d23aab6822f83486a792afb7310912b552e050febdd0e92d3dc711a8e054c401

Resubmissions

28/06/2024, 20:23

240628-y56hzatgmj 4

28/06/2024, 20:20

240628-y4c52atfrj 4

28/06/2024, 20:18

240628-y3p37stfpp 4

28/06/2024, 20:15

240628-y1r5satflk 7

Analysis

max time kernel
150s
max time network
153s
platform
macos-10.15_amd64
resource
macos-20240611-en
resource tags

arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
28/06/2024, 20:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Unconfirmed 216521.exe
Size

5.0MB
MD5

ea35a8472f27f246fde70c4c7a16f315
SHA1

5c5e86e77757278ccb1c4fde6cfc3053828c18d4
SHA256

d23aab6822f83486a792afb7310912b552e050febdd0e92d3dc711a8e054c401
SHA512

c6cbe6749f1e556ac9fbaa8c61b55a812d7868b2be352c95771df997fb770ac798355084e41badfa4f8e1182f71e06f9fb958b3b46efcfa61d9ffea6f8c58058
SSDEEP

98304:YSMX5HblvdIWXe+q2WWmQknh+oFAZTAxidupkxk/HK0SPtet/od3ygt9:YSE7dd9e+q2WWmQch+ZZREEkdoteaZ9f

Score

4^/10

evasion

Malware Config

Signatures

Resource Forking 1 TTPs 21 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/DesktopPictures.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.desktop.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.desktop.remoteservice	Process not Found
/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/ScreenEffects.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/Unconfirmed 216521.exe\""
1⤵
PID:557

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/Unconfirmed 216521.exe\""
1⤵
PID:557

/usr/bin/sudo
sudo /bin/zsh -c "/Users/run/Unconfirmed 216521.exe"
1⤵
PID:557
- /bin/zsh
  /bin/zsh -c "/Users/run/Unconfirmed 216521.exe"
  2⤵
  PID:561
- /Users/run/Unconfirmed
  /Users/run/Unconfirmed 216521.exe
  2⤵
  PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:560

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:562

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:564

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 562
1⤵
PID:565

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:565

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:567

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:568

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:569

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:570

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreAuthentication.agent
1⤵
PID:574

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:572

/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
/System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:575

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:575

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:576

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:599

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:600

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.security.remoteservice 562
1⤵
PID:601

/System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
/System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.sysextd
1⤵
PID:602

/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.preferencepane.security.AdvertisingExtension 601
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.preferencepane.security.PrivacyAnalytics 601
1⤵
PID:604

/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/AdvertisingExtension.appex/Contents/MacOS/AdvertisingExtension
/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/AdvertisingExtension.appex/Contents/MacOS/AdvertisingExtension
1⤵
PID:603

/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/PrivacyAnalytics.appex/Contents/MacOS/PrivacyAnalytics
/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/PrivacyAnalytics.appex/Contents/MacOS/PrivacyAnalytics
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountPolicyHelper
1⤵
PID:605

/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
/System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:606

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:607

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:608

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:609

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:610

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy com.apple.ap.adprivacyd
1⤵
PID:612

/usr/libexec/adprivacyd
/usr/libexec/adprivacyd
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:613

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.security.cloudkeychainproxy3
1⤵
PID:614

/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:620

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:621

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater66017B75/OneDrive.app
1⤵
PID:622

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:624

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:626

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputMenuAgent
1⤵
PID:627

/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
/System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.TextInputSwitcher
1⤵
PID:628

/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
/System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
1⤵
PID:628

/usr/libexec/xpcproxy
xpcproxy com.apple.ncplugin.weather 329
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.iCal.CalendarNC 329
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.ncplugin.stocks 329
1⤵
PID:631

/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather
1⤵
PID:629

/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC
1⤵
PID:630

/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:632

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:637

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 637
1⤵
PID:638

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:638

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:639

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:640

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:641

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:642

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.desktopscreeneffect.desktop.remoteservice 637
1⤵
PID:644

/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/DesktopPictures.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.desktop.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.desktop.remoteservice
/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/DesktopPictures.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.desktop.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.desktop.remoteservice
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.coremedia.videodecoder 644
1⤵
PID:648

/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
/System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:649

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.desktopscreeneffect.screeneffects.remoteservice 637
1⤵
PID:650

/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/ScreenEffects.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice
/System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/ScreenEffects.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy com.google.Chrome.3056
1⤵
PID:651

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:653

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:653

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:655

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:656

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:657

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:658

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy com.apple.sandboxd
1⤵
PID:660

/usr/libexec/sandboxd
/usr/libexec/sandboxd
1⤵
PID:660

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=28"
1⤵
PID:661

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreLocationAgent
1⤵
PID:663

/System/Library/CoreServices/CoreLocationAgent.app/Contents/MacOS/CoreLocationAgent
/System/Library/CoreServices/CoreLocationAgent.app/Contents/MacOS/CoreLocationAgent
1⤵
PID:663

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=27"
1⤵
PID:662

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=28"
1⤵
PID:664

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072"
1⤵
PID:665

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:666

/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
1⤵
PID:667

/Users/run/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Users/run/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
1⤵
PID:668

/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=4"
1⤵
PID:0
- /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
  2⤵
  PID:671
- /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=4"
  2⤵
  PID:0
- - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
    3⤵
    PID:674
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.ScreenSaver.Engine.legacyScreenSaver 650
    3⤵
    PID:675
- - /System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
    /System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
    3⤵
    PID:675
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.ScreenSaver.Computer-Name 650
    3⤵
    PID:676
- - /System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name
    "/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name"
    3⤵
    PID:676
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.ScreenSaver.iLife-Slideshow-Extension 650
    3⤵
    PID:677
- - /System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
    /System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
    3⤵
    PID:677
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.MediaLibraryService 650
    3⤵
    PID:678
- - /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
    /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
    3⤵
    PID:678
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.PerformanceAnalysis.animationperfd
    3⤵
    PID:679
- - /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
    /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
    3⤵
    PID:679
- - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update-internal" --system
    3⤵
    PID:0
  - - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=5"
      4⤵
      PID:1.8446744073709552e+19
  - - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
      "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
      4⤵
      PID:685
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=373621730" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=57"
      4⤵
      PID:686
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=373675536" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=57"
      4⤵
      PID:687
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.Terminal.2100
      4⤵
      PID:688
  - - /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
      /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
      4⤵
      PID:688
    - - /usr/bin/login
        
        login -pf run
        5⤵
        
        PID:698
      - /bin/zsh
        
        -zsh
        6⤵
        
        PID:700
        
        /usr/libexec/path_helper
        
        /usr/libexec/path_helper -s
        7⤵
        
        PID:702
        
        /usr/bin/locale
        
        locale LC_CTYPE
        7⤵
        
        PID:703
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.appleseed.FeedbackAssistant.2152
      4⤵
      PID:690
  - - /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/MacOS/Feedback Assistant
      "/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/MacOS/Feedback Assistant"
      4⤵
      PID:690
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.systempreferences.2140
      4⤵
      PID:691
  - - /System/Applications/System Preferences.app/Contents/MacOS/System Preferences
      "/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
      4⤵
      PID:691
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.AccountProfileRemoteViewService 691
      4⤵
      PID:692
  - - /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
      /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
      4⤵
      PID:692
  - - /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
      /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
      4⤵
      PID:693
  - - /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
      /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
      4⤵
      PID:694
  - - /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
      /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
      4⤵
      PID:695
  - - /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
      /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
      4⤵
      PID:696
  - - /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
      /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
      4⤵
      PID:697
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.AppStore.1900
      4⤵
      PID:699
  - - /System/Applications/App Store.app/Contents/MacOS/App Store
      "/System/Applications/App Store.app/Contents/MacOS/App Store"
      4⤵
      PID:699
  - - /System/Applications/Music.app/Contents/MacOS/Music
      /System/Applications/Music.app/Contents/MacOS/Music
      4⤵
      PID:701
  - - /System/Applications/Podcasts.app/Contents/MacOS/Podcasts
      /System/Applications/Podcasts.app/Contents/MacOS/Podcasts
      4⤵
      PID:704
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.Notes.1736
      4⤵
      PID:705
  - - /System/Applications/Notes.app/Contents/MacOS/Notes
      /System/Applications/Notes.app/Contents/MacOS/Notes
      4⤵
      PID:705
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.reminders.2592
      4⤵
      PID:706
  - - /System/Applications/Reminders.app/Contents/MacOS/Reminders
      /System/Applications/Reminders.app/Contents/MacOS/Reminders
      4⤵
      PID:706
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.AddressBook.1780
      4⤵
      PID:707
  - - /System/Applications/Contacts.app/Contents/MacOS/Contacts
      /System/Applications/Contacts.app/Contents/MacOS/Contacts
      4⤵
      PID:707
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.iCal.1908
      4⤵
      PID:708
  - - /System/Applications/Calendar.app/Contents/MacOS/Calendar
      /System/Applications/Calendar.app/Contents/MacOS/Calendar
      4⤵
      PID:708
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.Photos.1876
      4⤵
      PID:709
  - - /System/Applications/Photos.app/Contents/MacOS/Photos
      /System/Applications/Photos.app/Contents/MacOS/Photos
      4⤵
      PID:709
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.Maps.1864
      4⤵
      PID:710
  - - /System/Applications/Maps.app/Contents/MacOS/Maps
      /System/Applications/Maps.app/Contents/MacOS/Maps
      4⤵
      PID:710
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.iChat.1880
      4⤵
      PID:711
  - - /System/Applications/Messages.app/Contents/MacOS/Messages
      /System/Applications/Messages.app/Contents/MacOS/Messages
      4⤵
      PID:711
  - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
      /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
      4⤵
      PID:713
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.audio.AudioComponentRegistrar
      4⤵
      PID:714
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.mail.2576
      4⤵
      PID:715
  - - /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
      /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
      4⤵
      PID:714
  - - /System/Applications/Mail.app/Contents/MacOS/Mail
      /System/Applications/Mail.app/Contents/MacOS/Mail
      4⤵
      PID:715
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.SafariLaunchAgent
      4⤵
      PID:716
  - - /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
      /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
      4⤵
      PID:716
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.Safari.2028
      4⤵
      PID:717
  - - /Applications/Safari.app/Contents/MacOS/Safari
      /Applications/Safari.app/Contents/MacOS/Safari
      4⤵
      PID:717
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.mediaremoted
      4⤵
      PID:718
  - - /System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
      /System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
      4⤵
      PID:718
  - - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
      "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
      4⤵
      PID:720
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.FaceTime.1860
      4⤵
      PID:721
  - - /System/Applications/FaceTime.app/Contents/MacOS/FaceTime
      /System/Applications/FaceTime.app/Contents/MacOS/FaceTime
      4⤵
      PID:721
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=388944164" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=68"
      4⤵
      PID:722
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=74"
      4⤵
      PID:723
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=74"
      4⤵
      PID:724
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072"
      4⤵
      PID:725
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=15" "--launch-time-ticks=389545582" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=51"
      4⤵
      PID:726
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=390033985" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=51"
      4⤵
      PID:727
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=391016366" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=51"
      4⤵
      PID:728
  - - /usr/sbin/system_profiler
      /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
      4⤵
      PID:729
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=16" "--launch-time-ticks=394036892" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=101"
      4⤵
      PID:731
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=105"
      4⤵
      PID:734
  - - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      GoogleUpdater --server "--service=update" --system
      4⤵
      PID:1.8446744073709552e+19
  - - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=5"
      4⤵
      PID:1.8446744073709552e+19
  - - /usr/bin/profiles
      /usr/bin/profiles status -type enrollment
      4⤵
      PID:738
  - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
      "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=18" "--launch-time-ticks=403276866" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=105"
      4⤵
      PID:739
  - - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      GoogleUpdater --server "--service=update" --system
      4⤵
      PID:0
    - - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
        5⤵
        
        PID:743
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.PackageKit.InstallStatus
        5⤵
        
        PID:744
    - - /System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress
        
        "/System/Library/CoreServices/Install in Progress.app/Contents/MacOS/Install in Progress"
        5⤵
        
        PID:744
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.warmd_agent
        5⤵
        
        PID:745
    - - /usr/libexec/warmd_agent
        
        /usr/libexec/warmd_agent
        5⤵
        
        PID:745
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=107"
        5⤵
        
        PID:746
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=111"
        5⤵
        
        PID:747
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=111"
        5⤵
        
        PID:748
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=113"
        5⤵
        
        PID:749
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=111"
        5⤵
        
        PID:750
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=25" "--launch-time-ticks=423166576" --shared-files "--field-trial-handle=1718379636,r,10435313657629000864,5489479673259159993,131072" "--seatbelt-client=118"
        5⤵
        
        PID:752
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.sysmond
        5⤵
        
        PID:753
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:754
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.contacts.donation-agent
        5⤵
        
        PID:755
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.telephonyutilities.callservicesd
        5⤵
        
        PID:756
    - - /System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd
        
        /System/Library/PrivateFrameworks/TelephonyUtilities.framework/callservicesd
        5⤵
        
        PID:756
    - - /System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
        
        /System/Library/PrivateFrameworks/ContactsDonation.framework/Versions/A/Support/contactsdonationagent
        5⤵
        
        PID:755
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secd
        5⤵
        
        PID:757
    - - /usr/libexec/secd
        
        /usr/libexec/secd
        5⤵
        
        PID:757
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.adid
        5⤵
        
        PID:759
    - - /System/Library/PrivateFrameworks/CoreADI.framework/adid
        
        /System/Library/PrivateFrameworks/CoreADI.framework/adid
        5⤵
        
        PID:759
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
        5⤵
        
        PID:760
    - - /usr/libexec/neagent
        
        /usr/libexec/neagent
        5⤵
        
        PID:760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist

Filesize
676B

MD5
8dcea5de781edc6a13b932ca42a4d64e

SHA1
505527acbac5b4956ea45df6ab2cdcca93734fc3

SHA256
87631ad995533029ab8f66a447f477525c8dd283aa653b986b4a8018dd565bfd

SHA512
bc5f617ef606b1f1d01032e8245214e427901ab3fd26b1d5ed4a6e1317f242a5fa5a547b5bb1632d4180b4f8defee068045d7ab03a2605d5cd944f836f49efb2

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat

Filesize
40B

MD5
fcb4024c6dc53a5b72c492fd960762d7

SHA1
82c43024d9e274bf2b8a5d1e505d65cf3873fb92

SHA256
5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6

SHA512
5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_0/craw_background.js

Filesize
531KB

MD5
6eebed29e6a6301e92a9b8b347807f5f

SHA1
65dfb69b650560551110b33dcba50b25e5b876de

SHA256
04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697

SHA512
fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb

Filesize
339B

MD5
61a867b6e4a24cfcfd32ddef25ac3229

SHA1
87cc4516fbce1700174d8ea27c9d2cb70a60a1fd

SHA256
9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5

SHA512
3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb

Filesize
569B

MD5
b5db1f091948de93d7fc96e14aef6da3

SHA1
74745f991e3dfe45037366e55c2e6df47d8e6593

SHA256
b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e

SHA512
d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000004.log

Filesize
93B

MD5
4c7e2f1b3d93256b7bb208a5c17e8c63

SHA1
c392aa19102b81e2150ebcf58439a047e77f50fc

SHA256
5f4c74b46ce015bbc812990e833365eb10df3b9adbec07744c96ebe0152e7da7

SHA512
3ec47ebc6f1f7695cd04c7850003ae4594fe8c9a40ecbacead575adf6249abe8d69c0f61efd3368d87215ed042917e3168d0dfa2c391578e9a88b89d4a8114b7

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000006.ldb

Filesize
184B

MD5
8c31d0507f99d366b9f50381ac4793be

SHA1
a9a90b975c6e6ed9fe163e761f26332057d24b0a

SHA256
fc35c2a6fe961540680e7d57cae743ad291c1fef4145cd446d7f6d5b2ec393a9

SHA512
3907375a309decf02d29c683c44551e86aefefd352c58ad4e854d50e92cc14185545d35d57c7112031057342f7c3f20205aa7ccc5a7fc2822f2c111da35675d9

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/MANIFEST-000002

Filesize
91B

MD5
caffe487e2ca111f47112388105ee18a

SHA1
c88f52fb15a98d3e15a4cab36cd19d5675b87a23

SHA256
f29cd2b8688f3c3a234b3ad3ae085c204eb2c82304c6e74201e445fc616ca933

SHA512
04c51b39d7e92da8f8ff213668338a697dd343605224f5b9eb5b4151d8340c747121d96d3574008ecc26ccfef79b76cb5fa181ded60976dfe6f9005df182c68d

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb

Filesize
269B

MD5
6487e04972ecffd0aabf7b61bdda8119

SHA1
26f0b11a2529a35f6970a914deadfcf2e2d23286

SHA256
241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172

SHA512
44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Storage/ext/gfdkimpbcpahaombhbimeihdjnejgicl/def/Session Storage/000003.ldb

Filesize
141B

MD5
38fc535a8f11d7e955ef58cc63158eff

SHA1
c45ad3ee106dbfb65dce7c09b53140f34454cd0e

SHA256
085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8

SHA512
26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb

Filesize
136B

MD5
fe382e791274914bee5950777e4f1fd3

SHA1
53b523b5fc87e66f2520a0b5f9ea080072668f4d

SHA256
935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132

SHA512
a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb

Filesize
2KB

MD5
e0f65ad85a40a32fa91e551005e193ce

SHA1
a145766d5df23ae5fcd23dbb6937606f280f3502

SHA256
18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8

SHA512
bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb

Filesize
288B

MD5
b47a44bdd1b765b6af56b347447fd1b7

SHA1
8599a1870656af91e432bb35e3497863e34ddfbb

SHA256
79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06

SHA512
bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.32.0/Ruleset Data

Filesize
138KB

MD5
132df2b999906be7b21cc21bc247b068

SHA1
0665be201a96e717410a4e61a263bb879b3f08d4

SHA256
fed1557c8b4e40813114db3b546c043105892dd0895c4d7c02d45a8be351173a

SHA512
6764c8a425cd010a67a4636f812d43e63bb0815943e9839cf9fa35f3e5f9ba52309ed842306dcffe32a72e7019cb0c28e1d402dfc22dca0603a0cd48d6a26451

Download Submit
/Users/run/Library/Caches/Google/Chrome/Default/Cache/Cache_Data/index-dir/the-real-index

Filesize
48B

MD5
cb162c5b2db109c9577707dfe4e88b92

SHA1
14af7456e4b5b6587e421af2c219d3ca89286e11

SHA256
519d4ee1d916d82abd2be6c70066659c2be8563685dedba6d8ac0a2a6fee6739

SHA512
8eea6d65aec370c31784dee6ea73baa365aa2ef2664030d0a5dc604fccc476d635cf39c6b729fa15809a3fce600226114e520f338654b6639c61e602380b7ef0

Download Submit
/Users/run/Library/Caches/com.apple.systempreferences.imageCache

Filesize
294KB

MD5
5f47dc95a18b6db34bd821de47a7eb39

SHA1
193ab5169b52c7bddb3272451093155218af893c

SHA256
e1a326043213eb82abffaa3197a1a8379908682740d20f0c85f235eaf6768057

SHA512
715d844eb2474f4a83d321cd9922c1bb664ad10c5fbb6a7959582f771e055295a4d2037abd82282f0d8d9c8d35cbac0e815475e6c9488a9ad208d5344aacf138

Download Submit
/Users/run/Library/Caches/com.apple.systempreferences.imageCache

Filesize
288KB

MD5
ce9032fc27dc24f38c40c4116b2aec09

SHA1
617bf0e6e5838af3740393cedbf38307b7248371

SHA256
7bff5dd79349e4e42419a9f1720119cc19767df0ec1bedd6fada6a28a8be3749

SHA512
a1883e330fd3483da59388e16da1f392af2174170700093f213a1b218f3d04ae9b1d3f6d3bc9ebeb69324440de414f7a92b92739e98e5880f3b7b078b9676af1

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
106KB

MD5
6bba9d0f6807eecb8b34fa155b53d7f4

SHA1
71c3331b67d8e3d97acfe293793e2623d4242803

SHA256
9a128b3e7ccb8866018b21fd9d4ce2156c54b1dfc203e8bb01bafd995e6fadd9

SHA512
8879ab0e26bf260cdcb50bd0bf927b67d278d5d3497e91a9e539b7d04382e64857550097409782a69cf364e0266d666fbf04df45c54116e7c5034e33a66364e1

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
106KB

MD5
b86f6dd36cfd9987edb820c21e4a0868

SHA1
0dbf7da14a21199a405e63169ccfa62e9bf5ad41

SHA256
fc9e52660586282f159d7d2e2c73cacc3f7201d0648d31dbcdb851f78e8a69dc

SHA512
ae9a021fbc4909ffdc9240f957dded1aae2bafc52aa2fb235a3f1d110512e4d6cb2c82285ebabc514dcd92dd003e7f7ea0387dca37adcde42d30fa8de742ae57

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
104KB

MD5
6973211a00fb0f0c8c1cbac9222a6667

SHA1
d8dc78bc6ddac9ddc9b1a305fd0476c9f61d4a01

SHA256
98f0fc7122e2c835ff8ac0cf04e388e9e370a25786f44ab17e67d3d76fc31474

SHA512
e58a86c0051041d00c4e0d6341bfd9c4cfc9b2aace2589d67440d8b2cacf5d2b1a88b8d822cb293b6e3aa8adb94a6d3136a0dd774f8df10e416c6c8e87e00ab0

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
106KB

MD5
bf837ecdcd7197f15010fe03394fbdd9

SHA1
b22b1a7dd2d409e152e3048428990b4da66c1af5

SHA256
3af4ed0e3df139b675055a91c77debb812dfcbf705a02f8800c51e5e06c031d3

SHA512
4a66e04731e23afb396ef427e1685edbd844a175c865dea8cce238f42b17c200a3bdd6eeb920e67543efe3ae7967b5f6854e5818e7169379343bcea0b06a3e8c

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
106KB

MD5
1118d08ef5e11d09860899582a68fafa

SHA1
1a25a90360d22d9f034fff43e8e62ebd931ba865

SHA256
a7d2d8c8ffe5d0eb48fb19d34cc6bcd5248d983c096554914924a5080430bd35

SHA512
71f55ddcc5a6a12e4f6739bbd0b6f675cdf5d42e7f0c3214693dc6e295578e89343493f1c97ee331101aba219da3859f32eb153183d1c27fe9239f1a42a2a5c9

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
104KB

MD5
fd175297488fb6e188cb08082d588ab8

SHA1
d6f03f48aa33488b8073e6d1aba6557ddec5005d

SHA256
5786c953999fe11a1af510a252dcd577a82a3a271aeb9c0d0d8a52d52f55bef6

SHA512
72409fee4f9742c7b7b0edbc20396bbbbb75d1d5b3890bcb6339bc129acc639a44efaf3b50d9326e1ab20bda1f2898377e205c157f8e7c4fa0609e18cb59ac9f

Download Submit
/Users/run/Library/Saved Application State/com.apple.appleseed.feedbackassistant.savedState/data.data

Filesize
2KB

MD5
3eb62a23f322e7f7d542a34230b3f503

SHA1
cb875e2d8bb17ad825990955c651fbb4c4fb131e

SHA256
566fcc2bb1b94966bd66f63ba5409dd91f05dbba5994863cd258d0282dfed7a4

SHA512
08331893e122a94f56ce91749043d50ac24f4bc4ef83785a72b74b06059437f99df6efa6d38b4ccf8ede0a68cfc8e556b9c934508c4eea0e29bef7aa7154b357

Download Submit
/Users/run/Library/Saved Application State/com.apple.systempreferences.savedState/data.data

Filesize
2KB

MD5
0bd05d6a2dad3b4480867922e8f1e73b

SHA1
a2307dea5ce424024f3bc22c905b3c75bc7493ec

SHA256
a4c5b6426e298865381a7edd76213db6e5c39bef10d002695cd445822fe7e0d5

SHA512
aa0030baccbbe2b913210f99cc4d5de1aa3c3f731312aca0fa9ec9074301ff2c14c32c8337e1eb8a6446e4f711da74028ee64b4c828fd00cff4253797291fa81

Download Submit
/Users/run/Library/Saved Application State/com.apple.terminal.savedState/data.data

Filesize
121KB

MD5
8437493edc66e09a105038d060929ee9

SHA1
0edf40fc2b56e55fd0d2c6ce5332c04bec9b31de

SHA256
c3daa1cfab2aa3572f2b9008b00ac4756dd944ae5cc60e2013188bbcc0970879

SHA512
7d43788b6f7afbfe44b2f83e86e5f782c390dffcf03730edca29a91154a1ce3a32eb8a3c1f0cc2e2d64922aa712f59281c9ea3517f418902c48de8597e36800f

Download Submit
/Users/run/Library/Saved Application State/com.google.chrome.savedState/data.data

Filesize
1KB

MD5
5b41ba446122eebb6b89d9c07e48102c

SHA1
2a4f0db3a5df23d820bdc25f2f2be7f78af8e1d2

SHA256
4c34ba29f0e8d15afbd428de3df315414b071329e16f293382e8f15352ca68c3

SHA512
6f7cf4f33a5e7f488894bd3a54755bea71f231f03a76db265e0e07cabd926b82e067cd8071a1cfd588045b3efb30afec60fb6292b894618f0fe168983918f7eb

Download Submit
/private/var/db/spindump/tailspin-trace.2024-06-28_20-20-40.tailspin

Filesize
17.7MB

MD5
15be3afc12cb048948f7fe480bbdab7b

SHA1
0a025a0228e2f78c3ebcbd3875a0b2ab755197ec

SHA256
d2754fa54de400112a695986b60cf5aa64ce8346d56d4eb50c7f70e0e8123818

SHA512
57b73da200dfb328f5e5575140736e3a8ae3ca696bc8a5f473a24876ca17b5c25ee5e8c4a1d343b6209b616dabc1d592ba26b1aff3e0de9e610027cb8b3c8613

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirt2WyXt/CRX_INSTALL/images/icon_128.png

Filesize
3KB

MD5
30899b6c4e4a757b8ec6dd2208acdfb4

SHA1
f2c5880a724c6d75cce1b5191e0d82c3bc7de768

SHA256
4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4

SHA512
58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirt2WyXt/CRX_INSTALL/images/icon_16.png

Filesize
531B

MD5
344554d96e418120bd80ef5de5194697

SHA1
23e141c3a6ce368acc1c299f062ab85914bcb17e

SHA256
0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378

SHA512
7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e

Download Submit
/tmp/ssl-key.log

Filesize
4KB

MD5
cd62711cd6a71913e2a56e352e2ab212

SHA1
e1a78a616f8fa1e6b80ce5afe86b1b9bdf834236

SHA256
b0bbe053d50c72b497ace3e40ced3e352735c227d16bd9a5ad3752f2db036630

SHA512
746f56ba8b2cc84c6c2e240261891eefdc4641aea00b6fb1d38735b0b73a73a47a56502db06adc1c9971ebf652938c79ccd14ba86668bbb019bf4d6495501595

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.61Gv9O

Filesize
242KB

MD5
541f52e24fe1ef9f8e12377a6ccae0c0

SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6

SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

Download Submit