", "usb host", "bool yes", "bool no", "advance", "iousbhostfamily", "kernel", "ioreturn status", "nsnumber", "ioreturn error", "usb device", "select", "commands", "enqueue", "nsmutabledata", "field", "enum", "options", "retrieve", "iosource", "current address", "bos descriptor", "extract", "a descriptor", "license", "io request", "abort", "discussion", "stream", "please", "swift api", "iousbbitrange", "iousbbitrange64", "iousbbit", "client", "usb controller", "usb descriptor", "unknown", "critical", "refer", "link", "send", "same", "common ui", "bluetooth", "service browser", "option", "1001", "cfstringref", "deprecated", "macos", "returns", "abstract", "nswindow", "creates", "mac os", "uuids", "uuid", "sdp service", "nsimage", "nsview", "mpasskeystring", "nsmutablearray", "uuid array", "ioreturn", "runmodal", "group", "command", "byte", "masks", "pduid", "l2cap", "range", "opcode", "packet", "major", "local", "profiles", "iobluetooth", "framework", "support", "host controller", "rfcomm", "minor class", "pseudoclass", "specific device", "headset", "peripheral", "desktop", "glasses", "device reset", "no hci", "hci controller", "returns number", "variable number", "packdata", "cstring", "pass", "path", "deprecated in", "obex session", "obexsessionref", "rfcomm channel", "obex", "does not", "l2cap channel", "inrefcon", "device", "length", "obex spec", "error code", "make", "headerid", "april", "alarm", "avrcplog", "audiolog", "bccmd16touint16", "bccmd16touint8", "bccmd32touint32", "hfplog", "obexcreatevcard", "obexsessionget", "uint16tobccmd16", "intents", "created", "andrea gottardo", "inimage", "intentsui", "project version", "inshortcut", "ibdesignable", "invoiceshortcut", "nsbundle", "siri", "beralloct", "berbvarrayadd", "berbvarrayfree", "berbvdup", "berbvecadd", "berbvecfree", "berbvfree", "berdump", "berdup", "berdupbv", "ldap", "vdspinput1", "vectorsize", "iirchannel", "osvkerndsplib", "pragmaonce", "paul chang", "fri mar", "original code", "apple operating", "modifications", "apple public", "source license", "version", "lframesize", "i386", "picify", "callmcount", "nonlazystub", "align", "roundtostack", "leaf", "import", "carnegie mellon", "carnegie", "inline void", "software", "school", "august", "xnuarchi386selh", "next computer", "mike demoney", "bruce martin", "state segment", "nxswappedfloat", "osswapint32", "inline float", "inline double", "osswapint64", "armlimitsh", "arm64", "useclangtypes", "bsdarmtypesh", "int8t", "gnuc typedef", "uint8t", "ansi c", "ansi", "use wchart", "armmcontexth", "mcontextt", "armparamh", "round", "darwinsizet", "darwinalign", "uint32t", "darwinalign32", "warranties", "a particular", "university", "armarch6zk", "armarch6k", "armarch4t", "armarch4", "http", "capbitnb", "legacy", "armfeatureflag", "california", "notice", "berkeley", "limited to", "define", "useclanglimits", "lp64", "ansisource", "darwincsource", "longmin", "ulongmax", "parameter", "vmmemcoherent", "vmmemearlyack", "vmmeminner", "vmmemrt", "vmmemguarded", "armmemorytypesh", "armpalroutinesh", "read", "struct", "booleant", "cluster", "devbsize", "mclbytes", "unix system", "laboratories", "devbshift", "thumb", "armv5", "armv7", "cache", "neon", "swift", "bsdarmprofileh", "xxx todo", "block", "mcount", "mcountinit", "mcountenter", "splhigh", "armthreadh", "armtraph", "dflssiz", "targetososx", "maxssiz", "rliminfinity", "maxcsiz", "bsdarmvmparamh", "dfldsiz", "maxdsiz", "xxx stack", "armsignal", "int64t", "armmachtypesh", "int32t", "methods", "thread", "hasapplepac", "atmatmtypesh", "libkernlocksh", "fortifysource", "libkerncopyioh", "sizedby", "darwinosinline", "stdcversion", "osswapint16", "libkerncrch", "blockexport", "vaargs", "blockrelease", "blockh", "collection", "blockcopy", "ososbaseh", "base", "byteoffset", "host endianess", "generic host", "generic", "osmalloc", "osmalloctag tag", "osmalloctag", "pci device", "uint32", "uint32 mask", "safecastptr", "sint32", "osaddatomic64", "uint8", "libkern c", "internal error", "core osreturn", "libkern", "values", "pragmamark", "kexts", "kext", "c string", "grab", "osostypesh", "boolean", "unsignedwide", "uint32 hi", "buildtime value", "libkernversionh", "versionmajor", "versionminor", "versionvariant", "versionrevision", "ostype", "osrelease", "libkernsysctlh", "instructions", "data cache", "future", "rbleft", "rbright", "rbgetparent", "splayright", "splayleft", "rbsetcolor", "rbblack", "rbgetcolor", "comp", "main", "stdc", "msdos", "windows", "sys16bit", "zlibdll", "zextern", "zconfh", "model", "zextern int", "zstreamerror", "znull", "zbuferror", "zmemerror", "zstreamend", "zdataerror", "zfinish", "enough", "possible", "trailer", "compiler", "countedby", "sparta", "osatomic", "ipcipctypesh", "ipcobjectnull", "ipcobjectdead", "osreturn", "nfskrpch", "xdrbuf", "xdrbuf xbp", "xbptr", "xbleft", "tlen", "lval", "xbcleanup", "xbtype", "xbflags", "nfsargsversion", "file", "packed", "nfshz", "mount", "term", "restrict", "stats", "nfsbitmapset", "nfsver3", "nfsxunsigned", "attr", "nfsprogram", "nfssmallfh", "which", "from", "mark", "obsolete", "ip address", "iaddrt", "netinetbootph", "nvmaxtext", "magic", "etheraddrlen", "target", "byteorder", "bigendian", "littleendian", "dest", "igmp", "ushort", "inpcbptr", "inpcblistentry", "ipsec", "pcbs", "cookie", "netinetinstath", "minimal", "result", "arp packet", "icmpparamprob", "icmpredirect", "address", "ditto", "ip filter", "ipv4", "ip packet", "inject", "wifi", "server", "tcpmaxnotifyack", "wired", "ecn setup", "notify", "slow", "definitions", "tcptmax", "retransmit", "mptcp", "tcpsclosewait", "tcpsestablished", "tcpstimewait", "tcpseq", "timer drift", "sack", "char", "icmp", "synack", "tcpoptnop", "syndata", "ver", "internet", "iopcidevice", "constant", "perst", "localonly", "iooptionbits", "optional access", "ioservice", "open", "pcidriverkith", "osmetaclassbase", "iorpc rpc", "auditpipeiobase", "auditsdeviobase", "ioctls", "data", "the software", "stdargh", "hasincludenext", "eli friedman", "as is", "hack", "atomic", "atomicseqcst", "clangstdatomich", "stdchosted", "stdboolh", "needwintt", "stddefh", "hasbuiltin", "const src", "xnumembersize", "const dst", "wcharmax", "wcharmin", "limits", "kernelstdinth", "lp64 typedef", "intmaxc", "uintmaxc", "ptrauth", "olddata", "value", "declkey", "abi pointer", "c function", "float16", "fltevalmethod", "legacy bsd", "c standard", "sincospi", "cosp", "x8664monotonich", "staticifentry", "hasmte", "vmmemorytypesh", "vmwimgdefault", "wimg", "extvectortype", "utilfunction", "aligned", "srcptr", "vmpmaph", "vmdyldpagerh", "vmvmfaulth", "vmvmmaph", "development", "debug", "vmvmoptionsh", "vmvmpageouth", "kasantbi", "machvmmemtagh", "given", "vmmemtagptrsize", "vmmemtagtagsize", "copy", "vmsharedregionh", "vfsvfssupporth", "veclib", "master", "world wide", "various", "veclibtypes", "carbonlib", "availability", "carbon", "noncarbon cfm", "vbasicops", "shift", "vforceh", "vdsplength n", "realp", "nonnull", "vector", "dspsplitcomplex", "ieee", "dspcomplex", "uuiduuidh", "uuiddefine", "public", "uuid library", "kernelserver", "simpleroutine", "undkey", "execution", "strings array", "user", "title string", "info", "1024", "xmldatat", "undreplyref", "kernsuccess", "osaction", "targetosiphone", "istargetvendor", "targetcpux8664", "targetosunix", "targetcpuppc", "targetcpuppc64", "targetcpux86", "targetrtmaccfm", "bridge", "svflags", "svpavreal", "svpavreify", "xpvav", "svany", "avfillp", "for apidoc", "mutableav", "avrealoff", "pltopenv", "stmtstart", "stmtend", "copfile", "plcurstackinfo", "copfilegv", "cophinthashget", "loop", "stack", "beware", "orig", "loops", "this file", "the build", "plbitcount", "u8 value", "cvflags", "xpvcv", "mutableptr", "perlcore", "cvgv", "cvfile", "cvfmethod", "cvflvalue", "cvfconst", "anon", "doinit extconst", "ebcdic", "extconst u8", "index", "ascii platform", "confusingly", "u8 pla2e", "pla2e", "u8 ple2a", "guard", "declspec", "extconst", "ext externc", "init", "larry wall", "gnu general", "readme file", "multiplicity", "plsawampersand", "do not", "perliogetc", "perlioputc", "perliostdoutf", "perlio", "perlfeatureh", "featuresubbit", "featuremyrefbit", "featurefcbit", "featureisabit", "featuresaybit", "featurestatebit", "featuretrybit", "hintfeaturemask", "ffspace", "process", "ffdecimal", "ffend", "gvgp", "gvflags", "gvnamehek", "svtype", "gvegv", "gvstash", "gvxpvgv", "svtpvgv", "svtpvlv", "super", "edit directly", "djgpp", "bitbucket", "perlsysinitbody", "perlioinit", "perlsystermbody", "w macros", "wexitstatus", "shpath", "mkdir", "rotl64", "rotl32", "rotate x", "rotr32", "can64bithash", "rotr64", "ivsize", "u8to16le", "rotluv", "rotruv", "sbox32maxlen", "plhashstate", "perlhash", "perl", "usehashseed", "perlseenhvfunch", "perlhashseed", "siphash24", "siphash13", "seed", "c program", "c type", "c compiler", "gcc attribute", "longsize", "c preprocessor", "install", "kill", "cont", "thus", "ext declspec", "dext", "for apidocitem", "utf8", "ascii", "fitsin8bits", "nativetolatin1", "strwithlen", "u8 end", "test", "poison", "february", "cray", "prior", "behaviour", "except", "alpha", "perlvar", "perlvari", "perlvara", "padoffset", "true", "pmop", "hooks", "hook", "sv invlist", "perlinregcompc", "svcur", "perlinopc", "tointernalsize", "svtinvlist", "invlistlen", "strlen", "hvaux", "heklen", "svook", "hekutf8", "hekkey", "hekflags", "mutablehv", "hvnameheknn", "gosh", "leave", "iperlsock", "plsock", "iperlstdio", "plstdio", "iperlproc", "plproc", "iperllio", "pllio", "perlimplicitsys", "plink", "keypackage", "keyend", "keysub", "keydump", "keylog", "keysend", "keystate", "perlioclose", "perlmemcollxfrm", "nativetoneed", "plclocaleobj", "plno", "plwarnall", "plwarnnone", "plyes", "plzero", "plc9utf8dfatab", "nomathoms", "perlintokec", "perlinutf8c", "perlinsvc", "perlinregexecc", "debugging", "perlinlocalec", "pfinet", "snoop", "ccprint", "ccgraph", "cccharnamecont", "ccascii", "ccwordchar", "ccalphanumeric", "ccidfirst", "ccquotemeta", "ccalpha", "cccased", "ordinal", "magicvtablemax", "extra", "regex match", "env hash", "isa array", "debugger", "sig hash", "available", "shadow", "array length", "magic mg", "sv sv", "mgftainteddir", "hefsvkey", "mutablesv", "ssizet", "mgvtbl entry", "mgfbytes", "perlmagicsv 0", "special", "perlmagicarylen", "perlmagicrhash", "extra data", "perlmagicpos", "perlmagicsymtab", "provides", "dtrace probes", "stdioh", "stdioincluded", "sfioversion", "rxfpmfcharset", "rxfpmfmultiline", "rxfpmffold", "rxfpmfextended", "rxfpmfnocapture", "rxfpmfkeepcopy", "flags", "rxfpmfstrict", "ocshift", "plop", "perlbitfield16", "baseop op", "useithreads", "pmfonce", "padop", "perlcknull", "perlckfun", "opparg1mask", "opparg4mask", "opparg2mask", "perlckftst", "perlppftrowned", "perlckbitop", "perlckcmp", "perlcklfun", "dump", "chroot", "syscall", "flip", "undef", "crypt", "push", "stub", "trans", "predec", "flop", "prtf", "shutdown", "perlcontext cx", "perlmemlog", "c pointer", "cxtype", "logic", "toavamg", "tohvamg", "opftrread", "oplt", "opincmp", "opbitand", "opsbitor", "opsend", "opgetpeername", "opfteexec", "opftbinary", "opclose", "plparser", "yylex", "lexshared", "position", "repl", "memsize", "malloct", "perlmallocctlh", "uv nfree", "uv ntotal", "iv topbucket", "iv totalsbrk", "iv minbucket", "level", "plcomppad", "plcurpad", "uvxf", "ptr2uv", "avarray", "padnameflags", "plcopseqmax", "padlistarray", "c array", "padnametype", "incpushperl5lib", "appllibexp", "privlibexp", "defineincmacros", "perlfsversion", "perl5lib", "sitearchexp", "perllanginfoh", "hasnllanginfo", "ilanginfo", "codeset", "codeset 1", "dtfmt", "dtfmt 2", "dfmt", "dfmt 3", "sipround", "u8to64le", "fallthrough", "uint64c", "perlsiphashfnc", "siprounds", "strlen inlen", "sipfinalrounds", "could", "configure", "plout", "mine001", "argv", "plin", "localpatchcount", "perlapih", "xs code", "portingglossary", "first version", "brand", "symbols", "haswcrtomb", "perlionotstdio", "perlcallconv", "perlio f", "perlioh", "usestdio", "case", "bufsiz", "sizet", "perlstability", "perltypedefs", "perldtracehin", "perlloadedfile", "perlloadingfile", "perlopentry", "perlphasechange", "perlsubentry", "perlsubreturn", "generated", "perlcallconv iv", "sizet count", "sv arg", "mode", "perliofuncs tab", "stdchar", "perliolistt", "sv args", "mutex", "perlinterpreter", "sigsize", "perlioisstdio", "perlcallconv op", "perldokv", "perlppaassign", "perlppabs", "perlppaccept", "perlppadd", "perlppaeach", "perlppaelem", "public license", "free software", "foundation", "yydebug", "bison", "bareword", "funcmeth", "arrow", "targ", "pushs", "tops", "does", "xsub", "pops", "xpushs", "erange", "perlreentrapi", "perlreentrapi0", "hostentsize", "getgrentrproto", "getpwentrproto", "getnetentrproto", "grentbuffer", "grentsize", "hostenterrno", "redebugflag", "debugvtest", "debugr", "u16 nextoff", "argset", "u8 type", "nextoff", "strings", "problem", "june", "invert", "perlfpclass", "longdoublekind", "plstatusvalue", "pldebug", "numclasses", "locale", "grok", "pragma", "dword", "attack", "little", "lynx", "done", "reany", "rxpextflags", "rxextflags", "checkpoint cp", "rxftaintedseen", "rxfcopydone", "plsavestackix", "plsavestack", "plsavestackmax", "ssmaxpush", "enter", "debugscope", "state", "u32 state", "debugsbox32hash", "sbox32warn5", "line", "mutexunlock", "mutexinit", "noop", "mutexlock", "condinit", "detach", "panic", "usetm64", "should", "bsd extension", "configuration", "time64debug", "int64t nv", "gnu extension", "perltime64h", "time64t", "int64t int64", "int64 time64t", "i32 year", "tm64", "hastmtmgmtoff", "decide", "svpvx", "svgmagic", "bonk", "anything", "turn", "crash", "fstat", "perlmicro", "hasioctl", "hasutime", "hasgroup", "haspasswd", "usemybinmode", "idirent", "likely", "generated code", "utfebcdic", "unicode", "step", "ufeff", "u00a0", "u00df", "u00b5", "ufffd", "u017f", "u0300", "unlikely", "nativeutf8toi8", "utf8skip", "nativetouni", "lazy", "extrasize", "regnodemax", "exact", "match", "whilem", "anyof", "curly", "trie", "curlym", "eval", "star", "perlutilh", "hsmapiverlen", "hsxsverlenmax", "hskeyp", "tools", "sv vs", "perlversionlt", "svpvxnolenconst", "perlckwarner", "u32 err", "scroakxsusage", "pluumap", "warnings", "categories", "plcurcop", "perlckwarn", "perlckwarnd", "perlwarnisset", "perlwarnoff", "perlwarnbit", "xsversion", "xsreturn", "perlxshandshake", "plstackbase", "hskey", "zaphod32mix", "u8to32le", "zaphod32warn4", "zaphod32warn3", "zaphod32warn6", "perlform", "i8tonativeutf8", "warnutf8", "myshift", "c extension", "libs", "cflags", "afkuserlog", "kafkeventcancel", "kafkeventerror", "adamsbagmanager", "adjinglerequest", "isinternalbuild", "kickmcxdforuid", "loadappkit", "ardconfig", "authenticator", "dsauthenticator", "dsnode", "dsrecord", "hostconfig", "addtofront", "calcslope", "copyarray", "createcachenode", "defaultebecurve", "deletecache", "disablehcucache", "dumpcache", "dumpoutputhcu", "enablet1sim", "ascagent", "ascagentproxy", "asdevice", "ddrangecompare", "wdosloglauncher", "wdoslogprotocol", "findchar", "ddasllogger", "ddfilelogger", "ddlog", "ddlogfileinfo", "ddlogmessage", "ddloggernode", "mkurlparser", "mkerrordomain", "mkintegerhash", "mklonghash", "mkmaprectinset", "mkmaprectnull", "mkmaprectoffset", "mkmaprectworld", "mkmapsizeworld", "kextensionnonui", "wkarraycreate", "wkbooleancreate", "wkcontextcreate", "wkdatacreate", "wkdatagettypeid", "wkdoublecreate", "wkframecopyurl", "wkgettypeid", "wkimagecreate", "wkpagecandelete", "webkit", "methodkind", "wkerrordomain", "by apple", "document", "a block", "wkcontentworld", "wkwebview", "javascript", "wkerrorcode", "wkerrorunknown", "nsswiftasync", "wkswiftasync", "wkcookiepolicy", "nshttpcookie", "whether", "wknavigation", "wkdownload", "decides", "mime type", "wkscriptmessage", "wkframeinfo", "information", "url scheme", "wkcontentmode", "wkuserscript", "wkextern", "media", "promise", "fulfill", "cgfloat", "targetoswatch", "sign", "password", "provider", "uicontrol", "nscontrol", "opaque user", "apple id", "nsstring user", "asuseragerange", "initiate", "asauthorization", "confirms", "apple upgrade", "nserrorenum", "operation", "relying party", "targetosvision", "a byte", "nsdata userid", "relying", "a string", "asapiavailable", "http response", "authorization", "oauth", "saml", "nsdata readdata", "bool didwrite", "a cose", "nsstring name", "bool appid", "targetosxr", "a state", "a json", "web token", "private seckeys", "nsstring appid", "mdm profile", "nsurl url", "returns yes", "lacontext", "asswiftsendable", "keychain", "cose algorithm", "ecdsa", "sha256", "cose curve", "p256", "nsinteger rank", "enables", "bool success", "remove", "call", "complete", "prepare", "attempt", "list", "nsextension", "settings", "initializes", "a key", "extensions", "hash", "json", "initialize", "nsstring origin", "settings app", "urls", "https urls", "safari", "cancel", "nsuuid uuid", "asextern extern", "asextern", "nsswiftsendable", "uiwindow", "propertykind", "gkplayer", "n tags", "gkerrordomain", "gamecenter", "targetosios", "targetostv", "nsavailable", "gkachievement", "local player", "view", "present", "optional", "gkbaseplayer", "game center", "uiimage", "app store", "gkchallenge", "gklocalplayer", "nsdeprecated", "a singleton", "gkcloudplayer", "returns nil", "nsdeprecatedmac", "internal2", "internal3", "internal4", "gkscore", "gkextern", "gkextern extern", "gkexternweak", "gkerrorcode", "gkerrorunknown", "gkerrorunderage", "friendplayer", "standard view", "nsresponder", "parentwindow", "ibaction", "gkgamesession", "apis", "gkplayer player", "nsinteger score", "nsdate date", "gkleaderboard", "connect", "nsinteger value", "load", "gktransporttype", "nsstring title", "loads array", "localized", "gkmatch", "gkmatchrequest", "gkinvite", "gksession", "gksession api", "gamekit", "asynchronously", "welcome", "nstimeinterval", "delegate", "delivery", "gksenddatamode", "gksessionmode", "gkphotosize", "callbacks", "gkmatchdelegate", "gksavedgame", "default value", "gksessionerror", "gkvoicechat", "participant", "voice chat", "clienta" ], "references": [ "CredentialsCache.h", "CredentialsCache2.h", "config.xml", "popen_spawn_win32.py", "pycore_condvar.h", "Kerberos.h", "KerberosLogin.h", "plugin.js", "krb5.h", "MultipeerConnectivity.tbd", "MCBrowserViewController.h", "MCNearbyServiceAdvertiser.h", "MCError.h", "MCAdvertiserAssistant.h", "MCNearbyServiceBrowser.h", "MultipeerConnectivity.apinotes", "MultipeerConnectivity.h", "MCSession.h", "MCPeerID.h", "canvas.html", "capture_0.bundle.js", "capture_resize.js", "GCRacingWheelInput.h", "GCSyntheticDeviceKeys.h", "GCSwitchPositionInput.h", "GCSteeringWheelElement.h", "GCSwitchElement.h", "GCTouchedStateInput.h", "GCXboxGamepad.h", "GCTypes.h", "GCRelativeInput.h", "GameController.h", "GCAxis2DInput.h", "GCAxisElement.h", "GCAxisInput.h", "GCButtonElement.h", "GCController.h", "GCColor.h", "GCControllerAxisInput.h", "GCControllerDirectionPad.h", "GCControllerInput.h", "GCControllerElement.h", "GCControllerTouchpad.h", "GCDevice.h", "GCDeviceBattery.h", "GCDeviceCursor.h", "GCDeviceHaptics.h", "GCDeviceLight.h", "GCDevicePhysicalInputState.h", "GCDevicePhysicalInputStateDiff.h", "GCDirectionalGamepad.h", "GCDirectionPadElement.h", "GCDevicePhysicalInput.h", "GCDualSenseAdaptiveTrigger.h", "GCDualSenseGamepad.h", "GCDualShockGamepad.h", "GCEventViewController.h", "GCExtendedGamepadSnapshot.h", "GCExtern.h", "GCExtendedGamepad.h", "GCGamepadSnapshot.h", "GCGearShifterElement.h", "GCGamepad.h", "GCKeyboard.h", "GCInputNames.h", "GCControllerButtonInput.h", "GCKeyNames.h", "GCKeyboardInput.h", "GCKeyCodes.h", "GCLinearInput.h", "GCMotion.h", "GCMouse.h", "GCMouseInput.h", "GCMicroGamepadSnapshot.h", "GCPhysicalInputElement.h", "GCMicroGamepad.h", "GCPhysicalInputProfile.h", "GCPhysicalInputSource.h", "GCPressedStateInput.h", "GCProductCategories.h", "GCRacingWheel.h", "GameController.tbd", "arm64e-apple-macos.swiftinterface", "x86_64-apple-macos.swiftinterface", "module.modulemap", "com_err.h", "gssapi_generic.h", "locate_plugin.h", "profile.h", "gssapi_krb5.h", "preauth_plugin.h", "gssapi.h", "alc.h", "oalStaticBufferExtension.h", "oalMacOSX_OALExtensions.h", "OpenAL.h", "al.h", "OpenAL.tbd", "IOUSBHost.tbd", "IOUSBHostCIEndpointStateMachine.h", "IOUSBHostCIControllerStateMachine.h", "IOUSBHost.h", "IOUSBHostCIPortStateMachine.h", "IOUSBHostCIDeviceStateMachine.h", "IOUSBHostControllerInterfaceHelpers.h", "IOUSBHostDevice.h", "IOUSBHostControllerInterface.h", "IOUSBHostDefinitions.h", "IOUSBHostInterface.h", "IOUSBHostIOSource.h", "AppleUSBDescriptorParsing.h", "IOUSBHostStream.h", "IOUSBHostObject.h", "IOUSBHostControllerInterfaceDefinitions.h", "IOUSBHostPipe.h", "IOBluetoothUIUserLib.h", "IOBluetoothUI.h", "IOBluetoothObjectPushUIController.h", "IOBluetoothDeviceSelectorController.h", "IOBluetoothPasskeyDisplay.h", "IOBluetoothPairingController.h", "IOBluetoothServiceBrowserController.h", "IOBluetoothUI.tbd", "Bluetooth.h", "IOBluetooth.h", "BluetoothAssignedNumbers.h", "IOBluetoothTypes.h", "IOBluetoothUtilities.h", "OBEXBluetooth.h", "IOBluetoothUserLib.h", "OBEX.h", "IOBluetooth.tbd", "INImage+IntentsUI.h", "IntentsUI.h", "INUIAddVoiceShortcutButton.h", "IntentsUI.apinotes", "INUIEditVoiceShortcutViewController.h", "INUIAddVoiceShortcutViewController.h", "LDAP.tbd", "OSvKernDSPLib.h", "cpu.h", "asm_help.h", "desc.h", "pio.h", "io.h", "sel.h", "reg_help.h", "tss.h", "table.h", "byte_order.h", "_limits.h", "_types.h", "_mcontext.h", "_param.h", "_endian.h", "arch.h", "cpuid_internal.h", "cpu_capabilities_public.h", "arm_features.inc", "endian.h", "locks.h", "limits.h", "atomic.h", "machine_cpuid.h", "memory_types.h", "pal_routines.h", "machine_routines.h", "param.h", "cpuid.h", "thread.h", "trap.h", "vmparam.h", "signal.h", "types.h", "AFKMemoryDescriptorOptions.h", "machine_machdep.h", "atm_types.h", "copyio.h", "_OSByteOrder.h", "crc.h", "Block.h", "OSBase.h", "OSByteOrder.h", "OSDebug.h", "OSMalloc.h", "OSAtomic.h", "OSReturn.h", "OSKextLib.h", "OSTypes.h", "version.h", "sysctl.h", "tree.h", "zconf.h", "zlib.h", "libkern.h", "kdp_callout.h", "kdp_en_debugger.h", "ipc_types.h", "krpc.h", "rpcv2.h", "xdr_subs.h", "nfs.h", "nfsproto.h", "bootp.h", "if_ether.h", "icmp6.h", "icmp_var.h", "igmp_var.h", "igmp.h", "in_pcb.h", "in_stat.h", "in_private.h", "in_arp.h", "in_var.h", "in_systm.h", "ip_var.h", "ip_icmp.h", "kpi_ipfilter.h", "ip6.h", "tcp_private.h", "ip.h", "tcp_timer.h", "tcp_fsm.h", "udp_var.h", "tcp_seq.h", "tcpip.h", "udp.h", "tcp_var.h", "tcp.h", "IOPCIFamilyDefinitions.h", "IOPCIDevice.iig", "PCIDriverKit.h", "IOPCIDevice.h", "audit_ioctl.h", "stdarg.h", "stdatomic.h", "stdbool.h", "stddef.h", "string.h", "stdint.h", "ptrauth.h", "math.h", "monotonic.h", "static_if.h", "machine_kpc.h", "machine_remote_time.h", "ipc_pthread_priority_types.h", "lz4_assembly_select.h", "vm_compressor_algorithms.h", "lz4.h", "pmap.h", "vm_dyld_pager.h", "vm_far.h", "vm_fault.h", "vm_map.h", "lz4_constants.h", "vm_options.h", "vm_pageout.h", "vm_memtag.h", "vm_shared_region.h", "vm_kern.h", "vfs_support.h", "vecLib.h", "vecLibTypes.h", "vBasicOps.h", "vForce.h", "vDSP.h", "uuid.h", "UNDReply.defs", "UNDRequest.defs", "KUNCUserNotifications.h", "UNDTypes.defs", "UNDTypes.h", "TargetConditionals.h", "apfs_boot_mount.tbd", "av.h", "cop.h", "bitcount.h", "cv.h", "ebcdic_tables.h", "EXTERN.h", "embedvar.h", "fakesdio.h", "feature.h", "form.h", "gv.h", "git_version.h", "dosish.h", "hv_macro.h", "hv_func.h", "config.h", "INTERN.h", "handy.h", "intrpvar.h", "invlist_inline.h", "hv.h", "iperlsys.h", "keywords.h", "libperl.tbd", "embed.h", "l1_char_class_tab.h", "mg_data.h", "mg_raw.h", "mg.h", "mg_vtable.h", "mydtrace.h", "nostdio.h", "op_reg_common.h", "op.h", "opcode.h", "inline.h", "overload.h", "opnames.h", "parser.h", "malloc_ctl.h", "pad.h", "perl_inc_macro.h", "perl_langinfo.h", "perl_siphash.h", "patchlevel.h", "perlapi.h", "metaconfig.h", "perlio.h", "perldtrace.h", "perliol.h", "perlvars.h", "perlsdio.h", "pp_proto.h", "perly.h", "pp.h", "reentr.h", "regcomp.h", "perl.h", "regexp.h", "scope.h", "sbox32_hash.h", "time64_config.h", "time64.h", "sv.h", "unixish.h", "uconfig.h", "utfebcdic.h", "unicode_constants.h", "utf8.h", "regnodes.h", "util.h", "vutil.h", "uudmap.h", "warnings.h", "XSUB.h", "zaphod32_hash.h", "encode.h", "python-3.9.pc", "python-3.9-embed.pc", "python3-embed.pc", "python3.pc", "AFKUser.tbd", "AdID.tbd", "Admin.tbd", "AirPlayReceiver.tbd", "AppSandbox.tbd", "ASEProcessing.tbd", "AuthenticationServicesCore.tbd", "WebGPU.tbd", "WebDriver.tbd", "MapKit.tbd", "SwiftUI.swiftoverlay", "WebKit.tbd", "WebKit.apinotes", "WKBackForwardList.h", "NSAttributedString.h", "WebKit.h", "WKBackForwardListItem.h", "WKContentRuleList.h", "WKContentRuleListStore.h", "WKContextMenuElementInfo.h", "WKDataDetectorTypes.h", "WKContentWorld.h", "WKError.h", "WKFoundation.h", "WKFindResult.h", "WKHTTPCookieStore.h", "WKFrameInfo.h", "WKNavigation.h", "WKFindConfiguration.h", "WKNavigationDelegate.h", "WKNavigationResponse.h", "WKOpenPanelParameters.h", "WebKitLegacy.h", "WKPreviewActionItem.h", "WKNavigationAction.h", "WKPreferences.h", "WKPreviewActionItemIdentifiers.h", "WKPreviewElementInfo.h", "WKProcessPool.h", "WKDownload.h", "WKPDFConfiguration.h", "WKScriptMessage.h", "WKSecurityOrigin.h", "WKScriptMessageHandler.h", "WKSnapshotConfiguration.h", "WKUIDelegate.h", "WKURLSchemeTask.h", "WKWebpagePreferences.h", "WKUserContentController.h", "WKWebsiteDataStore.h", "WKWebsiteDataRecord.h", "WKUserScript.h", "WKURLSchemeHandler.h", "WKWebViewConfiguration.h", "WKWebView.h", "WKScriptMessageHandlerWithReply.h", "WKWindowFeatures.h", "WKDownloadDelegate.h", "ASAccountAuthenticationModificationController.h", "ASAccountAuthenticationModificationViewController.h", "ASAuthorization.h", "ASAuthorizationAppleIDButton.h", "ASAccountAuthenticationModificationRequest.h", "ASAuthorizationAppleIDProvider.h", "ASAuthorizationAppleIDRequest.h", "ASAuthorizationAppleIDCredential.h", "ASAuthorizationController.h", "ASAuthorizationCredential.h", "ASAccountAuthenticationModificationExtensionContext.h", "ASAuthorizationError.h", "ASAuthorizationCustomMethod.h", "ASAuthorizationPasswordRequest.h", "ASAuthorizationOpenIDRequest.h", "ASAuthorizationPlatformPublicKeyCredentialDescriptor.h", "ASAuthorizationPlatformPublicKeyCredentialProvider.h", "ASAccountAuthenticationModificationReplacePasswordWithSignInWithAppleRequest.h", "ASAccountAuthenticationModificationUpgradePasswordToStrongPasswordRequest.h", "ASAuthorizationPlatformPublicKeyCredentialRegistrationRequest.h", "ASAuthorizationPlatformPublicKeyCredentialRegistration.h", "ASAuthorizationProvider.h", "ASAuthorizationPlatformPublicKeyCredentialAssertion.h", "ASAuthorizationPublicKeyCredentialAssertion.h", "ASAuthorizationPublicKeyCredentialAssertionRequest.h", "ASAuthorizationPublicKeyCredentialConstants.h", "ASAuthorizationProviderExtensionAuthorizationResult.h", "ASAuthorizationPublicKeyCredentialDescriptor.h", "ASAuthorizationPublicKeyCredentialLargeBlobAssertionOutput.h", "ASAuthorizationPasswordProvider.h", "ASAuthorizationPublicKeyCredentialLargeBlobRegistrationInput.h", "ASAuthorizationPublicKeyCredentialParameters.h", "ASAuthorizationPublicKeyCredentialLargeBlobRegistrationOutput.h", "ASAuthorizationPublicKeyCredentialRegistration.h", "ASAuthorizationPublicKeyCredentialRegistrationRequest.h", "ASAuthorizationPublicKeyCredentialLargeBlobAssertionInput.h", "ASAuthorizationSecurityKeyPublicKeyCredentialAssertion.h", "ASAuthorizationRequest.h", "ASAuthorizationPlatformPublicKeyCredentialAssertionRequest.h", "ASAuthorizationSecurityKeyPublicKeyCredentialProvider.h", "ASAuthorizationSingleSignOnCredential.h", "ASAuthorizationSecurityKeyPublicKeyCredentialDescriptor.h", "ASAuthorizationSecurityKeyPublicKeyCredentialAssertionRequest.h", "ASAuthorizationSecurityKeyPublicKeyCredentialRegistration.h", "ASAuthorizationSingleSignOnProvider.h", "ASAuthorizationWebBrowserExternallyAuthenticatableRequest.h", "ASAuthorizationWebBrowserPlatformPublicKeyCredentialAssertionRequest.h", "ASAuthorizationWebBrowserPlatformPublicKeyCredentialRegistrationRequest.h", "ASAuthorizationWebBrowserPublicKeyCredentialManager.h", "ASAuthorizationWebBrowserPlatformPublicKeyCredential.h", "ASAuthorizationWebBrowserSecurityKeyPublicKeyCredentialAssertionRequest.h", "ASAuthorizationWebBrowserSecurityKeyPublicKeyCredentialRegistrationRequest.h", "ASCOSEConstants.h", "ASCredentialIdentity.h", "ASAuthorizationSingleSignOnRequest.h", "ASCredentialIdentityStore.h", "ASAuthorizationWebBrowserSecurityKeyPublicKeyCredentialProvider.h", "ASCredentialProviderExtensionContext.h", "ASCredentialProviderViewController.h", "ASAuthorizationSecurityKeyPublicKeyCredentialRegistrationRequest.h", "ASCredentialServiceIdentifier.h", "ASExtensionErrors.h", "ASAuthorizationProviderExtensionAuthorizationRequest.h", "ASCredentialRequest.h", "ASAuthorizationWebBrowserPlatformPublicKeyCredentialProvider.h", "ASPasskeyAssertionCredential.h", "ASPasskeyCredentialRequest.h", "ASPasskeyCredentialRequestParameters.h", "ASCredentialIdentityStoreState.h", "ASPasskeyRegistrationCredential.h", "ASPasswordCredential.h", "ASPublicKeyCredential.h", "ASPasskeyCredentialIdentity.h", "ASPublicKeyCredentialClientData.h", "ASSettingsHelper.h", "ASWebAuthenticationSessionCallback.h", "ASWebAuthenticationSession.h", "ASWebAuthenticationSessionRequest.h", "ASWebAuthenticationSessionWebBrowserSessionManager.h", "AuthenticationServices.h", "ASFoundation.h", "AuthenticationServices.apinotes", "ASWebAuthenticationSessionWebBrowserSessionHandling.h", "ASPasswordCredentialIdentity.h", "ASPasswordCredentialRequest.h", "GameKit.apinotes", "GKAccessPoint.h", "GameKit.h", "GKAchievement.h", "GKAchievementViewController.h", "GKBasePlayer.h", "GKAchievementDescription.h", "GKChallengeEventHandler.h", "GKCloudPlayer.h", "GKChallengesViewController.h", "GKChallenge.h", "GKDefines.h", "GKError.h", "GKEventListener.h", "GKFriendRequestComposeViewController.h", "GKDialogController.h", "GKGameSessionEventListener.h", "GKGameSessionError.h", "GKGameCenterViewController.h", "GKGameSessionSharingViewController.h", "GKLeaderboardEntry.h", "GKLeaderboard.h", "GKLeaderboardScore.h", "GKGameSession.h", "GKLeaderboardSet.h", "GKLocalPlayer.h", "GKLeaderboardViewController.h", "GKMatch.h", "GKMatchmaker.h", "GKMatchmakerViewController.h", "GKPeerPickerController.h", "GKNotificationBanner.h", "GKPublicConstants.h", "GKPlayer.h", "GKPublicProtocols.h", "GKSavedGameListener.h", "GKScore.h", "GKSessionError.h", "GKVoiceChat.h", "GKTurnBasedMatchmakerViewController.h", "GKSession.h", "GKTurnBasedMatch.h", "GKSavedGame.h", "GKVoiceChatService.h" ], "public": 1, "adversary": "Turla Group, FIN7, APT34, APT28, DragonForce Malaysia Hacker Group, Indonesia Islamic Warriors Counc", "targeted_countries": [ "United States of America", "India", "Australia" ], "malware_families": [ { "id": "OSAtomic", "display_name": "OSAtomic", "target": null }, { "id": "OSReturn", "display_name": "OSReturn", "target": null }, { "id": "Ver", "display_name": "Ver", "target": null }, { "id": "Internet", "display_name": "Internet", "target": null } ], "attack_ids": [ { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1562", "name": "Impair Defenses", "display_name": "T1562 - Impair Defenses" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1055", "name": "Process Injection", "display_name": "T1055 - Process Injection" }, { "id": "T1049", "name": "System Network Connections Discovery", "display_name": "T1049 - System Network Connections Discovery" }, { "id": "T1573", "name": "Encrypted Channel", "display_name": "T1573 - Encrypted Channel" }, { "id": "T1553", "name": "Subvert Trust Controls", "display_name": "T1553 - Subvert Trust Controls" }, { "id": "T1010", "name": "Application Window Discovery", "display_name": "T1010 - Application Window Discovery" }, { "id": "T1112", "name": "Modify Registry", "display_name": "T1112 - Modify Registry" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 39, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ilyailya", "id": "298851", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 1968, "domain": 526, "FileHash-SHA256": 207, "hostname": 972, "email": 55, "FileHash-SHA1": 9, "FileHash-MD5": 4, "CVE": 2, "CIDR": 10 }, "indicator_count": 3753, "is_author": false, "is_subscribing": null, "subscriber_count": 35, "modified_text": "390 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 }, { "id": "66f9ae71e7d4851280fa367f", "name": "The Jane Doe Syndrome Files: Credential Dumping and Data Exfiltration", "description": "This pulse outlines a series of techniques (Tactics) utilized in a cyber intrusion targeting Jane Doe's MacBook. These techniques span various stages of the attack lifecycle, including credential dumping (T1003), system discovery (T1016, T1082), and data exfiltration methods (T1114, T1560). The attacker employed advanced obfuscation strategies (T1027) and input capture methods (T1056) to maintain persistence and evade detection, while also utilizing command and scripting interpreters (T1059) to execute malicious commands.\n\nFurthermore, the adversary manipulated system tokens (T1134) and leveraged remote access software (T1219) to control the compromised system. Techniques for data destruction (T1485) and artifact hiding (T1564) indicate a concerted effort to cover tracks and minimize detection.\n\nBy examining these techniques, we can better understand the methods used in this intrusion, facilitating enhanced detection and prevention strategies for future incidents.", "modified": "2024-11-08T00:03:35.782000", "created": "2024-09-29T19:45:53.583000", "tags": [ "autogenerated", "please", "class", "hp laserjet", "duplexer", "modify", "printer", "description", "location", "share", "printer make", "ppd file", "model", "driver", "ipp everywhere", "printers", "hardware", "baud rate", "parity", "odd data", "flow control", "software", "rtscts", "dtrdsr", "input", "type", "name", "value", "hidden", "delete class", "form", "h2 class", "warning", "p align", "allow", "advanced", "use kerberos", "save", "max clients", "maximum", "metadata", "documents", "max log", "img src", "width", "height", "align", "absmiddle", "indicator", "status", "printername", "idle", "edit", "cupsdconf", "error", "blockquote", "unknown", "h3 class", "jobs", "help jobs", "helptitle", "qtext", "topic", "bmtext", "qptext", "cups", "search", "online help", "documents all", "hold job", "server default", "shared", "test page", "pause class", "accept jobs", "move all", "jobs cancel", "all jobs", "class delete", "cancel", "move job", "destination", "release", "reprint", "action", "method", "name user", "size pages", "state control", "jobid", "withheld", "held", "change settings", "label", "input type", "select name", "multiple size", "option", "inches feet", "table", "submit", "set default", "prev", "next", "last", "accept", "options", "default", "delete printer", "form action", "pause", "reject", "resume", "print", "self test", "pause printer", "location make", "model status", "test", "please stand", "allowed users", "prevent", "whichjobs", "standard rom", "standard", "copyright", "standard font", "cups ppd", "easy software", "apache license", "license", "symbol special", "deskjet", "cups sample", "hplaserjet", "laserjet", "hpdeskjet", "hpdeskjet2", "epson", "stylus color", "stylus photo", "escp", "epson9pin", "zebra", "dymo3x0", "dymo", "labelwriter", "advance", "leading", "move", "black", "gold", "rotate", "never", "cyan", "yellow", "turn", "long edge", "edge", "oversize", "address", "b1jis b1", "adobe", "small", "image", "apple mime", "xhtml", "pict string", "cgimageio", "radiance", "fujifilm", "preview", "os x", "colorsync", "airprint", "do not", "this file", "it is", "you install", "versions of", "base mime", "format", "postscript", "language", "pattern match", "ras2", "pwgraster", "comment", "attr", "group", "attr language", "attr integer", "attr name", "attributes", "attr keyword", "post", "resource admin", "operation", "group operation", "create", "withvalue", "display", "d recipienturi", "expect", "tv d", "member", "createjob", "senddocument", "create faxout", "get list", "display jobname", "cupsgetdevices", "get job", "expect jobstate", "job template", "get printer", "cupsgetppd", "cupsgetppds", "get ppd", "attr text", "product", "psversion", "version", "message", "hello", "cupsgetprinters", "beep", "sound", "count", "ingroup", "oftype keyword", "oftype integer", "oftype text", "oftype charset", "oftype enum", "az09", "withallvalues", "mediaregex", "oftype", "print file", "printjob", "test printjob", "file", "ippurischeme", "member integer", "print test", "printuri", "post resource", "validatejob", "validate", "printjob group", "repeatmatch", "choice", "envelope", "resolution", "modelname", "inputslot", "pcfilename", "modelnumber", "attribute", "false", "darkness", "media", "generic", "mark", "dark", "tear", "cupsbanner show", "header printer", "footer printer", "notice cups", "header cover", "page footer", "cover page", "header top", "secret footer", "top secret", "header secret", "footer secret", "vzefibootloader", "nsunavailable", "virtualization", "base class", "vzbootloader", "network device", "initialize", "host network", "property", "return", "define", "nsarray", "bsd name", "ethernet", "vzconsoledevice", "console port", "defines", "a directory", "vzexport extern", "apiavailable", "bool", "nsenum", "nsinteger", "local file", "raw format", "nsurl", "nserror", "file handle", "storage device", "nserror error", "nsfilehandle", "boot loader", "efi rom", "efi boot", "vzerrorcode", "vzerrordomain", "error type", "nserror domain", "vzerrorsave", "nbd server", "nbd client", "nsoptions", "nsuinteger", "nsswiftname", "nvram", "write", "sorcvbuf", "sosndbuf", "mtu value", "data", "data sent", "true", "graphics", "intel", "indicate", "enable", "nsdata", "opaque", "host audio", "host output", "host input", "cgsize", "new display", "protocol", "unix domain", "socket", "rosetta", "caching", "rosetta daemon", "nsstring", "abstract socket", "rosetta support", "linux", "arm64", "availability", "download", "vzmacaddress", "mac address", "a vzmacaddress", "linux kernel", "ram disk", "linux boot", "a mac", "configuration", "mac hardware", "describes", "mac platform", "mac keyboard", "usb keyboard", "mac machine", "apple silicon", "rosetta runtime", "nsobject", "handle", "init", "url property", "whether", "recovery", "block", "nullable", "load", "mac trackpad", "usb pointing", "cpus", "overwrite", "nsdictionary", "directory share", "check", "namemax", "vznetworkdevice", "nbd url", "nbd uniform", "nbd protocol", "url error", "nat attachment", "a network", "nvm express", "nsscreen", "nssize", "serial port", "directory", "spice agent", "spice guest", "a console", "vzsocketdevice", "vzstoragedevice", "vzexport", "usb controller", "vzusbcontroller", "usb device", "device uuid", "nsuuid uuid", "usb mass", "vzusbdevice", "virtio block", "device", "storage storage", "virtio console", "delegate object", "a class", "extra care", "virtio entropy", "nsstring name", "array", "virtio file", "system device", "discussion", "nsstring tag", "port", "bool isconsole", "a virtio", "virtio graphics", "virtio gpu", "virtio", "port array", "utf8", "virtio network", "macaddress", "virtio socket", "close", "does nothing", "virtio sound", "nsarray streams", "pointer", "device input", "a pcm", "audio stream", "source", "sink", "device output", "device stream", "memory balloon", "target memory", "return yes", "start", "stop", "usb xhci", "automatically", "nsview", "virtual machine", "cpucount", "verify", "apple swift", "o librarylevel", "swift", "cachingoptions", "vzaudiodevice", "vzdebugstub", "swiftname", "targetosiphone", "targetososx", "targetosios", "apple computer", "targetostv", "targetosvision", "targetostvos", "targetosxr", "vtbaseh", "vtint32point", "vtint32size", "iphonena", "apiunavailable", "vtexport const", "abstract", "cfstringref", "readwrite", "cfnumber", "cfboolean", "optional", "null", "macos", "cmnullable", "pass null", "call", "video toolbox", "contains", "cmtime duration", "cvimagebuffer", "vterrorsh", "cfoptions", "12914", "uint32", "osstatus", "12900", "12901", "12902", "12903", "17690", "vtexport", "encoder", "zero", "alpha", "requires", "cmsamplebuffer", "prototype", "osstatus status", "cfrelease", "cvpixelbuffer", "iosurface", "hdr metadata", "hdr per", "frame metadata", "cf type", "cfretain", "a mechanism", "cmbridgedtype", "interface", "specifies", "a reference", "pixel rotation", "session", "a pixel", "cf object", "vtframesilo", "returns", "vtframesiloh", "vtframesiloref", "pass", "pixel transfer", "vtexport void", "media extension", "video raw", "processors", "standard video", "metal device", "metal", "rawprocessors", "cfstring", "copy", "vtsessionh", "cfdictionaryref", "apis", "vtsessionref", "raw processor", "a cfdictionary", "cfswiftname", "vtutilitiesh", "cgimage", "builds", "cfarrayref", "raw processing", "list", "list element", "cfdictionaries", "skipper", "vdspdftexecute", "vdspdftexecuted", "vdspdftzop", "vdspfft16copv", "vdspfft16zopv", "vdspfft32copv", "vdspfft32zopv", "vdspbiquad", "vdspbiquadd", "vdspbiquadm", "project version", "created", "elana stettin", "apple", "swextern", "title", "typedef", "param", "nsstring title", "represents", "nsitemprovider", "const", "swhidden extern", "swdefines", "swextern extern", "sha256 hash", "merkle tree", "sociallayer", "swperson", "devin clary", "swaction", "sbappcontext", "sbapplocator", "sbapplication", "sbelementarray", "sbobject", "scriptingbridge", "objecttype", "finder", "bridge", "index", "apple event", "target", "urls", "locator", "scripting", "desctype", "receiver", "track", "code", "sccontentfilter", "bgra format", "rgha format", "const nonnull", "nserrorenum", "nsurl outputurl", "avfiletypempeg4", "provides", "scwindow", "scdisplay", "cgrect frame", "bool indicating", "pixel", "scstream", "control center", "takes", "cfdictionary", "rbhash", "initvmrandom", "initvmtranscode", "initarray", "initbarevm", "initbignum", "initcomplex", "initcont", "initdir", "initfile", "libxml", "require", "cfpropertylist", "xml parser", "libxmlparser", "xml file", "plist", "cfplisterror", "exception", "format error", "easy", "kruse", "mit license", "standarderror", "cfformaterror", "cftypeerror", "nokogiri", "parserinterface", "cftype", "cfdate", "cfinteger", "blob", "ruby string", "uidfixnum", "ruby integer", "date", "format constant", "formatbinary", "formatxml", "magicnumber", "enumerator", "cfdata", "ruby", "example", "john", "path", "plainparser", "ascii", "cfreal", "importplain", "escapechar", "read", "length", "utf16be", "cfarray", "offsetsize", "integer", "rexml", "rexmlparser", "float", "appledtd plist", "dom node", "prefix", "config", "item", "bindir", "libruby", "rubypath", "fileoperations", "arch", "installer", "template", "install", "major", "yesno", "todo", "kwargs", "makefiles", "miniportile", "cmakecmd", "configure", "cmakefile", "cmake", "keyringname", "debug", "targetos", "ldflags", "gpgexe", "digest", "stdout", "patch", "installerror", "savefile", "task", "packages", "dlext", "minero aoki", "rubyversion", "loaderror", "sqlite3", "was sqlite3", "apiobjects", "database", "pragmas", "resultset", "sqlite3ruby faq", "sqliteruby faq", "value klass", "qnil", "sqliteok", "sqliteerror", "sqliteinternal", "sqliteperm", "sqliteabort", "sqlitebusy", "sqlitelocked", "datagetstruct", "int2num", "main", "done", "stringvalueptr", "note", "sqlite3ruby", "sqlite3rubyptr", "unused", "gnuc", "lclint", "usasciip", "utf8p", "utf16lep", "utf16le", "utf16bep", "sqlite3stmtruby", "rubyplatform", "darwin", "rcarchs", "libpkgconfig", "pkgconfigpath", "pkgconf", "mswin", "cflags", "install sqlite3", "int2fix", "rbignumlen", "sizeofbdigits", "charbit", "bdigit", "bmax", "value unused", "sqliteopenuri", "open", "requireopendb", "nilp", "qtrue", "id2sym", "requireopenstmt", "donep", "rstringlen", "num2int", "attrs", "deal", "xsd module", "xmlparser", "nokogiri xml", "simply", "rubyengine", "slop decorator", "css3 selector", "xpath", "nokogiri class", "parse", "html", "xml document", "0x30", "0x41", "0x61", "gumbogentable", "gumboasciicntrl", "gumboasciispace", "gumboasciidigit", "constfn", "gumboasciih", "gumboasciialpha", "gumboasciialnum", "c0 control", "gumbocharrefh", "gumboattributeh", "gumboattribute", "craig barnes", "google inc", "as is", "basis", "or conditions", "any kind", "gumboerrorh", "gumbotag", "additional", "gumbovector", "encoding", "gumboerrparser", "gumboerrortype", "html tag", "minwordlength", "maxwordlength", "maxhashvalue", "ansic code", "m100 n", "computed", "totalkeywords", "minhashvalue", "doctype", "capacity", "doctype system", "sourcelength", "sourcetext", "silence", "html5", "a struct", "text", "gumbo", "gumboh", "anything", "gumboparserh", "output", "library", "oopstyle", "gumboparser", "const localname", "string", "ietfdtd html", "w3cdtd html", "level", "html strict", "terminator", "final", "buffer", "gnucatleast", "hasattribute", "macrosh", "printf", "returnsnonnull", "win32", "unusedifndebug", "malloc", "pure", "m100", "gumbotaglookuph", "gumbotag tag", "taghashslot", "gumbotagunknown", "gumbotokentypeh", "gumbotokencdata", "gumbotokennull", "gumbotokeneof", "gumbotokentype", "gumbotaglast", "position", "gumbotokenizerh", "struct", "gumbotoken", "spec", "stack", "emittoken", "continue", "current", "utf8iterator", "utf8accept", "parser", "html5 spec", "rest", "gumboutf8h", "unicode code", "html5 parser", "utf8 decoding", "func", "gumbodebug", "gumboutilh", "utility", "debug wrapper", "script", "attribute value", "comment end", "doctype name", "cdata section", "rcdata end", "rawtext end", "initialcapacity", "gumboalloc", "vector", "memmove", "gumbovectorh", "initializes", "ownership", "stringvaluecstr", "rtest", "xmlchar", "html document", "nokogiristrnew2", "html4", "value get", "qfalse", "a list", "value list", "attrsdepr", "attrsopt", "chunk", "pushparser", "xmlsax", "value chunk", "w3c dom", "xmlelementnode", "finds", "qundef", "value val", "value args", "value exc", "libxml2patches", "rbconfig", "packagerootdir", "cppflags", "libs", "dldflags", "nokogiri test", "attributedecl", "defaultvalue", "atype", "tree", "ctxt", "noreturn", "xmldocptr doc", "private", "nokogirinative", "nokogiristrnew", "xmldoc", "value setvalue", "value content", "xmlchar value", "xmlnode cur", "content", "cdata", "cdata element", "value argv", "value rbnode", "document", "value document", "value getname", "pcdata", "element", "mult", "datawrapstruct", "value ctxtval", "mydoc", "userdata", "encodinghandler", "value key", "delete", "elementdecl", "id iddocument", "etype", "value prefix", "orig", "externalid", "systemid", "nodenr", "xmlnodeset", "nodeset", "nodetab", "xmldtd", "value hash", "publicid", "notation", "hash", "rbfuncall", "parseargs", "xmlnode", "without", "href", "xmlns", "namespace node", "nodes", "value rbreader", "relaxng schema", "relaxng", "value name", "nokogirisaxself", "rbivget", "rbstrorqnil", "xmlchar name", "xmlparserctxt", "text element", "value string", "schema", "xmlschema", "context", "stringval", "wrapper", "emp0001n", "emp0002n", "xslt", "handler", "handlerstate", "checktype", "tarray", "id documentid", "comment element", "node", "first", "prop", "typeerror", "gc", "pkpublicchannel", "pkpushpayload", "pkpushregistry", "pkpushtypevoip", "pushkit", "object", "pkpushtype type", "forward", "http", "apple push", "pkexport extern", "nsstringenum", "payload data", "voip", "json format", "callkit", "pkpushtype", "framework", "apps", "push", "odsessioncreate", "odattributemap", "odconfiguration", "odcontext", "odmappings", "odmoduleentry", "odnode", "odquery", "odrecord", "odrecordmap", "nsavailablemac", "original code", "nsstring value", "custom", "modifications", "apple public", "source license", "of any", "nsavailable", "nsrunloop", "objc", "sets", "odsession", "sfauthorization", "will", "odsessionref", "cfexport", "odqueryref", "odnoderef", "cfexport bool", "odrecordref", "cfdataref", "cfexport const", "utf8 encoding", "odattributetype", "odrecordtype", "attribute type", "local", "realm", "cftyperef", "odnodegetdsref", "odnodegettypeid", "odrecorddelete", "odtriggercancel", "odnodeinit", "odquerycreate", "odqueryinit", "odsessioninit", "albuffer3i", "albufferdata", "albufferf", "albufferfv", "albufferi", "albufferiv", "aldistancemodel", "aldopplerfactor", "algetbooleanv", "algetbuffer3f", "alcapi", "alcapientry", "alcboolean", "targetosmac", "alcdevice", "alcenum param", "alalch", "alcchar", "alcsizei", "capture", "alenum param", "alapi", "aluint sid", "alfloat", "aluint bid", "alsizei", "alint", "alfloat value", "alapientry", "aluint", "play", "speed", "bits", "alutapi alvoid", "alvoid data", "alsizei size", "alsizei freq", "gnu library", "general public", "aluth", "alenum format", "openalopenalh", "umbrella header", "alvoid", "openal", "alvoid nonnull", "alenum", "roger beep", "sendable", "preconcurrency", "rawvalue", "network import", "failure", "service", "must", "number", "stride", "brief", "descriptor", "matrix", "mtlpackedfloat3", "infinity", "metalversion", "minimum point", "maximum point", "interpolation", "translation", "offset", "acceleration", "declare", "prior", "insert", "nonnull", "nsrange", "mtldevice", "t argname", "mtlstructtype", "mtlarraytype", "mtltype", "mtlpointertype", "instance", "methodkind", "swiftprivate", "mtlbuffer", "nullability", "mtlcommandqueue", "mtlresource", "mtlresidencyset", "command encoder", "individual", "mtlexport", "xcode", "gpu trace", "apideprecated", "mtlcapturescope", "remarks", "mtlallocation", "metal command", "mtldispatchtype", "mtlorigin", "mtlsize", "mtlblitoption", "flush", "gpu work", "marks", "specify", "mtlinline", "mtlintern", "stdcversion", "mtlextern", "definition", "inline", "nsstring label", "stencil", "defaults", "allocate", "typical", "nsprocessinfo", "mtldrawable", "present", "cftimeinterval", "gpustarttime", "gpuendtime", "mtlcountersh", "mtlcounter", "mtlcounterset", "mtllibrary", "a container", "mtlfence", "mtldatatype", "default usage", "mtlfunction", "mtllogcontainer", "mtlsharedevent", "mtlevent", "synchronously", "a function", "cpu cache", "requiredsize", "behavior", "mtlheap", "query device", "dispatch", "metal shading", "language guide", "raytriangle", "vends", "groups", "encodes", "mtliofilehandle", "mtlextern sizet", "mtlextern void", "mtlstoreaction", "mtlloglevel", "enum", "mtlmutability", "astcetc2bc", "normal", "astc", "clamptoedge", "depth", "mtlcoordinate2d", "nsnumber", "controls", "mtlclearcolor", "adds", "mtlregion", "cpu mapping", "mtltexture", "mtlindextype", "filter option", "clamp", "mtlrenderstages", "draw", "mtlstepfunction", "vertex", "compute", "gpu resource", "nsuinteger x", "identify", "nsuinteger y", "nsuinteger z", "mtlsize size", "mtlvertexformat", "nsuintegermax", "mtlpixelformat", "mtltexturetype", "slice", "swiftui", "coregraphics", "swift import", "previewregistry", "libraryitem", "category", "dict", "apple root", "code signing", "public", "uus10u", "GUANGZHOU FIVE SIX TECHNOLOGY", "Havana Syndrome", "Aishah Lazim", "Al-Arqam", "Brooklyn" ], "references": [ "httpd.exp", "metadata.json", "add-class.tmpl", "choose-make.tmpl", "choose-model.tmpl", "choose-device.tmpl", "add-printer.tmpl", "choose-serial.tmpl", "class-added.tmpl", "choose-uri.tmpl", "class-confirm.tmpl", "admin.tmpl", "class-deleted.tmpl", "class-modified.tmpl", "classes-header.tmpl", "command.tmpl", "classes.tmpl", "edit-config.tmpl", "error-op.tmpl", "class-jobs-header.tmpl", "error.tmpl", "header.tmpl", "help-header.tmpl", "help-printable.tmpl", "help-trailer.tmpl", "job-hold.tmpl", "class.tmpl", "job-cancel.tmpl", "job-move.tmpl", "job-moved.tmpl", "job-release.tmpl", "job-restart.tmpl", "list-available-printers.tmpl", "jobs.tmpl", "norestart.tmpl", "option-boolean.tmpl", "option-header.tmpl", "option-conflict.tmpl", "option-pickmany.tmpl", "option-pickone.tmpl", "modify-printer.tmpl", "option-trailer.tmpl", "pager.tmpl", "printer-cancel-jobs.tmpl", "printer-added.tmpl", "printer-accept.tmpl", "printer-configured.tmpl", "printer-default.tmpl", "printer-confirm.tmpl", "printer-deleted.tmpl", "printer-jobs-header.tmpl", "printer-modified.tmpl", "jobs-header.tmpl", "printer-stop.tmpl", "modify-class.tmpl", "printer-reject.tmpl", "printers-header.tmpl", "printer-start.tmpl", "printer.tmpl", "printers.tmpl", "set-printer-options-trailer.tmpl", "test-page.tmpl", "restart.tmpl", "users.tmpl", "set-printer-options-header.tmpl", "search.tmpl", "trailer.tmpl", "font.defs", "hp.h", "epson.h", "label.h", "raster.defs", "media.defs", "apple.types", "apple.convs", "mime.convs", "mime.types", "cancel-current-job.test", "create-job-sheets.test", "create-job.test", "create-job-format.test", "create-job-timeout.test", "create-printer-subscription.test", "cups-create-local-printer.test", "fax-job.test", "get-completed-jobs.test", "get-devices.test", "get-job-attributes.test", "get-job-attributes2.test", "get-notifications.test", "get-jobs.test", "get-job-template-attributes.test", "get-ppd-printer.test", "get-ppds-drv-only.test", "get-ppd.test", "get-ppds-make-and-model.test", "get-ppds-make.test", "get-ppds-product.test", "get-ppds-psversion.test", "get-ppds-language.test", "get-printer-description-attributes.test", "get-ppds.test", "get-printer-attributes.test", "get-subscriptions.test", "identify-printer-display.test", "get-printers-printer-id.test", "identify-printer-multiple.test", "get-printers.test", "identify-printer.test", "get-printer-attributes-suite.test", "ipp-2.0.test", "ipp-2.2.test", "ipp-backend.test", "ipp-2.1.test", "print-job-and-wait.test", "print-job-deflate.test", "print-job-hold.test", "print-job-gzip.test", "ipp-1.1.test", "print-job-manual.test", "print-job-password.test", "print-job.test", "print-job-media-col.test", "print-uri.test", "print-job-letter.test", "set-attrs-hold.test", "validate-job.test", "ipp-everywhere.test", "sample.drv", "testprint", "classified", "standard", "topsecret", "secret", "confidential", "unclassified", "ntp_opendirectory.conf", "ntp.conf", "notify.conf", "nfs.conf", "nsmb.conf", "xtab", "6015FED9-D723-4332-87D9-C478CF341407.aamdownload", "AuraService-fda-test", "com.adobe.acrobat.rna.AcroCefBrowserLock.DC", "ExmanProcessMutex", "proxy.xml", "A53749AF-3855-4842-A1E7-4AEFA60BD2AC", "XPdb-wal", "VZBootLoader.h", "VZAudioInputStreamSource.h", "VZBridgedNetworkDeviceAttachment.h", "VZAudioOutputStreamSink.h", "VZBridgedNetworkInterface.h", "VZConsoleDeviceConfiguration.h", "VZConsoleDevice.h", "VZConsolePortConfiguration.h", "VZDirectorySharingDevice.h", "VZDirectoryShare.h", "VZDefines.h", "VZDiskImageStorageDeviceAttachment.h", "VZDiskSynchronizationMode.h", "VZDiskBlockDeviceStorageDeviceAttachment.h", "Virtualization.h", "VZDirectorySharingDeviceConfiguration.h", "VZEntropyDeviceConfiguration.h", "VZEFIBootLoader.h", "VZError.h", "VZEFIVariableStore.h", "VZFileHandleNetworkDeviceAttachment.h", "VZFileHandleSerialPortAttachment.h", "VZFileSerialPortAttachment.h", "VZGraphicsDevice.h", "VZGenericPlatformConfiguration.h", "VZGenericMachineIdentifier.h", "VZGraphicsDeviceConfiguration.h", "VZGraphicsDisplayConfiguration.h", "VZHostAudioOutputStreamSink.h", "VZKeyboardConfiguration.h", "VZHostAudioInputStreamSource.h", "VZGraphicsDisplay.h", "VZAudioDeviceConfiguration.h", "VZLinuxRosettaUnixSocketCachingOptions.h", "VZLinuxRosettaAbstractSocketCachingOptions.h", "VZLinuxRosettaDirectoryShare.h", "VZMACAddress.h", "VZLinuxBootLoader.h", "VZMacGraphicsDevice.h", "VZMacGraphicsDisplay.h", "VZMacGraphicsDeviceConfiguration.h", "VZMacHardwareModel.h", "VZMacKeyboardConfiguration.h", "VZMacMachineIdentifier.h", "VZMacOSBootLoader.h", "VZLinuxRosettaCachingOptions.h", "VZMacOSInstaller.h", "VZMacOSVirtualMachineStartOptions.h", "VZMacOSRestoreImage.h", "VZMacTrackpadConfiguration.h", "VZMacOSConfigurationRequirements.h", "VZMemoryBalloonDevice.h", "VZMemoryBalloonDeviceConfiguration.h", "VZMacAuxiliaryStorage.h", "VZMultipleDirectoryShare.h", "VZMacPlatformConfiguration.h", "VZNetworkDevice.h", "VZNetworkBlockDeviceStorageDeviceAttachment.h", "VZNATNetworkDeviceAttachment.h", "VZNetworkDeviceAttachment.h", "VZPlatformConfiguration.h", "VZPointingDeviceConfiguration.h", "VZNetworkDeviceConfiguration.h", "VZSharedDirectory.h", "VZSerialPortAttachment.h", "VZNVMExpressControllerDeviceConfiguration.h", "VZMacGraphicsDisplayConfiguration.h", "VZSerialPortConfiguration.h", "VZSingleDirectoryShare.h", "VZSpiceAgentPortAttachment.h", "VZSocketDeviceConfiguration.h", "VZSocketDevice.h", "VZStorageDevice.h", "VZStorageDeviceAttachment.h", "VZStorageDeviceConfiguration.h", "VZUSBControllerConfiguration.h", "VZUSBDeviceConfiguration.h", "VZUSBMassStorageDevice.h", "VZUSBKeyboardConfiguration.h", "VZUSBController.h", "VZUSBDevice.h", "VZVirtioBlockDeviceConfiguration.h", "VZUSBScreenCoordinatePointingDeviceConfiguration.h", "VZUSBMassStorageDeviceConfiguration.h", "VZVirtioConsoleDevice.h", "VZVirtioConsoleDeviceConfiguration.h", "VZVirtioConsoleDeviceSerialPortConfiguration.h", "VZVirtioEntropyDeviceConfiguration.h", "VZVirtioConsolePort.h", "VZVirtioConsolePortConfigurationArray.h", "VZVirtioFileSystemDevice.h", "VZVirtioConsolePortConfiguration.h", "VZVirtioGraphicsDevice.h", "VZVirtioGraphicsDeviceConfiguration.h", "VZVirtioGraphicsScanout.h", "VZVirtioGraphicsScanoutConfiguration.h", "VZVirtioConsolePortArray.h", "VZVirtioFileSystemDeviceConfiguration.h", "VZVirtioNetworkDeviceConfiguration.h", "VZVirtioSocketConnection.h", "VZVirtioSocketDevice.h", "VZVirtioSoundDeviceConfiguration.h", "VZVirtioSocketListener.h", "VZVirtioSoundDeviceInputStreamConfiguration.h", "VZVirtioSocketDeviceConfiguration.h", "VZVirtioSoundDeviceOutputStreamConfiguration.h", "VZVirtioSoundDeviceStreamConfiguration.h", "VZVirtioTraditionalMemoryBalloonDeviceConfiguration.h", "VZVirtualMachineDelegate.h", "VZVirtualMachineStartOptions.h", "VZVirtioTraditionalMemoryBalloonDevice.h", "VZVirtualMachine.h", "VZXHCIControllerConfiguration.h", "VZVirtualMachineView.h", "VZVirtualMachineConfiguration.h", "VZXHCIController.h", "x86_64-apple-macos.swiftinterface", "arm64e-apple-macos.swiftinterface", "module.modulemap", "Virtualization.tbd", "VideoToolbox.apinotes", "VideoToolbox.h", "VTBase.h", "VTDecompressionProperties.h", "VTCompressionSession.h", "VTErrors.h", "VTCompressionProperties.h", "VTDecompressionSession.h", "VTHDRPerFrameMetadataGenerationSession.h", "VTMultiPassStorage.h", "VTPixelRotationSession.h", "VTFrameSilo.h", "VTPixelRotationProperties.h", "VTPixelTransferSession.h", "VTProfessionalVideoWorkflow.h", "VTRAWProcessingProperties.h", "VTPixelTransferProperties.h", "VTSession.h", "VTUtilities.h", "VTVideoEncoderList.h", "VTRAWProcessingSession.h", "libvDSP.tbd", "SharedWithYouCore.h", "SWAction.h", "SWCollaborationActionHandler.h", "SWCollaborationCoordinator.h", "SWCollaborationMetadata.h", "SWCollaborationOption.h", "SWCollaborationOptionsPickerGroup.h", "SWCollaborationOptionsGroup.h", "SWCollaborationShareOptions.h", "SWDefines.h", "SWPersonIdentity.h", "SWPerson.h", "SWStartCollaborationAction.h", "SWPersonIdentityProof.h", "SWUpdateCollaborationParticipantsAction.h", "SharedWithYouCore.tbd", "ScriptingBridge.tbd", "SBElementArray.h", "ScriptingBridge.apinotes", "ScriptingBridge.h", "SBApplication.h", "SBObject.h", "SCScreenshotManager.h", "SCError.h", "SCRecordingOutput.h", "ScreenCaptureKit.h", "SCShareableContent.h", "SCContentSharingPicker.h", "SCStream.h", "Ruby.tbd", "rbLibXMLParser.rb", "rbCFPlistError.rb", "rbNokogiriParser.rb", "rbCFTypes.rb", "rbCFPropertyList.rb", "rbPlainCFPropertyList.rb", "rbBinaryCFPropertyList.rb", "rbREXMLParser.rb", "cfpropertylist.rb", "setup.rb", "libxml.rb", "xml.rb", "mini_portile_cmake.rb", "version.rb", "mini_portile.rb", "sqlite3.rb", "faq.rb", "exception.c", "backup.h", "backup.c", "database.h", "exception.h", "sqlite3_ruby.h", "statement.h", "extconf.rb", "sqlite3.c", "database.c", "statement.c", "nokogiri.rb", "ascii.c", "ascii.h", "char_ref.h", "attribute.h", "attribute.c", "error.h", "foreign_attrs.c", "insertion_mode.h", "error.c", "gumbo.h", "parser.h", "replacement.h", "parser.c", "string_buffer.h", "string_buffer.c", "string_piece.c", "macros.h", "svg_attrs.c", "tag_lookup.h", "svg_tags.c", "tag_lookup.c", "token_type.h", "tag.c", "token_buffer.h", "token_buffer.c", "tokenizer.h", "tokenizer.c", "utf8.c", "utf8.h", "util.c", "util.h", "tokenizer_states.h", "vector.c", "vector.h", "html4_document.c", "html4_entity_lookup.c", "html4_element_description.c", "html4_sax_push_parser.c", "libxml2_backwards_compat.c", "nokogiri.c", "test_global_handlers.c", "xml_attribute_decl.c", "nokogiri.h", "xml_attr.c", "xml_cdata.c", "xml_document_fragment.c", "xml_document.c", "xml_element_content.c", "html4_sax_parser_context.c", "xml_encoding_handler.c", "xml_element_decl.c", "xml_entity_decl.c", "xml_node_set.c", "xml_dtd.c", "gumbo.c", "xml_namespace.c", "xml_processing_instruction.c", "xml_reader.c", "xml_relax_ng.c", "xml_entity_reference.c", "xml_sax_parser.c", "xml_sax_push_parser.c", "xml_sax_parser_context.c", "xml_text.c", "xml_schema.c", "xml_xpath_context.c", "xslt_stylesheet.c", "xml_syntax_error.c", "xml_comment.c", "xml_node.c", "PushKit.tbd", "PKPushCredentials.h", "PKDefines.h", "PKPushPayload.h", "PushKit.h", "PKPushRegistry.h", "PushKit.apinotes", "OpenDirectory.tbd", "ODAttributeMap.h", "ODMappings.h", "NSOpenDirectory.h", "ODConfiguration.h", "ODQuery.h", "ODNode.h", "OpenDirectory.h", "ODRecordMap.h", "ODSession.h", "ODModuleEntry.h", "ODRecord.h", "CFODContext.h", "CFODSession.h", "CFOpenDirectory.h", "CFODQuery.h", "CFODNode.h", "CFODRecord.h", "CFOpenDirectoryConstants.h", "CFOpenDirectory.tbd", "OpenAL.tbd", "alc.h", "al.h", "alut.h", "OpenAL.h", "MacOSX_OALExtensions.h", "arm64e-apple-ios-macabi.swiftinterface", "x86_64-apple-ios-macabi.swiftinterface", "SwiftUI.swiftoverlay", "MTLAccelerationStructure.h", "Metal.h", "MTLAccelerationStructureTypes.h", "MTLAccelerationStructureCommandEncoder.h", "MTLArgumentEncoder.h", "MTLArgument.h", "MTLBinaryArchive.h", "Metal.apinotes", "MTLBlitPass.h", "MTLBuffer.h", "MTLCaptureManager.h", "MTLCaptureScope.h", "MTLAllocation.h", "MTLCommandEncoder.h", "MTLCommandBuffer.h", "MTLComputePass.h", "MTLBlitCommandEncoder.h", "MTLCommandQueue.h", "MTLDefines.h", "MTLDepthStencil.h", "MTLComputePipeline.h", "MTLDeviceCertification.h", "MTLDrawable.h", "MTLCounters.h", "MTLComputeCommandEncoder.h", "MTLDynamicLibrary.h", "MTLFence.h", "MTLFunctionConstantValues.h", "MTLFunctionDescriptor.h", "MTLFunctionLog.h", "MTLFunctionHandle.h", "MTLEvent.h", "MTLFunctionStitching.h", "MTLHeap.h", "MTLDevice.h", "MTLIndirectCommandBuffer.h", "MTLIntersectionFunctionTable.h", "MTLIOCommandQueue.h", "MTLLinkedFunctions.h", "MTLIOCommandBuffer.h", "MTLIOCompressor.h", "MTLParallelRenderCommandEncoder.h", "MTLLogState.h", "MTLPipeline.h", "MTLLibrary.h", "MTLPixelFormat.h", "MTLRasterizationRate.h", "MTLRenderPass.h", "MTLRenderPipeline.h", "MTLResidencySet.h", "MTLResourceStateCommandEncoder.h", "MTLResourceStatePass.h", "MTLResource.h", "MTLIndirectCommandEncoder.h", "MTLSampler.h", "MTLRenderCommandEncoder.h", "MTLStageInputOutputDescriptor.h", "MTLVisibleFunctionTable.h", "MTLTypes.h", "MTLVertexDescriptor.h", "MTLTexture.h", "WebKit.arm64e.bridgesupport", "WebKit.bridgesupport" ], "public": 1, "adversary": "DragonForce Hacker Group Malaysia", "targeted_countries": [ "United States of America" ], "malware_families": [ { "id": "VZBootLoader", "display_name": "VZBootLoader", "target": null }, { "id": "TypeError", "display_name": "TypeError", "target": null }, { "id": "GC", "display_name": "GC", "target": null }, { "id": "CFTypeRef", "display_name": "CFTypeRef", "target": null } ], "attack_ids": [ { "id": "T1123", "name": "Audio Capture", "display_name": "T1123 - Audio Capture" }, { "id": "T1140", "name": "Deobfuscate/Decode Files or Information", "display_name": "T1140 - Deobfuscate/Decode Files or Information" }, { "id": "T1566", "name": "Phishing", "display_name": "T1566 - Phishing" }, { "id": "T1485", "name": "Data Destruction", "display_name": "T1485 - Data Destruction" }, { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" }, { "id": "T1497", "name": "Virtualization/Sandbox Evasion", "display_name": "T1497 - Virtualization/Sandbox Evasion" }, { "id": "T1082", "name": "System Information Discovery", "display_name": "T1082 - System Information Discovery" }, { "id": "T1071", "name": "Application Layer Protocol", "display_name": "T1071 - Application Layer Protocol" }, { "id": "T1113", "name": "Screen Capture", "display_name": "T1113 - Screen Capture" }, { "id": "T1135", "name": "Network Share Discovery", "display_name": "T1135 - Network Share Discovery" }, { "id": "T1095", "name": "Non-Application Layer Protocol", "display_name": "T1095 - Non-Application Layer Protocol" }, { "id": "T1569", "name": "System Services", "display_name": "T1569 - System Services" }, { "id": "T1016", "name": "System Network Configuration Discovery", "display_name": "T1016 - System Network Configuration Discovery" }, { "id": "T1070", "name": "Indicator Removal on Host", "display_name": "T1070 - Indicator Removal on Host" }, { "id": "T1124", "name": "System Time Discovery", "display_name": "T1124 - System Time Discovery" }, { "id": "T1106", "name": "Native API", "display_name": "T1106 - Native API" }, { "id": "T1550", "name": "Use Alternate Authentication Material", "display_name": "T1550 - Use Alternate Authentication Material" }, { "id": "T1547", "name": "Boot or Logon Autostart Execution", "display_name": "T1547 - Boot or Logon Autostart Execution" }, { "id": "T1056", "name": "Input Capture", "display_name": "T1056 - Input Capture" }, { "id": "T1027", "name": "Obfuscated Files or Information", "display_name": "T1027 - Obfuscated Files or Information" }, { "id": "T1114", "name": "Email Collection", "display_name": "T1114 - Email Collection" }, { "id": "T1564", "name": "Hide Artifacts", "display_name": "T1564 - Hide Artifacts" }, { "id": "T1219", "name": "Remote Access Software", "display_name": "T1219 - Remote Access Software" }, { "id": "T1119", "name": "Automated Collection", "display_name": "T1119 - Automated Collection" }, { "id": "T1574", "name": "Hijack Execution Flow", "display_name": "T1574 - Hijack Execution Flow" }, { "id": "T1134", "name": "Access Token Manipulation", "display_name": "T1134 - Access Token Manipulation" }, { "id": "T1176", "name": "Browser Extensions", "display_name": "T1176 - Browser Extensions" }, { "id": "T1560", "name": "Archive Collected Data", "display_name": "T1560 - Archive Collected Data" }, { "id": "T1003", "name": "OS Credential Dumping", "display_name": "T1003 - OS Credential Dumping" } ], "industries": [ "Media" ], "TLP": "white", "cloned_from": null, "export_count": 49, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "ravescoutllc.", "id": "288912", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 346, "FileHash-SHA256": 272, "domain": 110, "hostname": 101, "email": 1, "CVE": 2, "FileHash-SHA1": 1 }, "indicator_count": 833, "is_author": false, "is_subscribing": null, "subscriber_count": 34, "modified_text": "570 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "URL", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "https://bjoern.hoehrmann.de/utf-8/decoder/dfa/", "type": "URL" }, "abuseipdb": null, "urlhaus": { "indicator": "https://bjoern.hoehrmann.de/utf-8/decoder/dfa/", "type": "URL", "found": false, "verdict": "clean", "error": null }, "from_cache": true, "_cached_at": 1780354742.7439382 }