Every single Apple device I own is HACKED and Apple doesn't care.

Question

RPLLC2017 Author

Level 1

15 points

Every single Apple device I own is HACKED and Apple doesn't care.

Man, my life has turned to ****. I have been being tortured for the past 4 weeks of my life by the absolute WORST Trojan/Malware/Worm/Virus I have ever seen in my life. I cannot explain how this is occurring but I can promise you that it is.

My website got hacked at the end of Aug. I was really dumb for letting my site back up into my personal Dropbox every day. My DB synced with every single device I owned. When my site was hacked, the hackers injected a folder with a ton of Javascript files and PNG files in it. They either injected it into my site through hacking it somehow or they got my password to my DB because at around the same time this happened, 60+ Million DB passwords were dumped onto the dark web.. Either way, they screwed me really bad because every computer I own including my iPhone, and iMac got infected.

I am now seeing remote access happening and I actually saw that all of my saved passwords that I had in Chrome and Safari (I now know I am an ******* for this) were uploaded to an unknown server. I then realized that commands were being run on my computer via SSH and it still happened even when I disabled WiFi!!! Everything I could possibly do to shut down my wireless connections, I did. Still happening.. What the ****!? I then though that maybe the malware is written to still connect to my phone or any other device via bluetooth maybe? I have no answer to this...

I wiped my devices MULTIPLE TIMES! I even did a secure wipe on my laptop and let the thing sit for a whole day. The moment I installed the new OS, I kept seeing remote/sharing activity. I locked it down with Little Snitch and kept blocking connections I saw. I tried tracing the IP's connecting to me but I keep hitting dead ends. They come back to Ripe Networks and other cloud hosting companies.

I tried calling Apple probably 30 times in the past 4 weeks and I have spoke with SO many people. None of them could help. They would sometimes send me an email with a packet sniffing .dmg file to download so that I can let it sniff all the connections. The download button NEVER works; nor does the "Send Files To Apple" button in the email. I thought it was my DNS settings that were changed. (I have been getting redirects to malicious sites a lot) The DNS settings were not changed, but I changed them to OpenDNS' IP's. This didn't help. I am sure whoever it is, has my home IP address, and even when I changed out my router/modem, it did NOTHING. Time Warner Cable didn't know what to do with me. They suck so bad. I told them to give me a new IP and they "can't." What do I have to do to get some help from these people??

I sent a lot of logs that show all of this hacking activity to abuse@icloud.com and even Time Warner's abuse email. I haven't heard **** from anyone! A "Senior Apple Tech" promised he would call me today after we spoke last Friday... He didn't... When I bring my computer and iPhone 7 into the store, they look at me like I am nuts because these idiots believe their system is SUPER secure. Well, it's NOT. The head of the genius bar sat with me and saw the logs and the weird processes running and all she could say was that she would wipe my computer AGAIN and she said there is absolutely no way I could get infected again after I did it. So she did it AGAIN and of course, it happened again.

When I changed my gmail password in the beginning, I was getting google codes sent to me from the 2-step authentication from a FAKE phone number! I always get the code from the 5 digit number 220-00. I would always receive the code instantly as soon as I tried to log on but after the hack, it wouldn't come for a minute or two and it would come from the weird phone number...

I am mentally defeated. I scoured NYC for an actual hardware firewall but of course not one store has one... I can't buy **** online because everything is screwed.. My girl got 2 voicemails from the bank saying someone opened up credit cards in her name.. I know it is about to get a whole lot worse and no one has been any help to me whatsoever. It is horrible. I am so close to taking a plane straight to California and walking right in Apple HQ and raising **** in the **** place. HOW HARD IS IT TO LET ME SEND THE ENGINEERS MY LOGS!??? There is obviously a vulnerability that needs to be patched ASAP. It looks like the one they did recently didn't help.. I think they did one on Sep 1st. I may have been hit with it before they patched it, but it doesn't make sense that my brand new iPhone 7 gets hit without restoring from a backup or signing into any iCloud. Oh, when I changed my gmail password, it says that the IP is in Africa. My gmail app and phone are showing signs of CSS, C++ hacks so I sign in to fake sites. My computer does it as well. I use my gmail all day every day so I knew right away when it didn't look right.

On my iPhone, and my girl's iPhone, our LTE signal keeps getting downgraded to 3G then to 1x, then it will turn off completely then go back to LTE. I can't shut off the location sharing on my iPad either. (AGAIN, ALL DEVICES HAVE BEEN WIPED OVER AND OVER!!!) I still get redirects and malicious website data/cookies keep appearing in the background on my Safari web data on my iPhone and computer... If the DNS settings aren't causing this, then it seems to me that I am literally logged into a server somewhere at all times and my phone/ computer is being mirrored. When I run a netstat -ab command, I see a lot of established connections even when the Wifi is turned off!!! I see a server that has been connected to but cannot trace it.

If anyone reads this and knows what I should do or want's to help out, PLEASE shoot me a message or leave a comment.. I know it all sounds ********, but I am not an idiot and the proof is in all these logs I have been saving...

Posted on Sep 28, 2016 2:15 AM

Reply

Answer 1

RPLLC2017 Author

Level 1

15 points

Sep 28, 2016 6:30 PM in response to RPLLC2017

Reply

Answer 2

thomas_r.

Level 7

32,041 points

Aug 7, 2017 7:20 AM in response to BrockLeeVegetable

BrockLeeVegetable wrote:

I'm sorry to say that if you have this malware i have (same symptoms, only on windows/iphone/ipad), It's impossible to get rid of.

If you're having identical symptoms on all those devices, it's not because they're infected... it's because your network hardware is vulnerable in some way and has been remotely hacked or infected. This could be your cable/DSL modem, or could be your wifi router, assuming those are separate devices, depending on the configuration of your network.

Thus, any troubleshooting you might do on the devices showing the symptoms is useless, because they're not actually the devices that are infected.

Reply

Answer 3

Sep 28, 2016 9:40 AM in response to RPLLC2017

I could not read the entire message but when I searched in other Mac Forums when I had a similar problem I was advised to run this malware. You should try it. https://www.malwarebytes.com/antimalware/mac/

Reply

Answer 4

thomas_r.

Level 7

32,041 points

Sep 28, 2016 12:17 PM in response to RPLLC2017

It sounds like your website and a number of your other online accounts have been hacked. That is a very different thing from your devices being hacked.

I'm unclear what you're seeing, but it is not possible for someone to be connected to your computer via SSH when you have disconnected it from the network. Thus, I think you must be misinterpreting something somewhere.

What exactly are these weird processes and log file entries that you're seeing?

Reply

Answer 5

Kurt Lang

Level 9

70,261 points

Oct 4, 2017 7:22 AM in response to 25thfret

It is the code written (flashed) onto hardware.

Yes, but what is the chip it's written to? Hardware. You know as well as I do that the data in any computer isn't just floating around inside the machine. Every bit of it is residing on some sort of hardware. Whether that's RAM, NVRAM, ROM, a rotational hard drive, SSD, EEPROM, CD/DVD/Blu-ray disks, magneto optical disks, floppy disks, or whatever other sort of hardware there is capable of storing data.

It's impossible to talk about software without also talking about the hardware. Hardware can exist without software. Software cannot exist without hardware.

Reply

Answer 6

RPLLC2017 Author

Level 1

15 points

Sep 28, 2016 7:21 PM in response to RPLLC2017

[img]http://i.imgur.com/TYrIS0D.png[/img]

Reply

Answer 7

Aug 6, 2017 12:15 PM in response to SeaPapp

How can you look at that log and tell me "everything is okay?" Did you not take the time to read it and just presumptuously/ignorantly reply? Just because a little virtual switch on the GUI of an operating system says that the wifi is off, its impossible to have any legit connections or concerns? Even some hardware switches can be circumvented. Believe it or not, there are a million processes/scripts/code/etc going on behind that pretty wifi selecter. ANYTHING can be hacked. ANYTHING can be exploited and the GUI will not show even a hint of it happening, if the malware is good of course... And this malware is just that.

I'm sorry to say that if you have this malware i have (same symptoms, only on windows/iphone/ipad), It's impossible to get rid of. If so, Your firmware has been compromised... and by compromised i mean completely rewritten and the only way to fix it is to flash every single chip on every single device connected to your computer at the exact same time. This is to prevent re-compromising the firmware via another infected device. Anyone that doesn't have it, doesn't believe us. But there is a small group of people that are having the same problem... There are a lot more people that have it, its just unless you are either an advanced user, or you like to poke and prod, you wouldn't know anything was wrong.

What is actually happening on my machine is when you boot, the compromised devices take control of the boot process, and start a the host operating system, then create a guest virtual OS that the victim/user runs on. The malware has control of the host, so they are in COMPLETE control of everything you do.There is no detecting it (with standard methods), and unless you flash everything, there is no removing it. Every device you have anywhere near your infected devices are compromised, and it can infect literally EVERYTHING (even your dusty printer sitting in the corner of the room). It doesn't use the virtualization on everything, but that's just to start, then it loads tons of other malware and exploits to your machine, proximity devices and even air-gapped machines. So don't bother getting any new devices until you get rid of every single thing with a logic board and ANY form of radio. I know it sounds crazy, but you cant just say "its impossible." Especially unless you know every single thing about every aspect of code, scripts, logicboard, malware, --I think you get the point. It is possible. All computers do is process code, if they can create the technology that we currently have, why dont you think they can create exploits that can manipulate every aspect of any machine?

Reply

Answer 8

Aug 6, 2017 2:14 PM in response to Kurt Lang

What I am explaining , about the virtualization, is an actual thing. There's a name for it: VMBR (virtual-machine based rootkit). There is an actual piece of malware, and its been around for a long time: "Blue Pill" or "Sub Virt." Just because I don't have much time right now ill post a link fro wikkipedia, but google it... Its real.

https://en.wikipedia.org/wiki/Blue_Pill_(software)

www.cs.ucf.edu/~czou/CAP6133/SubVirt6-1

And, again, just because there are no mainstream conventional ways for malware to get from one piece of firmware on a device to another, doesn't mean its not possible. Well, it is actually documented. Virus total has a system that helps detect firmware malware. Sooo i really don't know what you are talking about. By the way, firmware isn't hardware, its the software that tells the hardware what to do. You really think you cannot change information on a ROM chip? YOU CAN DO ANYTHING TO ANYTHING if you know how. For reals, look deeper into things... No, its not conventional... but that's kind of the point, right? And there are plenty of bios malware, and firmware malware out there. just google it.

The whole thing about disk space? Im not sure what you are trying to say there... disks never show the actual amount of space they are rated it. It depends on how the OS processes the sectors or what not. So you end up with quite a bit of less space than it says on the box... On a 1tb HDD do you think 8gb for a light weight OS would be noticeable? and even if it was, the malware is in charge of everything you see... it can force the guest system to display anything it wants... and that is also possible, look it up.

Also, I never said that he had the same malware that I do, but it looks similar. I was saying IF he did, and this is what is happening to me, on my device. I was pretty clear about that.

Reply

Answer 9

Aug 6, 2017 3:14 PM in response to Kurt Lang

the firmware of something is the software on the chip... Which is why it can be updated... So when someone does a firmware update, they are physically removing the chip and replacing it with another? right.

Definition right here

https://en.wikipedia.org/wiki/Firmware

"In electronic systems and computing, firmware^[a] is a type of software that provides control, monitoring and data manipulation of engineered products and systems"

There are proof of concept/malware thats been reported in the wild that have manipulated ROM chips... Just because something is called "read only memory," doesnt mean it cant be exploited. You really have not researched these things very much.

Just read the error log reports on the first page, and actually read them. That definitely looks like code exploiting apples systems. It seems that most of that would not be happening on a normal device. Please explain every single suspicious looking input in the log file... anything that could be interpreted as suspicious. If you can do that, then maybe you'll have some sort of credit. But if you cant, you don't know enough information to be telling anyone that something malicious isn't happening. Because you do not know... you think... but you do not know. I don't see you trying to explain these things, you are just saying we are crazy. Try actually backing yourself up a bit, maybe?

Reply

Answer 10

Aug 6, 2017 7:00 PM in response to IdrisSeabright

I was being sarcastic when I said you have to remove the physical chip. But a definition is a definition. The chip is to store the 'firmware.' It's not the actual firmware. And anything connected to something can be accessed. Malware can write data outside of partition tables and store itself in unallocated parts of storage and force the device to display normal properties. Malware needs a very small amount of space to hide, so rom chips small size wouldn't matter.

In my responses, I mentioned that they were not good sources. It's was the quickest thing I could find, because I am at work and am blocked out of 90% of sites. I was just trying to make my point that what I was being told isn't possible, is.

Saw that one comin, this would be the perfect time to bow out! right when I ask you to back yourself with some answers, and actually explain what these very suspicious entries are in his logs.

Reply

Answer 11

RPLLC2017 Author

Level 1

15 points

Sep 28, 2016 5:52 PM in response to thomas_r.

I know it is supposed to be impossible for someone to be connecting via ssh or anything for that matter while the Wifi is turned off, but somehow, there are connections still happening, even when it is off. I will post as many screenshots and logs as I can. Thank you for your time and reply.

Reply

Answer 12

thomas_r.

Level 7

32,041 points

Sep 28, 2016 7:08 PM in response to RPLLC2017

I'm not sure what I'm supposed to be seeing there. Your first screenshot shows you attempting to connect to an SMB server, via a dialog that can be brought up in the Finder by pressing command-K, not someone connecting to your Mac. The second two have highlighted two completely normal processes that are part of macOS.

Reply

Answer 13

RPLLC2017 Author

Level 1

15 points

Sep 28, 2016 7:15 PM in response to thomas_r.

I tried to upload more pictures but it wouldn't let me. It seems as though my computer is connecting to my iPhone 7 even when wifi and bluetooth is off. I am uploading them to imgur now and will post them in a couple of minutes. The logs are what I really want you to see. Thank you so much for your time. I appreciate it very much. This was the other day showing all the connections to my computer with no websites open!

Reply

Answer 14

RPLLC2017 Author

Level 1

15 points

Sep 28, 2016 7:40 PM in response to thomas_r.

That smb server was not from me. It was already populated there when I pressed Command - K. Along with this server that populates when I go to terminal and click "New Remote Connection." See the attached image below:

Please see the connections that are ESTABLISHED right now: I used netstat -ab

Last login: Wed Sep 28 10:08:13 on ttys000

Bens-MacBook-Pro:~ ben$ netstat -ab

Active Internet connections (including servers)

Proto Recv-Q Send-Q Local Address Foreign Address (state) rxbytes txbytes

tcp4 0 0 192.168.0.5.54202 a104-106-247-41..https ESTABLISHED 373559 14785

tcp6 0 0 2604:2000:f093:e.54148 qk-in-x65.1e100..https ESTABLISHED 1351 51870

tcp6 0 0 2604:2000:f093:e.54068 qk-in-x66.1e100..https ESTABLISHED 6387 4183

tcp6 0 0 2604:2000:f093:e.54067 qk-in-x66.1e100..https ESTABLISHED 1280 3234

tcp4 0 0 192.168.0.5.54025 ec2-54-213-121-2.https ESTABLISHED 27122 14970

tcp6 0 0 2604:2000:f093:e.54024 lga15s48-in-x0e..https ESTABLISHED 7224 2818

tcp6 0 0 2604:2000:f093:e.54011 ql-in-x5e.1e100..https ESTABLISHED 1829 5028

tcp4 0 0 192.168.0.5.53970 *.112.2o7.net.https ESTABLISHED 6409 3873

tcp4 0 0 192.168.0.5.53969 appleglobal.102..https ESTABLISHED 1042 4492

tcp6 0 0 2604:2000:f093:e.53968 2600:1407:10:195.https ESTABLISHED 14322 8535

tcp6 0 0 2604:2000:f093:e.53966 2600:1407:10:19a.https ESTABLISHED 571 1894

tcp6 0 0 2604:2000:f093:e.53964 2600:1407:10:188.https ESTABLISHED 558 3885

tcp6 0 0 2604:2000:f093:e.53963 2600:1407:10:188.https ESTABLISHED 558 3884

tcp6 0 0 2604:2000:f093:e.53962 2600:1407:10:188.https ESTABLISHED 100131 7826

tcp6 0 0 2604:2000:f093:e.53961 2600:1407:10:19a.https ESTABLISHED 1226 9491

tcp6 0 0 2604:2000:f093:e.53960 2600:1407:10:19a.https ESTABLISHED 1716 9409

tcp4 0 0 192.168.0.5.53957 a104-106-247-41..https ESTABLISHED 503175 52345

tcp4 0 0 192.168.0.5.53956 a104-106-247-41..https ESTABLISHED 543130 38048

tcp4 0 0 192.168.0.5.53954 a104-106-247-41..https ESTABLISHED 721570 40725

tcp4 0 0 192.168.0.5.53953 a104-106-247-41..https ESTABLISHED 485524 37574

tcp6 0 0 2604:2000:f093:e.53952 2600:1407:10:19a.https ESTABLISHED 52501 19276

tcp6 0 0 2604:2000:f093:e.53951 2600:1407:10:1a4.https ESTABLISHED 45964 8097

tcp6 0 0 2604:2000:f093:e.53899 2606:2800:220:13.https CLOSE_WAIT 7784 2265

tcp4 0 0 192.168.0.5.53897 a104-92-1-57.dep.http ESTABLISHED 16582 1651

tcp4 0 0 192.168.0.5.53896 a104-92-1-57.dep.http ESTABLISHED 17266 1599

tcp4 0 0 192.168.0.5.53895 a104-92-1-57.dep.http ESTABLISHED 12926 1547

tcp4 0 0 192.168.0.5.53894 a104-92-1-57.dep.http ESTABLISHED 14611 1599

tcp4 0 0 192.168.0.5.53893 a104-92-1-57.dep.http ESTABLISHED 16195 1599

tcp4 0 0 192.168.0.5.53892 a104-92-1-57.dep.http ESTABLISHED 11985 1495

tcp4 0 0 192.168.0.5.53890 151.101.128.68.http ESTABLISHED 9380 1425

tcp6 0 0 2604:2000:f093:e.53888 lga15s47-in-x0d..https ESTABLISHED 5846 3457

tcp4 0 0 192.168.0.5.53885 a104-92-1-57.dep.http ESTABLISHED 26546 3301

tcp6 0 0 2604:2000:f093:e.53877 2607:f8b0:400d:c.https ESTABLISHED 6048 2698

tcp4 0 0 192.168.0.5.53876 151.101.65.140.https ESTABLISHED 5274 1653

tcp6 0 0 2604:2000:f093:e.53859 qk-in-x71.1e100..https ESTABLISHED 15602 3062

tcp6 0 0 2604:2000:f093:e.53857 lga15s44-in-x0e..https ESTABLISHED 8764 4020

tcp6 0 0 2604:2000:f093:e.53855 2600:1407:10:192.http ESTABLISHED 75822 5377

tcp6 0 0 2604:2000:f093:e.53853 qn-in-x66.1e100..https ESTABLISHED 1025 2834

tcp4 0 0 192.168.0.5.53852 a104-97-109-50.d.http ESTABLISHED 426 802

tcp6 0 0 2604:2000:f093:e.53851 lga15s48-in-x02..http ESTABLISHED 188 1033

tcp6 0 0 2604:2000:f093:e.53799 qk-in-x84.1e100..https ESTABLISHED 12799 3809

tcp6 0 0 2604:2000:f093:e.53796 lga15s47-in-x04..https ESTABLISHED 315152 32850

tcp4 0 0 192.168.0.5.53699 151.101.20.193.https ESTABLISHED 6309 2441

tcp4 0 0 192.168.0.5.53698 23.235.46.193.https ESTABLISHED 4458 3129

tcp4 0 0 192.168.0.5.53697 23.235.46.193.https ESTABLISHED 5042 5054

tcp4 0 0 192.168.0.5.53636 ghs-vip-any-c824.https ESTABLISHED 5035 3779

tcp6 0 0 2604:2000:f093:e.53543 lga15s48-in-x0e..https ESTABLISHED 329698 24642

tcp4 0 0 192.168.0.5.53027 ec2-50-19-115-22.https ESTABLISHED 3107 7547

tcp4 0 0 192.168.0.5.53001 199.16.156.241.https ESTABLISHED 1420 4446

tcp4 0 0 192.168.0.5.52538 a104-106-247-41..https ESTABLISHED 955447 99224

tcp6 0 0 2604:2000:f093:e.51979 ql-in-xbd.1e100..https ESTABLISHED 16637 10454

tcp4 0 0 192.168.0.5.57965 17.172.232.174.https ESTABLISHED 3794 4066

tcp4 0 0 192.168.0.5.57964 17.249.172.32.https ESTABLISHED 4325 5342

tcp4 0 0 192.168.0.5.55653 ec2-52-87-141-25.https ESTABLISHED 28297 29551

tcp4 0 0 192.168.0.5.55065 ec2-52-206-93-19.https ESTABLISHED 29762 29480

tcp4 37 0 192.168.0.5.50057 209-20-75-76.sli.https CLOSE_WAIT 5467 1497

tcp4 0 0 localhost.9421 *.* LISTEN 0 0

udp4 0 0 *.* *.* 0 0

udp6 0 0 2604:2000:f093:e.ntp *.* 0 0

udp6 0 0 *.64057 *.* 0 0

udp4 0 0 *.64057 *.* 421 288

udp6 0 0 *.55701 *.* 0 0

udp4 0 0 *.55701 *.* 424 288

udp6 0 0 *.64760 *.* 0 0

udp4 0 0 *.64760 *.* 420 284

udp6 0 0 *.63468 *.* 0 0

udp4 0 0 *.63468 *.* 468 344

udp6 0 0 *.55838 *.* 0 0

udp4 0 0 *.55838 *.* 468 344

udp6 0 0 *.63510 *.* 0 0

udp4 0 0 *.63510 *.* 464 340

udp4 0 0 192.168.0.5.ntp *.* 3168 5092

udp6 0 0 bens-macbook-pro.ntp *.* 0 0

udp4 0 0 *.* *.* 0 0

udp4 0 0 localhost.32376 *.* 22858 0

udp6 0 0 fe80::1%lo0.ntp *.* 0 0

udp4 0 0 localhost.ntp *.* 212 36

udp6 0 0 localhost.ntp *.* 0 0

udp6 0 0 *.ntp *.* 0 0

udp4 0 0 *.ntp *.* 0 0

udp4 0 0 *.* *.* 0 0

udp4 0 0 localhost.56335 *.* 0 0

udp4 0 0 localhost.62039 *.* 0 0

udp4 0 0 *.* *.* 0 0

udp4 0 0 *.57992 *.* 0 11456

udp4 0 0 *.* *.* 0 0

udp46 0 0 *.* *.* 0 0

udp4 0 0 *.* *.* 0 0

udp6 0 0 *.mdns *.* 137056 176704

udp4 0 0 *.mdns *.* 143777 140262

udp4 0 0 *.netbios-ns *.* 10284 9378

udp4 0 0 *.netbios-dgm *.* 0 0

Active Multipath Internet connections

Proto/ID Flags Local Address Foreign Address (state)

Active LOCAL (UNIX) domain sockets

Address Type Recv-Q Send-Q Inode Conn Refs Nextref Addr

a279e1f6098d106b stream 0 0 0 a279e1f6098cf833 0 0 /var/run/mDNSResponder

a279e1f6098cf833 stream 0 0 0 a279e1f6098d106b 0 0

a279e1f60894489b stream 0 0 0 a279e1f607f1d383 0 0 /var/run/mDNSResponder

a279e1f607f1d383 stream 0 0 0 a279e1f60894489b 0 0

a279e1f60c08b83b stream 0 0 0 a279e1f6089438fb 0 0

a279e1f6089438fb stream 0 0 0 a279e1f60c08b83b 0 0

a279e1f6098d057b stream 0 0 0 a279e1f6098d183b 0 0

a279e1f6098d183b stream 0 0 0 a279e1f6098d057b 0 0

a279e1f6098cfa8b stream 0 0 0 a279e1f60c08976b 0 0

a279e1f60c08976b stream 0 0 0 a279e1f6098cfa8b 0 0

a279e1f6098cf9c3 stream 0 0 0 a279e1f6098cef9b 0 0

a279e1f6098cef9b stream 0 0 0 a279e1f6098cf9c3 0 0

a279e1f6098d0643 stream 0 0 0 a279e1f6098d070b 0 0

a279e1f6098d070b stream 0 0 0 a279e1f6098d0643 0 0

a279e1f6098cf76b stream 0 0 0 a279e1f6098d15e3 0 0

a279e1f6098d15e3 stream 0 0 0 a279e1f6098cf76b 0 0

a279e1f6098cfce3 stream 0 0 0 a279e1f60c08a963 0 0

a279e1f60c08a963 stream 0 0 0 a279e1f6098cfce3 0 0

a279e1f607f1d44b stream 0 0 0 a279e1f6098cfb53 0 0

a279e1f6098cfb53 stream 0 0 0 a279e1f607f1d44b 0 0

a279e1f608945453 stream 0 0 0 a279e1f607f1d8fb 0 0

a279e1f607f1d8fb stream 0 0 0 a279e1f608945453 0 0

a279e1f6098cfc1b stream 0 0 0 a279e1f6098cf383 0 0

a279e1f6098cf383 stream 0 0 0 a279e1f6098cfc1b 0 0

a279e1f6098d16ab stream 0 0 0 a279e1f6098d1b5b 0 0

a279e1f6098d1b5b stream 0 0 0 a279e1f6098d16ab 0 0

a279e1f6098d0fa3 stream 0 0 0 a279e1f60c0896a3 0 0

a279e1f60c0896a3 stream 0 0 0 a279e1f6098d0fa3 0 0

a279e1f6098d1db3 stream 0 0 0 a279e1f6098cf5db 0 0 /var/run/mDNSResponder

a279e1f6098cf5db stream 0 0 0 a279e1f6098d1db3 0 0

a279e1f608945773 stream 0 0 0 a279e1f60c08a643 0 0 /var/run/mDNSResponder

a279e1f60c08a643 stream 0 0 0 a279e1f608945773 0 0

a279e1f60c0895db stream 0 0 a279e1f605a050b3 0 0 0 /var/tmp/kav/PRRemote:2733

a279e1f60c08b133 stream 0 0 0 a279e1f60c08aaf3 0 0 /var/run/mDNSResponder

a279e1f60c08aaf3 stream 0 0 0 a279e1f60c08b133 0 0

a279e1f607f1ced3 stream 0 0 0 a279e1f60c08aedb 0 0 /var/run/mDNSResponder

a279e1f60c08aedb stream 0 0 0 a279e1f607f1ced3 0 0

a279e1f60c08ba93 stream 0 0 0 a279e1f607f1d12b 0 0

a279e1f607f1d12b stream 0 0 0 a279e1f60c08ba93 0 0

a279e1f6098cfe73 stream 0 0 0 a279e1f60c089e73 0 0

a279e1f60c089e73 stream 0 0 0 a279e1f6098cfe73 0 0

a279e1f60c08b773 stream 0 0 0 a279e1f60c089b53 0 0

a279e1f60c089b53 stream 0 0 0 a279e1f60c08b773 0 0

a279e1f607f1f51b stream 0 0 0 a279e1f6098d089b 0 0

a279e1f6098d089b stream 0 0 0 a279e1f607f1f51b 0 0

a279e1f6098d0edb stream 0 0 0 0 0 0

a279e1f607f1f903 stream 0 0 a279e1f60a443653 0 0 0 /tmp/.pgp-occ-ben-501

a279e1f607f1cf9b stream 0 0 0 a279e1f607f1f38b 0 0 /var/run/usbmuxd

a279e1f607f1f38b stream 0 0 0 a279e1f607f1cf9b 0 0

a279e1f608945db3 stream 0 0 0 a279e1f607f1dc1b 0 0 /var/run/mDNSResponder

a279e1f607f1dc1b stream 0 0 0 a279e1f608945db3 0 0

a279e1f607f1f773 stream 0 0 0 a279e1f607f1d2bb 0 0 /var/run/mDNSResponder

a279e1f607f1d2bb stream 0 0 0 a279e1f607f1f773 0 0

a279e1f607f1d1f3 stream 0 0 0 a279e1f607f1d833 0 0 /var/run/mDNSResponder

a279e1f607f1d833 stream 0 0 0 a279e1f607f1d1f3 0 0

a279e1f607f1f83b stream 0 0 0 a279e1f607f1dce3 0 0 /var/run/usbmuxd

a279e1f607f1dce3 stream 0 0 0 a279e1f607f1f83b 0 0

a279e1f607f1db53 stream 0 0 0 a279e1f60c08b51b 0 0

a279e1f60c08b51b stream 0 0 0 a279e1f607f1db53 0 0

a279e1f607f1f6ab stream 0 0 0 a279e1f607f1d513 0 0

a279e1f607f1d513 stream 0 0 0 a279e1f607f1f6ab 0 0

a279e1f607f1eaf3 stream 0 0 0 a279e1f607f1d6a3 0 0

a279e1f607f1d6a3 stream 0 0 0 a279e1f607f1eaf3 0 0

a279e1f60c088ed3 stream 0 0 0 a279e1f607f1e70b 0 0

a279e1f607f1e70b stream 0 0 0 a279e1f60c088ed3 0 0

a279e1f608944af3 stream 0 0 0 a279e1f60c0891f3 0 0

a279e1f60c0891f3 stream 0 0 0 a279e1f608944af3 0 0

a279e1f607f1da8b stream 0 0 0 0 0 0

a279e1f607f1f9cb stream 0 0 0 a279e1f60c08a7d3 0 0

a279e1f60c08a7d3 stream 0 0 0 a279e1f607f1f9cb 0 0

a279e1f608945a93 stream 0 0 0 a279e1f60c089ce3 0 0

a279e1f60c089ce3 stream 0 0 0 a279e1f608945a93 0 0

a279e1f60c08b1fb stream 0 0 0 a279e1f607f1e193 0 0

a279e1f607f1e193 stream 0 0 0 a279e1f60c08b1fb 0 0

a279e1f60c08bdb3 stream 0 0 0 a279e1f60c089dab 0 0

a279e1f60c089dab stream 0 0 0 a279e1f60c08bdb3 0 0

a279e1f607f1ec83 stream 0 0 0 a279e1f607f1ebbb 0 0

a279e1f607f1ebbb stream 0 0 0 a279e1f607f1ec83 0 0

a279e1f60c08bb5b stream 0 0 0 a279e1f60480544b 0 0

a279e1f60480544b stream 0 0 0 a279e1f60c08bb5b 0 0

a279e1f608944963 stream 0 0 0 a279e1f607f1e643 0 0

a279e1f607f1e643 stream 0 0 0 a279e1f608944963 0 0

a279e1f60c08aa2b stream 0 0 0 a279e1f604805383 0 0

a279e1f604805383 stream 0 0 0 a279e1f60c08aa2b 0 0

a279e1f60c089063 stream 0 0 0 a279e1f6089432bb 0 0

a279e1f6089432bb stream 0 0 0 a279e1f60c089063 0 0

a279e1f60c08ae13 stream 0 0 0 a279e1f60c089513 0 0

a279e1f60c089513 stream 0 0 0 a279e1f60c08ae13 0 0

a279e1f60c08b453 stream 0 0 0 a279e1f6048051f3 0 0

a279e1f6048051f3 stream 0 0 0 a279e1f60c08b453 0 0

a279e1f60c089f3b stream 0 0 0 a279e1f60c0899c3 0 0

a279e1f60c0899c3 stream 0 0 0 a279e1f60c089f3b 0 0

a279e1f60c08a4b3 stream 0 0 0 a279e1f60c08a57b 0 0

a279e1f60c08a57b stream 0 0 0 a279e1f60c08a4b3 0 0

a279e1f604806bbb stream 0 0 a279e1f6049bda13 0 0 0 /var/run/com.pgp.framework.PGPwde.socket

a279e1f608945133 stream 0 0 0 a279e1f60c08b2c3 0 0 /var/run/mDNSResponder

a279e1f60c08b2c3 stream 0 0 0 a279e1f608945133 0 0

a279e1f60c0898fb stream 0 0 0 a279e1f60c08b06b 0 0

a279e1f60c08b06b stream 0 0 0 a279e1f60c0898fb 0 0

a279e1f60c089833 stream 0 0 0 a279e1f60c08afa3 0 0

a279e1f60c08afa3 stream 0 0 0 a279e1f60c089833 0 0

a279e1f60c08ad4b stream 0 0 0 a279e1f60c089a8b 0 0 /var/run/mDNSResponder

a279e1f60c089a8b stream 0 0 0 a279e1f60c08ad4b 0 0

a279e1f60c08ac83 stream 0 0 0 a279e1f60c08a003 0 0 /var/run/mDNSResponder

a279e1f60c08a003 stream 0 0 0 a279e1f60c08ac83 0 0

a279e1f60c08abbb stream 0 0 0 a279e1f60c08a0cb 0 0

a279e1f60c08a0cb stream 0 0 0 a279e1f60c08abbb 0 0

a279e1f608942ed3 stream 0 0 0 a279e1f608943b53 0 0

a279e1f608943b53 stream 0 0 0 a279e1f608942ed3 0 0

a279e1f608945903 stream 0 0 0 a279e1f6089455e3 0 0

a279e1f6089455e3 stream 0 0 0 a279e1f608945903 0 0

a279e1f60c08a70b stream 0 0 0 a279e1f608945ceb 0 0

a279e1f608945ceb stream 0 0 0 a279e1f60c08a70b 0 0

a279e1f608943063 stream 0 0 a279e1f60c91d0b3 0 0 0 /var/folders/c8/p6mk98xs7x52_7_th48xc3s80000gn/T/chrome-ULIOGI/Socket

a279e1f608942f9b stream 0 0 a279e1f60c91da13 0 0 0 /var/folders/c8/p6mk98xs7x52_7_th48xc3s80000gn/T/.com.google.Chrome.H5HMnQ/Sing letonSocket

a279e1f60c08a3eb stream 0 0 0 a279e1f60c08a323 0 0

a279e1f60c08a323 stream 0 0 0 a279e1f60c08a3eb 0 0

a279e1f60c08a193 stream 0 0 0 a279e1f60c08a25b 0 0

a279e1f60c08a25b stream 0 0 0 a279e1f60c08a193 0 0

a279e1f604807a93 stream 0 0 0 a279e1f6089443eb 0 0 /var/run/mDNSResponder

a279e1f6089443eb stream 0 0 0 a279e1f604807a93 0 0

a279e1f608943383 stream 0 0 0 a279e1f608943dab 0 0 /var/run/mDNSResponder

a279e1f608943dab stream 0 0 0 a279e1f608943383 0 0

a279e1f6089439c3 stream 0 0 0 a279e1f608944edb 0 0 /var/run/mDNSResponder

a279e1f608944edb stream 0 0 0 a279e1f6089439c3 0 0

a279e1f608943a8b stream 0 0 0 a279e1f608944d4b 0 0 /var/run/mDNSResponder

a279e1f608944d4b stream 0 0 0 a279e1f608943a8b 0 0

a279e1f6089436a3 stream 0 0 0 a279e1f608944fa3 0 0 /var/run/mDNSResponder

a279e1f608944fa3 stream 0 0 0 a279e1f6089436a3 0 0

a279e1f60894344b stream 0 0 0 a279e1f608943513 0 0 /var/run/usbmuxd

a279e1f608943513 stream 0 0 0 a279e1f60894344b 0 0

a279e1f6089444b3 stream 0 0 0 a279e1f60894457b 0 0 /var/run/mDNSResponder

a279e1f60894457b stream 0 0 0 a279e1f6089444b3 0 0

a279e1f604807903 stream 0 0 a279e1f60a2e6383 0 0 0 /var/tmp/kav/PRRemote:287

a279e1f608943e73 stream 0 0 0 a279e1f608943f3b 0 0

a279e1f608943f3b stream 0 0 0 a279e1f608943e73 0 0

a279e1f608944323 stream 0 0 0 a279e1f608944003 0 0

a279e1f608944003 stream 0 0 0 a279e1f608944323 0 0

a279e1f6089440cb stream 0 0 0 a279e1f60894425b 0 0

a279e1f60894425b stream 0 0 0 a279e1f6089440cb 0 0

a279e1f604804ed3 stream 0 0 0 a279e1f608944193 0 0

a279e1f608944193 stream 0 0 0 a279e1f604804ed3 0 0

a279e1f604807db3 stream 0 0 0 a279e1f604807ceb 0 0 /var/run/mDNSResponder

a279e1f604807ceb stream 0 0 0 a279e1f604807db3 0 0

a279e1f604804f9b stream 0 0 a279e1f60896a563 0 0 0 /var/folders/c8/p6mk98xs7x52_7_th48xc3s80000gn/T/icdd501

a279e1f604807c23 stream 0 0 0 a279e1f604805063 0 0 /var/run/mDNSResponder

a279e1f604807b5b stream 0 0 0 a279e1f60480512b 0 0 /var/run/mDNSResponder

a279e1f604805063 stream 0 0 0 a279e1f604807c23 0 0

a279e1f60480512b stream 0 0 0 a279e1f604807b5b 0 0

a279e1f604805513 stream 0 0 0 a279e1f6048076ab 0 0 /var/run/mDNSResponder

a279e1f6048076ab stream 0 0 0 a279e1f604805513 0 0

a279e1f6048055db stream 0 0 0 a279e1f6048075e3 0 0 /var/run/mDNSResponder

a279e1f6048075e3 stream 0 0 0 a279e1f6048055db 0 0

a279e1f60480738b stream 0 0 a279e1f607672923 0 0 0 /private/tmp/com.apple.launchd.WbRCW6fz4p/Listeners

a279e1f604807133 stream 0 0 a279e1f6073a3473 0 0 0 /private/tmp/com.apple.launchd.y3xkVVV574/Render

a279e1f6048059c3 stream 0 0 a279e1f6047a9743 0 0 0 /var/tmp/filesystemui.socket

a279e1f604805b53 stream 0 0 0 a279e1f604805c1b 0 0

a279e1f604805c1b stream 0 0 0 a279e1f604805b53 0 0

a279e1f604806d4b stream 0 0 a279e1f605448bf3 0 0 0 /var/run/pppconfd

a279e1f604806af3 stream 0 0 a279e1f6049bd923 0 0 0 /var/run/com.macpaw.CleanMyMac3.Agent.socket

a279e1f604806a2b stream 0 0 a279e1f6049a5ed3 0 0 0 /private/var/run/cupsd

a279e1f604806963 stream 0 0 a279e1f60499b833 0 0 0 /var/run/usbmuxd

a279e1f60480689b stream 0 0 a279e1f60498f923 0 0 0 /var/run/systemkeychaincheck.socket

a279e1f604805e73 stream 0 0 a279e1f60497e293 0 0 0 /var/run/portmap.socket

a279e1f6048067d3 stream 0 0 a279e1f604977fc3 0 0 0 /var/run/vpncontrol.sock

a279e1f60480670b stream 0 0 a279e1f604966383 0 0 0 /var/rpc/ncacn_np/mdssvc

a279e1f604806643 stream 0 0 a279e1f604966473 0 0 0 /var/rpc/ncacn_np/lsarpc

a279e1f604805f3b stream 0 0 a279e1f604966833 0 0 0 /var/rpc/ncalrpc/lsarpc

a279e1f60480657b stream 0 0 a279e1f604966743 0 0 0 /var/rpc/ncalrpc/NETLOGON

a279e1f6048064b3 stream 0 0 a279e1f604962dd3 0 0 0 /var/rpc/ncacn_np/wkssvc

a279e1f604806003 stream 0 0 a279e1f6049620b3 0 0 0 /var/rpc/ncalrpc/wkssvc

a279e1f6048063eb stream 0 0 a279e1f604962b03 0 0 0 /var/rpc/ncacn_np/srvsvc

a279e1f604806323 stream 0 0 a279e1f604962a13 0 0 0 /var/rpc/ncalrpc/srvsvc

a279e1f6048060cb stream 0 0 a279e1f604956ce3 0 0 0 /var/run/mDNSResponder

a279e1f6098cf1f3 dgram 0 0 0 a279e1f6098d11fb a279e1f6098d11fb 0

a279e1f6098d11fb dgram 0 0 0 a279e1f6098cf1f3 a279e1f6098cf1f3 0

a279e1f607f1f453 dgram 0 0 0 a279e1f604806193 0 a279e1f6098d0193

a279e1f6098d0193 dgram 0 0 0 a279e1f604806193 0 a279e1f6098d0a2b

a279e1f6098d0a2b dgram 0 0 0 a279e1f604806193 0 a279e1f608945b5b

a279e1f6098cf44b dgram 0 0 0 a279e1f6098d0e13 a279e1f6098d0e13 0

a279e1f6098d0e13 dgram 0 0 0 a279e1f6098cf44b a279e1f6098cf44b 0

a279e1f608945b5b dgram 0 0 0 a279e1f604806193 0 a279e1f607f1fdb3

a279e1f6098d0963 dgram 0 0 0 a279e1f60c089383 a279e1f60c089383 0

a279e1f60c089383 dgram 0 0 0 a279e1f6098d0963 a279e1f6098d0963 0

a279e1f607f1fdb3 dgram 0 0 0 a279e1f604806193 0 a279e1f60894312b

a279e1f607f1f2c3 dgram 0 0 0 a279e1f607f1e963 a279e1f607f1e963 0

a279e1f607f1e963 dgram 0 0 0 a279e1f607f1f2c3 a279e1f607f1f2c3 0

a279e1f60894312b dgram 0 0 0 a279e1f604806193 0 a279e1f607f1e89b

a279e1f607f1ddab dgram 0 0 0 a279e1f607f1f1fb a279e1f607f1f1fb 0

a279e1f607f1f1fb dgram 0 0 0 a279e1f607f1ddab a279e1f607f1ddab 0

a279e1f607f1eedb dgram 0 0 0 a279e1f607f1d9c3 a279e1f607f1d9c3 0

a279e1f607f1d9c3 dgram 0 0 0 a279e1f607f1eedb a279e1f607f1eedb 0

a279e1f607f1e7d3 dgram 0 0 0 a279e1f607f1ea2b a279e1f607f1ea2b 0

a279e1f607f1ea2b dgram 0 0 0 a279e1f607f1e7d3 a279e1f607f1e7d3 0

a279e1f607f1e25b dgram 0 0 0 a279e1f607f1ed4b a279e1f607f1ed4b 0

a279e1f607f1ed4b dgram 0 0 0 a279e1f607f1e25b a279e1f607f1e25b 0

a279e1f607f1e323 dgram 0 0 0 a279e1f607f1e4b3 a279e1f607f1e4b3 0

a279e1f607f1e4b3 dgram 0 0 0 a279e1f607f1e323 a279e1f607f1e323 0

a279e1f607f1e89b dgram 0 0 0 a279e1f604806193 0 a279e1f60c08b5e3

a279e1f6089452c3 dgram 0 0 0 a279e1f60c08b9cb a279e1f60c08b9cb 0

a279e1f60c08b9cb dgram 0 0 0 a279e1f6089452c3 a279e1f6089452c3 0

a279e1f60c08a89b dgram 0 0 0 a279e1f60c088f9b a279e1f60c088f9b 0

a279e1f60c088f9b dgram 0 0 0 a279e1f60c08a89b a279e1f60c08a89b 0

a279e1f60c08b6ab dgram 0 0 0 a279e1f60c08912b a279e1f60c08912b 0

a279e1f60c08912b dgram 0 0 0 a279e1f60c08b6ab a279e1f60c08b6ab 0

a279e1f60c08b903 dgram 0 0 0 a279e1f60c0892bb a279e1f60c0892bb 0

a279e1f60c0892bb dgram 0 0 0 a279e1f60c08b903 a279e1f60c08b903 0

a279e1f60c08b5e3 dgram 0 0 0 a279e1f604806193 0 a279e1f60480783b

a279e1f608945c23 dgram 0 0 0 a279e1f6089459cb a279e1f6089459cb 0

a279e1f6089459cb dgram 0 0 0 a279e1f608945c23 a279e1f608945c23 0

a279e1f608943c1b dgram 0 0 0 a279e1f608944c83 a279e1f608944c83 0

a279e1f608944c83 dgram 0 0 0 a279e1f608943c1b a279e1f608943c1b 0

a279e1f60894376b dgram 0 0 0 a279e1f608944e13 a279e1f608944e13 0

a279e1f608944e13 dgram 0 0 0 a279e1f60894376b a279e1f60894376b 0

a279e1f60894551b dgram 0 0 0 a279e1f608943833 a279e1f608943833 0

a279e1f608943833 dgram 0 0 0 a279e1f60894551b a279e1f60894551b 0

a279e1f60480783b dgram 0 0 0 a279e1f604806193 0 a279e1f60894470b

a279e1f60894470b dgram 0 0 0 a279e1f604806193 0 a279e1f60894506b

a279e1f608944a2b dgram 0 0 0 a279e1f608944bbb a279e1f608944bbb 0

a279e1f608944bbb dgram 0 0 0 a279e1f608944a2b a279e1f608944a2b 0

a279e1f604807453 dgram 0 0 0 a279e1f608943ce3 a279e1f608943ce3 0

a279e1f608943ce3 dgram 0 0 0 a279e1f604807453 a279e1f604807453 0

a279e1f6089447d3 dgram 0 0 0 a279e1f608944643 a279e1f608944643 0

a279e1f608944643 dgram 0 0 0 a279e1f6089447d3 a279e1f6089447d3 0

a279e1f6089435db dgram 0 0 0 a279e1f6089451fb a279e1f6089451fb 0

a279e1f6089451fb dgram 0 0 0 a279e1f6089435db a279e1f6089435db 0

a279e1f60894506b dgram 0 0 0 a279e1f604806193 0 a279e1f604807773

a279e1f6048079cb dgram 0 0 0 a279e1f6048052bb a279e1f6048052bb 0

a279e1f6048052bb dgram 0 0 0 a279e1f6048079cb a279e1f6048079cb 0

a279e1f604807773 dgram 0 0 0 a279e1f604806193 0 a279e1f604805833

a279e1f60480751b dgram 0 0 0 a279e1f6048056a3 a279e1f6048056a3 0

a279e1f6048056a3 dgram 0 0 0 a279e1f60480751b a279e1f60480751b 0

a279e1f604805833 dgram 0 0 0 a279e1f604806193 0 a279e1f604806edb

a279e1f6048072c3 dgram 0 0 0 a279e1f604805a8b a279e1f604805a8b 0

a279e1f604805a8b dgram 0 0 0 a279e1f6048072c3 a279e1f6048072c3 0

a279e1f604806edb dgram 0 0 0 a279e1f604806193 0 a279e1f60480625b

a279e1f6048058fb dgram 0 0 0 a279e1f6048071fb a279e1f6048071fb 0

a279e1f6048071fb dgram 0 0 0 a279e1f6048058fb a279e1f6048058fb 0

a279e1f60480706b dgram 0 0 0 a279e1f604806fa3 a279e1f604806fa3 0

a279e1f604806fa3 dgram 0 0 0 a279e1f60480706b a279e1f60480706b 0

a279e1f604806e13 dgram 0 0 0 a279e1f604805ce3 a279e1f604805ce3 0

a279e1f604805ce3 dgram 0 0 0 a279e1f604806e13 a279e1f604806e13 0

a279e1f604806c83 dgram 0 0 0 a279e1f604805dab a279e1f604805dab 0

a279e1f604805dab dgram 0 0 0 a279e1f604806c83 a279e1f604806c83 0

a279e1f60480625b dgram 0 0 0 a279e1f604806193 0 0

a279e1f604806193 dgram 0 0 a279e1f6047fd473 0 a279e1f607f1f453 0 /private//var/run/syslog

Registered kernel control modules

id flags pcbcount rcvbuf sndbuf name

1 9 0 131072 8192 com.apple.flow-divert

2 1 1 16384 2048 com.apple.nke.sockwall

3 9 0 524288 524288 com.apple.content-filter

4 9 0 8192 2048 com.apple.packet-mangler

5 1 4 65536 65536 com.apple.net.necp_control

6 1 1 65536 65536 com.apple.net.netagent

7 9 0 524288 524288 com.apple.net.utun_control

8 1 0 65536 65536 com.apple.net.ipsec_control

9 0 12 8192 2048 com.apple.netsrc

a 18 6 8192 2048 com.apple.network.statistics

b 5 0 8192 2048 com.apple.network.tcp_ccdebug

c 1 1 8192 2048 com.apple.network.advisory

Active kernel event sockets

Proto Recv-Q Send-Q vendor class subcla rxbytes txbytes

kevt 0 0 1 6 1 41968 0

kevt 0 0 1 1 2 6868 0

kevt 0 0 1 6 1 77280 0

kevt 0 0 1 1 7 288000 0

kevt 0 0 1 1 1 2204 0

kevt 0 0 1 1 10 12375 0

kevt 0 0 1001 5 11 14060 0

kevt 0 0 1 6 1 77836 0

kevt 0 0 1 6 1 77876 0

kevt 0 0 1 1 2 7812 0

kevt 0 0 1 6 1 77876 0

kevt 0 0 1 6 1 78072 0

kevt 0 0 1 1 9 80 0

kevt 0 0 1 1 8 1120 0

kevt 0 0 1 1 2 8360 0

kevt 0 0 1 1 0 350039 0

Active kernel control sockets

Proto Recv-Q Send-Q rxbytes txbytes unit id name

kctl 0 0 12220 8480 1 2 com.apple.nke.sockwall

kctl 0 0 494 313 1 5 com.apple.net.necp_control

kctl 0 0 43 62 2 5 com.apple.net.necp_control

kctl 0 0 13 17 3 5 com.apple.net.necp_control

kctl 0 0 299 193 4 5 com.apple.net.necp_control

kctl 0 0 32 472 1 6 com.apple.net.netagent

kctl 0 0 80 108 1 9 com.apple.netsrc

kctl 0 0 279680 251712 2 9 com.apple.netsrc

kctl 0 0 80 72 3 9 com.apple.netsrc

kctl 0 0 27200 24480 4 9 com.apple.netsrc

kctl 0 0 2240 2016 5 9 com.apple.netsrc

kctl 0 0 640 576 6 9 com.apple.netsrc

kctl 0 0 240 216 7 9 com.apple.netsrc

kctl 0 0 12560 11340 8 9 com.apple.netsrc

kctl 0 0 9360 8460 9 9 com.apple.netsrc

kctl 0 0 240 216 10 9 com.apple.netsrc

kctl 0 0 240 216 13 9 com.apple.netsrc

kctl 0 0 160 144 14 9 com.apple.netsrc

kctl 0 0 824 40 1 10 com.apple.network.statistics

kctl 0 0 5605580 76 2 10 com.apple.network.statistics

kctl 0 0 0 0 3 10 com.apple.network.statistics

kctl 0 0 17440 4180 4 10 com.apple.network.statistics

kctl 0 0 1073688 54108 5 10 com.apple.network.statistics

kctl 0 0 53517280 2759216 6 10 com.apple.network.statistics

kctl 0 0 0 0 1 12 com.apple.network.advisory

Bens-MacBook-Pro:~ ben$

Reply

Answer 15

thomas_r.

Level 7

32,041 points

Sep 29, 2016 4:09 AM in response to RPLLC2017

Again, I'm not sure what I'm supposed to be seeing in all this. If you are seeing network connections being made, your computer is still connected to a network. Perhaps you turned off wifi but left an ethernet cable connected, or perhaps your computer is sharing an internet connection via Bluetooth. I don't know. But it is physically impossible for the computer to still be connecting to the internet when all networking is turned off.

The SMB server being pre-populated in the Connect to Server dialog simply means that's the last server you connected to in that manner. That could have been three years ago and you may not even remember that anymore, but the system would still remember.

I'm not seeing anything that suggests to me that you are being hacked.

Reply