evilquest | b34738e181a6119f23e930476ae949fc0c7c4ded6efa003019fa946c4e5b287a

Resubmissions

23-05-2024 09:12

240523-k6dmpabf5s 10

23-05-2024 08:55

240523-kvsmgabd54 10

23-05-2024 08:46

240523-kpqwpabb8x 10

18-05-2024 14:00

240518-ra6rxseh59 10

Analysis

max time kernel
207s
max time network
217s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
23-05-2024 08:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Mixed In Key 8.dmg
Size

10.4MB
MD5

58680abd58baca826c2029f32e5b78b3
SHA1

98040c4d358a6fb9fed970df283a9b25f0ab393b
SHA256

b34738e181a6119f23e930476ae949fc0c7c4ded6efa003019fa946c4e5b287a
SHA512

be852ea2a0ce7a119392f6f28033dfcec27ac897f3479767287da8e5b2babd2cff95b94c399e64d5f219fbef3508a3a2f2b2f4346e057ddce416353825994d28
SSDEEP

196608:1kBu2wBiw00Bsqbxxf15AS2710A8O2RgXuHueFrs/7M+49/jhHh/:ig2whsQr5ASEcO28enS/7J4tT/

Score

10^/10

evilquest backdoor discovery evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 1 IoCs

resource	yara_rule
behavioral1/files/0x000000030008a49c-5.dat	family_evilquest

Compromise Client Software Binary 1 TTPs 2 IoCs

Adversaries may modify client software binaries to establish persistent access to systems. Client software enables users to access services provided by a server.

persistence

Compromise Host Software Binary

T1554

ioc	Process
/Library/AppQuest/com.apple.questd	Process not Found
/Users/run/Library/AppQuest/com.apple.questd	Process not Found

File Permission 1 TTPs
Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Installer Packages 1 TTPs 2 IoCs

Adversaries may establish persistence and elevate privileges by using an installer to trigger the execution of malicious content. Installer packages are OS specific and contain the resources an operating system needs to install applications on a system.

persistence

Installer Packages

T1546.016

ioc	Process
/tmp/PKInstallSandbox.GGB96Q/Scripts/com.mixedinkey.installer.Yy1SKI/postinstall /Users/run/setup.pkg /Applications / /	Process not Found
/bin/sh /tmp/PKInstallSandbox.GGB96Q/Scripts/com.mixedinkey.installer.Yy1SKI/postinstall /Users/run/setup.pkg /Applications / /	Process not Found

Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 10 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found

File and Directory Discovery. 1 TTPs 1 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
dirname /usr/bin/cups-config	Process not Found

Resource Forking 1 TTPs 18 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/891F6843-C1DB-42F6-ABC4-82D3BF0F75FC.activeSandbox/Root /	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c	Process not Found
/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode xpchost	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid	Process not Found
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/50A8793C-CE4F-467A-A9C2-7A0D85D6040A.activeSandbox/Root /	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found

Command and Scripting Interpreter 1 TTPs
Adversaries may abuse Unix shell commands and scripts for execution.
execution

Unix Shell
T1059.004

Launchctl 1 TTPs 10 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:545

/bin/bash
sh -c "sudo /bin/zsh -c \"installer -pkg /Users/run/setup.pkg -target /\""
1⤵
PID:545

/usr/bin/sudo
sudo /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
1⤵
PID:545
- /bin/zsh
  /bin/zsh -c "installer -pkg /Users/run/setup.pkg -target /"
  2⤵
  PID:548
- /usr/sbin/installer
  installer -pkg /Users/run/setup.pkg -target /
  2⤵
  PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:546

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:547

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:547

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:549

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:551

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:554

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:556

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:560

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:559

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 552
1⤵
PID:561

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:561

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:566

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/InstallerSandboxes/.PKInstallSandboxManager/891F6843-C1DB-42F6-ABC4-82D3BF0F75FC.activeSandbox/Root /
1⤵
PID:567

/tmp/PKInstallSandbox.GGB96Q/Scripts/com.mixedinkey.installer.Yy1SKI/postinstall
/tmp/PKInstallSandbox.GGB96Q/Scripts/com.mixedinkey.installer.Yy1SKI/postinstall /Users/run/setup.pkg /Applications / /
1⤵
PID:568

/bin/bash
/bin/sh /tmp/PKInstallSandbox.GGB96Q/Scripts/com.mixedinkey.installer.Yy1SKI/postinstall /Users/run/setup.pkg /Applications / /
1⤵
PID:568
- /bin/mkdir
  mkdir /Library/mixednkey
  2⤵
  PID:569
- /bin/mv
  mv /Applications/Utils/patch /Library/mixednkey/toolroomd
  2⤵
  PID:571
- /bin/rmdir
  rmdir /Application/Utils
  2⤵
  PID:572
- /bin/chmod
  chmod +x /Library/mixednkey/toolroomd
  2⤵
  PID:573
- /Library/mixednkey/toolroomd
  /Library/mixednkey/toolroomd
  2⤵
  PID:574

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
1⤵
PID:575

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:577

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:577

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:578

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:578

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:579

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:579

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:580

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:580

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:581

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:581

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:582

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:582

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:583

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:583

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:584

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:584

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:585

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:585

/usr/bin/csrutil
/usr/bin/csrutil status
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.SecureElementHelper 601
1⤵
PID:602

/System/Library/SystemProfiler/SPSecureElementReporter.spreporter/Contents/XPCServices/SecureElementHelper.xpc/Contents/MacOS/SecureElementHelper
/System/Library/SystemProfiler/SPSecureElementReporter.spreporter/Contents/XPCServices/SecureElementHelper.xpc/Contents/MacOS/SecureElementHelper
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.printtool.agent
1⤵
PID:606

/System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
1⤵
PID:606

/bin/sh
sh -c "/usr/bin/cups-config --version --build"
1⤵
PID:608

/bin/bash
sh -c "/usr/bin/cups-config --version --build"
1⤵
PID:608

/usr/bin/cups-config
/usr/bin/cups-config --version --build
1⤵
PID:608

/bin/bash
/bin/sh /usr/bin/cups-config --version --build
1⤵
PID:608
- /usr/bin/dirname
  dirname /usr/bin/cups-config
  2⤵
  PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.iBridgeDiscovery 612
1⤵
PID:613

/System/Library/SystemProfiler/SPiBridgeReporter.spreporter/Contents/XPCServices/iBridgeDiscovery.xpc/Contents/MacOS/iBridgeDiscovery
/System/Library/SystemProfiler/SPiBridgeReporter.spreporter/Contents/XPCServices/iBridgeDiscovery.xpc/Contents/MacOS/iBridgeDiscovery
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:623

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.Photos.StorageManagementExtension 549
1⤵
PID:624

/System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
/System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
1⤵
PID:624

/System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
/System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.iOSFiles 549
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.GarageBand 549
1⤵
PID:627

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
1⤵
PID:626

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Mail 549
1⤵
PID:628

/System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
/System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.CloudDocsDaemon.StorageManagement 549
1⤵
PID:629

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
1⤵
PID:629

/System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
/System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
1⤵
PID:630

/System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
/System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Trash 549
1⤵
PID:632

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.messages.StorageManagementExtension 549
1⤵
PID:633

/System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension
"/System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension"
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.AppleInternal 549
1⤵
PID:634

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.iBooksX.DiskSpaceEfficiency
1⤵
PID:635

/System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
/System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.CloudFiles 549
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.Applications 549
1⤵
PID:637

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
1⤵
PID:636

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.STMExtension.OtherUsers 549
1⤵
PID:638

/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
/System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.CloudPhotosConfiguration
1⤵
PID:639

/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
/System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.AppStore.1900
1⤵
PID:644

/System/Applications/App Store.app/Contents/MacOS/App Store
"/System/Applications/App Store.app/Contents/MacOS/App Store"
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.automountd
1⤵
PID:646

/usr/libexec/automountd
automountd
1⤵
PID:646
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:647
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:653

/usr/libexec/xpcproxy
xpcproxy com.apple.installandsetup.systemmigrationd
1⤵
PID:649

/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
/System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy com.apple.storagekitd
1⤵
PID:650

/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
/System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy com.apple.storeuid
1⤵
PID:652

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storeuid.app/Contents/MacOS/storeuid
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy com.apple.iconservices.iconservicesagent
1⤵
PID:655

/System/Library/CoreServices/iconservicesagent
/System/Library/CoreServices/iconservicesagent runAsRoot
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 644
1⤵
PID:657

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.B5F839AB-3043-4E98-BD01-EA24ABB7ADB0 558
1⤵
PID:658

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:658

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:659

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.questd.plist;launchctl start questd\\\" with administrator privileges\""
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:660

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy com.apple.softwareupdated
1⤵
PID:661

/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy com.apple.suhelperd
1⤵
PID:662

/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"
1⤵
PID:662

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.1864
1⤵
PID:665

/System/Applications/Maps.app/Contents/MacOS/Maps
/System/Applications/Maps.app/Contents/MacOS/Maps
1⤵
PID:665

/System/Applications/TV.app/Contents/MacOS/TV
/System/Applications/TV.app/Contents/MacOS/TV
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:667

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:667
- /usr/bin/login
  login -pf run
  2⤵
  PID:707
- - /bin/zsh
    -zsh
    3⤵
    PID:712
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:713
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:714

/usr/libexec/xpcproxy
xpcproxy com.apple.accessibility.mediaaccessibilityd
1⤵
PID:668

/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
/System/Library/Frameworks/MediaAccessibility.framework/Versions/A/XPCServices/com.apple.accessibility.mediaaccessibilityd.xpc/Contents/MacOS/com.apple.accessibility.mediaaccessibilityd
1⤵
PID:668

/usr/libexec/xpcproxy
xpcproxy com.apple.mediaremoted
1⤵
PID:669

/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
/System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
1⤵
PID:669

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
1⤵
PID:670

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/50A8793C-CE4F-467A-A9C2-7A0D85D6040A.activeSandbox/Root /
1⤵
PID:672

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
1⤵
PID:673

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:674

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:675

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:675

/usr/libexec/xpcproxy
xpcproxy com.apple.appleseed.FeedbackAssistant.2152
1⤵
PID:676

/usr/libexec/xpcproxy
xpcproxy com.apple.reminders.2592
1⤵
PID:677

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/MacOS/Feedback Assistant
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/MacOS/Feedback Assistant"
1⤵
PID:676

/System/Applications/Reminders.app/Contents/MacOS/Reminders
/System/Applications/Reminders.app/Contents/MacOS/Reminders
1⤵
PID:677

/usr/libexec/xpcproxy
xpcproxy com.apple.Photos.1876
1⤵
PID:678

/usr/libexec/xpcproxy
xpcproxy com.apple.accountsd
1⤵
PID:679

/System/Applications/Photos.app/Contents/MacOS/Photos
/System/Applications/Photos.app/Contents/MacOS/Photos
1⤵
PID:678

/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
1⤵
PID:679

/usr/libexec/xpcproxy
xpcproxy com.apple.mail.2576
1⤵
PID:680

/System/Applications/Mail.app/Contents/MacOS/Mail
/System/Applications/Mail.app/Contents/MacOS/Mail
1⤵
PID:680

/usr/libexec/xpcproxy
xpcproxy com.apple.FaceTime.1860
1⤵
PID:681

/System/Applications/FaceTime.app/Contents/MacOS/FaceTime
/System/Applications/FaceTime.app/Contents/MacOS/FaceTime
1⤵
PID:681

/usr/libexec/xpcproxy
xpcproxy com.apple.iChat.1880
1⤵
PID:682

/System/Applications/Messages.app/Contents/MacOS/Messages
/System/Applications/Messages.app/Contents/MacOS/Messages
1⤵
PID:682

/usr/libexec/xpcproxy
xpcproxy com.google.Chrome.3056
1⤵
PID:683

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:687

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:687

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
1⤵
PID:683

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:689

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:689

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:691

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreLocationAgent
1⤵
PID:692

/System/Library/CoreServices/CoreLocationAgent.app/Contents/MacOS/CoreLocationAgent
/System/Library/CoreServices/CoreLocationAgent.app/Contents/MacOS/CoreLocationAgent
1⤵
PID:692

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:693

/usr/libexec/xpcproxy
xpcproxy com.apple.videoconference.camera
1⤵
PID:695

/usr/libexec/avconferenced
/usr/libexec/avconferenced
1⤵
PID:695

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsync.useragent
1⤵
PID:696

/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
/System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
1⤵
PID:696

/usr/libexec/xpcproxy
xpcproxy com.apple.colorsyncd
1⤵
PID:697

/usr/libexec/colorsyncd
/usr/libexec/colorsyncd
1⤵
PID:697

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:698

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:699

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:700

/usr/libexec/xpcproxy
xpcproxy com.apple.sandboxd
1⤵
PID:701

/usr/libexec/sandboxd
/usr/libexec/sandboxd
1⤵
PID:701

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=23"
1⤵
PID:702

/usr/libexec/xpcproxy
xpcproxy com.apple.security.agent
1⤵
PID:703

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
1⤵
PID:703

/usr/libexec/xpcproxy
xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 695
1⤵
PID:704

/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
/System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
1⤵
PID:704

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:706

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:706

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=15"
1⤵
PID:705

/usr/libexec/xpcproxy
xpcproxy com.apple.accountsd
1⤵
PID:708

/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
1⤵
PID:708

/usr/libexec/xpcproxy
xpcproxy com.apple.WeatherService
1⤵
PID:709

/System/Library/PrivateFrameworks/WeatherFoundation.framework/Versions/A/XPCServices/WeatherService.xpc/Contents/MacOS/WeatherService
/System/Library/PrivateFrameworks/WeatherFoundation.framework/Versions/A/XPCServices/WeatherService.xpc/Contents/MacOS/WeatherService
1⤵
PID:709

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:711

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:711

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:715

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:716

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/GoogleSoftwareUpdateAgent.app/../../MacOS/crashpad_handler "--database=/Users/run/Library/Google/GoogleSoftwareUpdate/Crashes" "--url=https://clients2.google.com/cr/report" "--annotation=plat=OS X" "--annotation=prod=Keystone" "--annotation=ver=1.3.17.192" "--handshake-fd=4"
1⤵
PID:718

/usr/libexec/xpcproxy
xpcproxy com.google.keystone.system.xpcservice
1⤵
PID:719

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode xpchost
1⤵
PID:719

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=19"
1⤵
PID:720

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072"
1⤵
PID:721

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=488631439" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=59"
1⤵
PID:722

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=489095722" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=59"
1⤵
PID:723

/usr/libexec/xpcproxy
xpcproxy com.apple.accountsd
1⤵
PID:724

/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
1⤵
PID:724

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputMenuAgent
1⤵
PID:725

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
1⤵
PID:725

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputSwitcher
1⤵
PID:726

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
1⤵
PID:726

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:727

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:727

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
1⤵
PID:728

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:729

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:729

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
1⤵
PID:730

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=498458936" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=76"
1⤵
PID:731

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=498661514" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=76"
1⤵
PID:732

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=498726895" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=79"
1⤵
PID:733

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=498922308" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=83"
1⤵
PID:734

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=98"
1⤵
PID:735

/usr/libexec/xpcproxy
xpcproxy com.apple.accountsd
1⤵
PID:736

/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
/System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
1⤵
PID:736

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.1780
1⤵
PID:737

/System/Applications/Contacts.app/Contents/MacOS/Contacts
/System/Applications/Contacts.app/Contents/MacOS/Contacts
1⤵
PID:737

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=14" "--launch-time-ticks=505059426" --shared-files "--field-trial-handle=1718379636,r,18280503282546683875,7203910115830509750,131072" "--seatbelt-client=81"
1⤵
PID:738

/System/Applications/Podcasts.app/Contents/MacOS/Podcasts
/System/Applications/Podcasts.app/Contents/MacOS/Podcasts
1⤵
PID:739

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

Unix Shell

T1059.004

System Services

T1569

Launchctl

T1569.001

Persistence

Compromise Host Software Binary

T1554

Create or Modify System Process

T1543

Launch Daemon

T1543.004

Event Triggered Execution

T1546

Installer Packages

T1546.016

Privilege Escalation

Create or Modify System Process

T1543

Launch Daemon

T1543.004

Event Triggered Execution

T1546

Installer Packages

T1546.016

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

File and Directory Discovery

T1083

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Applications/Mixed In Key 8.app/Contents/Info.plist

Filesize
3KB

MD5
eb5ba03f7e18e66f902c3080682d4476

SHA1
f9fb20c25769bf24b717a18755d442b00f91ee9b

SHA256
25462eb1953770cb4b44669d2480c5b772a977de699caa181c408f20835790ab

SHA512
67f30b0ace358bf41322235c10262f44324f2b8e11b50702ff95afd52c39934edfcc16d7009332dd60cdfb4a416b1a375474637acfd58f319bc08cd987408dc5

Download Submit
/Applications/Mixed In Key 8.app/Contents/MacOS/Mixed In Key 8

Filesize
1.9MB

MD5
78349859202df2b3fe03dfcdddfe1f33

SHA1
4d5d157abe44202b396305a9aa0c1a5f8e64b4c1

SHA256
6a7c5843439123fbec749b43782634210f96a5f83d2b331eae7e109a0c070c6f

SHA512
94acd83181cd567028f5734d5fd584709df15ae1f6ee27b5e2e28003054b24dabe4c1c2fd956360ddd209118e80583737120507b5a8f7a6eba496a680709d1d9

Download Submit
/Applications/Mixed In Key 8.app/Contents/Resources/English.lproj/InfoPlist.strings

Filesize
552B

MD5
ade267dd9251c015a8ba6e64e884996c

SHA1
ad0cffe5fd769674c8f17df298b73fcf004b0846

SHA256
dc821dbcc2e81b74bb7995a8ee2b9e791971b292684418f4f5b0121789d4d7b1

SHA512
1a1be590f8d7a63dd9c1c603fef33426a0c4906a5529f00d8431dbc27f71f596734851182635c92b544c5baf7a5474951a33fa3c98d9629410a40a2971f32ae4

Download Submit
/Library/AppQuest/com.apple.questd

Filesize
85KB

MD5
322f4fb8f257a2e651b128c41df92b1d

SHA1
efbb681a61967e6f5a811f8649ec26efe16f50ae

SHA256
5a024ffabefa6082031dccdb1e74a7fec9f60f257cd0b1ab0f698ba2a5baca6b

SHA512
33c8cf815e4b37a3481c0ba4dfb14a4735a46575f6f70d5b351a8595e4ec8886224577c89c80d726f2e3d7cf2460d0cdd983379acb5fda0a9b7310f86c988e53

Download Submit
/Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/50A8793C-CE4F-467A-A9C2-7A0D85D6040A.activeSandbox/Boms/com.apple.pkg.IncompatibleAppList.10_15.16U1923.bom

Filesize
61KB

MD5
2f0f49de9ad6128f83b55002ddc0c733

SHA1
348b668dd78199b508fa73253568f3024a03410f

SHA256
4bde0dc120c8239b758f62e655e23be5f09b41f32f666bffa05e0104e8109d46

SHA512
6ed163e207886dd7661e67944197ef84c663eb129ca8c988d2fade90fa7e626b581627165521b3e9a8be77c04c12936ac40e1311750c2ad0aae4f6707910a4aa

Download Submit
/Library/InstallerSandboxes/.PKInstallSandboxManager/891F6843-C1DB-42F6-ABC4-82D3BF0F75FC.activeSandbox/Boms/com.mixedinkey.installer.bom

Filesize
99KB

MD5
0f07cb15d467adba0a80120ef583d92c

SHA1
9a66033fcbbd2c4a4ad82d173b7d686febcd7509

SHA256
977d7b35b060620e979cd8337ef0e4972afc08388986354b7a6b57763d0450d4

SHA512
e681f21eb24279dd9bf4f9c9f339f075e6e948d497fb42c4bf614425c4c62bae8fb9e71d9efc61a50f3d6957c211aaebbc20d36836a0d212d96950c252f93561

Download Submit
/Library/InstallerSandboxes/.PKInstallSandboxManager/891F6843-C1DB-42F6-ABC4-82D3BF0F75FC.activeSandbox/Scripts/com.mixedinkey.installer.Yy1SKI//Scripts/._postinstall__

Filesize
82B

MD5
5f57248f8a15969f55f716d8e7ce1447

SHA1
2daf28e0b224464534eecc6576c5b87e05cad4a7

SHA256
03ee1b034d79af0d5bc807f1560e7ffd5554ff56fcf29a47b3ac5db4f7fa4eb5

SHA512
2d9a3e97a5b991d9d22ef5e008f1828b9a7f8b8aa35111250edf45f9ed3f772378119f2a8c18cf5d1141f34d0b04200eadc7b75f1aaa57e0c15083c28f73c5c7

Download Submit
/Library/LaunchDaemons/com.apple.questd.plist

Filesize
435B

MD5
a3d34532a7dd2cd1d73cea75deb0677f

SHA1
3019d1c50907fb2597121c03619990c5670ff6f4

SHA256
779a31e4de99f9de28de8bf064c504382e050c114e2e865cc1f694c7e6339735

SHA512
52618a5f14247c909a3857b122a124d0ddd00890c128cf041976182423b3d728cab11daf5b6a1adb6845d062b54083e72380184b6f76369482305c2782bedd91

Download Submit
/Users/run/.CFUserTextEncoding

Filesize
314B

MD5
8dddd2eccec0319403f085aead8a28a6

SHA1
257c763a4614b52ed900646aee04fb5bf4317203

SHA256
9c99e853005363ef20f2a97895e42fa09e29ae7902aebcdf6ebb795cfdd94f88

SHA512
c68f6a16eba3e091319b5ed6356cccee1c75d3e77204d7fa77e0f055ebba04ef36a83ac96eba6c3d02b2a0bb773f4a1976f99453d24147288c9844df818ba443

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat

Filesize
40B

MD5
fcb4024c6dc53a5b72c492fd960762d7

SHA1
82c43024d9e274bf2b8a5d1e505d65cf3873fb92

SHA256
5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6

SHA512
5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb

Filesize
339B

MD5
61a867b6e4a24cfcfd32ddef25ac3229

SHA1
87cc4516fbce1700174d8ea27c9d2cb70a60a1fd

SHA256
9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5

SHA512
3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb

Filesize
569B

MD5
b5db1f091948de93d7fc96e14aef6da3

SHA1
74745f991e3dfe45037366e55c2e6df47d8e6593

SHA256
b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e

SHA512
d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb

Filesize
269B

MD5
6487e04972ecffd0aabf7b61bdda8119

SHA1
26f0b11a2529a35f6970a914deadfcf2e2d23286

SHA256
241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172

SHA512
44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb

Filesize
136B

MD5
fe382e791274914bee5950777e4f1fd3

SHA1
53b523b5fc87e66f2520a0b5f9ea080072668f4d

SHA256
935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132

SHA512
a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb

Filesize
2KB

MD5
e0f65ad85a40a32fa91e551005e193ce

SHA1
a145766d5df23ae5fcd23dbb6937606f280f3502

SHA256
18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8

SHA512
bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb

Filesize
288B

MD5
b47a44bdd1b765b6af56b347447fd1b7

SHA1
8599a1870656af91e432bb35e3497863e34ddfbb

SHA256
79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06

SHA512
bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0

Download Submit
/Users/run/Library/Containers/com.apple.Maps/Data/Library/Maps/GeoBookmarks.plist

Filesize
88B

MD5
44d48b8856347f58f97ffd5efbf6fb52

SHA1
749ac5298ea842c613f3748abe9e488bfdf4b382

SHA256
cd3a65a738c66abb558545cea94329fd7d882f1f4877cea4a5af32d024dbbce3

SHA512
974fc97ed31ccbc19dc976128a41f1fa032e353fdb8cf1e9b7b7f07134c022e01451f7ceb07f91b0ac4b6d97bc320224a2edd471d3e44f5ab5359f41584a8a50

Download Submit
/Users/run/Library/Containers/com.apple.Maps/Data/Library/Maps/GeoHistory.mapsdata

Filesize
84B

MD5
e32332952b2ccee296093224aea5acf9

SHA1
c0418197668954a7baa345478971e86b9ae132b0

SHA256
3c247e22168f7bd24cff896e8b9200d3c4f3229d4a15f5353c4c61483dabfd52

SHA512
089266dd43d52eef5fc38f15e217b3c9d7dae317757cbbfee9d0f21fb2264753de8c9b9c55736113d8e2a560c7d29a9d8ce5f13af742af380d4ccd717a04f5ec

Download Submit
/Users/run/Library/Google/GoogleSoftwareUpdate/Crashes/settings.dat

Filesize
40B

MD5
a30a3013aaafaa0d534dd31655d3c741

SHA1
5afd87ea28558f6970f1c17d5305f640ec649b06

SHA256
3c3b1523ecf2d67b99ab0d14ab60ff783c4a5fafa5cd8b9facba8ad7356a4a21

SHA512
412b333c4a24672dd6592e3d6005cf522ca256e6406daca8e87c56b9e000c393ba5b022354dc78c1230fff9238f4a6b13a678b94d143bd75724ffc346df0dd62

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
104KB

MD5
2c84f1aefa060991f0d168991cfec372

SHA1
4298ee860645b0edc08aada25ec90cdeb59e673d

SHA256
7729e0b2e265aa3a71beaa5da63325a813083cbcd31d26fb8172089bbed18892

SHA512
5e35e3433c910a5da21dc8145636683e7983ed99b6492559ed9366f5967a3c8e66a0b0422acd8bf4a5071cd48c0b030a0894e64ac7127a6f3fcd1d008242581f

Download Submit
/Users/run/Library/LaunchAgents/com.apple.questd.plist

Filesize
423B

MD5
eb73619f4e724257ff0fd951883a30ae

SHA1
5032251e50b32e340d8171631a598596bad8991e

SHA256
6e56467f3f5502588094c91e2d58bbb1e43c4e8171093db14931dd41788e17d4

SHA512
ec95c395414181bc77c7a2980fbd3fe69b718aa98c878e514c3f28b738e1669488126cbdfa96e3a182afd8536b54bc1791a044fa3535d1fd3fad54dfda337b7c

Download Submit
/Users/run/Library/Preferences/com.google.Chrome.plist

Filesize
410B

MD5
eff4310ffc622456a471538f2d90bda1

SHA1
dc5adc7993188ffca61ea067500ffc8b0b1e8ddf

SHA256
3dcaa2a31d0f0330587373dede28eea088cc50c797090076160a27432155ceb4

SHA512
f8dc1480ec216d96377026ec247bd9a76b6148d617eba1c38dc1fd7226b6fa80848fef23a3e94b146e07fa8c7c63c645ff0831156de4f2aa6d5cdef3d67971ae

Download Submit
/private/var/db/receipts/com.mixedinkey.installer.plist

Filesize
258B

MD5
7c1b09c1e7c6e1d2616a8c6dba140275

SHA1
c30f1766c4229cee3de5c1b20c923137a70e254b

SHA256
1df12bfb181c827a3cdde5684d1e35fb1232bbc064863fff7633d26d63e12b9a

SHA512
cbc0ccf3da2bb8850ce58ff2901b8a4e321b52bafc1ca17c3ddf93f246099f585ebe0510b98cdfe460dec4fbf027527381ef72e8b308e286d8b6d64985d3dbae

Download Submit
/private/var/db/spindump/tailspin-trace.2024-05-23_09-12-58.tailspin

Filesize
11.8MB

MD5
daba6fc5bf6e8e3c535c4ea8edccdeda

SHA1
3446af625da0e829a8279d4afd2f8e34b0c1de4d

SHA256
2f57f1cb98e9cac4865a1d2752c2b4f5050863618668a9ce65befaa0120b8255

SHA512
fc364fe3d97350d54b540d67dfb2d43b9b8cd210cd93fee1871cf710498d8290d69b766c3dd4244bab168c65545d09cfb00f0f5b1421d8e82a8ca895b44a8790

Download Submit
/private/var/run/installd.commit.pid

Filesize
3B

MD5
7f24d240521d99071c93af3917215ef7

SHA1
a4c36ded9dbf60a5a9dceb0d0a1e3b17ac92f8cf

SHA256
1f09802c4beac758321ae8a9f94d752b0976c7d54baa6e511bba8a7374107bef

SHA512
19c7a8d2900e7eb43ad2e9cdaa64a5a574e6e039ca67897c26678e3f7b749433e3692a6c979e2b669f1ee6fa19f1fcaf8bba152805ca9c48123cfe5d1e303702

Download Submit
/private/var/run/installd.commit.pid

Filesize
3B

MD5
a9a6653e48976138166de32772b1bf40

SHA1
84582c1dbe026475319df14c19967d1dd0bf751f

SHA256
6bcaea9882504292b2f6ea37a84b215463e71ab73b824ee90ecdc10c8dde71ed

SHA512
da79b500393269c29fb78461f75af01e8108ef0bf7f9dc6635b60d271b9bd16fe1215f6f72bb8d002d0f248712606cc360a3d68b1f8eab00521b760b20fa855c

Download Submit
/tmp/PKInstallSandbox.GGB96Q/Scripts/com.mixedinkey.installer.Yy1SKI/postinstall

Filesize
190B

MD5
03fc4e3ef9bdbccd7ea68537970ce472

SHA1
7cc289badfe38c5677175fa38810e0e18c51e1d3

SHA256
abcce423690c96a06414f68090db40cbdaee12b67f90d1ca64bddbdc1d11d097

SHA512
6f089d9c977fabc18e0a599c8239200031b6eeed1fbbd2f8197bb82e7cdd8f695b220902bef49276c6b1ca8784ebc3503aba841146a4ce36b1b571703e832bf1

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/SMIncompatibleAppUpdate/CFNetworkDownload_n1hmHp.tmp

Filesize
324KB

MD5
8ac8e766276bb799857b359b3a4f2347

SHA1
075fe1052e1e6de0a38aaa7711a54e8a77bb65f8

SHA256
a0ee16e403dd8609ce56b56a111b2926b591d368b6e99a41c836beb280dcf687

SHA512
60f88aacc4d89e7a52aa30a469b430f781006fac52b320c2acd05d8f3ace9638a042fa0b0000885293cf6ee391915e7d68ffc656f4056fcb6de3b638d52a6439

Download Submit

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads