d2c736fc70a887dda619b0098ee25efbc75093bd7f4d2937a08e70be8e66f1ec

Resubmissions

24/03/2024, 15:56

240324-tdd77agc8w4

24/03/2024, 15:54

240324-tch5rade983

24/03/2024, 15:47

240324-s8k4jsde857

Analysis

max time kernel
150s
max time network
154s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
24/03/2024, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ko-Fi.url
Size 122B
Sample240324-tdd77agc8w
SHA256 3c66f3c1f575e486fd6ff50405a53974cec3d8e9badf4d7cd9c045a23ff9658e
MD5 fe014b77eeedfabab4c600fdc4b187c9
SHA1 ca7966ff9b50db38f12ac20c993472a843dac90f
SHA512 e72b4995e4afb1021957b5adfea3f14c14ab487410d974e5088136c9b98f194c27c75fe440812cea73d0e785230782abcb6f829c0a6d3f26818719ba98070d98
MD5 SHA1 SHA512

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 10 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd	Process not Found
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/DE592AE2-71D1-49BC-ADCF-E25572172DB1.activeSandbox/Root /	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Ko-Fi.url\""
1⤵
PID:524

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Ko-Fi.url\""
1⤵
PID:524

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/Ko-Fi.url
1⤵
PID:524
- /bin/zsh
  /bin/zsh -c /Users/run/Ko-Fi.url
  2⤵
  PID:525
- /Users/run/Ko-Fi.url
  /Users/run/Ko-Fi.url
  2⤵
  PID:525
- /bin/sh
  sh /Users/run/Ko-Fi.url
  2⤵
  PID:525
- /bin/bash
  sh /Users/run/Ko-Fi.url
  2⤵
  PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:551

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:551

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:556

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterDA6CE80A/OneDrive.app
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:562

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:570

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:571

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:572

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:575

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:575

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:574

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:585

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:586

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:589

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:594

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:595

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:596

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 587
1⤵
PID:598

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:599

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.Photos.StorageManagementExtension 586
1⤵
PID:602

/System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
/System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.GarageBand 586
1⤵
PID:603

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.messages.StorageManagementExtension 586
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Trash 586
1⤵
PID:605

/System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension
"/System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension"
1⤵
PID:604

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Mail 586
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Applications 586
1⤵
PID:607

/System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
/System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
1⤵
PID:606

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.CloudFiles 586
1⤵
PID:609

/System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
/System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.OtherUsers 586
1⤵
PID:610

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
1⤵
PID:609

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.CloudDocsDaemon.StorageManagement 586
1⤵
PID:612

/System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
/System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
1⤵
PID:611

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
1⤵
PID:612

/System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
/System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.iBooksX.DiskSpaceEfficiency
1⤵
PID:614

/System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
/System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.AppleInternal 586
1⤵
PID:615

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.iOSFiles 586
1⤵
PID:616

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.CloudPhotosConfiguration
1⤵
PID:617

/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
1⤵
PID:617

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:621

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:619

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:621

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.installandsetup.systemmigrationd
1⤵
PID:629

/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.storagekitd
1⤵
PID:630

/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.automountd
1⤵
PID:632

/usr/libexec/automountd
automountd
1⤵
PID:632
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:633
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesagent
1⤵
PID:634

/System/Library/CoreServices/iconservicesagent
/System/Library/CoreServices/iconservicesagent runAsRoot
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.57E0AD98-A9BC-4273-8B1B-878101805F59
1⤵
PID:636

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:637

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.softwareupdated
1⤵
PID:639

/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:640

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:641

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:643

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.74BC6494-9EAA-49CE-8133-46F343CBF1F0 640
1⤵
PID:644

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.suhelperd
1⤵
PID:646

/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:649

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:652

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:652

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:654

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/DE592AE2-71D1-49BC-ADCF-E25572172DB1.activeSandbox/Root /
1⤵
PID:655

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.pkg.IncompatibleAppList.10_15.16U1923.bom

Path /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/DE592AE2-71D1-49BC-ADCF-E25572172DB1.activeSandbox/Boms/com.apple.pkg.IncompatibleAppList.10_15.16U1923.bom
Size 61KB
SHA256 4bde0dc120c8239b758f62e655e23be5f09b41f32f666bffa05e0104e8109d46
MD5 2f0f49de9ad6128f83b55002ddc0c733
SHA1 348b668dd78199b508fa73253568f3024a03410f
SHA512 6ed163e207886dd7661e67944197ef84c663eb129ca8c988d2fade90fa7e626b581627165521b3e9a8be77c04c12936ac40e1311750c2ad0aae4f6707910a4aa
SSDEEP 192:RG40du9VtrdQ5BvtrMJ/Jm45/6LprMJ/Jm45/6L:RG2Tri5ZGF65GF6
MD5 SHA1 SHA512 SSDEEP

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 288B
SHA256 04fefbaa058a5c300a90a50be6894dde2138fa47239dd93e7b9265352a96e4eb
MD5 c92127f7ee48ad5e3c8b165ef0dcba1c
SHA1 7fabbe716497efc2de185429b40127cdd58f59b7
SHA512 29d6c275b4337e642dfc183316969acbc345c0cfae53f94a103192e56fbf73499cc05cbf8076788191434162ba75275adfbbe0bf31ade37be0c76954570b1ccc
MD5 SHA1 SHA512

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 288B
SHA256 87a9a1a2c137609da7808452aa71478cca04d1b0a778b1d1f559446bd8178d19
MD5 180d9b3949b39ff1f5c85cecb6d6785c
SHA1 c0d976708fd5a19728d7f0f275e93e19b7558eba
SHA512 68ee36c2cf3ab0699358181e5027b9cc69adb9847de0206fe0dd46d3a06155b0f5557bd39863f6e1cfde3698f7abd873e57bd41398983fbbdf07a02e97b5ff43
MD5 SHA1 SHA512

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 124KB
SHA256 6a7e27eeccb32fcf67a96abc1d2eda20d48e77ef582a6da04298e5e1ede26f75
MD5 1d01c9e057bbba40391789c85729a043
SHA1 7b87d7dc20174c6e65009759df390f1a529d23bb
SHA512 7e345e24878ebb63c75984792b2bb71372168b2b59262612b518eaa60afb021c9a203ff89884ef39344bf5d21d52fbf3eb20de35a50ded6d9f41e592afa9d3a8
SSDEEP 3072:yG1q8+GXOdlVwEJcrhslHsj0YgN0fT7V/CEF7tPGqpyqA7icNCRqcV:yGq8+GXOdYralMj0Zy7tOiHV
MD5 SHA1 SHA512 SSDEEP

Submit Download

altitude-1249.xml

Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1249.xml
Size 160KB
SHA256 9320e397ccc5577acc65da1f4cbafea31c1d802014ec4b4459c628b449414fdc
MD5 c0b8e6fb70a16991ed49a487448cd106
SHA1 71f21321168dc466e7f64eb2c2516cecb1a931c3
SHA512 ae0c5fb1b29d7f80511a846f8c3db54d018aba7b9314792e63d6844ded948610aed6aeac4388dfbfd8530dbaaeae4cf479c10f52746bab866509d71217111ba1
SSDEEP 768:SGSaD5wrMhcpPXOqeyuwnW8arz4DZKrj45vJq2ZW/gt8VxtaxU3B4c4lWDSr/g22:SGSsJZyXba6lU6CDTwlHEkmXC1A
MD5 SHA1 SHA512 SSDEEP

Submit Download

installd.commit.pid

Path /private/var/run/installd.commit.pid
Size 3B
SHA256 a3aaf5a0e9ad2901ab35ce73910be7fbbe1731a3ed1ff947a6ac395c5024a8b3
MD5 04ecb1fa28506ccb6f72b12c0245ddbc
SHA1 edd6bb4181065a5b9fb559ad9fddeef16a975d07
SHA512 4e6a06897e469a17f8f6e8b61cc228101da3bcb6981c135cff0c2e4d25e21c866c0867e20753c7065f1282ddc8f230370e18fddb81b255cdc8a98992c5b4a252
MD5 SHA1 SHA512

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.CloudPhotosConfiguration//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
MD5 SHA1 SHA512 SSDEEP

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.CloudPhotosConfiguration//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CFNetworkDownload_Z4KPob.tmp

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/SMIncompatibleAppUpdate/CFNetworkDownload_Z4KPob.tmp
Size 324KB
SHA256 a0ee16e403dd8609ce56b56a111b2926b591d368b6e99a41c836beb280dcf687
MD5 8ac8e766276bb799857b359b3a4f2347
SHA1 075fe1052e1e6de0a38aaa7711a54e8a77bb65f8
SHA512 60f88aacc4d89e7a52aa30a469b430f781006fac52b320c2acd05d8f3ace9638a042fa0b0000885293cf6ee391915e7d68ffc656f4056fcb6de3b638d52a6439
SSDEEP 6144:SxT4GpoTuKqxr8Y3arWLsN+iPkGm7fuoBdMHeDM3ccghAOfTCTMN4QQWAOfG:SxTxyur181WZTfuoQHZ3cRA3gNvQWA7
MD5 SHA1 SHA512 SSDEEP

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads