Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Overview

overview

6

Static

static

important.exe

macos_amd64

6

Resubmissions

19/03/2022, 08:22

220319-j9qwraech8 10

19/03/2022, 08:21

220319-j84ffseebn 6

16/03/2022, 15:34

220316-sz9qjsfba4 10

17/02/2022, 18:50

220217-xhdn1aedap 10

17/02/2022, 13:21

220217-ql2rnsbbf7 10

17/02/2022, 13:20

220217-qljwvscdar 1

17/02/2022, 13:20

220217-qlb61sbbf6 1

17/02/2022, 13:19

220217-qkv8hacdap 1

17/02/2022, 12:49

220217-p2gwrscchl 10

17/02/2022, 08:03

220217-jxx5ascaan 1

Analysis

  • max time kernel
    48s
  • max time network
    50s
  • platform
    macos_amd64
  • resource
    macos
  • submitted
    19/03/2022, 08:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    important.exe

  • Size

    3.4MB

  • MD5

    84c82835a5d21bbcf75a61706d8ab549

  • SHA1

    5ff465afaabcbf0150d1a3ab2c2e74f3a4426467

  • SHA256

    ed01ebfbc9eb5bbea545af4d01bf5f1071661840480439c6e5babe8e080e41aa

  • SHA512

    90723a50c20ba3643d625595fd6be8dcf88d70ff7f4b4719a88f055d5b3149a4231018ea30d375171507a147e59f73478c0c27948590794554d031e7d54b7244

Score
6/10

Malware Config

Signatures

  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

Processes

  • /usr/sbin/spctl
    /usr/sbin/spctl --test-devid-status
    1⤵
      PID:601
    • /usr/bin/syslog
      /usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
      1⤵
        PID:602
      • /bin/sh
        sh -c "sudo /bin/zsh -c \"/Users/run/important.exe\""
        1⤵
          PID:603
        • /bin/bash
          sh -c "sudo /bin/zsh -c \"/Users/run/important.exe\""
          1⤵
            PID:603
          • /bin/bash
            sh -c "sudo /bin/zsh -c \"/Users/run/important.exe\""
            1⤵
              PID:603
            • /usr/bin/sudo
              sudo /bin/zsh -c /Users/run/important.exe
              1⤵
                PID:603
              • /usr/bin/sudo
                sudo /bin/zsh -c /Users/run/important.exe
                1⤵
                  PID:603
                  • /bin/zsh
                    /bin/zsh -c /Users/run/important.exe
                    2⤵
                      PID:605
                    • /bin/zsh
                      /bin/zsh -c /Users/run/important.exe
                      2⤵
                        PID:605
                      • /Users/run/important.exe
                        /Users/run/important.exe
                        2⤵
                          PID:605
                        • /Users/run/important.exe
                          /Users/run/important.exe
                          2⤵
                            PID:605
                        • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
                          "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" "-Djdk.disableLastUsageTracking=true" "-Djava.awt.headless=true " -cp "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/lib/deploy.jar" com.sun.deploy.panel.ControlPanel -getSecurityLevel
                          1⤵
                            PID:620
                          • /usr/libexec/xpcproxy
                            xpcproxy com.apple.ReportMemoryException
                            1⤵
                              PID:637
                            • /usr/libexec/ReportMemoryException
                              /usr/libexec/ReportMemoryException
                              1⤵
                                PID:637
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.systempreferences.2140
                                1⤵
                                  PID:638
                                • /System/Applications/System Preferences.app/Contents/MacOS/System Preferences
                                  "/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
                                  1⤵
                                    PID:638
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.AccountProfileRemoteViewService 638
                                    1⤵
                                      PID:639
                                    • /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
                                      /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
                                      1⤵
                                        PID:639
                                      • /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
                                        /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
                                        1⤵
                                          PID:641
                                        • /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
                                          /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
                                          1⤵
                                            PID:642
                                          • /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
                                            /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
                                            1⤵
                                              PID:643
                                            • /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
                                              /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
                                              1⤵
                                                PID:645
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.studentd
                                                1⤵
                                                  PID:646
                                                • /usr/libexec/studentd
                                                  /usr/libexec/studentd
                                                  1⤵
                                                    PID:646
                                                  • /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
                                                    /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
                                                    1⤵
                                                      PID:647
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.preference.screentime.remoteservice 638
                                                      1⤵
                                                        PID:648
                                                      • /System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice
                                                        /System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice
                                                        1⤵
                                                          PID:648
                                                        • /usr/libexec/xpcproxy
                                                          xpcproxy com.apple.metadata.mdwrite
                                                          1⤵
                                                            PID:649
                                                          • /usr/libexec/xpcproxy
                                                            xpcproxy com.apple.colorsync.useragent
                                                            1⤵
                                                              PID:650
                                                            • /System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
                                                              /System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
                                                              1⤵
                                                                PID:650
                                                              • /usr/bin/python
                                                                python
                                                                1⤵
                                                                  PID:652
                                                                • /usr/bin/python
                                                                  python
                                                                  1⤵
                                                                    PID:652
                                                                  • /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
                                                                    /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python
                                                                    1⤵
                                                                      PID:652
                                                                    • /usr/libexec/xpcproxy
                                                                      xpcproxy com.google.Chrome.3052
                                                                      1⤵
                                                                        PID:656
                                                                      • /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
                                                                        "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
                                                                        1⤵
                                                                          PID:656
                                                                        • /usr/libexec/xpcproxy
                                                                          xpcproxy com.apple.GameController.gamecontrollerd
                                                                          1⤵
                                                                            PID:658
                                                                          • /usr/libexec/gamecontrollerd
                                                                            /usr/libexec/gamecontrollerd
                                                                            1⤵
                                                                              PID:658
                                                                            • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/chrome_crashpad_handler
                                                                              "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=98.0.4758.109" "--handshake-fd=5"
                                                                              1⤵
                                                                                PID:661
                                                                              • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/chrome_crashpad_handler
                                                                                "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=98.0.4758.109" "--handshake-fd=5"
                                                                                1⤵
                                                                                  PID:661
                                                                                • /usr/bin/profiles
                                                                                  /usr/bin/profiles status -type enrollment
                                                                                  1⤵
                                                                                    PID:662
                                                                                  • /usr/sbin/system_profiler
                                                                                    /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
                                                                                    1⤵
                                                                                      PID:664
                                                                                    • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
                                                                                      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
                                                                                      1⤵
                                                                                        PID:665
                                                                                      • /usr/bin/tar
                                                                                        /usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
                                                                                        1⤵
                                                                                          PID:668
                                                                                        • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
                                                                                          "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072" "--seatbelt-client=30"
                                                                                          1⤵
                                                                                            PID:667
                                                                                          • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
                                                                                            "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072" "--seatbelt-client=30"
                                                                                            1⤵
                                                                                              PID:669
                                                                                            • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
                                                                                              "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072" "--seatbelt-client=31"
                                                                                              1⤵
                                                                                                PID:670
                                                                                              • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
                                                                                                "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072"
                                                                                                1⤵
                                                                                                  PID:671
                                                                                                • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
                                                                                                  /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
                                                                                                  1⤵
                                                                                                    PID:673
                                                                                                  • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
                                                                                                    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=296701662" --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072" "--seatbelt-client=59"
                                                                                                    1⤵
                                                                                                      PID:674
                                                                                                    • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
                                                                                                      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=296757972" --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072" "--seatbelt-client=59"
                                                                                                      1⤵
                                                                                                        PID:675
                                                                                                      • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler
                                                                                                        /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler "--database=/Users/run/Library/Google/GoogleSoftwareUpdate/Crashes" "--url=https://clients2.google.com/cr/report" "--annotation=plat=OS X" "--annotation=prod=Keystone" "--annotation=ver=1.3.16.180" "--handshake-fd=4"
                                                                                                        1⤵
                                                                                                          PID:677
                                                                                                        • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler
                                                                                                          /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler "--database=/Users/run/Library/Google/GoogleSoftwareUpdate/Crashes" "--url=https://clients2.google.com/cr/report" "--annotation=plat=OS X" "--annotation=prod=Keystone" "--annotation=ver=1.3.16.180" "--handshake-fd=4"
                                                                                                          1⤵
                                                                                                            PID:677
                                                                                                          • /usr/libexec/xpcproxy
                                                                                                            xpcproxy com.google.keystone.system.xpcservice
                                                                                                            1⤵
                                                                                                              PID:678
                                                                                                            • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
                                                                                                              /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode xpchost
                                                                                                              1⤵
                                                                                                                PID:678
                                                                                                              • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler
                                                                                                                /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler "--database=/Users/run/Library/Google/GoogleSoftwareUpdate/Crashes" "--url=https://clients2.google.com/cr/report" "--annotation=plat=OS X" "--annotation=prod=Keystone" "--annotation=ver=1.3.16.180" "--handshake-fd=4"
                                                                                                                1⤵
                                                                                                                  PID:680
                                                                                                                • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler
                                                                                                                  /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler "--database=/Users/run/Library/Google/GoogleSoftwareUpdate/Crashes" "--url=https://clients2.google.com/cr/report" "--annotation=plat=OS X" "--annotation=prod=Keystone" "--annotation=ver=1.3.16.180" "--handshake-fd=4"
                                                                                                                  1⤵
                                                                                                                    PID:680
                                                                                                                  • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
                                                                                                                    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
                                                                                                                    1⤵
                                                                                                                      PID:681
                                                                                                                    • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
                                                                                                                      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=298827091" --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072" "--seatbelt-client=62"
                                                                                                                      1⤵
                                                                                                                        PID:682
                                                                                                                      • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
                                                                                                                        /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
                                                                                                                        1⤵
                                                                                                                          PID:683
                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                          xpcproxy com.apple.SafariLaunchAgent
                                                                                                                          1⤵
                                                                                                                            PID:684
                                                                                                                          • /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
                                                                                                                            /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
                                                                                                                            1⤵
                                                                                                                              PID:684
                                                                                                                            • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
                                                                                                                              "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=9" "--launch-time-ticks=300547954" --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072" "--seatbelt-client=76"
                                                                                                                              1⤵
                                                                                                                                PID:685
                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                xpcproxy com.google.keystone.daemon
                                                                                                                                1⤵
                                                                                                                                  PID:686
                                                                                                                                • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/GoogleSoftwareUpdateDaemon
                                                                                                                                  /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/GoogleSoftwareUpdateDaemon
                                                                                                                                  1⤵
                                                                                                                                    PID:686
                                                                                                                                  • /usr/sbin/system_profiler
                                                                                                                                    /usr/sbin/system_profiler SPConfigurationProfileDataType
                                                                                                                                    1⤵
                                                                                                                                      PID:687
                                                                                                                                    • /usr/sbin/system_profiler
                                                                                                                                      /usr/sbin/system_profiler SPConfigurationProfileDataType
                                                                                                                                      1⤵
                                                                                                                                        PID:689
                                                                                                                                      • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
                                                                                                                                        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=305946321" --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072" "--seatbelt-client=64"
                                                                                                                                        1⤵
                                                                                                                                          PID:691
                                                                                                                                        • /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
                                                                                                                                          "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/98.0.4758.109/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,935849574755200662,15196430506815918157,131072" "--seatbelt-client=106"
                                                                                                                                          1⤵
                                                                                                                                            PID:692
                                                                                                                                          • /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch
                                                                                                                                            /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch
                                                                                                                                            1⤵
                                                                                                                                              PID:693

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Matrix

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads