6900a0cd2b50d5ecf103697fe653f62bc57cf38fa5c484286bea35085b7b29a4

Reason

Machine shutdown

General

Target
Image 2-19-24 at 6.40 PM.jpg
Size 532KB
Sample240307-fx413aff5z
SHA256 6900a0cd2b50d5ecf103697fe653f62bc57cf38fa5c484286bea35085b7b29a4
MD5 09706b0341bab67730191168a3f25073
SHA1 a6eb85b8fa66cfdd9eda95f3d8016214d77d91f3
SHA512 12b81c1d1ef5f907c82335dd6e275865d51d33eff0b4073b155117a2fbf0c5d5408734a9b0f2cc0e2aa2cafb4231b2a3fec3a81383eae9f8e1b98c6ed235b216
SSDEEP 12288:fCcoDnl8igjpI1h+X/p8Polvv/V6sy4RCsbGGmsrkNo5fnFtr:YblK9c+XR8Pqvv/VFRjbINo5nFB
MD5 SHA1 SHA512 SSDEEP

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 7 IoCs

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/DesktopPictures.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.desktop.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.desktop.remoteservice	Process not Found
/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/ScreenEffects.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Image 2-19-24 at 6.40 PM.jpg\""
1⤵
PID:534

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Image 2-19-24 at 6.40 PM.jpg\""
1⤵
PID:534

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Image 2-19-24 at 6.40 PM.jpg"
1⤵
PID:534
- /bin/zsh
  /bin/zsh -c "/Users/run/Image 2-19-24 at 6.40 PM.jpg"
  2⤵
  PID:535
- /Users/run/Image
  /Users/run/Image 2-19-24 at "6.40 PM.jpg"
  2⤵
  PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:537

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:540

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:540

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:568

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:569

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:571

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 569
1⤵
PID:573

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:573

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:575

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:576

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:577

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:578

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:581

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:582

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:583

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:584

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.desktopscreeneffect.desktop.remoteservice 569
1⤵
PID:585

/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/DesktopPictures.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.desktop.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.desktop.remoteservice
/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/DesktopPictures.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.desktop.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.desktop.remoteservice
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 585
1⤵
PID:586

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:588

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:589

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:592

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:593

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.desktopscreeneffect.screeneffects.remoteservice 569
1⤵
PID:596

/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/ScreenEffects.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice
/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/ScreenEffects.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Engine.legacyScreenSaver 596
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.iLife-Slideshow-Extension 596
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Computer-Name 596
1⤵
PID:599

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
/System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
1⤵
PID:597

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name
"/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name"
1⤵
PID:599

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.MediaLibraryService 596
1⤵
PID:600

/System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
/System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 596
1⤵
PID:601

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:606

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:608

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:609

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.adid
1⤵
PID:610

/System/Library/PrivateFrameworks/CoreADI.framework/adid
/System/Library/PrivateFrameworks/CoreADI.framework/adid
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Engine.1396
1⤵
PID:612

/System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine
/System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine runFromPref
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Engine.legacyScreenSaver 612
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.iLife-Slideshow-Extension 612
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Computer-Name 612
1⤵
PID:616

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
/System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
1⤵
PID:614

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
1⤵
PID:615

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name
"/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name"
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Engine.1396
1⤵
PID:619

/System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine
/System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine runFromPref
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:620

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Engine.legacyScreenSaver 619
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Computer-Name 619
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.iLife-Slideshow-Extension 619
1⤵
PID:623

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
/System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
1⤵
PID:621

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name
"/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name"
1⤵
PID:622

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.MediaLibraryService 598
1⤵
PID:624

/System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
/System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Engine.1396
1⤵
PID:625

/System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine
/System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine runFromPref
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Engine.legacyScreenSaver 625
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.Computer-Name 625
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenSaver.iLife-Slideshow-Extension 625
1⤵
PID:628

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
/System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
1⤵
PID:626

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name
"/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name"
1⤵
PID:627

/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
/System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.PackageKit.InstallStatus
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.warmd_agent
1⤵
PID:630

/usr/libexec/warmd_agent
/usr/libexec/warmd_agent
1⤵
PID:630

/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
"/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.security.keychain-circle-notification
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:633

/System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Keychain Circle Notification
"/System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Keychain Circle Notification"
1⤵
PID:631

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:633

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.sessionlogoutd
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:635

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:635

/System/Library/CoreServices/sessionlogoutd
/System/Library/CoreServices/sessionlogoutd
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:636

/sbin/shutdown
/sbin/shutdown -r now
1⤵
PID:0
- /bin/sh
  sh -c "/usr/bin/wall -n"
  2⤵
  PID:638
- /bin/bash
  sh -c "/usr/bin/wall -n"
  2⤵
  PID:638
- /usr/bin/wall
  /usr/bin/wall -n
  2⤵
  PID:638
- /System/Library/Extensions/IOGraphicsFamily.kext/iogdiagnose
  iogdiagnose -b /var/log/displaypolicy/iogdiagnose-last.bin
  2⤵
  PID:1.8446744071563117e+19
- /usr/sbin/spindump
  spindump -shutdownstall 2 -timelimit 5
  2⤵
  PID:640
- /bin/sh
  sh -c /usr/sbin/kextstat
  2⤵
  PID:641
- /bin/bash
  sh -c /usr/sbin/kextstat
  2⤵
  PID:641
- /usr/sbin/kextstat
  /usr/sbin/kextstat
  2⤵
  PID:641
- /bin/bash
  bash /private/var/install/shutdown_installer_tasks
  2⤵
  PID:642
- /bin/bash
  bash /private/var/install/deferred_install
  2⤵
  PID:643

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

1

T1564

Resource Forking

1

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 288B
SHA256 0de9ce482bde894cb5d5042cfeaf0d54cb0f56ad4852caa4d06ad54a53a7b49f
MD5 55d707d8a498ca399dd49c710374392d
SHA1 94956fb7af8ebb24faa018be5739179ae2e21dbb
SHA512 e6183083a8f1f1ea5e67806ecbcab5adefc331aca2622e3b846cee48b803a91076dfd9a905573ee71c900bc5563b4e6e7f3ab994de7e29552a01647cd29ad20e
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 355B
SHA256 232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa
MD5 a6ef4856e99c9d8e1d9bb762c5a8503a
SHA1 25d5405ad91791b716ae5a56b37aa2b393854967
SHA512 582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489
MD5 SHA1 SHA512

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 124KB
SHA256 320e92cb035a72376cf2b7aaf4ac4b77713025c47e7cde9c97a36cab405cb21b
MD5 47d95380bcc74254374a868ea82d3a6d
SHA1 203e26dac1b92f7ac15c657b76ddcb4a3c93e577
SHA512 b701da00bb4466d30ce88d32b7ea86c6c59b1ed7fe88a9bc9384dd84af6096fc43b060aee084c6431fdbc10e65696253e31400a20f3f4221b551678870232233
SSDEEP 3072:XG1qZQGBOoPVwEJcrhslHsj0YgN0fT7V/CEF7tPGqpyqA7icNCRqcX:XGqZQGBOoiralMj0Ze7tOiHX
MD5 SHA1 SHA512 SSDEEP

Submit Download

altitude-1188.xml

Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1188.xml
Size 157KB
SHA256 95e4aa9570e1acd3de701ac19c395d80a710275d6e052c598c09cc1ed710c398
MD5 3e6423b24f263da56088a101653606cd
SHA1 7c43adc6c23442858bf0dcdf84b5a08323fba317
SHA512 3f85d2f77102790e8ee82c1f8797c754167a79af91dfdd5377e7681370f01540234017eb24be89cc7a4da5e70005bf35b069d21f5bf70cc59efe1abd6dd8c255
SSDEEP 768:SmSaD5wrMhciPVOqMyDwnW8bz4DZKrj4zvJq2ZZgt8VxtaxU3B4c4lWDSr/g2Oq/:SmSs0byobX6TUtCDTwlHEAhXCm
MD5 SHA1 SHA512 SSDEEP

Submit Download

tailspin-trace.2024-03-07_05-16-53.tailspin

Path /private/var/db/spindump/tailspin-trace.2024-03-07_05-16-53.tailspin
Size 8.4MB
SHA256 b8e3b0d5841be348b125d639debf4008af70ecb8767191ef8020d8dfcf54c92d
MD5 79e4eb2cb15e540e0fa1178f7a104edf
SHA1 457fe17f4104977871f694e1b3fd8b4a90a245c1
SHA512 c0de7da80a6277a1c9a3db90c9f8f6d45012d2dacd2e08b38396c31869b301f0456487467239390555e1cd9ed7b1028620d61387b1317eab06e9c0da3ab74112
SSDEEP 196608:NHRnKZLXojVOinJHpI+u05F1o5cuk4/+T083PVfY/3d9+5mu:DoLXojVOinBpI+u05Po5cuk4/+T083Pt
MD5 SHA1 SHA512 SSDEEP

Submit Download

tailspin-trace.2024-03-07_05-16-53.tailspin

Path /private/var/db/spindump/tailspin-trace.2024-03-07_05-16-53.tailspin
Size 6.4MB
SHA256 f584a8ad4bd6098b736f427c2b2aedbb299be1aaed4584d20b9223c262c2d3ba
MD5 94ddcdabda482590ec0240f8ec1c9608
SHA1 c6644ef1c73cd38a6410686553ff8d4eaac934b6
SHA512 d17b616ee7a8bf2675c558154ab0fd912cfff35496bf0abded1df82023227c8183f203af85da6b0ff6662302bc6a52d9f4cdee86d081c12b7980dc9f3238844e
SSDEEP 196608:NHRnKZLXojVOinJHpI+u05F1o5cuk4/+T083PVfY/3d9+G:DoLXojVOinBpI+u05Po5cuk4/+T083Pk
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 132KB
SHA256 3f89fc84f34946279471e0fa9e2de4a60432a9b3a4d54fffd1815595b2b476bf
MD5 e448a53f2e2ef343cdf9613ca44640b8
SHA1 6ff3f53d9069e7bfce6f763841af5b4fce2ce472
SHA512 5e146708e94316e6f99bbc251bab50124c295aaa00c616431d6a86c60bbb202683f294d0d3412411902081258d68a2f6371f7d65cc7b2bd4813deecc9b8abb1a
SSDEEP 3072:OoS4SSj5bboTBYlqfe/MrNXBmcxnR0d3q7y7C:PS41VKBaqfeEbmcxnR0dq7qC
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads