hxxp://giris[.]eba[.]gov[.]tr

Resubmissions

04/04/2024, 16:45

240404-t9qk4acg6s 10

04/04/2024, 16:44

04/04/2024, 16:42

04/04/2024, 16:39

04/04/2024, 16:36

Analysis

max time kernel
122s
max time network
122s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
04/04/2024, 16:39

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://giris.eba.gov.tr

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 5 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found

/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.DiagnosticReportCleanup.plist
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:527

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.appleseed.seedusaged
1⤵
PID:528

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.speech.speechdatainstallerd
1⤵
PID:529

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:529

/bin/sh
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://giris.eba.gov.tr\""
1⤵
PID:532

/bin/bash
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://giris.eba.gov.tr\""
1⤵
PID:532

/usr/bin/sudo
sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://giris.eba.gov.tr"
1⤵
PID:532
- /bin/zsh
  /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://giris.eba.gov.tr"
  2⤵
  PID:533
- /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window http://giris.eba.gov.tr
  2⤵
  PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:537

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:537

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/var/root/Library/Application Support/Google/Chrome/Crashpad" "--metrics-dir=/var/root/Library/Application Support/Google/Chrome" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:541

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:541

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:543

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:546

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:547

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:548

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=21"
1⤵
PID:550

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=21"
1⤵
PID:551

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=28"
1⤵
PID:552

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072"
1⤵
PID:553

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:558

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:558

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=288337972" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=63"
1⤵
PID:557

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=288541856" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=63"
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:562

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:563

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:563

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=292470981" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=20"
1⤵
PID:565

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
1⤵
PID:566

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --user-store
1⤵
PID:567

/usr/sbin/system_profiler
/usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.secd
1⤵
PID:569

/usr/libexec/secd
/usr/libexec/secd
1⤵
PID:569

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:592

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:593

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:598

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:602

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:602

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.FaceTime.1860
1⤵
PID:606

/System/Applications/FaceTime.app/Contents/MacOS/FaceTime
/System/Applications/FaceTime.app/Contents/MacOS/FaceTime
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.telephonyutilities.callservicesd
1⤵
PID:607

/System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd
/System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.videoconference.camera
1⤵
PID:608

/usr/libexec/avconferenced
/usr/libexec/avconferenced
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:609

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.FaceTime.FaceTimeNotificationCenterService 606
1⤵
PID:611

/System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService
/System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.mediaremoted
1⤵
PID:612

/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 608
1⤵
PID:614

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 606
1⤵
PID:615

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 607
1⤵
PID:619

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:619

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=111"
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:623

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:624

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:628

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:629

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:632

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:634

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:634

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:633

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=111"
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 625
1⤵
PID:638

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:638

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=111"
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.ncplugin.stocks 311
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy com.apple.iCal.CalendarNC 311
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy com.apple.notificationcenterui.WeatherSummary 311
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.ncplugin.weather 311
1⤵
PID:644

/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
1⤵
PID:641

/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
1⤵
PID:642

/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
1⤵
PID:644

/System/Library/CoreServices/NotificationCenter.app/Contents/XPCServices/com.apple.notificationcenterui.WeatherSummary.xpc/Contents/MacOS/com.apple.notificationcenterui.WeatherSummary
/System/Library/CoreServices/NotificationCenter.app/Contents/XPCServices/com.apple.notificationcenterui.WeatherSummary.xpc/Contents/MacOS/com.apple.notificationcenterui.WeatherSummary
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:648

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:648

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=111"
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:650

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:651

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:651

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=112"
1⤵
PID:653

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=112"
1⤵
PID:654

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=114"
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.Photos.1876
1⤵
PID:656

/System/Applications/Photos.app/Contents/MacOS/Photos
/System/Applications/Photos.app/Contents/MacOS/Photos
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:658

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsync.useragent
1⤵
PID:659

/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsyncd
1⤵
PID:660

/usr/libexec/colorsyncd
/usr/libexec/colorsyncd
1⤵
PID:660

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:657

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,3002967422470859096,12709795897514038218,131072" "--seatbelt-client=114"
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:662

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:663

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy com.apple.PackageKit.InstallStatus
1⤵
PID:664

/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
"/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy com.apple.warmd_agent
1⤵
PID:665

/usr/libexec/warmd_agent
/usr/libexec/warmd_agent
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy com.apple.security.keychain-circle-notification
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:667

/System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Keychain Circle Notification
"/System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Keychain Circle Notification"
1⤵
PID:666

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:667

/usr/libexec/xpcproxy
xpcproxy com.apple.sessionlogoutd
1⤵
PID:668

/System/Library/CoreServices/sessionlogoutd
/System/Library/CoreServices/sessionlogoutd
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy com.apple.akd
1⤵
PID:669

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:670

/sbin/shutdown
/sbin/shutdown -h now
1⤵
PID:92

/bin/sh
sh -c "/usr/bin/wall -n"
1⤵
PID:673

/bin/bash
sh -c "/usr/bin/wall -n"
1⤵
PID:673

/usr/bin/wall
/usr/bin/wall -n
1⤵
PID:673

/System/Library/Extensions/IOGraphicsFamily.kext/iogdiagnose
iogdiagnose -b /var/log/displaypolicy/iogdiagnose-last.bin
1⤵
PID:1.8446744073709552e+19

/usr/sbin/spindump
spindump -shutdownstall 2 -timelimit 5
1⤵
PID:675

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:676

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:676

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:676

/bin/bash
bash /private/var/install/shutdown_installer_tasks
1⤵
PID:677

/bin/bash
bash /private/var/install/deferred_install
1⤵
PID:678

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
103B

MD5
0f6a8cc17f2213961fc33a4646eca848

SHA1
b55c7cabcc7aa10a9064297574b1a1644594d774

SHA256
657db43895a669f40884eab2f014a89beec71e86a1ac2745d0bf2c8bf937c836

SHA512
50bb2dd8a44696daeac943e804ce350638d2558dc8485de1783daf0858df38deef97fac2606c12e92a31b4f70bdaaa22475ceb918dc6e616d2be4db72844d653

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
148B

MD5
a2d06040900c3e72aa695e36fc2358f7

SHA1
c3f04b93f9b07508e8130d59252eb35762c7dbd1

SHA256
d1b503e167c350ffaff71a1b2d17f0c4b161aa2bd9ec73a453a0e84847a59192

SHA512
9237b1ccb95caf088cc74d231447455e4f679e338212e150b62a4b29ae1a6e94cffb2eb27e8fd29ff5813d749855dd5af91e112afb10b78877648eeb6187a1d8

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
106B

MD5
47175fa3da87b5fbf01685c4cd96a8e8

SHA1
ab0a96d19b3ea98d07048f7c2eb542dce2aa9ae5

SHA256
41b9d79f7340d3e13cdc89cd5986592ba64d2eeb918e1d326a3d1660bcfb59eb

SHA512
1f218a69284ea8bc913dfb16dc3cc3e4abe011aa006dd27791cd00839e47642708338ec91ae3b9aa6db84986c968e3ff05f1b6cebc6d0b856ebcbf767459dccf

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
126B

MD5
59cf5f3b8c1f3e635abcb2e39ecfe7d5

SHA1
1028fab86d136960171666f79f211d1dd954db02

SHA256
b7ebf3a5a197bb65fafab5ea6a1fb38cd3be6f6b39a93c094f7fdbc5217b9cfc

SHA512
241b562934aad26b3121e529ce8d72f025fae43fb9294c547f8fcf9dbb612be36237506e956fe0ede6acb9f79c7bd65d432d132b0e53915371bcaa9959cd409b

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1261.xml

Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.colorsync.profiles.502

Filesize
21KB

MD5
fd790579f9bf920bdc1e7642d9743402

SHA1
6d8988a1642bcc14e0dfde68949b705e0c3fdc23

SHA256
753b178aa9fac9ec02187dc87286c18b9e0a8496297664fbb963a523b8565758

SHA512
92f7129c5ce3dfb2dba528ef9cf70e58f60d4def657c44142a9a39862591c09495d934c43685c0d985b1a4a0a608295245888d9a23656f7833e084938ef026bf

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.1jMNE1/hfnkpimlhhgieaddgfemjhofmfblmnib_8640_all_gixex7yiq3guddfd6niqe4weri.crx3

Filesize
25KB

MD5
2e4a1f2d76976608668970f73b03e426

SHA1
8e0cd15e0b315ec7e41a1e953a8f728ad1706187

SHA256
74cac03d4463f3d19c22f4282adfdfb289cfd3d9b234eeed605a2790dfa6bed6

SHA512
d52cc984ad9ba84eb60ed3202379f434ecc486cd79e44359f0d792c49bf3cec08d96f9de2722ea901e9575811f6bf107fa855e4a7076dae0a4caaa8d31d44e65

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.8RJl1q/ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3

Filesize
10KB

MD5
cb79d407a4d6d8526b42060b9210b5c2

SHA1
331e3d66e82e130042897faf86dcbd05d7b227f1

SHA256
e3a7322843834a5270a01c56533a34a24b1a253e3bda6f14046e10d818446165

SHA512
0ea283f2077ff874e1f2518565497864b11fd8a65f03d65e2b2996048bdba19849fcab81d9a8220cd51d4a09741b9cf222b1393f6ea4fde6db76dfe0590efdf9

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.QclgIM/efniojlnjndmcbiieegkicadnoecjjef_916_all_m7irhq4ozk76w42au46ve7cf4a.crx3

Filesize
150KB

MD5
a9ba56bfb71c7bd5e44766f68508e6e6

SHA1
1c538e1b9547ceb5db3525fc21bcfcfe088ff4d8

SHA256
38d01effb9f02c3d201ba10492bdd903a464d5facba4a0ecfb2f7425ea1d1db9

SHA512
b2b395dbbc0a59f090a1686401dc84b5dc4155ae52f82113e4e5f343daff26df4d8922ab4c5f6db7244173290ea98a4c2dc3ce2a1684bff32d09a4959905ae95

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.WBWt7O/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx

Filesize
3KB

MD5
39fbc1bf4c6c8f919181e3e72630f974

SHA1
b73f2394a2c1ac341df75ba63eef4e5e9830fade

SHA256
3a118962ef814c91f6476bb9f0de58afa63103af6ac1b8729be9b39a86789e96

SHA512
2dbd8f772bc113f6500dace5d187b12c79e6e3a5c7f6f68d270beebc482334a1970499b28de5187a3619ff3ecd20aab10c31df8433d509dc011e1e88978ab70e

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.iXIDqC/dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3

Filesize
136KB

MD5
667e9eec04509aa9e2b318f580addd8c

SHA1
346267ecad10c54de52a3aeb766ea72449500326

SHA256
0c24e9bd976adffa987e08fc54dc0950c84cf18f9cdb4c5caabc6acf24887c4f

SHA512
a9d22d49290c164abf36dd7e887063ccdd2bf508eb2d16bbac6de749e5152805ecb38ca39352706150de29a76839fa6a56c084ea4f2757b61887b3a7912be917

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.yg0mlH/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3

Filesize
34KB

MD5
2db7e78c310ca8e73c069a604eac4d99

SHA1
a6d1e03514f8eba03ab81f1380fc54aaded823b6

SHA256
cd1978742a4afdbaaa15bf712d5c90bef4144caa99024df98f6a9ad58043ae85

SHA512
681eaddbf304f4513b008b98493272b44815460568876b93528851ff7806775de38e6ec588fe27a2cf3dc804415e83a420e45d754b25ad4bdf68ef2c78403aa3

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

Filesize
132KB

MD5
9f0064b68b0f663529d8111204e0107b

SHA1
f4a811e4d53513d201a29153cd4a2888d50c0b64

SHA256
81aa53f99a8171db0fc3921626ebe7052b05f508963d70ebe3be0758e909153f

SHA512
696dae75eedd78138a510b1012e691897e49f35e39dad38fb313ba5a68726f04fc44c2a695952482b2f913999bd8bb7b72b00c868a777113023509adc1ee09ce

Download Submit
/var/root/Library/Application Support/Google/Chrome/Crashpad/settings.dat

Filesize
40B

MD5
c6db1caaee0095f017c09113d53ed054

SHA1
cc37e2b3948325a0eeb51080f45b17ebf52a7035

SHA256
ca3252b297284a87de2ee1688585f7c37d26b98c05d7ed04bd7d6df10c0d1476

SHA512
3013340ee4157dfef7dcacd690b840f12b876e8241d4e8bc419016d5336810ab77023cdbbeaa896544e4c29f386d21296649542ef2b0fc6b58c49e2ad0337d85

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb

Filesize
141B

MD5
38fc535a8f11d7e955ef58cc63158eff

SHA1
c45ad3ee106dbfb65dce7c09b53140f34454cd0e

SHA256
085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8

SHA512
26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb

Filesize
312B

MD5
5c4e7ade5753ab7de2c42c04111fa42e

SHA1
fb577b8c07d9617f507a3f2950df0a6dcfebe4e2

SHA256
d3979fd2d9ecfdb05498d79d1f24998c38cfd107e321f6810d8b7f9f12affd82

SHA512
7a7452bcd22e66190e36ff0036f21d854fa57bdcbaebf637aa3a6d932a385a7c90525ede0c124853c218445d583c0edcf45d12159ca452732f31d16c3901929b

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb

Filesize
136B

MD5
fe382e791274914bee5950777e4f1fd3

SHA1
53b523b5fc87e66f2520a0b5f9ea080072668f4d

SHA256
935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132

SHA512
a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb

Filesize
337B

MD5
ea517aa120c972c602673d331dfa35bc

SHA1
7ff539eec544cf306b80137bc182fb544e58aad5

SHA256
0c53b2ef8ec9bd6c3b81955b45cd9fc69705e7b435ad747b50c150c7e341f8da

SHA512
e2bc6f26b0db61af3b7f1648e890be2b748aa886ff3ab51e207a915432c6d9a426b188fe9c979b443e8fe8aad248442b20b2e6cd38f494264cb7cdbcaa88eecd

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb

Filesize
353B

MD5
17a2dc5826aeb539547f00f52eccccd5

SHA1
fd36ad6db84312792cffac0267f6329b21727d66

SHA256
746da9cf33c3e4d29907dfdf1065f06ae16dcb5c2e9a34cfb5dd0dae9130f151

SHA512
6bca3e308d0446211570021c1f1dc6d8e9704a2a68a90c5c8daf26b20cb2702bccfae8ddfeb6f16c8bfea83e1b648810054a25a7967bb9539feb241f2950ea73

Download Submit
/var/root/Library/Application Support/Google/Chrome/OptimizationGuidePredictionModels/10c15b80-d953-4596-8ac1-107775bcb7c3/model.tflite

Filesize
382KB

MD5
6d7c2f9e94664539dec99b3233301b01

SHA1
85812b004742cc1c211c92911131ce270f8ba769

SHA256
a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534

SHA512
4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33

Download Submit
/var/root/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.49.1/Ruleset Data

Filesize
120KB

MD5
c5e30274fe7b93847f6d7c02410d1209

SHA1
488a49f38459f29e110c706c51b61ca1ae3b0e26

SHA256
e634e3cfdd0d27d0be1f5f9a19748d19d564928765db343503f42a6e1f5dd4ea

SHA512
bc235bb3af269e9a828e6788dbae2b42cabc879b858102f4cc76c0fa02af0e296d20ffc8f134c0a3f9b408643e4810e8c46afeb0c285b892908b06ea1aa1b811

Download Submit
/var/root/Library/Application Support/Google/Chrome/Subresource Filter/Unindexed Rules/9.49.1/Filtering Rules

Filesize
68KB

MD5
6274a7426421914c19502cbe0fe28ca0

SHA1
e4d1c702ca1b5497a3abcdd9495a5d0758f19ffc

SHA256
ae2fd01d2908591e0f39343a5b4a78baa8e7d6cac9d78ba79c502fe0a15ce3ee

SHA512
bf1287f502013308cdd906f6e42998c422ef1e272b348e66122dc4a4e471d01333b418f48d1bb2198c72845bdc950612597e179e612aaa1ba6cf8d48fb8f0cf5

Download Submit