Resubmissions

25-03-2024 01:45

240325-b6r1msfe7s 1

28-02-2024 06:38

240228-hd8w1sde3s 8

Analysis

  • max time kernel
    190s
  • max time network
    196s
  • platform
    macos-10.15_amd64
  • resource
    macos-20240214-en
  • resource tags

    arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    28-02-2024 06:38

General

  • Target

    Notion-3-2-0-universal/Notion-3-2-0-universal

  • Size

    188KB

  • MD5

    9dfaf66ffb827d88526ae4faa939597f

  • SHA1

    d76ad480dbed0e6cb2bbf5a6ee35bb47bce69acb

  • SHA256

    4d9e075c07b83a8a2630fbd3b95e48d8f4626a0e821688cb37beab36f95956cd

  • SHA512

    dc6ade1121be2f352306e9828e396d3dbb960a4833976146d3f0d90123bb32b14915357bad4d6f5c69965d9574be4d8b3bcfd547fad51211f476905063e2e114

  • SSDEEP

    1536:pPyAFfDtisIwHexXjrPMGT/LVRQIcJfDtisIwHjKXIRMTT:5yAFfDtisIwHehAGTgfDtisIwHj9iTT

Score
4/10

Malware Config

Signatures

  • AppleScript 1 TTPs 12 IoCs
  • Resource Forking 1 TTPs 4 IoCs

Processes

  • /usr/libexec/xpcproxy
    xpcproxy com.apple.pluginkit.pkd
    1⤵
      PID:570
    • /usr/libexec/pkd
      /usr/libexec/pkd
      1⤵
        PID:570
      • /usr/libexec/xpcproxy
        xpcproxy com.apple.nsurlstoraged
        1⤵
          PID:571
        • /usr/libexec/nsurlstoraged
          /usr/libexec/nsurlstoraged
          1⤵
            PID:571
          • /bin/sh
            sh -c "sudo /bin/zsh -c \"/Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal\""
            1⤵
              PID:572
            • /bin/bash
              sh -c "sudo /bin/zsh -c \"/Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal\""
              1⤵
                PID:572
              • /usr/bin/sudo
                sudo /bin/zsh -c /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                1⤵
                  PID:572
                  • /bin/zsh
                    /bin/zsh -c /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                    2⤵
                      PID:573
                    • /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                      /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                      2⤵
                        PID:573
                    • /bin/sh
                      sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                      1⤵
                        PID:575
                      • /bin/bash
                        sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                        1⤵
                          PID:575
                          • /usr/bin/osascript
                            osascript -e "tell application \"Terminal\" to close first window"
                            2⤵
                              PID:576
                          • /bin/sh
                            sh -c "python3 /var/tmp/olx"
                            1⤵
                              PID:577
                            • /bin/bash
                              sh -c "python3 /var/tmp/olx"
                              1⤵
                                PID:577
                              • /usr/bin/python3
                                python3 /var/tmp/olx
                                1⤵
                                  PID:577
                                • /Library/Developer/CommandLineTools/usr/bin/python3
                                  /Library/Developer/CommandLineTools/usr/bin/python3 /var/tmp/olx
                                  1⤵
                                    PID:577
                                  • /Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.7/Resources/Python.app/Contents/MacOS/Python
                                    /Library/Developer/CommandLineTools/Library/Frameworks/Python3.framework/Versions/3.7/Resources/Python.app/Contents/MacOS/Python /var/tmp/olx
                                    1⤵
                                      PID:577
                                      • /usr/bin/osascript
                                        osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""
                                        2⤵
                                          PID:580
                                        • /usr/bin/dscl
                                          dscl . authonly root
                                          2⤵
                                            PID:690
                                          • /usr/bin/osascript
                                            osascript -e "display dialog \"Required System Upgrade. Please enter passphrase for root.\" default answer \"\" with icon caution buttons {\"Continue\"} default button \"Continue\" giving up after 150 with title \"Application wants to install helper\""
                                            2⤵
                                              PID:691
                                          • /usr/libexec/xpcproxy
                                            xpcproxy com.apple.ViewBridgeAuxiliary
                                            1⤵
                                              PID:583
                                            • /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                              /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                              1⤵
                                                PID:583
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.spindump
                                                1⤵
                                                  PID:585
                                                • /usr/sbin/spindump
                                                  /usr/sbin/spindump
                                                  1⤵
                                                    PID:585
                                                  • /usr/libexec/xpcproxy
                                                    xpcproxy com.apple.tailspind
                                                    1⤵
                                                      PID:586
                                                    • /usr/libexec/xpcproxy
                                                      xpcproxy com.apple.spindump_agent
                                                      1⤵
                                                        PID:587
                                                      • /usr/libexec/tailspind
                                                        /usr/libexec/tailspind
                                                        1⤵
                                                          PID:586
                                                        • /usr/libexec/spindump_agent
                                                          /usr/libexec/spindump_agent
                                                          1⤵
                                                            PID:587
                                                          • /usr/libexec/xpcproxy
                                                            xpcproxy com.apple.sysmond
                                                            1⤵
                                                              PID:607
                                                            • /usr/libexec/sysmond
                                                              /usr/libexec/sysmond
                                                              1⤵
                                                                PID:607
                                                              • /usr/libexec/xpcproxy
                                                                xpcproxy com.apple.TextInputMenuAgent
                                                                1⤵
                                                                  PID:608
                                                                • /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
                                                                  /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
                                                                  1⤵
                                                                    PID:608
                                                                  • /usr/libexec/xpcproxy
                                                                    xpcproxy com.apple.audio.systemsoundserverd
                                                                    1⤵
                                                                      PID:609
                                                                    • /usr/sbin/systemsoundserverd
                                                                      /usr/sbin/systemsoundserverd
                                                                      1⤵
                                                                        PID:609
                                                                      • /usr/libexec/xpcproxy
                                                                        xpcproxy com.apple.TextInputSwitcher
                                                                        1⤵
                                                                          PID:610
                                                                        • /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
                                                                          /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
                                                                          1⤵
                                                                            PID:610
                                                                          • /usr/libexec/xpcproxy
                                                                            xpcproxy com.apple.icloud.findmydeviced
                                                                            1⤵
                                                                              PID:611
                                                                            • /usr/libexec/findmydeviced
                                                                              /usr/libexec/findmydeviced
                                                                              1⤵
                                                                                PID:611
                                                                              • /usr/bin/pluginkit
                                                                                /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
                                                                                1⤵
                                                                                  PID:612
                                                                                • /usr/sbin/spctl
                                                                                  /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2481EFE7/OneDrive.app
                                                                                  1⤵
                                                                                    PID:613
                                                                                  • /usr/libexec/xpcproxy
                                                                                    xpcproxy com.apple.geod
                                                                                    1⤵
                                                                                      PID:628
                                                                                    • /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                                                                      /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                                                                      1⤵
                                                                                        PID:628
                                                                                      • /usr/libexec/xpcproxy
                                                                                        xpcproxy com.apple.geod
                                                                                        1⤵
                                                                                          PID:629
                                                                                        • /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                                                                          /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
                                                                                          1⤵
                                                                                            PID:629
                                                                                          • /usr/libexec/xpcproxy
                                                                                            xpcproxy com.apple.secinitd
                                                                                            1⤵
                                                                                              PID:630
                                                                                            • /usr/libexec/secinitd
                                                                                              /usr/libexec/secinitd
                                                                                              1⤵
                                                                                                PID:630
                                                                                              • /usr/libexec/xpcproxy
                                                                                                xpcproxy com.apple.cfprefsd.xpc.agent
                                                                                                1⤵
                                                                                                  PID:631
                                                                                                • /usr/sbin/cfprefsd
                                                                                                  /usr/sbin/cfprefsd agent
                                                                                                  1⤵
                                                                                                    PID:631
                                                                                                  • /usr/libexec/xpcproxy
                                                                                                    xpcproxy com.apple.AddressBook.ContactsAccountsService
                                                                                                    1⤵
                                                                                                      PID:634
                                                                                                    • /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
                                                                                                      /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
                                                                                                      1⤵
                                                                                                        PID:634
                                                                                                      • /usr/libexec/xpcproxy
                                                                                                        xpcproxy com.apple.suggestd
                                                                                                        1⤵
                                                                                                          PID:635
                                                                                                        • /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
                                                                                                          /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
                                                                                                          1⤵
                                                                                                            PID:635
                                                                                                          • /usr/bin/login
                                                                                                            login -pf run
                                                                                                            1⤵
                                                                                                              PID:636
                                                                                                              • /bin/zsh
                                                                                                                -zsh
                                                                                                                2⤵
                                                                                                                  PID:639
                                                                                                                  • /usr/libexec/path_helper
                                                                                                                    /usr/libexec/path_helper -s
                                                                                                                    3⤵
                                                                                                                      PID:640
                                                                                                                    • /usr/bin/locale
                                                                                                                      locale LC_CTYPE
                                                                                                                      3⤵
                                                                                                                        PID:641
                                                                                                                      • /bin/ls
                                                                                                                        ls
                                                                                                                        3⤵
                                                                                                                          PID:650
                                                                                                                        • /usr/bin/open
                                                                                                                          open Notion-3-2-0-universal
                                                                                                                          3⤵
                                                                                                                            PID:659
                                                                                                                          • /bin/ls
                                                                                                                            ls
                                                                                                                            3⤵
                                                                                                                              PID:700
                                                                                                                            • /usr/bin/open
                                                                                                                              open Notion-3-2-0-universal
                                                                                                                              3⤵
                                                                                                                                PID:705
                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                            xpcproxy com.apple.audio.AudioComponentRegistrar
                                                                                                                            1⤵
                                                                                                                              PID:637
                                                                                                                            • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                                                                                                                              /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                                                                                                                              1⤵
                                                                                                                                PID:637
                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                xpcproxy com.apple.AccountPolicyHelper
                                                                                                                                1⤵
                                                                                                                                  PID:638
                                                                                                                                • /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
                                                                                                                                  /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
                                                                                                                                  1⤵
                                                                                                                                    PID:638
                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                    xpcproxy com.apple.PerformanceAnalysis.animationperfd
                                                                                                                                    1⤵
                                                                                                                                      PID:643
                                                                                                                                    • /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                                                                                      /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
                                                                                                                                      1⤵
                                                                                                                                        PID:643
                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                        xpcproxy com.apple.ReportCrash.Root
                                                                                                                                        1⤵
                                                                                                                                          PID:646
                                                                                                                                        • /System/Library/CoreServices/ReportCrash
                                                                                                                                          /System/Library/CoreServices/ReportCrash daemon
                                                                                                                                          1⤵
                                                                                                                                            PID:646
                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                            xpcproxy com.apple.knowledge-agent
                                                                                                                                            1⤵
                                                                                                                                              PID:647
                                                                                                                                            • /usr/libexec/knowledge-agent
                                                                                                                                              /usr/libexec/knowledge-agent
                                                                                                                                              1⤵
                                                                                                                                                PID:647
                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                xpcproxy com.apple.ReportMemoryException
                                                                                                                                                1⤵
                                                                                                                                                  PID:648
                                                                                                                                                • /usr/libexec/ReportMemoryException
                                                                                                                                                  /usr/libexec/ReportMemoryException
                                                                                                                                                  1⤵
                                                                                                                                                    PID:648
                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                    xpcproxy com.apple.routined
                                                                                                                                                    1⤵
                                                                                                                                                      PID:651
                                                                                                                                                    • /usr/libexec/routined
                                                                                                                                                      /usr/libexec/routined LAUNCHED_BY_LAUNCHD
                                                                                                                                                      1⤵
                                                                                                                                                        PID:651
                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                        xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
                                                                                                                                                        1⤵
                                                                                                                                                          PID:653
                                                                                                                                                        • /usr/libexec/neagent
                                                                                                                                                          /usr/libexec/neagent
                                                                                                                                                          1⤵
                                                                                                                                                            PID:653
                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                            xpcproxy com.apple.siri.context.service
                                                                                                                                                            1⤵
                                                                                                                                                              PID:654
                                                                                                                                                            • /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
                                                                                                                                                              /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
                                                                                                                                                              1⤵
                                                                                                                                                                PID:654
                                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                                xpcproxy com.apple.Maps.mapspushd
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:655
                                                                                                                                                                • /System/Library/CoreServices/mapspushd
                                                                                                                                                                  /System/Library/CoreServices/mapspushd
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:655
                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                    xpcproxy com.apple.pbs
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:656
                                                                                                                                                                    • /System/Library/CoreServices/pbs
                                                                                                                                                                      /System/Library/CoreServices/pbs
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:656
                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                        xpcproxy com.apple.assistantd
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:657
                                                                                                                                                                        • /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
                                                                                                                                                                          /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:657
                                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                                            xpcproxy com.apple.quicklook.ui.helper
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:664
                                                                                                                                                                            • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                                                                                                              /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:664
                                                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                                                xpcproxy com.apple.metadata.mdwrite
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:665
                                                                                                                                                                                • /usr/bin/login
                                                                                                                                                                                  login -pf run
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:666
                                                                                                                                                                                    • /bin/zsh
                                                                                                                                                                                      -zsh
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:667
                                                                                                                                                                                        • /usr/libexec/path_helper
                                                                                                                                                                                          /usr/libexec/path_helper -s
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:668
                                                                                                                                                                                          • /usr/bin/locale
                                                                                                                                                                                            locale LC_CTYPE
                                                                                                                                                                                            3⤵
                                                                                                                                                                                              PID:669
                                                                                                                                                                                            • /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                                                                                                                                                                                              /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                                                                                                                                                                                              3⤵
                                                                                                                                                                                                PID:670
                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                            sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:672
                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                              sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:672
                                                                                                                                                                                                • /usr/bin/osascript
                                                                                                                                                                                                  osascript -e "tell application \"Terminal\" to close first window"
                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                    PID:673
                                                                                                                                                                                                • /usr/sbin/spctl
                                                                                                                                                                                                  /usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:676
                                                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                                                    xpcproxy com.apple.quicklook.ui.helper
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:680
                                                                                                                                                                                                    • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                                                                                                                                      /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:680
                                                                                                                                                                                                      • /usr/bin/login
                                                                                                                                                                                                        login -pf run
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:681
                                                                                                                                                                                                          • /bin/zsh
                                                                                                                                                                                                            -zsh
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:682
                                                                                                                                                                                                              • /usr/libexec/path_helper
                                                                                                                                                                                                                /usr/libexec/path_helper -s
                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                  PID:683
                                                                                                                                                                                                                • /usr/bin/locale
                                                                                                                                                                                                                  locale LC_CTYPE
                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                    PID:684
                                                                                                                                                                                                                  • /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                                                                                                                                                                                                                    /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                                                                                                                                                                                                                    3⤵
                                                                                                                                                                                                                      PID:685
                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                  sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:687
                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                    sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:687
                                                                                                                                                                                                                      • /usr/bin/osascript
                                                                                                                                                                                                                        osascript -e "tell application \"Terminal\" to close first window"
                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                          PID:688
                                                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                                                        xpcproxy com.apple.ReportMemoryException
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:701
                                                                                                                                                                                                                        • /usr/libexec/ReportMemoryException
                                                                                                                                                                                                                          /usr/libexec/ReportMemoryException
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:701
                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                            /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:702
                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                              /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                PID:703
                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                sh -c /usr/sbin/kextstat
                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                  PID:704
                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                  sh -c /usr/sbin/kextstat
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:704
                                                                                                                                                                                                                                  • /usr/sbin/kextstat
                                                                                                                                                                                                                                    /usr/sbin/kextstat
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:704
                                                                                                                                                                                                                                    • /usr/bin/login
                                                                                                                                                                                                                                      login -pf run
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:706
                                                                                                                                                                                                                                        • /bin/zsh
                                                                                                                                                                                                                                          -zsh
                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                            PID:707
                                                                                                                                                                                                                                            • /usr/libexec/path_helper
                                                                                                                                                                                                                                              /usr/libexec/path_helper -s
                                                                                                                                                                                                                                              3⤵
                                                                                                                                                                                                                                                PID:708
                                                                                                                                                                                                                                              • /usr/bin/locale
                                                                                                                                                                                                                                                locale LC_CTYPE
                                                                                                                                                                                                                                                3⤵
                                                                                                                                                                                                                                                  PID:709
                                                                                                                                                                                                                                                • /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                                                                                                                                                                                                                                                  /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                                                                                                                                                                                                                                                  3⤵
                                                                                                                                                                                                                                                    PID:710
                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:712
                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                  sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:712
                                                                                                                                                                                                                                                    • /usr/bin/osascript
                                                                                                                                                                                                                                                      osascript -e "tell application \"Terminal\" to close first window"
                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                        PID:713
                                                                                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                      xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:714
                                                                                                                                                                                                                                                      • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                                                                                                        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:714
                                                                                                                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                                                                                                                          xpcproxy com.apple.quicklook.ui.helper
                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                            PID:715
                                                                                                                                                                                                                                                          • /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                                                                                                                                                                                            /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                              PID:715
                                                                                                                                                                                                                                                            • /usr/bin/login
                                                                                                                                                                                                                                                              login -pf run
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:716
                                                                                                                                                                                                                                                                • /bin/zsh
                                                                                                                                                                                                                                                                  -zsh
                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                    PID:717
                                                                                                                                                                                                                                                                    • /usr/libexec/path_helper
                                                                                                                                                                                                                                                                      /usr/libexec/path_helper -s
                                                                                                                                                                                                                                                                      3⤵
                                                                                                                                                                                                                                                                        PID:718
                                                                                                                                                                                                                                                                      • /usr/bin/locale
                                                                                                                                                                                                                                                                        locale LC_CTYPE
                                                                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                                                                          PID:719
                                                                                                                                                                                                                                                                        • /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                                                                                                                                                                                                                                                                          /Users/run/Notion-3-2-0-universal/Notion-3-2-0-universal
                                                                                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                                                                                            PID:720
                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                        sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                          PID:722
                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                          sh -c "osascript -e 'tell application \"Terminal\" to close first window'& exit"
                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                            PID:722
                                                                                                                                                                                                                                                                            • /usr/bin/osascript
                                                                                                                                                                                                                                                                              osascript -e "tell application \"Terminal\" to close first window"
                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                PID:723

                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                                                                            Replay Monitor

                                                                                                                                                                                                                                                                            Loading Replay Monitor...

                                                                                                                                                                                                                                                                            Downloads

                                                                                                                                                                                                                                                                            • /Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              676B

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              943c1145a3000a9cfd516c8f582e9faf

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              d64cf9c719ff6d7c20331b06725771169e8e3260

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              0c5693988a5c778fbbbe645fc4ade81989c8bfffff4aa9cc1e97ba214f78aa2e

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              22ac24281b661695c8501bb34129578233041b46f30131e414664a97410d4d58e90a3ea23e4aa10be1e42fb133f0421ed1bc6b841ea11f4470b3216b9eba33b3

                                                                                                                                                                                                                                                                            • /Users/run/.zsh_history

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              593B

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              fca61148b08b3f3ccd14102cbed804c9

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              b7e0488633bc34038632a1e28c52a1789c6b7118

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              c11c9cbad41ea6d9d9ea33e553fa60311d49b43cd5236c7fddc9b892447ca5d9

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              cbda7575c3789bc82b266a46fb8011387bf13927f899e005579188d9c38fe4dbe1a9e438a59f3942f493367f152c0fa5f9f9cca1d9143433dd4fb4176f2378dc

                                                                                                                                                                                                                                                                            • /Users/run/.zsh_history

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              658B

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              fe75399419749e4580f0e09ac90fa8c2

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              e8959849afca30849643150a4ac5e1b8b7a30350

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              9576307105a2e30fc11f0812324ea52a1cace80e6c86a021df755739e3d4fed2

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              95b2e76206ddb77a984dde5d2fde1fe70c114bfa4142ca9944f4f27167bf568821d938a334e1ae47232513c7bd354c6b233db9ed99c5b22c0f21915d025f9451

                                                                                                                                                                                                                                                                            • /Users/run/.zsh_history

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              723B

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              486c703c8b65c1054639c8f303076017

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              43b0355ae5dfc23391a9b9c065506b200ea57180

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              d7c0cacc1e05ad73e8d84388c6e180e51618180f1ec451affaccbcd4a176d272

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              3ad0511ca08fd0f224a3d5a9198c166523ca2d868c4f369f889fb57aa5816853fa1c5e863a5c6732db93ae36ed125d91523def6f8e1f248629b972b8fe9e6cf4

                                                                                                                                                                                                                                                                            • /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              124KB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              6a277aa300080a7144048cd2f9875d6a

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              bee3a4142f7a5cc8dc6733b08bd6d48255dcb452

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              77f4c6caaa374dc3df29b89ae84160be35d23100d13fd1ec05877827b6795a1a

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              13943bcc9e1a4afcff846be950c7addca48c702d924357c6e3548c68ebd01d895249d249ea165de5e7740ca6ea936289275cf38b76cf4cf90af106e837bc67fa

                                                                                                                                                                                                                                                                            • /Users/run/Library/Caches/GeoServices/Experiments.pbd

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              137B

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              f3a04a58f57c2165a7c66c4845b05270

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              7696302a836fb7c373d3d42ae763a3ff42d0148d

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              edc75a76d292ec6286ade3fb72ead07d1200a2768fd05a1f14592d3f38361798

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              d61ee1a297a5b7e4e0e1b13eb6ad9c171ebc6cfc71532cb2669abacddb438c53df9824c403d917cec310a8a77d844e51f857bc7348b79b3deb2a184656e74443

                                                                                                                                                                                                                                                                            • /Users/run/Library/Caches/GeoServices/Resources/altitude-1184.xml

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              157KB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              de0d1de3897d152e34fad38ac8384188

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              8783a7701c14576789a2316e0f3f9c3d5acd660a

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              fd449596e4bb21c338a5102cd749ba1c87debfe62d1c161deb0cc7d8d74e8226

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              5fd1734e6289fa80752c4c583875577e87d7f58b01c5d14445d7888c172acd94ab0c4d3332660e1d92706678e1611515393c7c3d28be0d0e735028e1f5d16de5

                                                                                                                                                                                                                                                                            • /private/var/db/spindump/tailspin-trace.2024-02-28_06-42-16.tailspin

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              2.5MB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              99effd9a308f74ea2a6a24a22e438db3

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              fc2fa3e6020d7983d66463a27b2b34583d53f96e

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              1587cd71c0b37ed18f83f996e86dac83a032c3bd99fea878591d84f23b84710e

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              9b51b38d827a0315731a78f54f872a5120518360413682ae34f03e121e17ee0cc41f375a8d7fdc2113a221f58e784e45f8d7b85c6ba2a0180ad387c24e25571e

                                                                                                                                                                                                                                                                            • /private/var/db/spindump/tailspin-trace.2024-02-28_06-42-16.tailspin

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              839KB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              181a32bbf99081b60089402bf468eb62

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              733277473f62e05e6b973b5e4d58296784b0325a

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              fde2f634ea224ea7f4abb70a1ca33031ea9cb88c6e3b55ab9572e5adf0cf7887

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              333162b2c90187d1c60eb221d6a3a83ea0952a55e9b94054814e50adec64af328e9a1f27f3ff05fc3ee81d6d5ec103a45ce6c361cbc14e9dc0c554dc6029e844

                                                                                                                                                                                                                                                                            • /var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              47KB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              0e4a0d1ceb2af6f0f8d0167ce77be2d3

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

                                                                                                                                                                                                                                                                            • /var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              4KB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              d3a1859e6ec593505cc882e6def48fc8

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              f8e6728e3e9de477a75706faa95cead9ce13cb32

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

                                                                                                                                                                                                                                                                            • /var/root/Library/Saved Application State/com.apple.osascript.savedState/data.data

                                                                                                                                                                                                                                                                              Filesize

                                                                                                                                                                                                                                                                              2KB

                                                                                                                                                                                                                                                                              MD5

                                                                                                                                                                                                                                                                              2da6b62e969b7a6eeeacbd686ee285cb

                                                                                                                                                                                                                                                                              SHA1

                                                                                                                                                                                                                                                                              22902dbeb8b4b0df8c63608b2350f52d5854a1e2

                                                                                                                                                                                                                                                                              SHA256

                                                                                                                                                                                                                                                                              2017dd36cb5c427bb747938bf74dea4400994d83c3917611b02858521ec8bc95

                                                                                                                                                                                                                                                                              SHA512

                                                                                                                                                                                                                                                                              f38ce73f030b0203fecd01b96cbe1bb86274cd44ed3d4437d3eacde391df11ca222edfb82e8457dc67a431c7523aae5309eb73c21289a2c641ae3fbf08c1b9cb