29dc64e0ada4c711d0452801d3364b2f44cf4bd52337547aaa2f40744da97cd1

Resubmissions

29/06/2024, 07:53

240629-jrbzwatdqe 10

29/06/2024, 07:51

29/06/2024, 07:48

29/06/2024, 07:37

29/06/2024, 07:36

29/06/2024, 07:34

29/06/2024, 07:33

29/06/2024, 07:29

Analysis

max time kernel
905s
max time network
982s
platform
macos-10.15_amd64
resource
macos-20240611-en
resource tags

arch:amd64arch:i386image:macos-20240611-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29/06/2024, 07:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

The-MALWARE-Repo
Size

284KB
MD5

1c0a02c3390b9fd77746574def84b1d1
SHA1

2e62ae7936cf5b6398308f702ddbb06427091109
SHA256

29dc64e0ada4c711d0452801d3364b2f44cf4bd52337547aaa2f40744da97cd1
SHA512

4f62bc5c219a6fa412dc06653227561b10cb32d144be733e0b2e57dea24baa17683dc09b84c57237326e6909e27f42ea7e1f70032eeff455d12423364bc433a2
SSDEEP

6144:ibRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvZJT3CqbMrhryfQNRPaCieMjAkvCJv1VZ:qRoQ02n9dH5M2vkm0y3Cl3pId9Rj9vvC

Score

8^/10

discovery evasion

Malware Config

Signatures

Path Permission 1 TTPs
Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
evasion

Linux and Mac File and Directory Permissions Modification
T1222.002
Gatekeeper Bypass 1 TTPs
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
evasion

Gatekeeper Bypass
T1553.001
File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
evasion

File Deletion
T1070.004

File and Directory Discovery. 1 TTPs 3 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
basename "/Volumes/Google Chrome/.keystone_install"	Process not Found
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName	Process not Found
dirname "/Library/Google/Google Chrome Brand.plist"	Process not Found

Resource Forking 1 TTPs 21 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid EAE31DB6-FDBB-4631-8756-122F13F3E921	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 88A50077-BE02-401F-BB98-31AC9E58FFE0 -post-exec 4	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid EAE31DB6-FDBB-4631-8756-122F13F3E921 -post-exec 4	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 88A50077-BE02-401F-BB98-31AC9E58FFE0	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/The-MALWARE-Repo\""
1⤵
PID:557

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/The-MALWARE-Repo\""
1⤵
PID:557

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/The-MALWARE-Repo
1⤵
PID:557
- /bin/zsh
  /bin/zsh -c /Users/run/The-MALWARE-Repo
  2⤵
  PID:559
- /Users/run/The-MALWARE-Repo
  /Users/run/The-MALWARE-Repo
  2⤵
  PID:559
- /bin/sh
  sh /Users/run/The-MALWARE-Repo
  2⤵
  PID:559
- /bin/bash
  sh /Users/run/The-MALWARE-Repo
  2⤵
  PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:558

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:565

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.google.Chrome.3056
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:569

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:569

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:570

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:570

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:571

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:572

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:572

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:576

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:576

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:577

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:579

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:580

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:581

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:583

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy com.apple.CoreLocationAgent
1⤵
PID:585

/System/Library/CoreServices/CoreLocationAgent.app/Contents/MacOS/CoreLocationAgent
/System/Library/CoreServices/CoreLocationAgent.app/Contents/MacOS/CoreLocationAgent
1⤵
PID:585

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:586

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:587

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:587

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=15"
1⤵
PID:584

/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
1⤵
PID:589

/Users/run/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Users/run/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
1⤵
PID:590

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=15"
1⤵
PID:588

/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=4"
1⤵
PID:0
- /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
  2⤵
  PID:593
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=26"
  2⤵
  PID:594
- /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=4"
  2⤵
  PID:0
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072"
    3⤵
    PID:597
- - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
    3⤵
    PID:598
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=297247179" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=56"
    3⤵
    PID:599
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=297328390" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=56"
    3⤵
    PID:600
- - /usr/bin/pluginkit
    /usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
    3⤵
    PID:601
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.TextInputMenuAgent
    3⤵
    PID:602
- - /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
    /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
    3⤵
    PID:602
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.TextInputSwitcher
    3⤵
    PID:603
- - /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
    /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
    3⤵
    PID:603
- - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
    3⤵
    PID:605
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.SafariLaunchAgent
    3⤵
    PID:606
- - /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    3⤵
    PID:606
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:608
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=302826388" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=71"
    3⤵
    PID:609
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=303349518" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=75"
    3⤵
    PID:610
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=303445547" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=75"
    3⤵
    PID:611
- - /usr/sbin/spctl
    /usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater66017B75/OneDrive.app
    3⤵
    PID:613
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=304369486" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=84"
    3⤵
    PID:614
- - /usr/sbin/system_profiler
    /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
    3⤵
    PID:615
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=83"
    3⤵
    PID:618
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=14" "--launch-time-ticks=314225471" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=104"
    3⤵
    PID:619
- - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update-internal" --system
    3⤵
    PID:1.8446744073709552e+19
- - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=5"
    3⤵
    PID:1.8446744073709552e+19
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:623
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=15" "--launch-time-ticks=317050124" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=104"
    3⤵
    PID:625
- - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update" --system
    3⤵
    PID:0
  - - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=5"
      4⤵
      PID:1.8446744073709552e+19
  - - /usr/bin/profiles
      /usr/bin/profiles status -type enrollment
      4⤵
      PID:629
  - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
      /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
      4⤵
      PID:630
  - - /usr/libexec/xpcproxy
      xpcproxy com.apple.bsd.dirhelper
      4⤵
      PID:650
  - - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      GoogleUpdater --server "--service=update" --system
      4⤵
      PID:0
    - - /Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/127.0.6490.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=127.0.6490.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportCrash
        5⤵
        
        PID:654
    - - /System/Library/CoreServices/ReportCrash
        
        /System/Library/CoreServices/ReportCrash agent
        5⤵
        
        PID:654
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        5⤵
        
        PID:656
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.cloudkeychainproxy3
        5⤵
        
        PID:657
    - - /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
        
        /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
        5⤵
        
        PID:657
    - - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        5⤵
        
        PID:656
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:659
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=71"
        5⤵
        
        PID:660
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=113"
        5⤵
        
        PID:661
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=112"
        5⤵
        
        PID:662
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=112"
        5⤵
        
        PID:663
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=22" "--launch-time-ticks=330351564" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=119"
        5⤵
        
        PID:664
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportCrash.Root
        5⤵
        
        PID:665
    - - /System/Library/CoreServices/ReportCrash
        
        /System/Library/CoreServices/ReportCrash daemon
        5⤵
        
        PID:665
    - - /bin/sh
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:668
    - - /bin/bash
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:668
    - - /usr/sbin/kextstat
        
        /usr/sbin/kextstat
        5⤵
        
        PID:668
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=118"
        5⤵
        
        PID:669
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=118"
        5⤵
        
        PID:670
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=121"
        5⤵
        
        PID:671
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=122"
        5⤵
        
        PID:672
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=122"
        5⤵
        
        PID:673
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=123"
        5⤵
        
        PID:674
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:675
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:677
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:680
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:683
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:688
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:690
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:691
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.geod
        5⤵
        
        PID:693
    - - /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        
        /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        5⤵
        
        PID:693
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.geod
        5⤵
        
        PID:696
    - - /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        
        /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        5⤵
        
        PID:696
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secinitd
        5⤵
        
        PID:698
    - - /usr/libexec/secinitd
        
        /usr/libexec/secinitd
        5⤵
        
        PID:698
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=56"
        5⤵
        
        PID:700
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AddressBook.ContactsAccountsService
        5⤵
        
        PID:701
    - - /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
        
        /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
        5⤵
        
        PID:701
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.routined
        5⤵
        
        PID:702
    - - /usr/libexec/routined
        
        /usr/libexec/routined LAUNCHED_BY_LAUNCHD
        5⤵
        
        PID:702
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Maps.mapspushd
        5⤵
        
        PID:703
    - - /System/Library/CoreServices/mapspushd
        
        /System/Library/CoreServices/mapspushd
        5⤵
        
        PID:703
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
        5⤵
        
        PID:704
    - - /usr/libexec/neagent
        
        /usr/libexec/neagent
        5⤵
        
        PID:704
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:705
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=124"
        5⤵
        
        PID:707
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=124"
        5⤵
        
        PID:708
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=124"
        5⤵
        
        PID:709
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil attach /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.EmKpI9/GoogleChrome-126.0.6478.127.dmg -plist -nobrowse -readonly
        5⤵
        
        PID:711
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid EAE31DB6-FDBB-4631-8756-122F13F3E921
        5⤵
        
        PID:712
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid EAE31DB6-FDBB-4631-8756-122F13F3E921 -post-exec 4
        5⤵
        
        PID:713
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
        5⤵
        
        PID:714
    - - /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        
        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        5⤵
        
        PID:714
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:716
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly
        5⤵
        
        PID:717
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2
        5⤵
        
        PID:718
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2
        5⤵
        
        PID:719
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly
        5⤵
        
        PID:720
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2
        5⤵
        
        PID:721
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2
        5⤵
        
        PID:722
    - - /sbin/mount
        
        /sbin/mount -t hfs -o "-u=99,-g=99,-m=755,nodev,noowners,nosuid,rdonly,nobrowse" /dev/disk4s2 "/Volumes/Google Chrome"
        5⤵
        
        PID:723
      - /sbin/mount_hfs
        
        /sbin/mount_hfs -u 99 -g 99 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o nobrowse /dev/disk4s2 "/Volumes/Google Chrome"
        6⤵
        
        PID:724
    - - /Volumes/Google Chrome/.keystone_install
        
        "/Volumes/Google Chrome/.keystone_install" "/Volumes/Google Chrome" "/Applications/Google Chrome.app" 101.0.4951.54
        5⤵
        
        PID:726
      - /usr/bin/basename
        
        basename "/Volumes/Google Chrome/.keystone_install"
        6⤵
        
        PID:727
      - /bin/mkdir
        
        mkdir -p "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions"
        6⤵
        
        PID:742
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-before "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/126.0.6478.127/" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/126.0.6478.127"
        6⤵
        
        PID:743
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/Volumes/Google Chrome/Google Chrome.app/" "/Applications/Google Chrome.app"
        6⤵
        
        PID:748
      - /bin/rm
        
        rm -f "/Applications/Google Chrome.app/.want_full_installer"
        6⤵
        
        PID:751
      - /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
        
        /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"
        6⤵
        
        PID:762
      - /usr/bin/dirname
        
        dirname "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:765
      - /bin/mkdir
        
        mkdir -p /Library/Google
        6⤵
        
        PID:766
      - /usr/bin/defaults
        
        defaults write "/Library/Google/Google Chrome Brand" KSBrandID -string GGRO
        6⤵
        
        PID:767
      - /usr/sbin/chown
        
        chown root:wheel "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:768
      - /bin/chmod
        
        chmod 644 "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:769
      - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        ksadmin --register --productid com.google.Chrome --version 126.0.6478.127 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion
        6⤵
        
        PID:774
      - /bin/rm
        
        rm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"
        6⤵
        
        PID:782
      - /usr/sbin/chown
        
        chown -Rh root:wheel "/Applications/Google Chrome.app"
        6⤵
        
        PID:783
      - /bin/chmod
        
        chmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"
        6⤵
        
        PID:784
      - /usr/bin/find
        
        find "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +
        6⤵
        
        PID:785
        
        /bin/chmod
        
        chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/126.0.6478.127/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
        7⤵
        
        PID:786
      - /usr/bin/xattr
        
        xattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"
        6⤵
        
        PID:787
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4323064843329169489,6906355692608358880,131072" "--seatbelt-client=65"
        5⤵
        
        PID:747
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.assistantd
        5⤵
        
        PID:791
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:792
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:792
    - - /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
        
        /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
        5⤵
        
        PID:791
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil detach "/Volumes/Google Chrome" -force
        5⤵
        
        PID:793
    - - /sbin/umount
        
        /sbin/umount -f "/Volumes/Google Chrome"
        5⤵
        
        PID:794
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.DiskUnmountWatcher
        5⤵
        
        PID:795
    - - /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        
        /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        5⤵
        
        PID:795
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil attach /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.P9MYSz/GoogleUpdater-128.0.6537.0.dmg -plist -nobrowse -readonly
        5⤵
        
        PID:798
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 88A50077-BE02-401F-BB98-31AC9E58FFE0
        5⤵
        
        PID:799
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 88A50077-BE02-401F-BB98-31AC9E58FFE0 -post-exec 4
        5⤵
        
        PID:800
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly
        5⤵
        
        PID:801
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2
        5⤵
        
        PID:802
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2
        5⤵
        
        PID:803
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly
        5⤵
        
        PID:804
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2
        5⤵
        
        PID:805
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2
        5⤵
        
        PID:806
    - - /sbin/mount
        
        /sbin/mount -t hfs -o "-u=99,-g=99,-m=755,nodev,noowners,nosuid,rdonly,nobrowse" /dev/disk4s2 /Volumes/GoogleUpdater
        5⤵
        
        PID:807
      - /sbin/mount_hfs
        
        /sbin/mount_hfs -u 99 -g 99 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o nobrowse /dev/disk4s2 /Volumes/GoogleUpdater
        6⤵
        
        PID:808
    - - /Volumes/GoogleUpdater/.keystone_install
        
        /Volumes/GoogleUpdater/.keystone_install /Volumes/GoogleUpdater 127.0.6490.0
        5⤵
        
        PID:809
      - /usr/bin/env
        
        env
        6⤵
        
        PID:810
      - /Volumes/GoogleUpdater/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        /Volumes/GoogleUpdater/GoogleUpdater.app/Contents/MacOS/GoogleUpdater --update --system --enable-logging "--vmodule=*/chrome/updater/*=2"
        6⤵
        
        PID:811
    - - /Volumes/GoogleUpdater/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        /Volumes/GoogleUpdater/GoogleUpdater.app/Contents/MacOS/GoogleUpdater --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6537.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6537.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil detach /Volumes/GoogleUpdater -force
        5⤵
        
        PID:814
    - - /sbin/umount
        
        /sbin/umount -f /Volumes/GoogleUpdater
        5⤵
        
        PID:815
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.pbs
        5⤵
        
        PID:834
    - - /System/Library/CoreServices/pbs
        
        /System/Library/CoreServices/pbs
        5⤵
        
        PID:834
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ViewBridgeAuxiliary
        5⤵
        
        PID:835
    - - /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        
        /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        5⤵
        
        PID:835
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:836
    - - /usr/libexec/mobileassetd
        
        /usr/libexec/mobileassetd
        5⤵
        
        PID:836
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
        5⤵
        
        PID:848
    - - /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        
        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        5⤵
        
        PID:848
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.sysmond
        5⤵
        
        PID:849
    - - /usr/libexec/sysmond
        
        /usr/libexec/sysmond
        5⤵
        
        PID:849
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ScreenTimeAgent
        5⤵
        
        PID:851
    - - /System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
        
        /System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
        5⤵
        
        PID:851
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secinitd
        5⤵
        
        PID:852
    - - /usr/libexec/secinitd
        
        /usr/libexec/secinitd
        5⤵
        
        PID:852
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.geod
        5⤵
        
        PID:853
    - - /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        
        /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        5⤵
        
        PID:853
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.geod
        5⤵
        
        PID:854
    - - /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        
        /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        5⤵
        
        PID:854
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secinitd
        5⤵
        
        PID:855
    - - /usr/libexec/secinitd
        
        /usr/libexec/secinitd
        5⤵
        
        PID:855
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.cfprefsd.xpc.agent
        5⤵
        
        PID:856
    - - /usr/sbin/cfprefsd
        
        /usr/sbin/cfprefsd agent
        5⤵
        
        PID:856
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
        5⤵
        
        PID:858
    - - /usr/libexec/neagent
        
        /usr/libexec/neagent
        5⤵
        
        PID:858
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump
        5⤵
        
        PID:859
    - - /usr/sbin/spindump
        
        /usr/sbin/spindump
        5⤵
        
        PID:859
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.diagnosticd
        5⤵
        
        PID:860
    - - /usr/libexec/diagnosticd
        
        /usr/libexec/diagnosticd
        5⤵
        
        PID:860
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.GameController.gamecontrollerd
        5⤵
        
        PID:862
    - - /usr/libexec/gamecontrollerd
        
        /usr/libexec/gamecontrollerd
        5⤵
        
        PID:862
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.akd
        5⤵
        
        PID:863
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.CoreAuthentication.agent
        5⤵
        
        PID:864
    - - /System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
        
        /System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
        5⤵
        
        PID:864
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.routined
        5⤵
        
        PID:865
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.cloudkeychainproxy3
        5⤵
        
        PID:866
    - - /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
        
        /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
        5⤵
        
        PID:866
    - - /usr/libexec/routined
        
        /usr/libexec/routined LAUNCHED_BY_LAUNCHD
        5⤵
        
        PID:865
    - - /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
        
        /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
        5⤵
        
        PID:863
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AccountPolicyHelper
        5⤵
        
        PID:868
    - - /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
        
        /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
        5⤵
        
        PID:868
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Maps.mapspushd
        5⤵
        
        PID:869
    - - /System/Library/CoreServices/mapspushd
        
        /System/Library/CoreServices/mapspushd
        5⤵
        
        PID:869
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AddressBook.ContactsAccountsService
        5⤵
        
        PID:870
    - - /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
        
        /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
        5⤵
        
        PID:870

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:729

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:731

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSProductID
1⤵
PID:733

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
ksadmin --ksadmin-version
1⤵
PID:736

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:739

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSBrandID
1⤵
PID:741

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:753

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:755

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL
1⤵
PID:757

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID
1⤵
PID:759

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName
1⤵
PID:761

/usr/bin/defaults
defaults read "/Library/Google/Google Chrome Brand" KSBrandID
1⤵
PID:764

/bin/ps
ps -ewwo "comm="
1⤵
PID:776

/usr/bin/grep
grep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"
1⤵
PID:778

/usr/bin/cut
cut -c 1-108
1⤵
PID:777

/usr/sbin/lsof
lsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"
1⤵
PID:780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Subvert Trust Controls

T1553

Gatekeeper Bypass

T1553.001

Credential Access

Discovery

File and Directory Discovery

T1083

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users/run/Library/Application Support/Google/Chrome/ClientSidePhishing/29.0/visual_model.tflite

Filesize
3.0MB

MD5
a9803d560544e4d1fe551b2c113c5370

SHA1
a998fdb1e80dbca61267db112812a7ee34b82dce

SHA256
d38a4cda8912f9598b8701dac7d5ee90eff324ed1fb9d277b9784fe45a4e6c72

SHA512
65b8b6ecfea2aeae95a39581c39476a54721e07ee7c296650ccddea29a09b29a11cab15fdc89f97295bd61423dc13a66666faca371200bcb459dc1f25b6c89fd

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat

Filesize
40B

MD5
fcb4024c6dc53a5b72c492fd960762d7

SHA1
82c43024d9e274bf2b8a5d1e505d65cf3873fb92

SHA256
5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6

SHA512
5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/4a64a072-8ed0-44a6-b19a-82cf28f1d8e2

Filesize
258KB

MD5
5adf364735dcbe6bf26ebe3f705c9dbc

SHA1
a891521fea2f61a2fd16ea9f0a3fc3c2c5fb3a46

SHA256
8d21fe1bd251856bfaeaedd6a72ab78f153a047b6042e0fc614f57a32b56d340

SHA512
5f77f8923ab3800ab754f4c60095077b529c5f5f230c6a0b6803dc28597f42ed682921267ed344e190d0f08e0a23eceace7bccbc9d22432029a3e6f4838420e0

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_1/craw_background.js

Filesize
531KB

MD5
6eebed29e6a6301e92a9b8b347807f5f

SHA1
65dfb69b650560551110b33dcba50b25e5b876de

SHA256
04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697

SHA512
fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb

Filesize
339B

MD5
61a867b6e4a24cfcfd32ddef25ac3229

SHA1
87cc4516fbce1700174d8ea27c9d2cb70a60a1fd

SHA256
9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5

SHA512
3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb

Filesize
569B

MD5
b5db1f091948de93d7fc96e14aef6da3

SHA1
74745f991e3dfe45037366e55c2e6df47d8e6593

SHA256
b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e

SHA512
d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb

Filesize
269B

MD5
6487e04972ecffd0aabf7b61bdda8119

SHA1
26f0b11a2529a35f6970a914deadfcf2e2d23286

SHA256
241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172

SHA512
44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Storage/ext/gfdkimpbcpahaombhbimeihdjnejgicl/def/Session Storage/000003.ldb

Filesize
141B

MD5
38fc535a8f11d7e955ef58cc63158eff

SHA1
c45ad3ee106dbfb65dce7c09b53140f34454cd0e

SHA256
085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8

SHA512
26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb

Filesize
136B

MD5
fe382e791274914bee5950777e4f1fd3

SHA1
53b523b5fc87e66f2520a0b5f9ea080072668f4d

SHA256
935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132

SHA512
a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb

Filesize
2KB

MD5
e0f65ad85a40a32fa91e551005e193ce

SHA1
a145766d5df23ae5fcd23dbb6937606f280f3502

SHA256
18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8

SHA512
bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb

Filesize
288B

MD5
b47a44bdd1b765b6af56b347447fd1b7

SHA1
8599a1870656af91e432bb35e3497863e34ddfbb

SHA256
79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06

SHA512
bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0

Download Submit
/Users/run/Library/Application Support/Google/Chrome/OptimizationGuidePredictionModels/0eac41e8-0195-46e1-957f-7bbcf8e98162/model.tflite

Filesize
382KB

MD5
6d7c2f9e94664539dec99b3233301b01

SHA1
85812b004742cc1c211c92911131ce270f8ba769

SHA256
a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534

SHA512
4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.32.0/Ruleset Data

Filesize
138KB

MD5
132df2b999906be7b21cc21bc247b068

SHA1
0665be201a96e717410a4e61a263bb879b3f08d4

SHA256
fed1557c8b4e40813114db3b546c043105892dd0895c4d7c02d45a8be351173a

SHA512
6764c8a425cd010a67a4636f812d43e63bb0815943e9839cf9fa35f3e5f9ba52309ed842306dcffe32a72e7019cb0c28e1d402dfc22dca0603a0cd48d6a26451

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.49.1/Ruleset Data

Filesize
120KB

MD5
c5e30274fe7b93847f6d7c02410d1209

SHA1
488a49f38459f29e110c706c51b61ca1ae3b0e26

SHA256
e634e3cfdd0d27d0be1f5f9a19748d19d564928765db343503f42a6e1f5dd4ea

SHA512
bc235bb3af269e9a828e6788dbae2b42cabc879b858102f4cc76c0fa02af0e296d20ffc8f134c0a3f9b408643e4810e8c46afeb0c285b892908b06ea1aa1b811

Download Submit
/Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Unindexed Rules/9.49.1/Filtering Rules

Filesize
68KB

MD5
6274a7426421914c19502cbe0fe28ca0

SHA1
e4d1c702ca1b5497a3abcdd9495a5d0758f19ffc

SHA256
ae2fd01d2908591e0f39343a5b4a78baa8e7d6cac9d78ba79c502fe0a15ce3ee

SHA512
bf1287f502013308cdd906f6e42998c422ef1e272b348e66122dc4a4e471d01333b418f48d1bb2198c72845bdc950612597e179e612aaa1ba6cf8d48fb8f0cf5

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
63e50dc44c0c3d543eb59b6789856d12

SHA1
8821df3d9106f64cdb71f00d8b9ec4ef2dad57f1

SHA256
04c818aa4d85ef45e2ea54ea10f416255b8e24cbb4852db7ba38bbb3ff7f0ac5

SHA512
79cf9d3fc86ac5e07254ea4744eadbad9baa731c2bf422c2059b8b172482c8866436b81c6e3a8e083134954d701c43148ba1d9e9e22dcc1ecf5f6f6e5c889ea8

Download Submit
/Users/run/Library/Caches/GeoServices/ResourceManifest.pbd

Filesize
248KB

MD5
b57c0abc2496ed654f38df5274641acc

SHA1
9a926707866f8371dc271c0e41812232a2ca39bf

SHA256
e0ed9b6cfda42ed31bf3e4d0c0e11a28d1f13ba337a68835ec69789ff81671f8

SHA512
c1ef2a8030b520b2f77e556a3ec6dc01498546a7b2634644476d1caad1e80aa43da382cc6d28304720af0e7e3e8584bf661782158dd77c52a941711d2c9609f4

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
106KB

MD5
c18b88adf51b3c215a1b4d83698c2591

SHA1
7921ea17aec73ef2ad874a8262425222cf56b1ee

SHA256
f02464d1a605ba019764edd8e0aea8a806cb012b6d2be67b7b89d4bba86e387b

SHA512
7d8baf96b33083121b5fdac43a9f159255119050ac652d2f836b9caf779121c60ce8369fc1a23326bb9f274f6e1bc8aff4c321b030da943ece647c37c75b7b50

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
106KB

MD5
7cfbf61be7a97bbf777804d536b3def9

SHA1
c889869bc2cabff98fa208981fb7af8582131878

SHA256
de5448c4bf9150045507e0d3aafc82cf7a1a8bb236c620308f0cf4127335740d

SHA512
5d78689a1f0f21d76d4c39a010b6edb67ced8ff2c27937705ea53b3209b9e43df1e2c7f717103badfb0acfb4b725b1e554ce71edbc5630a8c2b8a71cb5d28f84

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
104KB

MD5
258f5e3c572fda8996b44c126a2276cb

SHA1
c160802698da074c9595423d60144eb04da22bba

SHA256
34ec6ac8585a08da2a63c2263d50ae723d8700dd31f208ff221c6cc8a77a6d2d

SHA512
1876c71f41b1fed7f7cccb612aa59bdaabc3a13ccf51655186374ee37a3eb3c9be2c595b991881b915c33bd95eb815c8d25e8f1f3ff3965fca7604a23066f0d1

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
106KB

MD5
6e9b78d811f5ecba0b512cb5e0f02d29

SHA1
adc7f8bba0fe9fc29760cc78bc27e37cf50066c5

SHA256
96555ba66a8eb32e45490fa63a7d8799338406102a932ead6f498c98ffeeebf0

SHA512
cee41e4eb202de2f619408157228860cb9fec6ca52491caa7e2b4752297c1b590d6f2e7174a51f19cbb9280c11a05962cd5b7da9a96e1e7ba8a3f50924479e96

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
106KB

MD5
e2468f9e63db46221568f5bb0ccbf61b

SHA1
8157900ec5a04e0bc25a08125587bd761016f3fb

SHA256
6d434f6420cc1535e746cb2e5a4a3b79ffbd32ad706625ad89020ddbde342e78

SHA512
2f1846686b633414fb7a7df1cad10f5a0f9e0c3bc6b300515d9999998f808adfe6a0d34f788bc2c8024bc287ad651fb10015974b9bad08099d686a99b3698436

Download Submit
/Users/run/Library/Keychains/login.keychain-db

Filesize
104KB

MD5
ad30577e3ded2ba6b290aa5972d8536e

SHA1
01b97fe2b1e27f913bd920ab863157dce0e73855

SHA256
2d2273ace6ccf1670c3739e5d8c5ead11997647e3a71dd920a451ddc7cd0e4f1

SHA512
34fd3d9a6e937c7b273ace461c37ab4888a9536c633876f9fb73d7f681e9a4860da11d9f3848b4c6860a27773a608612d609617e194ffbff6fafb56f4aa96829

Download Submit
/Users/run/Library/Preferences/com.apple.security.cloudkeychainproxy3.keysToRegister.plist

Filesize
640B

MD5
ecde215a82eeac460378acf5962d031f

SHA1
2c6c5315f6bc5e4262a6ce348cf5b6bef9469db3

SHA256
72b2c221609a38f49cd903e663f34d6d5e4fc66e980e55f130e20aa628d4fce2

SHA512
0267a081979b1cb52a5d5509332afc81c4deca923321e12fa20c0d6261c2a52b129269661b3774b1c424118a1980715f572e8cc6848ff46691d2131b06ad5e2a

Download Submit
/private/var/db/spindump/tailspin-trace.2024-06-29_07-36-50.tailspin

Filesize
17.5MB

MD5
a5a65af4597e8ab75e9f5e52f1240983

SHA1
bb536d70ec57b3d20520ea4ee87c0d9ed729aa5b

SHA256
572adce8d68d221152f4c7d1ff35a3411b88e761583fca32704a5c12404241cc

SHA512
8648287e87b0bbbc2ace33e8ac04999a634b007083d91c0625c91fa2ceac39f8123a8669354500b69f27330e38315e367e95658feeed22005e3993de3c5ab1ac

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_direi8hpS/CRX_INSTALL/images/icon_128.png

Filesize
3KB

MD5
30899b6c4e4a757b8ec6dd2208acdfb4

SHA1
f2c5880a724c6d75cce1b5191e0d82c3bc7de768

SHA256
4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4

SHA512
58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee

Download Submit
/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_direi8hpS/CRX_INSTALL/images/icon_16.png

Filesize
531B

MD5
344554d96e418120bd80ef5de5194697

SHA1
23e141c3a6ce368acc1c299f062ab85914bcb17e

SHA256
0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378

SHA512
7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e

Download Submit
/var/db/locationd/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
73c8bc94cec9149aaa87ca6e1ff34e5a

SHA1
761f8e3c2e5da71a077a2956d2f0195d717cc274

SHA256
883ca94e370f096112e7563fd36c7aae380fb5a860e0f30a5c9a2397eea2fff9

SHA512
d0de1093ed9824289bce29f639517f2c3a10c7318f1ac794f3329d2007a55a0eb3139037f4ae1a824e13f90b63813e71a731da29154dfd6d140a264c96dcd4e5

Download Submit
/var/db/locationd/Library/Caches/GeoServices/ResourceManifest.pbd

Filesize
248KB

MD5
ef838598b4edab1679d1edd548792913

SHA1
4e3d903be9b5ce87d959369789e17a3a5d600c28

SHA256
6d3a9431dc5ccbfd6d522f82176fa39fdda3d532f577ae6299229ccd63990021

SHA512
521cf8523a017d55459728038863d938756df6ed3ece38d01471dc2f5a5c25164c81b67b6637e520b1a9152f7ef86f99e079c2f46a199d1d4253b8df26312355

Download Submit
/var/db/locationd/Library/Caches/GeoServices/networkDefaults.plist

Filesize
6KB

MD5
57487c5e523f4e461e97ab98b41803aa

SHA1
c631fbf25dc6f23be44ccc2670b334278800c63e

SHA256
67725d05a0ce28bf4ccbfcde82acfcaa627c0eeb7678d5c8e5b7649a7f158f8d

SHA512
9d9826379ab15e2da65a2a32bc3584b201d79e89e3a7d6e554b2398b7a0ada77241144be6d69fc749526029838293d5107f96f45392fe6a07a05dd2f4d07a3bf

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.0YUUkI/ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3

Filesize
10KB

MD5
cb79d407a4d6d8526b42060b9210b5c2

SHA1
331e3d66e82e130042897faf86dcbd05d7b227f1

SHA256
e3a7322843834a5270a01c56533a34a24b1a253e3bda6f14046e10d818446165

SHA512
0ea283f2077ff874e1f2518565497864b11fd8a65f03d65e2b2996048bdba19849fcab81d9a8220cd51d4a09741b9cf222b1393f6ea4fde6db76dfe0590efdf9

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.5SR3NL/1.0.0.16_llkgjffcdpffmhiakmfcdcblohccpfmo.crx

Filesize
3KB

MD5
3bb7cff9ff6ee1d2ce1dd375a9bb8293

SHA1
0da5228af26959bf28c4d1f3570c6bdfa66dde5c

SHA256
50194698c958b2db374ace82588897597f893533a46f0243bd0e972a7b7ce2a5

SHA512
55fc41e364b6285e76b4053185e89511dfcbdf17ce769a031917d1ee1c7df6279a3980bab38530c9c55cd996e33a20bf988edb557839738ff26f4badd748a973

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.9RPSOR/eeigpngbgcognadeebkilcpcaedhellh_2024.06.05.140657_all_ccj7nw5iotmqmvpbhiiji4wfca.crx3

Filesize
135KB

MD5
0b1bbd3a85c6b5b46ff609b906632114

SHA1
305db6992df90fc483d44991fd9e98e43715ccde

SHA256
26c197ab0b2bd999fd5c8b5932e5700a083febf68e6d35f56b2473d6858a02cd

SHA512
1953eb559161500e8ab1a5aa3738dde247f0682cb632cf0304167c6dd82fa12a08dc971da337c272a4f0945d299331c5f0aa55edbc0479df2354c4d4a365ddd8

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.LV8cQO/dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3

Filesize
136KB

MD5
667e9eec04509aa9e2b318f580addd8c

SHA1
346267ecad10c54de52a3aeb766ea72449500326

SHA256
0c24e9bd976adffa987e08fc54dc0950c84cf18f9cdb4c5caabc6acf24887c4f

SHA512
a9d22d49290c164abf36dd7e887063ccdd2bf508eb2d16bbac6de749e5152805ecb38ca39352706150de29a76839fa6a56c084ea4f2757b61887b3a7912be917

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.M0BzO4

Filesize
242KB

MD5
541f52e24fe1ef9f8e12377a6ccae0c0

SHA1
189898bb2dcae7d5a6057bc2d98b8b450afaebb6

SHA256
81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82

SHA512
d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.OrkjUM/gonpemdgkjcecdgbnaabipppbmgfggbe_2024.06.20.00_all_f3og7hwihwqa4rmuwuovfkp43e.crx3

Filesize
6KB

MD5
bb92631c710b680ea035d36b1bc4f744

SHA1
8daed7513022b3bdee8a917c4f1d259b6d58127c

SHA256
16784ce19d23309b8ffa9cd4816d024aa17bc230b8fb12b5e4744e351a690be4

SHA512
98071bb25a8109316d4529a70f16f083b999fd4c3568c150f3246b923409588ce8c020c0c4b738cead3218376992879e5f5aa6696fd9c72046c0e3d359030a66

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.RCrErj/obedbbhbpmojnkanicioggnmelmoomoc_20240619.645742785.14_all_ENGB500000_acipcqizi6tznat4m2vuqmrbvqma.crx3

Filesize
5.1MB

MD5
e8f5506b7dfb03e1e825eb199be4a911

SHA1
8bb16cf179ecf8910df35ef5a7415f057e4b3129

SHA256
446c39069b1d65e37281d3a6b646838c8bc39147c43259fe26527dd12439a48c

SHA512
b02aaaad83cda0fbb1f7ea0b7514fba7f9a31967f155174360d070b9ec4f2d5e053ddb0fae925985f76ed61931396fef3241fe2d60c1e1101bfc18043866b095

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.RfEfaG/lmelglejhemejginpboagddgdfbepgmp_453_all_ZZ_mkjuqf56fedszid3zk4gd42uyy.crx3

Filesize
47KB

MD5
4aa8b9b1ac1d935ee36574ca6fe2af27

SHA1
a158b85a764a7efef5be6a7c0fc7d2ce2735b23c

SHA256
5ae071feec82fce5632afc7406519c721e8d34d309b12a7332392c81b03cfedf

SHA512
4ada26fc0afbf9fe079bca4344677d460fb3796e2d685d320d186c7c0428cd725b761a6eb6552a9c8ac67a6bed5f6eac8c7bef27f178fd85ab7f25f97dceb429

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.Ri6WfU/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.49.1_all_ixzyrcu7pvmgu5pjv6enfqq6wa.crx3

Filesize
34KB

MD5
2db7e78c310ca8e73c069a604eac4d99

SHA1
a6d1e03514f8eba03ab81f1380fc54aaded823b6

SHA256
cd1978742a4afdbaaa15bf712d5c90bef4144caa99024df98f6a9ad58043ae85

SHA512
681eaddbf304f4513b008b98493272b44815460568876b93528851ff7806775de38e6ec588fe27a2cf3dc804415e83a420e45d754b25ad4bdf68ef2c78403aa3

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.hWdRTe/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3

Filesize
857KB

MD5
a40c655b337e082c76b6ab04042b7ae0

SHA1
3cc2a2b7178a29fd2d246cbc532684d6ae45bea8

SHA256
545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff

SHA512
fb4d54b573eb2275d8a3580fff138ecd7bded27ec58086b909b12c03c8005e35105c354a4a1ff76ada608ee8bbabeaafe208bb9e557661bb74e4ca39ee5eee56

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.kWB0Pn/hfnkpimlhhgieaddgfemjhofmfblmnib_8889_all_adqxq5imgqaxdzxajlvlm57c224a.crx3

Filesize
614KB

MD5
1408b59ba3fb29b31668bb411a067d9e

SHA1
beacc07be669d106657896c2265a07deb75630d2

SHA256
727f7b760590c80e6c989aaa35e37b70b7b7ed7f4416cfe57c9d346c4acb21d9

SHA512
8e9a7ab66ccfa9c53de279f823db55e04d6448fb54513fc1ac08507462c2302a44fe36f6e94b13aa206f95a43df2a3e6e74ce7d0b7f39ab05fa72e80e14fed85

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.kjWOEd/jflookgnkcckhobaglndicnbbgbonegd_3033_all_jk2jdznzkogtplyei4c66klhpm.crx3

Filesize
71KB

MD5
65d941790da74ea39b89e675d7105ca3

SHA1
9bbfa8c3c5b37dcb334f951f584b8c105abe7e68

SHA256
2e871143703b862fcdf558b45cfe02a93a2cb74518b30f4c1e0f07753b0823b8

SHA512
6ec08a25eba3b1d1947a26eb2bbbf772a0603261c78a3c9e94cfffdf6cc2ea8a8e4932996a4461b92891b6589c48ae0ac530643d34a91bb9fd43919bbde7375d

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.nRSTOy/efniojlnjndmcbiieegkicadnoecjjef_999_all_imhul26wwctozz2rnen2wcuu5a.crx3

Filesize
150KB

MD5
5ab411796cec4f4d414fe57de90888c6

SHA1
46751a2a8d5868dfdbf37b76bf31d968bb30f801

SHA256
f7da621a9509b913b6b2c3cdfba7e47551159ace62b2d2af1d903dfc98c6065b

SHA512
9a1b83302a33b6a3d67854350440499cbc2339723ecde087a83fd03ac14eaf8e1d5e334a6b64f4993d6a1627f0f9f662b49d535865c42970054d799c997b6d5b

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.rHRFTR/npdjjkjlcidkjlamlmmdelcjbcpdjocm_1.3.19.240_mac_adygwryqqyfdwvvjh32xxi6rilea.crx3

Filesize
3.3MB

MD5
91a8d56c19e60520cf00b78a506b87f0

SHA1
a794be44a680983ac0f87b1faedf064a65016623

SHA256
b158d145928f6c80d855f1fcc5b6813e73b7e14327d65fa9abb26c438e56bf29

SHA512
efe8b3be1ff7c30596230e091a5109b1328b3f603a4f3cad134ad99cf648b8b3a0dbdd79413f854a53dae4e1316862c6b6798660dd9f37283a97115905c65d06

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.rrCWAr/imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3

Filesize
2.4MB

MD5
0fa505d26fd906c645e60aa05f12af36

SHA1
ecb1def63dba6d475dcd61c4d3a6938855e6f24a

SHA256
9738a550f51cdfb80146b1620b40a37d58c5136254ee1f0f03c20a864fab89d2

SHA512
6c49784a21465a2b7348720003f072a279a7aaeb88783b98cdb968a54cb1ce6771122a6f1bbbfb8dd36507576c81d6caa000166f2dc0f81a3feca4e8d5131a00

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.s3Z4YO/khaoiebndkojlmppeemjhbpbandiljpe_66_mac_adbxmk3cir53o3v2f66pezkgcbjq.crx3

Filesize
5KB

MD5
ba0c44cdcbb9f1a8b1b2cbed95346caa

SHA1
c9a5e9df64b46db7bf44b091da1c5553137bff55

SHA256
3658efbb825c2826d2c66de6fdfbdaaffdd1d053105eb7d547e34d3271a59948

SHA512
61d9521200a86b583bff7ceafea793513ba34a5ae43309edabd9b19a52277752adcad1f0ddf5e33986511e75a2c9df0b13b9b520fed1d1ef8590644bd4483616

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.vBUMP6/laoigpblnllgcgjnjnllmfolckpjlhki_1.0.7.1652906823_all_jtggsagwbg7dhs53nvq4e53lva.crx3

Filesize
10KB

MD5
91e1255f92fc76b16509bbd174a992b5

SHA1
44cbc6b7b60470149850d375f2e2ae95cf1c012b

SHA256
29661be65c8fb50d3d4df2fe040a1cc6dd525f50a95850aae6a191301c3de744

SHA512
ac1588c003c345aaf9a7c4b5f2d338fdaba041dacd65db567ff8cc588b47e372863e44a4a87f611c1530fb42fdb1388814d3caccf8bb3498c7efe78fc321d9cf

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

Filesize
118KB

MD5
5679409c71796ff69b4f230318bb4421

SHA1
f98c9a9a96cbb8c2906cc231a4afa21dc84c2565

SHA256
6e9bd6c1b95c5f2a853953cc30a80329b310eff48c90ee7e1b946f065cfd5640

SHA512
8281b50c976adf4679f874775f563e603c044776c856a34569140138b2e3fc9cb024f8207407b1425a8cb2dda49eb494764945f26f69e42ffaa5a202060db5f3

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

Filesize
400KB

MD5
c700bb774615beb312f961ffa248452e

SHA1
0d1ce03fca081b83904bebfbbeb58453a5ac017b

SHA256
2dcc94dffe2b83b919f7c63792890bc7642388e870414fc0b0b9f27da72ba9fe

SHA512
d6aed0e1cbca065895327c238e7a3dafbce8404f065d7affc57898a89276075e066fefa7bf392149e0d929917dca23f1d8ee02868e33142cda02bc3e5c52c714

Download Submit
/var/log/fsck_hfs.log

Filesize
15KB

MD5
698ed8c838aa7f95fce5e5f7f5bebda3

SHA1
fee2594e7d8d90d38eb8e895a6a6fa60045f739c

SHA256
725cd9b1db2da798cb589f8a208e963647d0a97d204948c0f6a41cae3048dd0f

SHA512
aaf81f94dba8675123ea851d3f8b896d1972d5c782a21d829f5f9cd958a77ab7d92e554830e9bcf37a8b79baae248e75eec9aac6345059b6289692746875125b

Download Submit
/var/log/fsck_hfs.log

Filesize
15KB

MD5
9482c3f1d3b194a0aecc5ca5b02cf672

SHA1
08471c440e4b75f9b7786223926442860e32c674

SHA256
f7ab2d20002423e0079088c69aa958742b500b790463057122f6b74fbea40645

SHA512
62adaf7c6bdacd639b0cf1f45605b1056fad2313478af96933bbc1c4a9772f5bd2a537a8dce114f7f9ef85e990659357ee2d7543f84132f6fad7f49182e7fd36

Download Submit
/var/log/fsck_hfs.log

Filesize
16KB

MD5
bac805e49ad5a4a91a3f11185e81ab45

SHA1
fdde38d04c3cb39d710a708bd58047088fdd367a

SHA256
982af0609731d63b536a16ceb974ec9f8eba1239a17b1a348a1e459746129a08

SHA512
148e2f023038ea45605baeabc84fed3467d2abf71640e95b6c4b22051ec347c6282ce40dc4c0e9a315232e693b5d0773f591625c6dd46250375a1afe405e269a

Download Submit