Windows 7 deprecation
Windows 7 will be removed from tria.ge on 2025-03-31
Analysis
-
max time kernel
148s -
max time network
154s -
platform
macos-10.15_amd64 -
resource
macos-20230831-en -
resource tags
arch:amd64arch:i386image:macos-20230831-enkernel:19b77alocale:en-usos:macos-10.15-amd64system -
submitted
04/10/2023, 15:45
Static task
static1
Behavioral task
behavioral1
Sample
3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc
Resource
macos-20230831-en
General
-
Target
3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc
-
Size
50.1MB
-
MD5
a3e020b1b41ae9d5ced78248cf43e5ac
-
SHA1
12baca12ef04bf4af43a50579922a169383ffd2d
-
SHA256
3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc
-
SHA512
44160140a15c9e8f9bfe76b8605cd1a2593a853896aa1fbe97dd0c9d32f74e9b0a324a23dcf42b7a969a4f87a8bc4b2db6756da57787dedc3fa2b5005e719e1a
-
SSDEEP
1572864:z2pv3xJvz/yV9UOSB4JBmO+TEuF2pv3xJvz/yV9UOSB4JBmO+TTf:z2Z3/vzqV9UOSKm72Z3/vzqV9UOSKmj
Malware Config
Signatures
-
Identifies hardware specifics through system_profiler 2 IoCs
ioc Process bash -c "system_profiler SPHardwareDataType" Process not Found system_profiler SPHardwareDataType Process not Found -
GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
description flow ioc HTTP User-Agent header 39 Go-http-client/1.1
Processes
-
/bin/shsh -c "sudo /bin/zsh -c \"/Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc\""1⤵PID:658
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc\""1⤵PID:658
-
/bin/bashsh -c "sudo /bin/zsh -c \"/Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc\""1⤵PID:658
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc1⤵PID:658
-
/usr/bin/sudosudo /bin/zsh -c /Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc1⤵PID:658
-
/bin/zsh/bin/zsh -c /Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc2⤵PID:659
-
-
/bin/zsh/bin/zsh -c /Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc2⤵PID:659
-
-
/Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc/Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc2⤵PID:659
-
-
/Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc/Users/run/3a14c28ec0bd616b029efa6b1421a120869c80f088add868de93aeefd1b60cbc2⤵PID:659
-
/usr/bin/osascriptosascript -e "display dialog \"MacOS wants to access System Preferences Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"3⤵PID:660
-
-
/usr/bin/osascriptosascript -e "display dialog \"MacOS wants to access System Preferences Please enter your password.\" with title \"System Preferences\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:ToolbarAdvanced.icns\" default answer \"\" giving up after 30 with hidden answer ¬"3⤵PID:660
-
-
/bin/bashbash -c "system_profiler SPHardwareDataType"3⤵PID:692
-
-
/bin/bashbash -c "system_profiler SPHardwareDataType"3⤵PID:692
-
-
/usr/sbin/system_profilersystem_profiler SPHardwareDataType3⤵PID:692
-
-
/usr/sbin/system_profilersystem_profiler SPHardwareDataType3⤵PID:692
-
-
/usr/bin/osascriptosascript -e "display dialog \"An unexpected error ocurred while running the Application\" with title \"macOS Error\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:AlertStopIcon.icns\""3⤵PID:694
-
-
/usr/bin/osascriptosascript -e "display dialog \"An unexpected error ocurred while running the Application\" with title \"macOS Error\" with icon file \"System:Library:CoreServices:CoreTypes.bundle:Contents:Resources:AlertStopIcon.icns\""3⤵PID:694
-
-
-
/usr/sbin/spctl/usr/sbin/spctl --test-devid-status1⤵PID:662
-
/usr/bin/syslog/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"1⤵PID:663
-
/usr/bin/pluginkit/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync1⤵PID:665
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterD830718C/OneDrive.app1⤵PID:666
-
/sbin/mount_msdos/sbin/mount_msdos -o perm -o nobrowse /dev/disk1s1 /Volumes/firmwaresyncd.qlpE2K1⤵PID:689
-
/sbin/kextload/sbin/kextload /System/Library/Extensions/msdosfs.kext1⤵PID:690
-
/usr/bin/rsyncrsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/tmp/KSInstallAction.RCIxUNSygB/m/Google Chrome.app/" "/Applications/Google Chrome.app"1⤵PID:696
-
/usr/bin/rsyncrsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/tmp/KSInstallAction.RCIxUNSygB/m/Google Chrome.app/" "/Applications/Google Chrome.app"1⤵PID:696
-
/bin/rmrm -f "/Applications/Google Chrome.app/.want_full_installer"1⤵PID:699
-
/bin/rmrm -f "/Applications/Google Chrome.app/.want_full_installer"1⤵PID:699
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString1⤵PID:701
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString1⤵PID:701
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion1⤵PID:703
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion1⤵PID:703
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL1⤵PID:705
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL1⤵PID:705
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID1⤵PID:707
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID1⤵PID:707
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName1⤵PID:709
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName1⤵PID:709
-
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"1⤵PID:710
-
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"1⤵PID:710
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadminksadmin --register --productid com.google.Chrome --version 116.0.5845.140 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion1⤵PID:715
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadminksadmin --register --productid com.google.Chrome --version 116.0.5845.140 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion1⤵PID:715
-
/bin/psps -ewwo "comm="1⤵PID:717
-
/bin/psps -ewwo "comm="1⤵PID:717
-
/usr/bin/grepgrep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"1⤵PID:719
-
/usr/bin/grepgrep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"1⤵PID:719
-
/usr/bin/cutcut -c 1-1081⤵PID:718
-
/usr/bin/cutcut -c 1-1081⤵PID:718
-
/usr/sbin/lsoflsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"1⤵PID:721
-
/usr/sbin/lsoflsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"1⤵PID:721
-
/bin/rmrm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"1⤵PID:724
-
/bin/rmrm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"1⤵PID:724
-
/usr/sbin/chownchown -Rh root:wheel "/Applications/Google Chrome.app"1⤵PID:725
-
/usr/sbin/chownchown -Rh root:wheel "/Applications/Google Chrome.app"1⤵PID:725
-
/bin/chmodchmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"1⤵PID:726
-
/bin/chmodchmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"1⤵PID:726
-
/usr/bin/findfind "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +1⤵PID:727
-
/usr/bin/findfind "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +1⤵PID:727
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/chmodchmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"2⤵PID:729
-
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/chmodchmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"2⤵PID:729
-
-
/bin/chmodchmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"2⤵PID:729
-
-
/bin/chmodchmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.140/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"2⤵PID:729
-
-
/usr/bin/xattrxattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"1⤵PID:730
-
/usr/bin/xattrxattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"1⤵PID:730
-
/usr/bin/hdiutil/usr/bin/hdiutil detach /tmp/KSInstallAction.RCIxUNSygB/m1⤵PID:731
-
/sbin/umount/sbin/umount /private/tmp/KSInstallAction.RCIxUNSygB/m1⤵PID:734
-
/sbin/umount/sbin/umount /private/tmp/KSInstallAction.RCIxUNSygB/m1⤵PID:734
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch1⤵PID:736
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportCrash.Root1⤵PID:740
-
/System/Library/CoreServices/ReportCrash/System/Library/CoreServices/ReportCrash daemon1⤵PID:740
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException1⤵PID:741
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException1⤵PID:741
-
/usr/libexec/xpcproxyxpcproxy com.apple.mediaremoteagent1⤵PID:743
-
/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoteagent/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoteagent1⤵PID:743
-
/usr/libexec/xpcproxyxpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 4861⤵PID:745
-
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent1⤵PID:745
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportCrash1⤵PID:750
-
/System/Library/CoreServices/ReportCrash/System/Library/CoreServices/ReportCrash agent1⤵PID:750
-
/usr/sbin/spctl/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app1⤵PID:751
-
/usr/libexec/xpcproxyxpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E1⤵PID:760
-
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService1⤵PID:760
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD5d8c1da4da2463fdb980d45c3bc7a5947
SHA11d07c6f92f10d6c85c8d331eeba6a7d06682be1f
SHA256f5eac6457ac6b1b01caa04dc3e50b702b5cb9689371b7c078a196c47f60e125c
SHA5124acb9f419ac77e49d3cbd06ff8d2cba1be55fa63bcaf90f916608d5cd05581f5176a0c628c3ea16456bc70e3c6b9b4a8394f1d9ce896dc1cb9bd65445eed9dbb
-
Filesize
1KB
MD578b94a75a21b35451716f43e54dfcefd
SHA14c2e08d0bf9f081c791fdaa6422849ce4fb813b6
SHA2568eaf3c86424848f223c190ac84aba3fe56e4ddb0efce33f666fbb5e1fdbe8592
SHA512baac489d2157bd8638d18741f4f8ee336b4f5a8a8ddd5237a925c3a654632598ab414d6a279f6bedf23d74fe16c6b526e019081077b725a1f4590953853e0afd
-
Filesize
1KB
MD578b94a75a21b35451716f43e54dfcefd
SHA14c2e08d0bf9f081c791fdaa6422849ce4fb813b6
SHA2568eaf3c86424848f223c190ac84aba3fe56e4ddb0efce33f666fbb5e1fdbe8592
SHA512baac489d2157bd8638d18741f4f8ee336b4f5a8a8ddd5237a925c3a654632598ab414d6a279f6bedf23d74fe16c6b526e019081077b725a1f4590953853e0afd