hxxp:// | Triage™

Analysis

max time kernel
1051s
max time network
1053s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
25/03/2024, 01:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://
Sample240325-cbzyfacg87

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 18 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/System/Library/PrivateFrameworks/AppleMediaServices.framework/Resources/amsaccountsd	Process not Found
/System/Library/Filesystems/apfs.fs/Contents/Resources/./apfs.util -p disk2s3 removable readonly	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PrivateFrameworks/CoreCDP.framework/Versions/A/Resources/cdpd	Process not Found
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/Filesystems/apfs.fs/Contents/Resources/./apfs.util -k disk2s3	Process not Found
/System/Library/Filesystems/apfs.fs/Contents/Resources/./fsck_apfs -q /dev/rdisk2s3	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://\""
1⤵
PID:534

/bin/bash
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://\""
1⤵
PID:534

/usr/bin/sudo
sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://"
1⤵
PID:534
- /bin/zsh
  /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://"
  2⤵
  PID:537
- /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window http://
  2⤵
  PID:537

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:560

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:560

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/var/root/Library/Application Support/Google/Chrome/Crashpad" "--metrics-dir=/var/root/Library/Application Support/Google/Chrome" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:562

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:567

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:567

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:568

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:569

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.sandboxd
1⤵
PID:571

/usr/libexec/sandboxd
/usr/libexec/sandboxd
1⤵
PID:571

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=28"
1⤵
PID:572

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=28"
1⤵
PID:573

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=28"
1⤵
PID:574

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072"
1⤵
PID:575

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=289099464" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=58"
1⤵
PID:576

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=289161700" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=58"
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:579

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:579

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:578

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:582

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:582

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --user-store
1⤵
PID:584

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=292061616" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=72"
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:587

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:590

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:592

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:595

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:595

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:599

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:599

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:605

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:606

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:607

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:608

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:608

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=30"
1⤵
PID:613

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:615

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:617

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:617

/usr/sbin/system_profiler
/usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
1⤵
PID:627

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=42"
1⤵
PID:631

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=34"
1⤵
PID:632

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=34"
1⤵
PID:633

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=42"
1⤵
PID:634

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=47"
1⤵
PID:635

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=47"
1⤵
PID:636

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=47"
1⤵
PID:637

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=47"
1⤵
PID:638

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=47"
1⤵
PID:639

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=47"
1⤵
PID:640

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=47"
1⤵
PID:641

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=47"
1⤵
PID:642

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=48"
1⤵
PID:643

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=48"
1⤵
PID:644

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=48"
1⤵
PID:645

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=47"
1⤵
PID:646

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=48"
1⤵
PID:647

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=48"
1⤵
PID:648

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=48"
1⤵
PID:649

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=30" "--launch-time-ticks=624764564" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=73"
1⤵
PID:651

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=29" "--launch-time-ticks=624849725" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=71"
1⤵
PID:653

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=31" "--launch-time-ticks=627346064" --shared-files "--field-trial-handle=1718379636,r,15886350350310097039,13703809479834300389,131072" "--seatbelt-client=52"
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.AppStore.1900
1⤵
PID:656

/System/Applications/App Store.app/Contents/MacOS/App Store
"/System/Applications/App Store.app/Contents/MacOS/App Store"
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:658

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy com.apple.adid
1⤵
PID:660

/System/Library/PrivateFrameworks/CoreADI.framework/adid
/System/Library/PrivateFrameworks/CoreADI.framework/adid
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 656
1⤵
PID:662

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:664

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:666

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:674

/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:676

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:677

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:678

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:677

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:678

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:670

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:676

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 668
1⤵
PID:679

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:672

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:679

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.1780
1⤵
PID:682

/System/Applications/Contacts.app/Contents/MacOS/Contacts
/System/Applications/Contacts.app/Contents/MacOS/Contacts
1⤵
PID:682

/usr/libexec/xpcproxy
xpcproxy com.apple.contacts.donation-agent
1⤵
PID:683

/usr/libexec/xpcproxy
xpcproxy com.apple.telephonyutilities.callservicesd
1⤵
PID:684

/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
/System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
1⤵
PID:683

/System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd
/System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd
1⤵
PID:684

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 684
1⤵
PID:686

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:686

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.AssistantService
1⤵
PID:688

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:689

/usr/libexec/xpcproxy
xpcproxy com.apple.tonelibraryd
1⤵
PID:690

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:689

/System/Library/Frameworks/AddressBook.framework/Versions/A/Helpers/ABAssistantService.app/Contents/MacOS/ABAssistantService
/System/Library/Frameworks/AddressBook.framework/Versions/A/Helpers/ABAssistantService.app/Contents/MacOS/ABAssistantService
1⤵
PID:688

/System/Library/PrivateFrameworks/ToneLibrary.framework/Versions/A/XPCServices/com.apple.tonelibraryd.xpc/Contents/MacOS/com.apple.tonelibraryd
/System/Library/PrivateFrameworks/ToneLibrary.framework/Versions/A/XPCServices/com.apple.tonelibraryd.xpc/Contents/MacOS/com.apple.tonelibraryd
1⤵
PID:690

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:691

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:691

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.AssistantService
1⤵
PID:695

/System/Library/Frameworks/AddressBook.framework/Versions/A/Helpers/ABAssistantService.app/Contents/MacOS/ABAssistantService
/System/Library/Frameworks/AddressBook.framework/Versions/A/Helpers/ABAssistantService.app/Contents/MacOS/ABAssistantService
1⤵
PID:695

/usr/libexec/xpcproxy
xpcproxy com.apple.recentsd
1⤵
PID:697

/System/Library/PrivateFrameworks/CoreRecents.framework/Versions/A/Support/recentsd
/System/Library/PrivateFrameworks/CoreRecents.framework/Versions/A/Support/recentsd
1⤵
PID:697

/usr/libexec/xpcproxy
xpcproxy com.apple.ContactsAgent
1⤵
PID:698

/System/Library/PrivateFrameworks/ContactsAgent.framework/Executables/ContactsAgent
/System/Library/PrivateFrameworks/ContactsAgent.framework/Executables/ContactsAgent
1⤵
PID:698

/usr/libexec/xpcproxy
xpcproxy com.apple.iChat.1880
1⤵
PID:699

/System/Applications/Messages.app/Contents/MacOS/Messages
/System/Applications/Messages.app/Contents/MacOS/Messages
1⤵
PID:699

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.toolbox.reporting.service
1⤵
PID:701

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/CAReportingService.xpc/Contents/MacOS/CAReportingService
1⤵
PID:701

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.fmfd
1⤵
PID:702

/usr/libexec/fmfd
/usr/libexec/fmfd
1⤵
PID:702

/usr/libexec/xpcproxy
xpcproxy com.apple.iCloudHelper
1⤵
PID:703

/System/Library/PrivateFrameworks/AOSKit.framework/Versions/A/XPCServices/com.apple.iCloudHelper.xpc/Contents/MacOS/com.apple.iCloudHelper
/System/Library/PrivateFrameworks/AOSKit.framework/Versions/A/XPCServices/com.apple.iCloudHelper.xpc/Contents/MacOS/com.apple.iCloudHelper
1⤵
PID:703

/usr/libexec/xpcproxy
xpcproxy com.apple.CharacterPicker.FileService
1⤵
PID:704

/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService
/System/Library/PrivateFrameworks/CharacterPicker.framework/Versions/A/XPCServices/com.apple.CharacterPicker.FileService.xpc/Contents/MacOS/com.apple.CharacterPicker.FileService
1⤵
PID:704

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 699
1⤵
PID:705

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:705

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:706

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:706

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:707

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:707

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 359
1⤵
PID:709

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:709

/usr/libexec/xpcproxy
xpcproxy com.apple.AOSPushRelay
1⤵
PID:711

/System/Library/PrivateFrameworks/AOSKit.framework/Helpers/AOSPushRelay.app/Contents/MacOS/AOSPushRelay
/System/Library/PrivateFrameworks/AOSKit.framework/Helpers/AOSPushRelay.app/Contents/MacOS/AOSPushRelay
1⤵
PID:711

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 310
1⤵
PID:712

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:712

/usr/libexec/xpcproxy
xpcproxy com.apple.ctkd
1⤵
PID:713

/System/Library/Frameworks/CryptoTokenKit.framework/ctkd
/System/Library/Frameworks/CryptoTokenKit.framework/ctkd -tw
1⤵
PID:713

/usr/libexec/xpcproxy
xpcproxy com.apple.ctkd
1⤵
PID:714

/System/Library/Frameworks/CryptoTokenKit.framework/ctkd
/System/Library/Frameworks/CryptoTokenKit.framework/ctkd -s
1⤵
PID:714

/usr/libexec/xpcproxy
xpcproxy com.apple.CryptoTokenKit.setoken 713
1⤵
PID:715

/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
/System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
1⤵
PID:715

/usr/libexec/xpcproxy
xpcproxy com.apple.passd
1⤵
PID:716

/System/Library/PrivateFrameworks/PassKitCore.framework/passd
/System/Library/PrivateFrameworks/PassKitCore.framework/passd
1⤵
PID:716

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:717

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:717

/usr/libexec/xpcproxy
xpcproxy com.apple.cmfsyncagent
1⤵
PID:718

/System/Library/PrivateFrameworks/CommunicationsFilter.framework/CMFSyncAgent
/System/Library/PrivateFrameworks/CommunicationsFilter.framework/CMFSyncAgent
1⤵
PID:718

/usr/libexec/xpcproxy
xpcproxy com.apple.imdmessageservices.IMDMessageServicesAgent 359
1⤵
PID:720

/System/Library/PrivateFrameworks/IMDMessageServices.framework/XPCServices/IMDMessageServicesAgent.xpc/Contents/MacOS/IMDMessageServicesAgent
/System/Library/PrivateFrameworks/IMDMessageServices.framework/XPCServices/IMDMessageServicesAgent.xpc/Contents/MacOS/IMDMessageServicesAgent
1⤵
PID:720

/usr/libexec/xpcproxy
xpcproxy com.apple.reversetemplated
1⤵
PID:721

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/reversetemplated
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/reversetemplated
1⤵
PID:721

/usr/libexec/xpcproxy
xpcproxy com.apple.imdmessageservices.IMDMessageServicesAgent 359
1⤵
PID:723

/System/Library/PrivateFrameworks/IMDMessageServices.framework/XPCServices/IMDMessageServicesAgent.xpc/Contents/MacOS/IMDMessageServicesAgent
/System/Library/PrivateFrameworks/IMDMessageServices.framework/XPCServices/IMDMessageServicesAgent.xpc/Contents/MacOS/IMDMessageServicesAgent
1⤵
PID:723

/usr/libexec/xpcproxy
xpcproxy com.apple.progressd
1⤵
PID:724

/System/Library/PrivateFrameworks/ClassKit.framework/Versions/A/progressd
/System/Library/PrivateFrameworks/ClassKit.framework/Versions/A/progressd
1⤵
PID:724

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:725

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:725

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 725
1⤵
PID:726

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:726

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:727

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:728

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:729

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:730

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:731

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:733

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:733

/usr/libexec/xpcproxy
xpcproxy com.apple.preferences.AppleIDPrefPane.remoteservice 725
1⤵
PID:734

/System/Library/PreferencePanes/AppleIDPrefPane.prefPane/Contents/XPCServices/com.apple.preferences.AppleIDPrefPane.remoteservice.xpc/Contents/MacOS/com.apple.preferences.AppleIDPrefPane.remoteservice
/System/Library/PreferencePanes/AppleIDPrefPane.prefPane/Contents/XPCServices/com.apple.preferences.AppleIDPrefPane.remoteservice.xpc/Contents/MacOS/com.apple.preferences.AppleIDPrefPane.remoteservice
1⤵
PID:734

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:735

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:736

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:736

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:737

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:737

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:739

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:739

/usr/libexec/xpcproxy
xpcproxy com.apple.security.keychain-circle-notification
1⤵
PID:740

/System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Keychain Circle Notification
"/System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Keychain Circle Notification"
1⤵
PID:740

/usr/libexec/xpcproxy
xpcproxy com.apple.mobileassetd
1⤵
PID:742

/usr/libexec/mobileassetd
/usr/libexec/mobileassetd
1⤵
PID:742

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:743

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:743

/usr/libexec/xpcproxy
xpcproxy com.apple.recentsd
1⤵
PID:745

/System/Library/PrivateFrameworks/CoreRecents.framework/Versions/A/Support/recentsd
/System/Library/PrivateFrameworks/CoreRecents.framework/Versions/A/Support/recentsd
1⤵
PID:745

/usr/libexec/xpcproxy
xpcproxy com.apple.coreduetd
1⤵
PID:746

/usr/libexec/coreduetd
/usr/libexec/coreduetd
1⤵
PID:746

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:747

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:748

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged
1⤵
PID:747

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:748

/usr/libexec/xpcproxy
xpcproxy com.apple.tccd
1⤵
PID:750

/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
1⤵
PID:750

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:751

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:751

/usr/libexec/xpcproxy
xpcproxy com.apple.iCloudHelper
1⤵
PID:752

/usr/libexec/xpcproxy
xpcproxy com.apple.sandboxd
1⤵
PID:753

/System/Library/PrivateFrameworks/AOSKit.framework/Versions/A/XPCServices/com.apple.iCloudHelper.xpc/Contents/MacOS/com.apple.iCloudHelper
/System/Library/PrivateFrameworks/AOSKit.framework/Versions/A/XPCServices/com.apple.iCloudHelper.xpc/Contents/MacOS/com.apple.iCloudHelper
1⤵
PID:752

/usr/libexec/sandboxd
/usr/libexec/sandboxd
1⤵
PID:753

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:754

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:754

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:755

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:755

/usr/libexec/xpcproxy
xpcproxy com.apple.amp.accounts.pluginhelper 325
1⤵
PID:756

/usr/libexec/xpcproxy
xpcproxy com.apple.gamed
1⤵
PID:757

/System/Library/CoreServices/SetupAssistantPlugins/AMPAccounts.icdplugin/Contents/XPCServices/AMPAccountPluginHelper.xpc/Contents/MacOS/AMPAccountPluginHelper
/System/Library/CoreServices/SetupAssistantPlugins/AMPAccounts.icdplugin/Contents/XPCServices/AMPAccountPluginHelper.xpc/Contents/MacOS/AMPAccountPluginHelper
1⤵
PID:756

/System/Library/PrivateFrameworks/GameCenterFoundation.framework/Versions/A/gamed
/System/Library/PrivateFrameworks/GameCenterFoundation.framework/Versions/A/gamed
1⤵
PID:757

/usr/libexec/xpcproxy
xpcproxy com.apple.SecureBackupDaemon
1⤵
PID:758

/System/Library/PrivateFrameworks/CloudServices.framework/Helpers/com.apple.sbd
/System/Library/PrivateFrameworks/CloudServices.framework/Helpers/com.apple.sbd
1⤵
PID:758

/usr/libexec/xpcproxy
xpcproxy com.apple.amsaccountsd
1⤵
PID:761

/System/Library/PrivateFrameworks/AppleMediaServices.framework/Resources/amsaccountsd
/System/Library/PrivateFrameworks/AppleMediaServices.framework/Resources/amsaccountsd
1⤵
PID:761

/usr/libexec/xpcproxy
xpcproxy com.apple.ap.adprivacyd
1⤵
PID:762

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:763

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:763

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:764

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:764

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:765

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:765

/usr/libexec/adprivacyd
/usr/libexec/adprivacyd
1⤵
PID:762

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 310
1⤵
PID:767

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:767

/usr/libexec/xpcproxy
xpcproxy com.apple.CalendarAgent
1⤵
PID:768

/System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarAgent
/System/Library/PrivateFrameworks/CalendarAgent.framework/Executables/CalendarAgent
1⤵
PID:768

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesagent
1⤵
PID:769

/System/Library/CoreServices/iconservicesagent
/System/Library/CoreServices/iconservicesagent
1⤵
PID:769

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesd
1⤵
PID:770

/System/Library/CoreServices/iconservicesd
/System/Library/CoreServices/iconservicesd
1⤵
PID:770

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:771

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:771

/usr/libexec/xpcproxy
xpcproxy com.apple.CalendarNotification.CalNCService 768
1⤵
PID:772

/System/Library/PrivateFrameworks/CalendarNotification.framework/Versions/A/XPCServices/CalNCService.xpc/Contents/MacOS/CalNCService
/System/Library/PrivateFrameworks/CalendarNotification.framework/Versions/A/XPCServices/CalNCService.xpc/Contents/MacOS/CalNCService
1⤵
PID:772

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:777

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:777

/usr/libexec/xpcproxy
xpcproxy com.apple.progressd
1⤵
PID:780

/System/Library/PrivateFrameworks/ClassKit.framework/Versions/A/progressd
/System/Library/PrivateFrameworks/ClassKit.framework/Versions/A/progressd
1⤵
PID:780

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.searchpartyuseragent
1⤵
PID:781

/usr/libexec/searchpartyuseragent
/usr/libexec/searchpartyuseragent
1⤵
PID:781

/usr/libexec/xpcproxy
xpcproxy com.apple.homed
1⤵
PID:782

/System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed
/System/Library/PrivateFrameworks/HomeKitDaemon.framework/Support/homed
1⤵
PID:782

/usr/libexec/xpcproxy
xpcproxy com.apple.dmd
1⤵
PID:783

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:784

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:784

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenTimeAgent
1⤵
PID:785

/usr/libexec/xpcproxy
xpcproxy com.apple.CloudPhotosConfiguration
1⤵
PID:786

/usr/libexec/xpcproxy
xpcproxy com.apple.cdpd
1⤵
PID:787

/System/Library/PrivateFrameworks/CoreCDP.framework/Versions/A/Resources/cdpd
/System/Library/PrivateFrameworks/CoreCDP.framework/Versions/A/Resources/cdpd
1⤵
PID:787

/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
1⤵
PID:786

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:789

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:789

/System/Library/Filesystems/apfs.fs/Contents/Resources/./apfs.util
/System/Library/Filesystems/apfs.fs/Contents/Resources/./apfs.util -p disk2s3 removable readonly
1⤵
PID:790

/System/Library/Filesystems/apfs.fs/Contents/Resources/./apfs.util
/System/Library/Filesystems/apfs.fs/Contents/Resources/./apfs.util -k disk2s3
1⤵
PID:791

/System/Library/Filesystems/apfs.fs/Contents/Resources/./fsck_apfs
/System/Library/Filesystems/apfs.fs/Contents/Resources/./fsck_apfs -q /dev/rdisk2s3
1⤵
PID:792

/sbin/mount
/sbin/mount -t apfs -o nobrowse /dev/disk2s3 /Volumes/Recovery
1⤵
PID:793
- /sbin/mount_apfs
  /sbin/mount_apfs -o nobrowse /dev/disk2s3 /Volumes/Recovery
  2⤵
  PID:794

/usr/libexec/xpcproxy
xpcproxy com.apple.TrustedPeersHelper
1⤵
PID:797

/System/Library/Frameworks/Security.framework/Versions/A/XPCServices/TrustedPeersHelper.xpc/Contents/MacOS/TrustedPeersHelper
/System/Library/Frameworks/Security.framework/Versions/A/XPCServices/TrustedPeersHelper.xpc/Contents/MacOS/TrustedPeersHelper
1⤵
PID:797

/usr/libexec/xpcproxy
xpcproxy com.apple.HasTRB 734
1⤵
PID:798

/System/Library/PrivateFrameworks/FindMyMac.framework/XPCServices/com.apple.HasTRB.xpc/Contents/MacOS/com.apple.HasTRB
/System/Library/PrivateFrameworks/FindMyMac.framework/XPCServices/com.apple.HasTRB.xpc/Contents/MacOS/com.apple.HasTRB
1⤵
PID:798

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.fmfd
1⤵
PID:799

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:802

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:802

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:803

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:803

/usr/libexec/xpcproxy
xpcproxy com.apple.mediaremoted
1⤵
PID:804

/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
1⤵
PID:804

/usr/libexec/fmfd
/usr/libexec/fmfd
1⤵
PID:799

/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
1⤵
PID:785

/usr/libexec/xpcproxy
xpcproxy com.apple.bsd.dirhelper
1⤵
PID:807

/sbin/umount
/sbin/umount /Volumes/Recovery
1⤵
PID:808

/usr/libexec/dmd
/usr/libexec/dmd
1⤵
PID:783

/usr/libexec/xpcproxy
xpcproxy com.apple.cmfsyncagent
1⤵
PID:810

/System/Library/PrivateFrameworks/CommunicationsFilter.framework/CMFSyncAgent
/System/Library/PrivateFrameworks/CommunicationsFilter.framework/CMFSyncAgent
1⤵
PID:810

/usr/libexec/xpcproxy
xpcproxy com.apple.cloudphotod
1⤵
PID:811

/usr/libexec/xpcproxy
xpcproxy com.apple.siriknowledged
1⤵
PID:813

/System/Library/PrivateFrameworks/CloudPhotoLibrary.framework/Versions/A/Support//cloudphotod
cloudphotod
1⤵
PID:811

/usr/libexec/siriknowledged
/usr/libexec/siriknowledged
1⤵
PID:813

/usr/libexec/xpcproxy
xpcproxy com.apple.mediastream.mstreamd
1⤵
PID:814

/System/Library/PrivateFrameworks/MediaStream.framework/Versions/A/Support/mstreamd
/System/Library/PrivateFrameworks/MediaStream.framework/Versions/A/Support/mstreamd
1⤵
PID:814

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:815

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:815

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:816

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:816

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:818

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:818

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

savedConfiguration.plist

Path /Library/Application Support/com.apple.icloud.searchpartyd/savedConfiguration.plist
Size 2KB
SHA256 bff60d1818d3c635d8e844c7eb59b4bc45ee3563320ba8c278a064aa3ae5d64c
MD5 d8858841b3415b0e7ce869c9ff94cc6c
SHA1 2d384b197673e24d84270c4b1f5b998a2f5cc671
SHA512 5165384c11f49c318eebd43c59205af9059f81789017712a279b55294007fa072c8a04f14f60bb613d6650f4c6ab0ecceb0b6a78f5c86e4c13e3b277f3bb3a81
MD5 SHA1 SHA512

Submit Download

savedConfiguration.plist

Path /Library/Application Support/com.apple.icloud.searchpartyd/savedConfiguration.plist
Size 2KB
SHA256 7b5bae12d75d54b6600dba8198c094e26fd4d9dd0b0426f2bc4a6f6a628ede95
MD5 94ddb4817f4f1024bb7ee5a79866ac67
SHA1 da5f1cb7efa0676bb0e546ef37575aef580db7e3
SHA512 b95dbd6f6f782473d30cf6864e126a1ba039834b4ce9a0fe96976f97801aa347ad4cb0f8f4e5a34953c88d50b5c9d5be1f4d987f0fcb089a9707161ec6a166a6
MD5 SHA1 SHA512

Submit Download