Overview

overview

4

Static

static

1

URLScan

urlscan

1

https://greggman.com...

windows7-x64

3

https://greggman.com...

macos-10.15-amd64

4

Resubmissions

18-11-2024 16:29

241118-ty96csvqcp 10

18-11-2024 16:26

241118-txn7hazfre 4

18-11-2024 16:20

241118-ttg9sa1bnm 4

Analysis

  • max time kernel
    228s
  • max time network
    230s
  • platform
    macos-10.15_amd64
  • resource
    macos-20241101-en
  • resource tags

    arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    18-11-2024 16:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    https://greggman.com/downloads/examples/html5bytebeat/html5bytebeat.html#t=0&e=0&s=8000&bb=5d00000100d8000000000000000017e07c448a369a0fb84fd64c3680f0b757a25bd766d62696e767c8dd550588c4247b59701e0e8da7fac3eb2ef42618bcfee305a8794a84de090a58b4c2afae4dea361455b6e322a8c5ae9d4560337fcc00c84b7d301a79c3553e3be93807fbfd1e28d151964b29e2b16affe9b8ee12a6db921233daac18f14850deee365ac8ad2e5de190238336358a2653ceff4b62a8467a0c3aff7f3758cb11042da65e8941ffff4b429d00

Score
4/10
evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 10 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://greggman.com/downloads/examples/html5bytebeat/html5bytebeat.html#t=0&e=0&s=8000&bb=5d00000100d8000000000000000017e07c448a369a0fb84fd64c3680f0b757a25bd766d62696e767c8dd550588c4247b59701e0e8da7fac3eb2ef42618bcfee305a8794a84de090a58b4c2afae4dea361455b6e322a8c5ae9d4560337fcc00c84b7d301a79c3553e3be93807fbfd1e28d151964b29e2b16affe9b8ee12a6db921233daac18f14850deee365ac8ad2e5de190238336358a2653ceff4b62a8467a0c3aff7f3758cb11042da65e8941ffff4b429d00\""
    1⤵
      PID:470
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://greggman.com/downloads/examples/html5bytebeat/html5bytebeat.html#t=0&e=0&s=8000&bb=5d00000100d8000000000000000017e07c448a369a0fb84fd64c3680f0b757a25bd766d62696e767c8dd550588c4247b59701e0e8da7fac3eb2ef42618bcfee305a8794a84de090a58b4c2afae4dea361455b6e322a8c5ae9d4560337fcc00c84b7d301a79c3553e3be93807fbfd1e28d151964b29e2b16affe9b8ee12a6db921233daac18f14850deee365ac8ad2e5de190238336358a2653ceff4b62a8467a0c3aff7f3758cb11042da65e8941ffff4b429d00\""
      1⤵
        PID:470
      • /usr/bin/sudo
        sudo /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://greggman.com/downloads/examples/html5bytebeat/html5bytebeat.html#t=0&e=0&s=8000&bb=5d00000100d8000000000000000017e07c448a369a0fb84fd64c3680f0b757a25bd766d62696e767c8dd550588c4247b59701e0e8da7fac3eb2ef42618bcfee305a8794a84de090a58b4c2afae4dea361455b6e322a8c5ae9d4560337fcc00c84b7d301a79c3553e3be93807fbfd1e28d151964b29e2b16affe9b8ee12a6db921233daac18f14850deee365ac8ad2e5de190238336358a2653ceff4b62a8467a0c3aff7f3758cb11042da65e8941ffff4b429d00"
        1⤵
          PID:470
          • /bin/zsh
            /bin/zsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window https://greggman.com/downloads/examples/html5bytebeat/html5bytebeat.html#t=0&e=0&s=8000&bb=5d00000100d8000000000000000017e07c448a369a0fb84fd64c3680f0b757a25bd766d62696e767c8dd550588c4247b59701e0e8da7fac3eb2ef42618bcfee305a8794a84de090a58b4c2afae4dea361455b6e322a8c5ae9d4560337fcc00c84b7d301a79c3553e3be93807fbfd1e28d151964b29e2b16affe9b8ee12a6db921233daac18f14850deee365ac8ad2e5de190238336358a2653ceff4b62a8467a0c3aff7f3758cb11042da65e8941ffff4b429d00"
            2⤵
              PID:473
          • /System/Library/CoreServices/talagent
            /System/Library/CoreServices/talagent
            1⤵
              PID:453
            • /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
              /System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
              1⤵
                PID:455
              • /usr/libexec/pkreporter
                /usr/libexec/pkreporter
                1⤵
                  PID:466
                • /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                  /System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
                  1⤵
                    PID:463
                  • /System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
                    "/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
                    1⤵
                      PID:461
                    • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
                      "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
                      1⤵
                        PID:457
                      • /usr/libexec/xpcproxy
                        xpcproxy com.apple.secinitd
                        1⤵
                          PID:491
                        • /usr/libexec/secinitd
                          /usr/libexec/secinitd
                          1⤵
                            PID:491
                          • /usr/libexec/xpcproxy
                            xpcproxy com.apple.audio.systemsoundserverd
                            1⤵
                              PID:498
                            • /usr/sbin/systemsoundserverd
                              /usr/sbin/systemsoundserverd
                              1⤵
                                PID:498
                              • /usr/libexec/xpcproxy
                                xpcproxy com.apple.pbs
                                1⤵
                                  PID:499
                                • /System/Library/CoreServices/pbs
                                  /System/Library/CoreServices/pbs
                                  1⤵
                                    PID:499
                                  • /usr/libexec/xpcproxy
                                    xpcproxy com.apple.audio.AudioComponentRegistrar
                                    1⤵
                                      PID:502
                                    • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                                      /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                                      1⤵
                                        PID:502
                                      • /usr/libexec/xpcproxy
                                        xpcproxy com.apple.TextInputMenuAgent
                                        1⤵
                                          PID:507
                                        • /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
                                          /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
                                          1⤵
                                            PID:507
                                          • /usr/libexec/xpcproxy
                                            xpcproxy com.apple.TextInputSwitcher
                                            1⤵
                                              PID:509
                                            • /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
                                              /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
                                              1⤵
                                                PID:509
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.systempreferences.2140
                                                1⤵
                                                  PID:512
                                                • /System/Applications/System Preferences.app/Contents/MacOS/System Preferences
                                                  "/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
                                                  1⤵
                                                    PID:512
                                                  • /usr/libexec/xpcproxy
                                                    xpcproxy com.apple.AccountProfileRemoteViewService 512
                                                    1⤵
                                                      PID:514
                                                    • /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
                                                      /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
                                                      1⤵
                                                        PID:514
                                                      • /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
                                                        /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
                                                        1⤵
                                                          PID:515
                                                        • /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
                                                          /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
                                                          1⤵
                                                            PID:516
                                                          • /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
                                                            /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
                                                            1⤵
                                                              PID:517
                                                            • /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
                                                              /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
                                                              1⤵
                                                                PID:518
                                                              • /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
                                                                /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
                                                                1⤵
                                                                  PID:519
                                                                • /usr/libexec/xpcproxy
                                                                  xpcproxy com.apple.nfcd
                                                                  1⤵
                                                                    PID:521
                                                                  • /usr/libexec/nfcd
                                                                    /usr/libexec/nfcd
                                                                    1⤵
                                                                      PID:521
                                                                    • /usr/libexec/xpcproxy
                                                                      xpcproxy com.apple.studentd
                                                                      1⤵
                                                                        PID:522
                                                                      • /usr/libexec/studentd
                                                                        /usr/libexec/studentd
                                                                        1⤵
                                                                          PID:522
                                                                        • /usr/libexec/xpcproxy
                                                                          xpcproxy com.apple.preference.desktopscreeneffect.desktop.remoteservice 512
                                                                          1⤵
                                                                            PID:523
                                                                          • /System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/DesktopPictures.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.desktop.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.desktop.remoteservice
                                                                            /System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/DesktopPictures.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.desktop.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.desktop.remoteservice
                                                                            1⤵
                                                                              PID:523
                                                                            • /usr/libexec/xpcproxy
                                                                              xpcproxy com.apple.spindump
                                                                              1⤵
                                                                                PID:524
                                                                              • /usr/sbin/spindump
                                                                                /usr/sbin/spindump
                                                                                1⤵
                                                                                  PID:524
                                                                                • /usr/libexec/xpcproxy
                                                                                  xpcproxy com.apple.tailspind
                                                                                  1⤵
                                                                                    PID:525
                                                                                  • /usr/libexec/tailspind
                                                                                    /usr/libexec/tailspind
                                                                                    1⤵
                                                                                      PID:525
                                                                                    • /usr/libexec/xpcproxy
                                                                                      xpcproxy com.apple.spindump_agent
                                                                                      1⤵
                                                                                        PID:526
                                                                                      • /usr/libexec/spindump_agent
                                                                                        /usr/libexec/spindump_agent
                                                                                        1⤵
                                                                                          PID:526
                                                                                        • /usr/libexec/xpcproxy
                                                                                          xpcproxy com.apple.coremedia.videodecoder 523
                                                                                          1⤵
                                                                                            PID:527
                                                                                          • /System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
                                                                                            /System/Library/Frameworks/VideoToolbox.framework/Versions/A/XPCServices/VTDecoderXPCService.xpc/Contents/MacOS/VTDecoderXPCService
                                                                                            1⤵
                                                                                              PID:527
                                                                                            • /usr/libexec/xpcproxy
                                                                                              xpcproxy com.apple.metadata.mdwrite
                                                                                              1⤵
                                                                                                PID:528
                                                                                              • /usr/libexec/xpcproxy
                                                                                                xpcproxy com.apple.ReportCrash.Root
                                                                                                1⤵
                                                                                                  PID:529
                                                                                                • /System/Library/CoreServices/ReportCrash
                                                                                                  /System/Library/CoreServices/ReportCrash daemon
                                                                                                  1⤵
                                                                                                    PID:529
                                                                                                  • /usr/libexec/xpcproxy
                                                                                                    xpcproxy com.apple.ReportMemoryException
                                                                                                    1⤵
                                                                                                      PID:532
                                                                                                    • /usr/libexec/ReportMemoryException
                                                                                                      /usr/libexec/ReportMemoryException
                                                                                                      1⤵
                                                                                                        PID:532
                                                                                                      • /usr/libexec/xpcproxy
                                                                                                        xpcproxy com.apple.nsurlstoraged
                                                                                                        1⤵
                                                                                                          PID:533
                                                                                                        • /usr/libexec/nsurlstoraged
                                                                                                          /usr/libexec/nsurlstoraged --privileged
                                                                                                          1⤵
                                                                                                            PID:533
                                                                                                          • /usr/libexec/xpcproxy
                                                                                                            xpcproxy com.apple.preference.desktopscreeneffect.screeneffects.remoteservice 512
                                                                                                            1⤵
                                                                                                              PID:535
                                                                                                            • /System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/ScreenEffects.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice
                                                                                                              /System/Library/PreferencePanes/DesktopScreenEffectsPref.prefPane/Contents/Resources/ScreenEffects.prefPane/Contents/XPCServices/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice.xpc/Contents/MacOS/com.apple.preference.desktopscreeneffect.screeneffects.remoteservice
                                                                                                              1⤵
                                                                                                                PID:535
                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                xpcproxy com.apple.ScreenSaver.Engine.legacyScreenSaver 535
                                                                                                                1⤵
                                                                                                                  PID:536
                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                  xpcproxy com.apple.ScreenSaver.iLife-Slideshow-Extension 535
                                                                                                                  1⤵
                                                                                                                    PID:537
                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                    xpcproxy com.apple.ScreenSaver.Computer-Name 535
                                                                                                                    1⤵
                                                                                                                      PID:538
                                                                                                                    • /System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
                                                                                                                      /System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
                                                                                                                      1⤵
                                                                                                                        PID:536
                                                                                                                      • /System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
                                                                                                                        /System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
                                                                                                                        1⤵
                                                                                                                          PID:537
                                                                                                                        • /System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name
                                                                                                                          "/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name"
                                                                                                                          1⤵
                                                                                                                            PID:538
                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                            xpcproxy com.apple.MediaLibraryService 535
                                                                                                                            1⤵
                                                                                                                              PID:539
                                                                                                                            • /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
                                                                                                                              /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
                                                                                                                              1⤵
                                                                                                                                PID:539
                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                xpcproxy com.apple.adid
                                                                                                                                1⤵
                                                                                                                                  PID:545
                                                                                                                                • /System/Library/PrivateFrameworks/CoreADI.framework/adid
                                                                                                                                  /System/Library/PrivateFrameworks/CoreADI.framework/adid
                                                                                                                                  1⤵
                                                                                                                                    PID:545
                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                    xpcproxy com.apple.MediaLibraryService 537
                                                                                                                                    1⤵
                                                                                                                                      PID:546
                                                                                                                                    • /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
                                                                                                                                      /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
                                                                                                                                      1⤵
                                                                                                                                        PID:546
                                                                                                                                      • /bin/sh
                                                                                                                                        sh -c /usr/sbin/kextstat
                                                                                                                                        1⤵
                                                                                                                                          PID:549
                                                                                                                                        • /bin/bash
                                                                                                                                          sh -c /usr/sbin/kextstat
                                                                                                                                          1⤵
                                                                                                                                            PID:549
                                                                                                                                          • /usr/sbin/kextstat
                                                                                                                                            /usr/sbin/kextstat
                                                                                                                                            1⤵
                                                                                                                                              PID:549
                                                                                                                                            • /usr/libexec/xpcproxy
                                                                                                                                              xpcproxy com.apple.xpc.launchd.oneshot.0x10000001.ScreenSaverEngine
                                                                                                                                              1⤵
                                                                                                                                                PID:550
                                                                                                                                              • /System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine
                                                                                                                                                /System/Library/CoreServices/ScreenSaverEngine.app/Contents/MacOS/ScreenSaverEngine
                                                                                                                                                1⤵
                                                                                                                                                  PID:550
                                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                                  xpcproxy com.apple.ScreenSaver.Computer-Name 550
                                                                                                                                                  1⤵
                                                                                                                                                    PID:552
                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                    xpcproxy com.apple.ScreenSaver.iLife-Slideshow-Extension 550
                                                                                                                                                    1⤵
                                                                                                                                                      PID:553
                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                      xpcproxy com.apple.ScreenSaver.Engine.legacyScreenSaver 550
                                                                                                                                                      1⤵
                                                                                                                                                        PID:554
                                                                                                                                                      • /System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name
                                                                                                                                                        "/System/Library/Frameworks/ScreenSaver.framework/PlugIns/Computer Name.appex/Contents/MacOS/Computer Name"
                                                                                                                                                        1⤵
                                                                                                                                                          PID:552
                                                                                                                                                        • /System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
                                                                                                                                                          /System/Library/Frameworks/ScreenSaver.framework/PlugIns/legacyScreenSaver.appex/Contents/MacOS/legacyScreenSaver
                                                                                                                                                          1⤵
                                                                                                                                                            PID:554
                                                                                                                                                          • /System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
                                                                                                                                                            /System/Library/Frameworks/ScreenSaver.framework/PlugIns/iLifeSlideshows.appex/Contents/MacOS/iLifeSlideshows
                                                                                                                                                            1⤵
                                                                                                                                                              PID:553
                                                                                                                                                            • /usr/libexec/xpcproxy
                                                                                                                                                              xpcproxy com.apple.security.cloudkeychainproxy3
                                                                                                                                                              1⤵
                                                                                                                                                                PID:555
                                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                                xpcproxy com.apple.MediaLibraryService 553
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:556
                                                                                                                                                                • /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
                                                                                                                                                                  /System/Library/Frameworks/MediaLibrary.framework/Versions/A/XPCServices/com.apple.MediaLibraryService.xpc/Contents/MacOS/com.apple.MediaLibraryService
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:556
                                                                                                                                                                  • /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                                                                                                                                                                    /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:555
                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                      xpcproxy com.apple.AccountPolicyHelper
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:557
                                                                                                                                                                      • /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
                                                                                                                                                                        /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:557

                                                                                                                                                                        Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        • /Users/run/Library/Saved Application State/com.apple.systempreferences.savedState/data.data
                                                                                                                                                                          Filesize

                                                                                                                                                                          1KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9c8258f830f92c681021f2c6d8e0cade

                                                                                                                                                                          SHA1

                                                                                                                                                                          f70b7b52a675099e9802c09dc76d54685c9905be

                                                                                                                                                                          SHA256

                                                                                                                                                                          98d5e88ccaeed419390d6c2986b87344a6662c05e13b0159feb22b2b3fb3b249

                                                                                                                                                                          SHA512

                                                                                                                                                                          1ad76d9806ca1da952a6a65703ca612a666a2ac6100385a08172e35b044e1fde2fc4fb5a9d17db24bb0b267e03b14a8834d5b0fe7b2c0f3306cccf80cd0e8b83

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • /private/var/db/spindump/tailspin-trace.2024-11-18_16-22-26.tailspin
                                                                                                                                                                          Filesize

                                                                                                                                                                          17.2MB

                                                                                                                                                                          MD5

                                                                                                                                                                          79193b5a494ca246ed23649813d45806

                                                                                                                                                                          SHA1

                                                                                                                                                                          1115c271d2556ee80f698747d9f01343fbaef358

                                                                                                                                                                          SHA256

                                                                                                                                                                          7eeb14dddbbba54463e59d29bcedd2de904603e8c16ccacf26ee90b75e5de098

                                                                                                                                                                          SHA512

                                                                                                                                                                          26776c2b700902bf34d3bd60f246ee27ff8dd8a3c3476d8a83efb3f895544b11e81b68ee4fc694bad28d1c0e382a65ea80259a30bb96d6a3ffcb84551f2d7da4

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
                                                                                                                                                                          Filesize

                                                                                                                                                                          47KB

                                                                                                                                                                          MD5

                                                                                                                                                                          0e4a0d1ceb2af6f0f8d0167ce77be2d3

                                                                                                                                                                          SHA1

                                                                                                                                                                          414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

                                                                                                                                                                          SHA256

                                                                                                                                                                          cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

                                                                                                                                                                          SHA512

                                                                                                                                                                          1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
                                                                                                                                                                          Filesize

                                                                                                                                                                          4KB

                                                                                                                                                                          MD5

                                                                                                                                                                          d3a1859e6ec593505cc882e6def48fc8

                                                                                                                                                                          SHA1

                                                                                                                                                                          f8e6728e3e9de477a75706faa95cead9ce13cb32

                                                                                                                                                                          SHA256

                                                                                                                                                                          3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

                                                                                                                                                                          SHA512

                                                                                                                                                                          ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

                                                                                                                                                                          Download Submit

                                                                                                                                                                        • /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
                                                                                                                                                                          Filesize

                                                                                                                                                                          3.4MB

                                                                                                                                                                          MD5

                                                                                                                                                                          cd45f473034bf27adb3d22ccc4c50db9

                                                                                                                                                                          SHA1

                                                                                                                                                                          22ac1e3baa85a672bf93d3774d845e670f4e8d4d

                                                                                                                                                                          SHA256

                                                                                                                                                                          7b071c74e9967e7d9fc6de1108de736245ab47a12106a6609b4d73e22ba931a2

                                                                                                                                                                          SHA512

                                                                                                                                                                          b99a50fdc21cd7934bed5437a44edfe95f91319f7c77860e72693c10a9d5d35f6555814018837d5ee43eb9f9e4f81ed88039d68eaec21c0010f70f9d27e094ed

                                                                                                                                                                          Download Submit