Parent page of this data file: https://divinity-in-action.com/articles/pegasusspyware/ipad1/otherdatafiles/ Other Data Files Which May Be Related to Pegasus Spyware Found on Irina Bright's Apple Devices. iPad 1. File name: duetexpertd.cpu_resource-2023-07-01-154445.ips Downloaded from: Apple Device > Settings > Privacy & Security > Analytics & Improvements > Analytics Data. {"duration_ms":"92684","share_with_app_devs":1,"roots_installed":0,"bug_type":"202","os_version":"iPhone OS 16.5.1 (20F75)","slice_uuid":"3860BF39-B1F1-3B42-81BB-A2A5E92132E2","is_first_party":0,"incident_id":"ED114182-8D90-48C3-9152-F51AA11492DC","timestamp":"2023-07-01 15:44:45.00 +0300","app_name":"duetexpertd","name":"duetexpertd"} Date/Time: 2023-07-01 15:43:11.346 +0300 End time: 2023-07-01 15:44:44.031 +0300 OS Version: iPhone OS 16.5.1 (Build 20F75) Architecture: arm64e Report Version: 40 Incident Identifier: ED114182-8D90-48C3-9152-F51AA11492DC Share With Devs: Yes Data Source: Microstackshots Shared Cache: 897CC0D1-BD62-3BA4-920E-435E58CD1292 slid base address 0x1bf7f0000, slide 0x3f7f0000 Command: duetexpertd Path: /usr/libexec/duetexpertd Resource Coalition ID: 247 Architecture: arm64e Parent: UNKNOWN [1] PID: 455 Event: cpu usage Action taken: none CPU: 90 seconds cpu time over 93 seconds (97% cpu average), exceeding limit of 50% cpu over 180 seconds CPU limit: 90s Limit duration: 180s CPU used: 90s CPU duration: 93s Duration: 92.68s Duration Sampled: 74.39s Steps: 33 Hardware model: iPad13,2 Active cpus: 6 HW page size: 16384 VM page size: 16384 Advisory levels: Battery -> 3, User -> 3, ThermalPressure -> 0, Combined -> 3 Free disk space: 13.38 GB/59.58 GB, low space threshold 150 MB Low Power Mode: Enabled Vnodes Available: 75.19% (15039/20000, 10000 allocated, 10000 soft limit) Preferred User Language: en-GB, ru-GB Country Code: GB Keyboards: en_GB QWERTYBritish, ru_RU Russian OS Cryptex File Extents: 5616 Heaviest stack for the target process: 31 ??? (libsystem_pthread.dylib + 2940) [0x225a96b7c] 31 ??? (libsystem_pthread.dylib + 3548) [0x225a96ddc] 31 ??? (libdispatch.dylib + 93404) [0x1cdc6dcdc] 31 ??? (libdispatch.dylib + 49316) [0x1cdc630a4] 31 ??? (libdispatch.dylib + 46092) [0x1cdc6240c] 31 ??? (libdispatch.dylib + 138808) [0x1cdc78e38] 31 ??? (libdispatch.dylib + 16172) [0x1cdc5af2c] 31 ??? (libxpc.dylib + 69352) [0x225ae9ee8] 31 ??? (libxpc.dylib + 122596) [0x225af6ee4] 31 ??? (libxpc.dylib + 201252) [0x225b0a224] 31 ??? (libxpc.dylib + 201628) [0x225b0a39c] 31 ??? (libxpc.dylib + 200156) [0x225b09ddc] 31 ??? (AppPredictionInternal + 3685860) [0x2026b7de4] 31 ??? (AppPredictionInternal + 3686496) [0x2026b8060] 31 ??? (AppPredictionInternal + 2300024) [0x202565878] 31 ??? (AppPredictionInternal + 4030956) [0x20270c1ec] 31 ??? (AppPredictionInternal + 4030208) [0x20270bf00] 31 ??? (AppPredictionInternal + 414044) [0x20239915c] 31 ??? (AppPredictionInternal + 319252) [0x202381f14] 31 ??? (AppPredictionInternal + 39468) [0x20233da2c] 31 ??? (AppPredictionInternal + 102268) [0x20234cf7c] 31 ??? (libdispatch.dylib + 78888) [0x1cdc6a428] 31 ??? (libdispatch.dylib + 16044) [0x1cdc5aeac] 31 ??? (AppPredictionInternal + 117448) [0x202350ac8] 31 ??? (AppPredictionInternal + 71988) [0x202345934] 31 ??? (CoreDuet + 72848) [0x1d0e4bc90] 31 ??? (CoreDuet + 159304) [0x1d0e60e48] 31 ??? (libdispatch.dylib + 78888) [0x1cdc6a428] 31 ??? (libdispatch.dylib + 16044) [0x1cdc5aeac] 31 ??? (CoreDuet + 181244) [0x1d0e663fc] 31 ??? (CoreDuet + 52888) [0x1d0e46e98] 31 ??? (CoreDuet + 799008) [0x1d0efd120] 31 ??? (CoreDuet + 53780) [0x1d0e47214] 31 ??? (CoreDuet + 1166440) [0x1d0f56c68] 31 ??? (BiomePubSub + 94300) [0x1e88cd05c] 31 ??? (BiomePubSub + 47924) [0x1e88c1b34] 31 ??? (BiomePubSub + 47924) [0x1e88c1b34] 29 ??? (BiomePubSub + 126448) [0x1e88d4df0] 29 ??? (BiomePubSub + 26704) [0x1e88bc850] 29 ??? (BiomePubSub + 47924) [0x1e88c1b34] 29 ??? (BiomeStreams + 11144) [0x1d0cb3b88] 29 ??? (BiomePubSub + 22544) [0x1e88bb810] 29 ??? (BiomePubSub + 20300) [0x1e88baf4c] 29 ??? (BiomePubSub + 146564) [0x1e88d9c84] 29 ??? (BiomePubSub + 26444) [0x1e88bc74c] 25 ??? (BiomeStreams + 7456) [0x1d0cb2d20] 12 ??? (BiomePubSub + 126928) [0x1e88d4fd0] 9 ??? (CoreDuet + 1161744) [0x1d0f55a10] 9 ??? (BiomeStreams + 659752) [0x1d0d52128] 4 ??? (BiomeStreams + 486100) [0x1d0d27ad4] 4 ??? (BiomeStreams + 485420) [0x1d0d2782c] 1 ??? (CoreDuet + 775504) [0x1d0ef7550] 1 ??? (Foundation + 640260) [0x1c0b69504] 1 ??? (libsystem_malloc.dylib + 19060) [0x1d4c05a74] Powerstats for: duetexpertd [455] UUID: 3860BF39-B1F1-3B42-81BB-A2A5E92132E2 Path: /usr/libexec/duetexpertd Resource Coalition ID: 247 Architecture: arm64e Parent: UNKNOWN [1] UID: 501 Sudden Term: Tracked (allows idle exit) Footprint: 10048 KB -> 10.31 MB (+512 KB) Pageins: 3 pages Start time: 2023-07-01 15:43:29.558 +0300 End time: 2023-07-01 15:44:42.935 +0300 Num samples: 31 (94%) Primary state: 31 samples Non-Frontmost App, Non-Suppressed, User mode, Effective Thread QoS Background, Requested Thread QoS Background, Override Thread QoS Unspecified User Activity: 31 samples Idle, 0 samples Active Power Source: 0 samples on Battery, 31 samples on AC 31 ??? (libsystem_pthread.dylib + 2940) [0x225a96b7c] 31 ??? (libsystem_pthread.dylib + 3548) [0x225a96ddc] 31 ??? (libdispatch.dylib + 93404) [0x1cdc6dcdc] 31 ??? (libdispatch.dylib + 49316) [0x1cdc630a4] 31 ??? (libdispatch.dylib + 46092) [0x1cdc6240c] 31 ??? (libdispatch.dylib + 138808) [0x1cdc78e38] 31 ??? (libdispatch.dylib + 16172) [0x1cdc5af2c] 31 ??? (libxpc.dylib + 69352) [0x225ae9ee8] 31 ??? (libxpc.dylib + 122596) [0x225af6ee4] 31 ??? (libxpc.dylib + 201252) [0x225b0a224] 31 ??? (libxpc.dylib + 201628) [0x225b0a39c] 31 ??? (libxpc.dylib + 200156) [0x225b09ddc] 31 ??? (AppPredictionInternal + 3685860) [0x2026b7de4] 31 ??? (AppPredictionInternal + 3686496) [0x2026b8060] 31 ??? (AppPredictionInternal + 2300024) [0x202565878] 31 ??? (AppPredictionInternal + 4030956) [0x20270c1ec] 31 ??? (AppPredictionInternal + 4030208) [0x20270bf00] 31 ??? (AppPredictionInternal + 414044) [0x20239915c] 31 ??? (AppPredictionInternal + 319252) [0x202381f14] 31 ??? (AppPredictionInternal + 39468) [0x20233da2c] 31 ??? (AppPredictionInternal + 102268) [0x20234cf7c] 31 ??? (libdispatch.dylib + 78888) [0x1cdc6a428] 31 ??? (libdispatch.dylib + 16044) [0x1cdc5aeac] 31 ??? (AppPredictionInternal + 117448) [0x202350ac8] 31 ??? (AppPredictionInternal + 71988) [0x202345934] 31 ??? (CoreDuet + 72848) [0x1d0e4bc90] 31 ??? (CoreDuet + 159304) [0x1d0e60e48] 31 ??? (libdispatch.dylib + 78888) [0x1cdc6a428] 31 ??? (libdispatch.dylib + 16044) [0x1cdc5aeac] 31 ??? (CoreDuet + 181244) [0x1d0e663fc] 31 ??? (CoreDuet + 52888) [0x1d0e46e98] 31 ??? (CoreDuet + 799008) [0x1d0efd120] 31 ??? (CoreDuet + 53780) [0x1d0e47214] 31 ??? (CoreDuet + 1166440) [0x1d0f56c68] 31 ??? (BiomePubSub + 94300) [0x1e88cd05c] 31 ??? (BiomePubSub + 47924) [0x1e88c1b34] 31 ??? (BiomePubSub + 47924) [0x1e88c1b34] 29 ??? (BiomePubSub + 126448) [0x1e88d4df0] 29 ??? (BiomePubSub + 26704) [0x1e88bc850] 29 ??? (BiomePubSub + 47924) [0x1e88c1b34] 29 ??? (BiomeStreams + 11144) [0x1d0cb3b88] 29 ??? (BiomePubSub + 22544) [0x1e88bb810] 29 ??? (BiomePubSub + 20300) [0x1e88baf4c] 29 ??? (BiomePubSub + 146564) [0x1e88d9c84] 29 ??? (BiomePubSub + 26444) [0x1e88bc74c] 25 ??? (BiomeStreams + 7456) [0x1d0cb2d20] 12 ??? (BiomePubSub + 126928) [0x1e88d4fd0] 9 ??? (CoreDuet + 1161744) [0x1d0f55a10] 9 ??? (BiomeStreams + 659752) [0x1d0d52128] 4 ??? (BiomeStreams + 486100) [0x1d0d27ad4] 4 ??? (BiomeStreams + 485420) [0x1d0d2782c] 1 ??? (CoreDuet + 775504) [0x1d0ef7550] 1 ??? (Foundation + 640260) [0x1c0b69504] 1 ??? (libsystem_malloc.dylib + 19060) [0x1d4c05a74] 1 ??? (CoreDuet + 775432) [0x1d0ef7508] 1 ??? (libobjc.A.dylib + 19724) [0x1bf8a4d0c] 1 ??? (CoreDuet + 775228) [0x1d0ef743c] 1 ??? (libobjc.A.dylib + 10368) [0x1bf8a2880] 1 ??? (CoreDuet + 774904) [0x1d0ef72f8] 1 ??? (libobjc.A.dylib + 19576) [0x1bf8a4c78] 3 ??? (BiomeStreams + 486080) [0x1d0d27ac0] 3 ??? (ProtocolBuffer + 6316) [0x1e5e7c8ac] 2 ??? (CoreDuet + 1049684) [0x1d0f3a454] 2 ??? (CoreDuet + 1346268) [0x1d0f82adc] 2 ??? (CoreDuet + 455204) [0x1d0ea9224] 2 ??? (ProtocolBuffer + 7332) [0x1e5e7cca4] 2 ??? (libobjc.A.dylib + 137940) [0x1bf8c1ad4] 1 ??? (CoreDuet + 1049708) [0x1d0f3a46c] 1 ??? (BiomeStreams + 486112) [0x1d0d27ae0] 1 ??? (libobjc.A.dylib + 66812) [0x1bf8b04fc] 1 ??? (libobjc.A.dylib + 28160) [0x1bf8a6e00] 1 ??? (libobjc.A.dylib + 8356) [0x1bf8a20a4] 1 ??? (CoreDuet + 1053392) [0x1d0f3b2d0] 1 ??? (CoreFoundation + 431968) [0x1c67f8760] 1 ??? (libobjc.A.dylib + 10272) [0x1bf8a2820] 1 ??? (BiomeStreams + 485556) [0x1d0d278b4] 3 ??? (CoreDuet + 1161844) [0x1d0f55a74] 1 ??? (CoreDuet + 1163700) [0x1d0f561b4] 1 ??? (CoreFoundation + 513032) [0x1c680c408] 1 ??? (CoreDuet + 1163696) [0x1d0f561b0] 1 ??? (libobjc.A.dylib + 10368) [0x1bf8a2880] 1 ??? (CoreDuet + 1163592) [0x1d0f56148] 1 ??? (CoreFoundation + 17648) [0x1c67934f0] 11 ??? (BiomePubSub + 126968) [0x1e88d4ff8] 10 ??? (BiomePubSub + 9540) [0x1e88b8544] 10 ??? (BiomePubSub + 10904) [0x1e88b8a98] 10 ??? (CoreDuet + 1161984) [0x1d0f55b00] 10 ??? (Foundation + 19312) [0x1c0ad1b70] 10 ??? (Foundation + 14972) [0x1c0ad0a7c] 10 ??? (Foundation + 19312) [0x1c0ad1b70] 6 ??? (Foundation + 14824) [0x1c0ad09e8] 6 ??? (Foundation + 19312) [0x1c0ad1b70] 6 ??? (Foundation + 14972) [0x1c0ad0a7c] 6 ??? (Foundation + 15392) [0x1c0ad0c20] 6 ??? (Foundation + 5215436) [0x1c0fc64cc] 4 ??? (Foundation + 15980) [0x1c0ad0e6c] 3 ??? (Foundation + 5723464) [0x1c1042548] 2 ??? (CoreFoundation + 108788) [0x1c67a98f4] 2 ??? (libsystem_c.dylib + 30132) [0x1cdca55b4] 1 ??? (CoreFoundation + 37008) [0x1c6798090] 1 ??? (CoreFoundation + 27496) [0x1c6795b68] 1 ??? (CoreFoundation + 550668) [0x1c681570c] 1 ??? (libobjc.A.dylib + 10308) [0x1bf8a2844] 1 ??? (CoreFoundation + 108828) [0x1c67a991c] 1 ??? (Foundation + 5723632) [0x1c10425f0] 1 ??? (CoreFoundation + 108788) [0x1c67a98f4] 1 ??? (libsystem_c.dylib + 30132) [0x1cdca55b4] 1 ??? (libobjc.A.dylib + 10268) [0x1bf8a281c] 1 ??? (Foundation + 16880) [0x1c0ad11f0] 1 ??? (libobjc.A.dylib + 139096) [0x1bf8c1f58] 1 ??? (Foundation + 16384) [0x1c0ad1000] 1 ??? (libobjc.A.dylib + 53908) [0x1bf8ad294] 1 ??? (libobjc.A.dylib + 46264) [0x1bf8ab4b8] 4 ??? (Foundation + 14720) [0x1c0ad0980] 4 ??? (Foundation + 19312) [0x1c0ad1b70] 4 ??? (Foundation + 14972) [0x1c0ad0a7c] 3 ??? (Foundation + 15392) [0x1c0ad0c20] 3 ??? (Foundation + 5215436) [0x1c0fc64cc] 2 ??? (Foundation + 16316) [0x1c0ad0fbc] 1 ??? (Foundation + 5724780) [0x1c1042a6c] 1 ??? (libobjc.A.dylib + 23312) [0x1bf8a5b10] 1 ??? (libobjc.A.dylib + 10944) [0x1bf8a2ac0] 1 ??? (Foundation + 5724480) [0x1c1042940] 1 ??? (Foundation + 12480) [0x1c0ad00c0] 1 ??? (Foundation + 13072) [0x1c0ad0310] 1 ??? (CoreFoundation + 60860) [0x1c679ddbc] 1 ??? (Foundation + 16384) [0x1c0ad1000] 1 ??? (libobjc.A.dylib + 33776) [0x1bf8a83f0] 1 ??? (Foundation + 15508) [0x1c0ad0c94] 1 ??? (libobjc.A.dylib + 23516) [0x1bf8a5bdc] 1 ??? (libobjc.A.dylib + 8660) [0x1bf8a21d4] 1 ??? (CoreFoundation + 512904) [0x1c680c388] 1 ??? (libsystem_malloc.dylib + 19584) [0x1d4c05c80] 1 ??? (libsystem_malloc.dylib + 117168) [0x1d4c1d9b0] 1 ??? (BiomePubSub + 52508) [0x1e88c2d1c] 1 ??? (BiomePubSub + 126908) [0x1e88d4fbc] 1 ??? (libsystem_blocks.dylib + 7580) [0x225a92d9c] 1 ??? (libsystem_blocks.dylib + 7108) [0x225a92bc4] 1 ??? (libobjc.A.dylib + 14956) [0x1bf8a3a6c] 4 ??? (BiomeStreams + 7404) [0x1d0cb2cec] 4 ??? (BiomeStorage + 12424) [0x1e88f5088] 2 ??? (BiomeStorage + 22864) [0x1e88f7950] 2 ??? (BiomeStorage + 18052) [0x1e88f6684] 1 ??? (BiomeStorage + 8804) [0x1e88f4264] 1 ??? (BiomeStorage + 54180) [0x1e88ff3a4] 1 ??? (BiomeStorage + 32280) [0x1e88f9e18] 1 ??? (BiomeStorage + 32036) [0x1e88f9d24] 1 ??? (CoreFoundation + 35612) [0x1c6797b1c] 2 ??? (BiomeStorage + 23120) [0x1e88f7a50] 1 ??? (BiomeStorage + 26724) [0x1e88f8864] 1 ??? (libobjc.A.dylib + 10368) [0x1bf8a2880] 1 ??? (BiomeStorage + 26664) [0x1e88f8828] 1 ??? (BiomeStorage + 26884) [0x1e88f8904] 1 ??? (libobjc.A.dylib + 210436) [0x1bf8d3604] 2 ??? (libobjc.A.dylib + 66812) [0x1bf8b04fc] 2 ??? (libobjc.A.dylib + 28160) [0x1bf8a6e00] 2 ??? (libobjc.A.dylib + 8356) [0x1bf8a20a4] 2 ??? (CoreFoundation + 431968) [0x1c67f8760] 2 ??? (CoreFoundation + 431700) [0x1c67f8654] 2 ??? (libobjc.A.dylib + 66812) [0x1bf8b04fc] 2 ??? (libobjc.A.dylib + 28160) [0x1bf8a6e00] 2 ??? (libobjc.A.dylib + 8356) [0x1bf8a20a4] 1 ??? (CoreDuet + 1171880) [0x1d0f581a8] 1 ??? (libobjc.A.dylib + 66812) [0x1bf8b04fc] 1 ??? (libobjc.A.dylib + 28160) [0x1bf8a6e00] 1 ??? (libobjc.A.dylib + 8356) [0x1bf8a20a4] 1 ??? (CoreDuet + 90404) [0x1d0e50124] 1 ??? (libobjc.A.dylib + 39564) [0x1bf8a9a8c] 1 ??? (libobjc.A.dylib + 16764) [0x1bf8a417c] Binary Images: 0x10046c000 - ??? duetexpertd <3860BF39-B1F1-3B42-81BB-A2A5E92132E2> /usr/libexec/duetexpertd 0x1bf8a0000 - 0x1bf8e3f9f libobjc.A.dylib <085A190C-6214-38EA-ACCB-428C3E8AFA65> /usr/lib/libobjc.A.dylib 0x1c0acd000 - 0x1c13aafff Foundation <6E76DC96-11AF-3B2E-B71E-215F9CC6E822> /System/Library/Frameworks/Foundation.framework/Foundation 0x1c678f000 - 0x1c6b76fff CoreFoundation <4230C122-42E8-383B-BEEC-EE7B61F8BB61> /System/Library/Frameworks/CoreFoundation.framework/CoreFoundation 0x1cdc57000 - 0x1cdc9dfff libdispatch.dylib /usr/lib/system/libdispatch.dylib 0x1cdc9e000 - 0x1cdd1bff3 libsystem_c.dylib <3548F8EE-7A07-3B67-8D69-9C7D42096513> /usr/lib/system/libsystem_c.dylib 0x1d0cb1000 - 0x1d0deafff BiomeStreams <8147D686-852F-3FAD-AE0B-869EBF655EDF> /System/Library/PrivateFrameworks/BiomeStreams.framework/BiomeStreams 0x1d0e3a000 - 0x1d1055fff CoreDuet <8E158D7A-D32A-39F4-9202-68B42BDFA5D5> /System/Library/PrivateFrameworks/CoreDuet.framework/CoreDuet 0x1d4c01000 - 0x1d4c24ff3 libsystem_malloc.dylib <8C0013B0-7B99-30BB-9950-C6D2229B69A5> /usr/lib/system/libsystem_malloc.dylib 0x1e5e7b000 - 0x1e5e94fff ProtocolBuffer /System/Library/PrivateFrameworks/ProtocolBuffer.framework/ProtocolBuffer 0x1e88b6000 - 0x1e88f1fff BiomePubSub <929841F9-30E2-3EEA-A383-A226F7D261C3> /System/Library/PrivateFrameworks/BiomePubSub.framework/BiomePubSub 0x1e88f2000 - 0x1e8929fff BiomeStorage <4D1456A5-E7DA-3646-95AD-20BCE10CFB9E> /System/Library/PrivateFrameworks/BiomeStorage.framework/BiomeStorage 0x202334000 - 0x202944fff AppPredictionInternal <1B8999B7-DD53-318F-9168-5919F41F9654> /System/Library/PrivateFrameworks/AppPredictionInternal.framework/AppPredictionInternal 0x225a91000 - 0x225a95ff8 libsystem_blocks.dylib <0CA360B3-1288-3AC5-8A29-305A313F5728> /usr/lib/system/libsystem_blocks.dylib 0x225a96000 - 0x225aa1ff3 libsystem_pthread.dylib <56698309-210A-3137-97D4-14E4604B1117> /usr/lib/system/libsystem_pthread.dylib 0x225ad9000 - 0x225b1afff libxpc.dylib /usr/lib/system/libxpc.dylib