7b22d4f5dbc3559e93942d91e3f9695f18875ce33b6959d706a26020f114b288

Resubmissions

25-01-2024 17:14

240125-vrzaysccfn 10

25-01-2024 17:12

240125-vqyyssccdl 1

Analysis

max time kernel
26s
max time network
29s
platform
macos-10.15_amd64
resource
macos-20231201-en
resource tags

arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
25-01-2024 17:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

IMG_0108.jpg
Size

222KB
MD5

65e88013bb3511f2417bf20abd276947
SHA1

eb9143fb209e858e24d541a2947a7fa692090d54
SHA256

7b22d4f5dbc3559e93942d91e3f9695f18875ce33b6959d706a26020f114b288
SHA512

c0ff2bd15194094e4ec0cd982f8eb9d2ad12350d3373699968fccfe8251002d2ff64058c71dad669738789fd4c8ab143bc756b19043dbc31367b6170f6644e23
SSDEEP

3072:clrA3dPx4hkFbTxWt97E7NoreUDH8KO3AYUyw4+Bh1GakiAvs:o+xPbswvUtOwY1+Biak5vs

Score

1^/10

Malware Config

Signatures

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/IMG_0108.jpg\""
1⤵
PID:521

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/IMG_0108.jpg\""
1⤵
PID:521

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/IMG_0108.jpg
1⤵
PID:521

/bin/zsh
/bin/zsh -c /Users/run/IMG_0108.jpg
2⤵
PID:522

/Users/run/IMG_0108.jpg
/Users/run/IMG_0108.jpg
2⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:524

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.google.Chrome.3056
1⤵
PID:542

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:551

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:551

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:553

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:555

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:557

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:558

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:559

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:560

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,10297401863029181714,6553753037392372518,131072" "--seatbelt-client=19"
1⤵
PID:561

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler "--database=/Users/run/Library/Google/GoogleSoftwareUpdate/Crashes" "--url=https://clients2.google.com/cr/report" "--annotation=plat=OS X" "--annotation=prod=Keystone" "--annotation=ver=1.3.17.192" "--handshake-fd=4"
1⤵
PID:563

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,10297401863029181714,6553753037392372518,131072" "--seatbelt-client=19"
1⤵
PID:564

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,10297401863029181714,6553753037392372518,131072" "--seatbelt-client=19"
1⤵
PID:565

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,10297401863029181714,6553753037392372518,131072"
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.google.keystone.system.xpcservice
1⤵
PID:567

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode xpchost
1⤵
PID:567

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=299658953" --shared-files "--field-trial-handle=1718379636,r,10297401863029181714,6553753037392372518,131072" "--seatbelt-client=56"
1⤵
PID:568

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=299717401" --shared-files "--field-trial-handle=1718379636,r,10297401863029181714,6553753037392372518,131072" "--seatbelt-client=56"
1⤵
PID:569

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler "--database=/Users/run/Library/Google/GoogleSoftwareUpdate/Crashes" "--url=https://clients2.google.com/cr/report" "--annotation=plat=OS X" "--annotation=prod=Keystone" "--annotation=ver=1.3.17.192" "--handshake-fd=4"
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.google.keystone.daemon
1⤵
PID:572

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/GoogleSoftwareUpdateDaemon
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/GoogleSoftwareUpdateDaemon
1⤵
PID:572

/usr/sbin/system_profiler
/usr/sbin/system_profiler SPConfigurationProfileDataType
1⤵
PID:573

/usr/sbin/system_profiler
/usr/sbin/system_profiler SPConfigurationProfileDataType
1⤵
PID:576

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:581

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:581

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
1⤵
PID:582

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=303498626" --shared-files "--field-trial-handle=1718379636,r,10297401863029181714,6553753037392372518,131072" "--seatbelt-client=74"
1⤵
PID:583

/usr/sbin/system_profiler
/usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
1⤵
PID:585

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=9" "--launch-time-ticks=306480691" --shared-files "--field-trial-handle=1718379636,r,10297401863029181714,6553753037392372518,131072" "--seatbelt-client=98"
1⤵
PID:587

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch
1⤵
PID:589

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,10297401863029181714,6553753037392372518,131072" "--seatbelt-client=99"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:591

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksfetch
1⤵
PID:592

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:591

/usr/bin/hdiutil
/usr/bin/hdiutil isencrypted /tmp/KSDownloadAction.iiw9be0TZB/com.google.Keystone.dmg -plist
1⤵
PID:593

/usr/bin/hdiutil
/usr/bin/hdiutil isencrypted /tmp/KSDownloadAction.iiw9be0TZB/com.google.Keystone.dmg -plist
1⤵
PID:594

/usr/bin/hdiutil
/usr/bin/hdiutil imageinfo /tmp/KSDownloadAction.iiw9be0TZB/com.google.Keystone.dmg -plist
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.hdiejectd
1⤵
PID:596

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
1⤵
PID:596

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 47BDE168-4F43-4A3C-A6BF-4EF35408D3C2
1⤵
PID:597

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 47BDE168-4F43-4A3C-A6BF-4EF35408D3C2 -post-exec 4
1⤵
PID:598

/usr/bin/hdiutil
/usr/bin/hdiutil attach /tmp/KSDownloadAction.iiw9be0TZB/com.google.Keystone.dmg -plist -readonly -noverify -nobrowse -mountpoint /tmp/KSInstallAction.cLzhZvuUMq/m
1⤵
PID:600

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid AD876D80-590B-4E66-8F6D-0F4984B2242A
1⤵
PID:601

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid AD876D80-590B-4E66-8F6D-0F4984B2242A -post-exec 4
1⤵
PID:602

/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
1⤵
PID:603

/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
1⤵
PID:604

/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
1⤵
PID:605

/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
1⤵
PID:606

/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
1⤵
PID:607

/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
1⤵
PID:608

/sbin/mount
/sbin/mount -t hfs -o "-u=99,-g=99,-m=755,nodev,noowners,nosuid,rdonly,nobrowse" /dev/disk3s2 /private/tmp/KSInstallAction.cLzhZvuUMq/m
1⤵
PID:609

/sbin/mount_hfs
/sbin/mount_hfs -u 99 -g 99 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o nobrowse /dev/disk3s2 /private/tmp/KSInstallAction.cLzhZvuUMq/m
2⤵
PID:610

/tmp/KSInstallAction.cLzhZvuUMq/m/.keystone_install
/tmp/KSInstallAction.cLzhZvuUMq/m/.keystone_install /tmp/KSInstallAction.cLzhZvuUMq/m
1⤵
PID:611

/usr/bin/env
env
2⤵
PID:612

/tmp/KSInstallAction.cLzhZvuUMq/m/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
/tmp/KSInstallAction.cLzhZvuUMq/m/GoogleUpdater.app/Contents/MacOS/GoogleUpdater --install --system --enable-logging "--vmodule=*/chrome/updater/*=2"
2⤵
PID:613

/private/tmp/KSInstallAction.cLzhZvuUMq/m/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
/private/tmp/KSInstallAction.cLzhZvuUMq/m/GoogleUpdater.app/Contents/MacOS/GoogleUpdater --crash-handler --enable-logging "--vmodule=*/components/update_client/*=2,*/chrome/updater/*=2" --system "--database=/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=122.0.6234.0" "--handshake-fd=5"
1⤵
PID:1.8446744073709552e+19

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:616

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:616

/bin/launchctl
/bin/launchctl bootout system /Library/LaunchDaemons/com.google.GoogleUpdater.wake.system.plist
1⤵
PID:617

/bin/launchctl
/bin/launchctl bootstrap system /Library/LaunchDaemons/com.google.GoogleUpdater.wake.system.plist
1⤵
PID:618

/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/launcher
"/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
1⤵
PID:619

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/CodeResources
Filesize
1KB

MD5
cf305c5dc09a560c836129c564e3367f

SHA1
d173079c6304d21c69c0ef8b404023413cccf0aa

SHA256
049bc8705363ddbbe0e49fab0ec3643c51f2c1cfd57d8b1dab9697e092611ad0

SHA512
5974a402a6cbf7e0afb0764e338a045b7cc2a792da4b097848fae2da4da34dbaaa53d853705dded69b6878449461ee11b0428dd1f501571fcdaa7ef465c09665

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
Filesize
4.4MB

MD5
6faf9cae689eed2e62cd8322829a7c9c

SHA1
ae919583ffef3672a7b56effbd579119b481f07e

SHA256
c8638f9cd698e815832f1a5e15eb6781b588eaf49a88e07e709f17fd0ad70ffa

SHA512
2bc6bc89dc200e2c2b47efb1e4a2123a160be1449090f48f2e91462f2beed2c58ba100fb215d75469d785d474f607727536f31fe3c1f27dc559c479a6c7b7d98

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
Filesize
3.5MB

MD5
bf3f69f02fbc6d300ffbb578086c5414

SHA1
039940cd17a9ac293201ee95e1fb2e366d2efc5f

SHA256
30d2fda4ebc8fa7b243581bfb4e9bad880a3c0c2984506c5cbe1cdde1d673c5c

SHA512
9e33cc0d2fd5d5adf9be0988341e4bdd24a0733a20de625ea6d57cfd79a410471c23083aed06ab93e6c2b926e0afe45b42c93035d1811e95f4d6fffca93530c0

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
Filesize
1.2MB

MD5
a789d1959a5912a2b69b27980c946032

SHA1
855857acdddba7ddba3024b2f0822bf02225aa7d

SHA256
8a922cf31ecc37b50783f484d937f9989ee85097b55b3334dbd29d5e51b31ddd

SHA512
f5009a7bf2cbf0645930846b570f45addc6fc69907bdcadcc6ae2933ed0c735f05ce48abb8515c610054190ad047e58c5447a3ef7a00f971a2f861ac831e9345

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksinstall
Filesize
2.8MB

MD5
18e9202a5ebfcaca86eb417524451435

SHA1
e742b7c05024067e016e9549cdc74d375f735c62

SHA256
79dbeb85e6ea7bf47ece3a2b5ecbbc8994e8faf307f86913d4c088c5e773555d

SHA512
daf43a5200ae4cc51b191657a2034044a1388680a64432c15e031274e4c5f45ced2efa1511a4221b55781dc20eeaf9a8ba3e92ff385872e6f478fcc2b634474d

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/Info.plist
Filesize
1KB

MD5
e516586a174a7d639f4ac4101c6bd9e4

SHA1
08c90151bd866b32eafc5ac6e8b49a866d434314

SHA256
6d5d2ae942d03fd5e2c77fc494ac6b0577f314bbd9a0d1709dadfd4af92c2f6c

SHA512
026bb1ca67be250ae852f1b6e0a01d0fc93a0253215f2f35fa453d1d8c83e606229dc06ff9a863179d168d3011cd0d908d78f582fa9a46bc7920a0626ef8d58f

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/GoogleSoftwareUpdate
Filesize
408KB

MD5
675de6c669486f573772d5adf9bf769e

SHA1
20fbd5279d3a91c45a77a03154faafcf4d187fb0

SHA256
7fe25d6662f1a8eac26b9cd5b76eae4f3917bb4cf17f00bd40f9f28a2c1e3474

SHA512
9252d9ae95a679bbdda2c86021300cb347fefe7987e0656302c0a792198fd6ddac8316550695a1e60df855520d273799765f094cc7fc75ca04a60f2bba431f11

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/Info.plist
Filesize
1KB

MD5
23930c9c5269ddf00f2a10ba0babab64

SHA1
cba2b647c920f647a111be523cb22e24b6b51182

SHA256
8dc87a0909469ee855a6dee6f51c9ee7957aba89d78b045ea6927dda75416766

SHA512
ceae9bda20ec669f543e9373a4bb01e447c5994784e5584660f9329d36ddbb6c7d2cb303e57202fb6cd297f1fcafa35cac82e01680d8afd1ca41da9dbf45bcc7

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
Filesize
4.4MB

MD5
191c1d75ba04f51c8c49c57a9fe2f761

SHA1
b69e3b44e3eecbdf67b03a1622f0e02d28096cca

SHA256
f08055114d11c98637bbbd94c81eed337eedd7b207735f20c5d652a6c7e44c0a

SHA512
11a4d5dde555b6cddd96984acbd85bdeffa8abf252517672d61c7b6b0fe5c472adf5e8a6c4f212954fa199a4f101d54891a10cb9689699a5c21fe0abaf53f111

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/_CodeSignature/CodeResources
Filesize
2KB

MD5
c48c1d9c6cf982c32580a9c58b0cce51

SHA1
630a08873072069616cdcc31f55e6d7423086d78

SHA256
6686de10a28a2fe11b36cbb86dcbacc827cfc4ea116b4dabf1845e5aee629e9b

SHA512
27f6256579e03e319af66d7fa316935b4e2d5c126429a8b961424a466cab907ceab5d068fb87d763bc3d819a791492c17ab1d1b54f5530cb34224b582d00c013

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/_CodeSignature/CodeResources
Filesize
3KB

MD5
cef7bad2c36bdeaf98e706b2a99dfbb0

SHA1
1117b386820cba93229993f679d5108b400838d0

SHA256
b2e741c3daa5eb30b8fb223f4f1720561425bac7427c26dfc8d5eb3a39b43802

SHA512
69d5bdd83d37772ba3e0b3e46dfa9f4cf6b0fd9966c4f77c1ab6c8c63031bbc3fae9f5a515273a39460657a8cb9c4e181b245313973d2bcb49df3d14e25ac914

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Helpers/launcher
Filesize
411KB

MD5
1324cc669f98c29769774421666eb2bf

SHA1
1ea2a8a7dfb03b56dbeae01cbe9eeee2a05a31b1

SHA256
9367ca6c6995779fd53be7286862af7a0a4d56101ea5a1a129582c1e10979413

SHA512
d8a948921e592f25d9074c951436cf585d433f62534331f90140a354660163bb7baa158327ef996c69c7e3daa73dd9fc36adca0773fd2ee7af883b4e812493c4

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/Info.plist
Filesize
1KB

MD5
4ac7de4b71100fe54f53bf7661039174

SHA1
9f34ff47915bb60303ff7494edeb0a5547380171

SHA256
1750a71cd40686a48163141e533e59c74fda975b4026e0cb1ef73b84f4685061

SHA512
e1ff807b64a38dbfc6c298a770e8f792f699c1e21bb7bb401f1f6c0611d548b0449ef6071840cc4d8e7fe289b1f9819a86ce80870f3ae9de477d16a297fb15bc

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
Filesize
9.1MB

MD5
6d6cadad0add47fa3e7ea10a5b171288

SHA1
0c86d1f533457cc953faad5db17bea8766dd89df

SHA256
a6b03284871d6c961fc345eb82265e671e04453a1cd6fd66f1dfbddbfcdd0f12

SHA512
50550c97b7b5ef7075b70cfea3668c498fea9734f3d3bb27fcb444aaf0162a2957fadbd1b9c52c3731cc54234d43c22efbc24a3f36f43316c6ef72fbeaa3a676

Download Submit
/Library/Application Support/Google/GoogleUpdater/122.0.6234.0/GoogleUpdater.app/Contents/_CodeSignature/CodeResources
Filesize
2KB

MD5
aeca191759951de7e9d111f6b9f4cd91

SHA1
47195cec236bd18add189f9a6f02c7b92ae7e120

SHA256
4d520ebbe9cfdf7490848790d7c6e538f65d8d015e17e2c79b338fbc074511b1

SHA512
54d64eb71ef40b736be46539aeccfa70ddb92790181fc1b31aef6ae7a2cf74e0082094dd21fb599127d5b37366a86f21cbb57851e67887095ba7b1d34fed7d41

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat
Filesize
40B

MD5
fcb4024c6dc53a5b72c492fd960762d7

SHA1
82c43024d9e274bf2b8a5d1e505d65cf3873fb92

SHA256
5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6

SHA512
5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001
Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb
Filesize
339B

MD5
61a867b6e4a24cfcfd32ddef25ac3229

SHA1
87cc4516fbce1700174d8ea27c9d2cb70a60a1fd

SHA256
9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5

SHA512
3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb
Filesize
569B

MD5
b5db1f091948de93d7fc96e14aef6da3

SHA1
74745f991e3dfe45037366e55c2e6df47d8e6593

SHA256
b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e

SHA512
d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
Filesize
269B

MD5
6487e04972ecffd0aabf7b61bdda8119

SHA1
26f0b11a2529a35f6970a914deadfcf2e2d23286

SHA256
241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172

SHA512
44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb
Filesize
136B

MD5
fe382e791274914bee5950777e4f1fd3

SHA1
53b523b5fc87e66f2520a0b5f9ea080072668f4d

SHA256
935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132

SHA512
a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb
Filesize
2KB

MD5
e0f65ad85a40a32fa91e551005e193ce

SHA1
a145766d5df23ae5fcd23dbb6937606f280f3502

SHA256
18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8

SHA512
bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb
Filesize
288B

MD5
b47a44bdd1b765b6af56b347447fd1b7

SHA1
8599a1870656af91e432bb35e3497863e34ddfbb

SHA256
79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06

SHA512
bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.32.0/Ruleset Data
Filesize
138KB

MD5
132df2b999906be7b21cc21bc247b068

SHA1
0665be201a96e717410a4e61a263bb879b3f08d4

SHA256
fed1557c8b4e40813114db3b546c043105892dd0895c4d7c02d45a8be351173a

SHA512
6764c8a425cd010a67a4636f812d43e63bb0815943e9839cf9fa35f3e5f9ba52309ed842306dcffe32a72e7019cb0c28e1d402dfc22dca0603a0cd48d6a26451

Download Submit
/Users/run/Library/Google/GoogleSoftwareUpdate/Crashes/settings.dat
Filesize
40B

MD5
a30a3013aaafaa0d534dd31655d3c741

SHA1
5afd87ea28558f6970f1c17d5305f640ec649b06

SHA256
3c3b1523ecf2d67b99ab0d14ab60ff783c4a5fafa5cd8b9facba8ad7356a4a21

SHA512
412b333c4a24672dd6592e3d6005cf522ca256e6406daca8e87c56b9e000c393ba5b022354dc78c1230fff9238f4a6b13a678b94d143bd75724ffc346df0dd62

Download Submit
/tmp/KSOutOfProcessFetcher.PEXFEymsiC/download
Filesize
1KB

MD5
9c1b3375b2253557f206009577b53620

SHA1
84e7b38a208a5b327d240233732223c9712596b9

SHA256
bc18b48418f24b6cefd1bf539a44131fb4fe025e4c8a72ef0cdf0d74f2dadad7

SHA512
11beb71bb978630c676cc464e570df4023caa8e37d168d161ed26558a79ed2303dfca72ffa265e0e5afe84297472338928d8771a42989a1b2ca1d19b0b19c439

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/log/fsck_hfs.log
Filesize
15KB

MD5
522cd968f9273010b8cc6e53ec2d6e8f

SHA1
1fda352ffe7acbe73631ccf409b9ebe171b1c183

SHA256
ddfc48029955559a491cd0923fe387dae1d4651d02fd58595ffa482f49b9bccc

SHA512
c15d1e83490fe45b04718fcaa47b47725d73cc11689e13df7ee5b4ce602431cf1e8557d61202a977db6cdf2ad28eba69d34d578c7ce323f7a4b69ec082ba2981

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads