From d7026ad75d2e360580c9168b3b6c3b4f17f27ca0 Mon Sep 17 00:00:00 2001
From: khanhduytran0 <khanhduytran0@users.noreply.github.com>
Date: Sun, 8 Mar 2026 07:40:45 +0700
Subject: [PATCH] Update ANALYSIS.md

---
 ANALYSIS.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ANALYSIS.md b/ANALYSIS.md
index 51fac38..15e3adf 100644
--- a/ANALYSIS.md
+++ b/ANALYSIS.md
@@ -164,12 +164,12 @@ coruna-main/
 ├── utility_module.js               # Crypto helpers, Int64, LZW
 ├── Stage3_VariantB.js              # Sandbox escape + MachOPayloadBuilder
 ├── other/
-│   └── bootstrap.dylib             # Extracted dylib with ChaCha20 + LZMA
 ├── downloaded/                     # 17 files fetched from C2 server
 │   └── <hash>.min.js               # Raw encrypted payloads
 ├── extracted/                      # Base64-decoded qbrdr payloads (from repo JS files)
 │   └── <hash>.bin
 └── payload/                        # All 19 decrypted + decompressed F00DBEEF containers
+    ├── bootstrap.dylib             # Bootstrap dylib to validate and load other dylibs
     ├── 7a7d...payload              # Decrypted manifest (F00DBEEF with 19 download entries)
     ├── <hash>.bin                  # F00DBEEF container
     └── <hash>/                     # Extracted entries per container