# web_entry_powerd

CDN files used by **libSystemPowerAssertion.dylib** (Plasma loader / `entry0_type0x01`).

Typical flow:
1. DGA host → `GET /workspace/daily.html` (7zAES config blob)
2. From decrypted config `core.url` → `GET /details/ch/…/corepayload7z.js`

Hosts rotate via DGA; files below were fetched from capture-era host
`www.u4dg3st9hjx5qkn117kxms8.app` (still serving).

See `table_map.json` for CDN path → local path.