Parent page of this data file: https://divinity-in-action.com/articles/pegasusspyware/macbooks/ Spyware Found on Irina Bright’s MacBooks, Which May Be Related to Pegasus Spyware. File name: VDCAssistant_2018-02-23-205811_Irinas-MacBook-Pro.memory_resource.diag Downloaded from: McBook > Library_Logs_DiagnosticReports. Date/Time: 2018-02-23 20:38:04.665943 +0000 OS Version: Mac OS X 10.13.3 (Build 17D102) Architecture: x86_64 Report Version: 19 Command: VDCAssistant Path: /System/Library/Frameworks/CoreMediaIO.framework/Versions/A/Resources/VDC.plugin/Contents/Resources/VDCAssistant Version: ??? (???) Bundle Id: com.apple.cmio.VDCAssistant PID: 218 Coalition ID: 181 Wall Time Alive: 166341 Footprint: 0MB Limit: 50 Process Flags: Active Event: memory high watermark Action taken: none -- this exception is advisory Duration: 1200.00s Steps: 0 Hardware model: MacBookPro9,2 Active cpus: 4 Signature: MALLOC_SMALL,untagged ("VM_ALLOCATE") MallocStack Sig: Section: footprint --summary ========================================================================================== VDCAssistant [218] (corpse): 64-bit Footprint: 49 MB (4096 bytes per page) ========================================================================================== Dirty (Swapped) Clean Reclaimable (Wired) Regions Category --- --- --- --- --- --- --- 34 MB 32 MB 0 B 0 B 0 B 18 MALLOC_SMALL 6652 KB 1452 KB 2592 KB 0 B 0 B 26 untagged ("VM_ALLOCATE") 3572 KB 744 KB 0 B 0 B 0 B 45 IOKit (IOMemoryDescriptor) 2276 KB 532 KB 0 B 0 B 0 B 8 MALLOC_TINY 1180 KB 1180 KB 0 B 0 B 0 B 7 MALLOC_LARGE 224 KB 68 KB 0 B 0 B 0 B 13 stack 116 KB 12 KB 0 B 0 B 0 B 3 OpenGL Shading Language 84 KB 4096 B 0 B 0 B 0 B 29 malloc metadata 32 KB 0 B 0 B 0 B 0 B 1 libdispatch 20 KB 8192 B 0 B 0 B 0 B 1 Activity Tracing 8192 B 4096 B 0 B 0 B 0 B 1 os_alloc_once 1128 KB 440 KB 4392 KB 0 B 0 B 835 Other --- --- --- --- --- --- --- 49 MB 37 MB 6984 KB 0 B 0 B 987 TOTAL Auxiliary data: Kernel memory: KPRVT: 8192 B KSHRD: 0 B phys_footprint: 0 B Powerstats for: VDCAssistant [218] UUID: DF1D9537-81D0-3E32-8F56-21086033EB81 Start time: 2018-02-23 20:57:18 +0000 End time: 2018-02-23 20:57:57 +0000 Parent: launchd Microstackshots: 14 samples Primary state: 12 samples Non-Frontmost App, Kernel mode, Effective Thread QoS Unspecified, Requested Thread QoS Unspecified, Override Thread QoS Unspecified User Activity: 0 samples Idle, 14 samples Active Power Source: 0 samples on Battery, 14 samples on AC 13 _pthread_start + 377 (libsystem_pthread.dylib) [0x7fff543fa56d] 13 _pthread_body + 340 (libsystem_pthread.dylib) [0x7fff543fa6c1] 8 ??? ( + 19866) [0x1069a3d9a] 8 ??? ( + 141581) [0x1069c190d] 8 ??? ( + 24740) [0x108e0d0a4] 8 IOConnectCallMethod + 244 (IOKit) [0x7fff2ef66ffe] 7 io_connect_method + 369 (IOKit) [0x7fff2ef67197] 7 mach_msg_trap + 10 (libsystem_kernel.dylib) [0x7fff542b57c2] 1 io_connect_method + 50 (IOKit) [0x7fff2ef67058] 1 5 ??? ( + 22658) [0x1069a4882] 5 CFRunLoopRun + 99 (CoreFoundation) [0x7fff2c7fbb13] 5 CFRunLoopRunSpecific + 487 (CoreFoundation) [0x7fff2c7bd787] 5 __CFRunLoopRun + 2848 (CoreFoundation) [0x7fff2c7be540] 5 __CFRunLoopDoSource1 + 533 (CoreFoundation) [0x7fff2c7c6785] 5 __CFRUNLOOP_IS_CALLING_OUT_TO_A_SOURCE1_PERFORM_FUNCTION__ + 41 (CoreFoundation) [0x7fff2c7c6839] 5 __CFMachPortPerform + 347 (CoreFoundation) [0x7fff2c7c69ab] 5 IODispatchCalloutFromCFMessage + 349 (IOKit) [0x7fff2ef762b5] 5 ??? ( + 222428) [0x1069d54dc] 5 ??? ( + 229273) [0x1069d6f99] 5 ??? ( + 29411) [0x108e0e2e3] 5 IOConnectCallAsyncScalarMethod + 95 (IOKit) [0x7fff2ef7783b] 5 io_connect_async_method + 497 (IOKit) [0x7fff2ef77a39] 5 mach_msg_trap + 10 (libsystem_kernel.dylib) [0x7fff542b57c2] 1 _pthread_wqthread + 980 (libsystem_pthread.dylib) [0x7fff543fa033] 1 _dispatch_workloop_worker_thread + 880 (libdispatch.dylib) [0x7fff5414ed16] 1 _dispatch_root_queue_drain_deferred_wlh + 332 (libdispatch.dylib) [0x7fff5414af02] 1 _dispatch_queue_invoke + 373 (libdispatch.dylib) [0x7fff5413d0fd] 1 _dispatch_queue_serial_drain + 222 (libdispatch.dylib) [0x7fff5414a06f] 1 _dispatch_source_invoke + 620 (libdispatch.dylib) [0x7fff54138018] 1 _dispatch_continuation_pop + 472 (libdispatch.dylib) [0x7fff54148e76] 1 _dispatch_client_callout + 8 (libdispatch.dylib) [0x7fff54135d50] 1 ??? ( + 38910) [0x1069a87fe] 1 dispatch_mig_server + 413 (libdispatch.dylib) [0x7fff54141f62] 1 ??? ( + 244783) [0x1069dac2f] 1 ??? ( + 13410) [0x1069a2462] 1 ??? ( + 11158) [0x1069a1b96] 1 ??? ( + 252266) [0x1069dc96a] 1 ??? ( + 65146) [0x1069aee7a] 1 ??? ( + 184340) [0x1069cc014] 1 ??? ( + 188725) [0x1069cd135] 1 ??? ( + 41252) [0x1069a9124] 1 ??? ( + 29571) [0x1069a6383] 1 CGLChoosePixelFormat + 28 (OpenGL) [0x7fff36aacb84] 1 pthread_once + 56 (libsystem_pthread.dylib) [0x7fff543fa959] 1 ??? (libsystem_platform.dylib + 3840) [0x7fff543eff00] 1 __pthread_once_handler + 66 (libsystem_pthread.dylib) [0x7fff543fa9be] 1 ??? (OpenGL + 15201) [0x7fff36aa7b61] 1 CFPreferencesCopyMultiple + 118 (CoreFoundation) [0x7fff2c831396] 1 -[_CFXPreferences copyValuesForKeys:identifier:user:host:container:] + 183 (CoreFoundation) [0x7fff2c91cdf7] 1 -[_CFXPreferences(SourceAdditions) withSourceForIdentifier:user:byHost:container:cloud:perform:] + 778 (CoreFoundation) [0x7fff2c8b431a] 1 __68-[_CFXPreferences copyValuesForKeys:identifier:user:host:container:]_block_invoke + 273 (CoreFoundation) [0x7fff2c91cf71] 1 -[CFPrefsPlistSource alreadylocked_copyDictionary] + 560 (CoreFoundation) [0x7fff2c801030] 1 -[CFPrefsPlistSource alreadylocked_requestNewData] + 301 (CoreFoundation) [0x7fff2c7c83dd] 1 -[_CFXPreferences withConnectionForRole:performBlock:] + 36 (CoreFoundation) [0x7fff2c91eaf4] 1 __50-[CFPrefsPlistSource alreadylocked_requestNewData]_block_invoke + 108 (CoreFoundation) [0x7fff2c7c84bc] 1 -[CFPrefsPlistSource createRequestNewContentMessageForDaemon:] + 746 (CoreFoundation) [0x7fff2c774f7a] 1 __62-[CFPrefsPlistSource createRequestNewContentMessageForDaemon:]_block_invoke + 68 (CoreFoundation) [0x7fff2c7750c4] 1 -[CFPrefsPlistSource createSynchronizeMessage] + 99 (CoreFoundation) [0x7fff2c7755d3] 1 xpc_dictionary_create + 37 (libxpc.dylib) [0x7fff5442db11] 1 _os_object_alloc_realized + 35 (libdispatch.dylib) [0x7fff54135baa] 1 class_createInstance + 33 (libobjc.A.dylib) [0x7fff53574c8d] 1 Binary Images: 0x10699f000 - ??? ??? 0x108e07000 - ??? ??? 0x7fff2c73c000 - 0x7fff2cbd5fff com.apple.CoreFoundation 6.9 (1451) <739D6558-3DF3-3181-AA07-BBE3882D3B7F> /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation 0x7fff2ef63000 - 0x7fff2effefff com.apple.framework.IOKit 2.0.2 <9CFA07B9-BA6E-31E4-AD4F-C47071A8C522> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit 0x7fff36aa4000 - 0x7fff36ab2ffb com.apple.opengl 16.4.2 (16.4.2) /System/Library/Frameworks/OpenGL.framework/Versions/A/OpenGL 0x7fff5356e000 - 0x7fff5395f3b7 libobjc.A.dylib (723) <37A7D77E-952C-3F5D-970B-3CDE349B2322> /usr/lib/libobjc.A.dylib 0x7fff54134000 - 0x7fff5416dff7 libdispatch.dylib (913.30.4) <7D0E3183-282B-3FEE-A734-2C0ADC092084> /usr/lib/system/libdispatch.dylib 0x7fff542a3000 - 0x7fff542c8ff7 libsystem_kernel.dylib (4570.41.2) <5155A4C3-825B-3178-AC51-0D2D2F2A6618> /usr/lib/system/libsystem_kernel.dylib 0x7fff543ef000 - 0x7fff543f6fff libsystem_platform.dylib /usr/lib/system/libsystem_platform.dylib 0x7fff543f7000 - 0x7fff54402fff libsystem_pthread.dylib (301.30.1) /usr/lib/system/libsystem_pthread.dylib 0x7fff5442c000 - 0x7fff54458ff7 libxpc.dylib (1205.30.29) /usr/lib/system/libxpc.dylib