hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
856s
max time network
852s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
08/05/2026, 20:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260508-y86cdadv3s

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 12 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found

/usr/bin/csrutil
/usr/bin/csrutil report
1⤵
PID:453

/bin/sh
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'http://google.com'"
1⤵
PID:474

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:455

/bin/bash
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'http://google.com'"
1⤵
PID:474

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window http://google.com
1⤵
PID:474

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:494

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:494

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=9"
1⤵
PID:496

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:498

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:501

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:502

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:503

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:504

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=24"
1⤵
PID:505

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=23"
1⤵
PID:506

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=23"
1⤵
PID:507

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072"
1⤵
PID:508

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
1⤵
PID:511

/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
1⤵
PID:512

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
1⤵
PID:0
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
  2⤵
  PID:515
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
  2⤵
  PID:0
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
    3⤵
    PID:518
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=292448490" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=63"
    3⤵
    PID:519
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=292513958" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=63"
    3⤵
    PID:520
- - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
    3⤵
    PID:521
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.SafariLaunchAgent
    3⤵
    PID:522
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=296119611" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=76"
    3⤵
    PID:523
- - /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    3⤵
    PID:522
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=296778502" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=69"
    3⤵
    PID:524
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:525
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=296966113" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=76"
    3⤵
    PID:526
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=297210655" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=76"
    3⤵
    PID:527
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=90"
    3⤵
    PID:528
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update-internal" --system
    3⤵
    PID:1.8446744073709552e+19
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
    3⤵
    PID:1.8446744073709552e+19
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:532
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.systemprofiler
    3⤵
    PID:533
- - /System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
    "/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
    3⤵
    PID:533
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.spindump
    3⤵
    PID:534
- - /usr/sbin/spindump
    /usr/sbin/spindump
    3⤵
    PID:534
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.tailspind
    3⤵
    PID:536
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.spindump_agent
    3⤵
    PID:537
- - /usr/libexec/tailspind
    /usr/libexec/tailspind
    3⤵
    PID:536
- - /usr/libexec/spindump_agent
    /usr/libexec/spindump_agent
    3⤵
    PID:537
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update" --system
    3⤵
    PID:0
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
      4⤵
      PID:1.8446744073709552e+19
  - - /usr/bin/profiles
      /usr/bin/profiles status -type enrollment
      4⤵
      PID:541
  - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
      /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
      4⤵
      PID:543
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      GoogleUpdater --server "--service=update" --system
      4⤵
      PID:0
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=14" "--launch-time-ticks=321242548" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=67"
        5⤵
        
        PID:549
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=15" "--launch-time-ticks=323731484" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=77"
        5⤵
        
        PID:550
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.replayd
        5⤵
        
        PID:551
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        5⤵
        
        PID:555
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.storedownloadd
        5⤵
        
        PID:558
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.system_installd
        5⤵
        
        PID:559
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.installd
        5⤵
        
        PID:560
    - - /usr/libexec/replayd
        
        /usr/libexec/replayd
        5⤵
        
        PID:551
    - - /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
        
        /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
        5⤵
        
        PID:560
    - - /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
        
        /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
        5⤵
        
        PID:559
    - - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        5⤵
        
        PID:555
    - - /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
        
        /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
        5⤵
        
        PID:558
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Safari.CacheDeleteExtension 544
        5⤵
        
        PID:563
    - - /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
        
        /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
        5⤵
        
        PID:563
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nsurlstoraged
        5⤵
        
        PID:564
    - - /usr/libexec/nsurlstoraged
        
        /usr/libexec/nsurlstoraged --privileged
        5⤵
        
        PID:564
    - - /usr/sbin/system_profiler
        
        /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
        5⤵
        
        PID:565
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=110"
        5⤵
        
        PID:568
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.FaceTime.1860
        5⤵
        
        PID:569
    - - /System/Applications/FaceTime.app/Contents/MacOS/FaceTime
        
        /System/Applications/FaceTime.app/Contents/MacOS/FaceTime
        5⤵
        
        PID:569
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.videoconference.camera
        5⤵
        
        PID:570
    - - /usr/libexec/avconferenced
        
        /usr/libexec/avconferenced
        5⤵
        
        PID:570
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.FaceTime.FaceTimeNotificationCenterService 569
        5⤵
        
        PID:572
    - - /System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService
        
        /System/Applications/FaceTime.app/Contents/XPCServices/FaceTimeNotificationCenterService.xpc/Contents/MacOS/FaceTimeNotificationCenterService
        5⤵
        
        PID:572
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 570
        5⤵
        
        PID:573
    - - /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
        
        /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
        5⤵
        
        PID:573
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 569
        5⤵
        
        PID:574
    - - /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
        
        /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
        5⤵
        
        PID:574
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.audio.AudioComponentRegistrar
        5⤵
        
        PID:576
    - - /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
        
        /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
        5⤵
        
        PID:576
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.satellite.CAA7AA83-03D4-448A-80FA-B0390CEF04CB 554
        5⤵
        
        PID:578
    - - /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        
        /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
        5⤵
        
        PID:578
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=111"
        5⤵
        
        PID:579
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.systempreferences.2140
        5⤵
        
        PID:580
    - - /System/Applications/System Preferences.app/Contents/MacOS/System Preferences
        
        "/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
        5⤵
        
        PID:580
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AccountProfileRemoteViewService 580
        5⤵
        
        PID:581
    - - /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
        
        /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
        5⤵
        
        PID:581
    - - /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
        
        /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
        5⤵
        
        PID:583
    - - /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
        
        /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
        5⤵
        
        PID:584
    - - /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
        
        /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
        5⤵
        
        PID:585
    - - /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
        
        /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
        5⤵
        
        PID:586
    - - /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
        
        /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
        5⤵
        
        PID:587
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nfcd
        5⤵
        
        PID:588
    - - /usr/libexec/nfcd
        
        /usr/libexec/nfcd
        5⤵
        
        PID:588
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.studentd
        5⤵
        
        PID:589
    - - /usr/libexec/studentd
        
        /usr/libexec/studentd
        5⤵
        
        PID:589
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=111"
        5⤵
        
        PID:590
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.PerformanceAnalysis.animationperfd
        5⤵
        
        PID:591
    - - /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        
        /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        5⤵
        
        PID:591
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=117"
        5⤵
        
        PID:592
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.preference.screentime.remoteservice 580
        5⤵
        
        PID:593
    - - /System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice
        
        /System/Library/PreferencePanes/ScreenTime.prefPane/Contents/XPCServices/com.apple.preference.screentime.remoteservice.xpc/Contents/MacOS/com.apple.preference.screentime.remoteservice
        5⤵
        
        PID:593
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.metadata.mdwrite
        5⤵
        
        PID:595
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=111"
        5⤵
        
        PID:596
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.colorsync.useragent
        5⤵
        
        PID:597
    - - /System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
        
        /System/Library/Frameworks/ColorSync.framework/Support/colorsync.useragent
        5⤵
        
        PID:597
    - - /bin/launchctl
        
        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
        5⤵
        
        PID:599
    - - /bin/launchctl
        
        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
        5⤵
        
        PID:600
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=117"
        5⤵
        
        PID:602
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=23" "--launch-time-ticks=361348299" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=123"
        5⤵
        
        PID:603
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
        5⤵
        
        PID:606
    - - /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        
        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        5⤵
        
        PID:606
    - - /usr/bin/profiles
        
        /usr/bin/profiles status -type enrollment
        5⤵
        
        PID:607
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.newsyslog
        5⤵
        
        PID:610
    - - /usr/sbin/newsyslog
        
        /usr/sbin/newsyslog
        5⤵
        
        PID:610
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=124"
        5⤵
        
        PID:611
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=124"
        5⤵
        
        PID:612
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=26" "--launch-time-ticks=413788904" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=124"
        5⤵
        
        PID:613
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=125"
        5⤵
        
        PID:614
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.backup.launcher.1784
        5⤵
        
        PID:615
    - - /System/Applications/Time Machine.app/Contents/MacOS/Time Machine
        
        "/System/Applications/Time Machine.app/Contents/MacOS/Time Machine"
        5⤵
        
        PID:615
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=124"
        5⤵
        
        PID:616
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportCrash.Root
        5⤵
        
        PID:617
    - - /System/Library/CoreServices/ReportCrash
        
        /System/Library/CoreServices/ReportCrash daemon
        5⤵
        
        PID:617
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        5⤵
        
        PID:618
    - - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        5⤵
        
        PID:618
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=29" "--launch-time-ticks=442814129" --shared-files "--field-trial-handle=1718379636,r,1468495340236913037,11521902431440141686,131072" "--seatbelt-client=126"
        5⤵
        
        PID:622
    - - /bin/sh
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:626
    - - /bin/bash
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:626
    - - /usr/sbin/kextstat
        
        /usr/sbin/kextstat
        5⤵
        
        PID:626
    - - /bin/sh
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:627
    - - /bin/bash
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:627
    - - /usr/sbin/kextstat
        
        /usr/sbin/kextstat
        5⤵
        
        PID:627
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.imfoundation.IMRemoteURLConnectionAgent 303
        5⤵
        
        PID:650
    - - /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
        
        /System/Library/PrivateFrameworks/IMFoundation.framework/XPCServices/IMRemoteURLConnectionAgent.xpc/Contents/MacOS/IMRemoteURLConnectionAgent
        5⤵
        
        PID:650
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.StreamingUnzipService 172
        5⤵
        
        PID:653
    - - /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
        
        /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
        5⤵
        
        PID:653
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.diagnosticd
        5⤵
        
        PID:654
    - - /usr/libexec/diagnosticd
        
        /usr/libexec/diagnosticd
        5⤵
        
        PID:654
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        5⤵
        
        PID:655
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.cloudkeychainproxy3
        5⤵
        
        PID:657
    - - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        5⤵
        
        PID:655
    - - /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
        
        /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
        5⤵
        
        PID:657
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AccountPolicyHelper
        5⤵
        
        PID:658
    - - /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
        
        /System/Library/PrivateFrameworks/AccountPolicy.framework/XPCServices/com.apple.AccountPolicyHelper.xpc/Contents/MacOS/com.apple.AccountPolicyHelper
        5⤵
        
        PID:658

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DiagnosticMessagesHistory.plist

Path /Library/Application Support/CrashReporter/DiagnosticMessagesHistory.plist
Size 676B
SHA256 d6d13b495a62b646ab5badb0de9547be203f69edb1ad0581cbc63fc299ab90db
MD5 1ce8de41293d7d52494bbc41606a7f43
SHA1 5c314888932df5d7ca6a091ab037c0a4a95b586a
SHA512 b386097f945f1cbb348a717a261d131730dbec3a0939e2dfe2da9b21095215572993fa2bd0f8b723e42d2f511e9ca1b0574f51bc1430cb59fb7be4f2698d0602
TLSH
T1CF01231B20D278A6CB6B75BD41630ECB04209B7A299857E983A26A102608F51255B631
MD5 SHA1 SHA512 TLSH

Submit Download

Finder_2026-05-08-203102_tests-iMac.spin

Path /Library/Logs/DiagnosticReports/Finder_2026-05-08-203102_tests-iMac.spin
Size 48KB
SHA256 86bb5e0dd6d377f0b45e50ae3c2098bffff16afc6b522ac73b377adaf18f3a77
MD5 22dad060160afa49e62e840d8df5474d
SHA1 1762f9252ba01412e39196b07caf1771cbecf1eb
SHA512 c48b440a729bd8b20b3694961333ccdef04e800714f7b9571860598b0e0d2714e3c75f07570f45489afeee3c2411f086a72ab3ca4d07aa11dd5645ef47ef1d06
SSDEEP 768:QtQ1HgKpn3Nu+AsJkPdGjGbkBhoFoLvKRGnq:1H9JkFL3orOGnq
TLSH
T1352363E4881C1A60617AC73B575B96010168E26FAC5A3C3EB11FBA785F46533E7EF834
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path /Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat
Size 40B
SHA256 5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6
MD5 fcb4024c6dc53a5b72c492fd960762d7
SHA1 82c43024d9e274bf2b8a5d1e505d65cf3873fb92
SHA512 5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b
MD5 SHA1 SHA512

Submit Download

90dec04d-19ab-4322-9a9d-ac688435f779

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/90dec04d-19ab-4322-9a9d-ac688435f779
Size 258KB
SHA256 8d21fe1bd251856bfaeaedd6a72ab78f153a047b6042e0fc614f57a32b56d340
MD5 5adf364735dcbe6bf26ebe3f705c9dbc
SHA1 a891521fea2f61a2fd16ea9f0a3fc3c2c5fb3a46
SHA512 5f77f8923ab3800ab754f4c60095077b529c5f5f230c6a0b6803dc28597f42ed682921267ed344e190d0f08e0a23eceace7bccbc9d22432029a3e6f4838420e0
SSDEEP 6144:771bE8xvMX08XghZNhvfhua/I4dMdYuw4/xCRxQkdE6oO:7p1xE3g3Nhvf39dMNxxyxGLO
TLSH
T12B4423A9480AFA919B0236F2BF61D07C234649142C9E2B9DDFE48F70E7FE715658F108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

craw_background.js

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_1/craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb
Size 339B
SHA256 9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5
MD5 61a867b6e4a24cfcfd32ddef25ac3229
SHA1 87cc4516fbce1700174d8ea27c9d2cb70a60a1fd
SHA512 3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc
TLSH
T115E0C2FB0A4984C1E9519BBB2524371D7B25CA2AD9448BE38E48E2528A284616609468
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb
Size 569B
SHA256 b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e
MD5 b5db1f091948de93d7fc96e14aef6da3
SHA1 74745f991e3dfe45037366e55c2e6df47d8e6593
SHA512 d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34
TLSH
T157F020631A2BD8A6C868A8325C94270C23A78F0D47B8865B6231CA301D668113A148AA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
Size 269B
SHA256 241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172
MD5 6487e04972ecffd0aabf7b61bdda8119
SHA1 26f0b11a2529a35f6970a914deadfcf2e2d23286
SHA512 44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae
TLSH
T150D0231426B7C48FE44951B165C35F64736CF459F5154783561865E44F3F0043D44174
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Storage/ext/gfdkimpbcpahaombhbimeihdjnejgicl/def/Session Storage/000003.ldb
Size 141B
SHA256 085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8
MD5 38fc535a8f11d7e955ef58cc63158eff
SHA1 c45ad3ee106dbfb65dce7c09b53140f34454cd0e
SHA512 26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505
TLSH
T187C01210066B8863C417737106C417501310E8A40006471316C233600C740311F1045A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb
Size 136B
SHA256 935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132
MD5 fe382e791274914bee5950777e4f1fd3
SHA1 53b523b5fc87e66f2520a0b5f9ea080072668f4d
SHA512 a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67
TLSH
T156C012480B948CC3C9009736082443141301C920F72CDB434381B2A10D740CF5E00085
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb
Size 2KB
SHA256 18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8
MD5 e0f65ad85a40a32fa91e551005e193ce
SHA1 a145766d5df23ae5fcd23dbb6937606f280f3502
SHA512 bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425
TLSH
T1F44164D3BDFD4BB2ED447E70D12ADB5C1015C6BE00564E0FAAE5A53C9274DA104F6076
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb
Size 288B
SHA256 79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06
MD5 b47a44bdd1b765b6af56b347447fd1b7
SHA1 8599a1870656af91e432bb35e3497863e34ddfbb
SHA512 bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0
TLSH
T129D09520FB93C021D7C0137D4D301F4C170555D1D5067759D43FF5642C74001784D430
MD5 SHA1 SHA512 TLSH

Submit Download

model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/OptimizationGuidePredictionModels/ac4a13e8-d5dc-4b54-8e04-14d5948be8e4/model.tflite
Size 382KB
SHA256 a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534
MD5 6d7c2f9e94664539dec99b3233301b01
SHA1 85812b004742cc1c211c92911131ce270f8ba769
SHA512 4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33
SSDEEP 6144:4i8mNiZGi+jiwubrNEOB37+rNiyykvXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMl:WqEGi+GwGrNv9+r8bkvXpqQMLuNy5YmJ
TLSH
T10584C013460497BAD7FC237684C31D9E12A5F2625E73B86BF9363E464811B1BE62237C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.32.0/Ruleset Data
Size 138KB
SHA256 fed1557c8b4e40813114db3b546c043105892dd0895c4d7c02d45a8be351173a
MD5 132df2b999906be7b21cc21bc247b068
SHA1 0665be201a96e717410a4e61a263bb879b3f08d4
SHA512 6764c8a425cd010a67a4636f812d43e63bb0815943e9839cf9fa35f3e5f9ba52309ed842306dcffe32a72e7019cb0c28e1d402dfc22dca0603a0cd48d6a26451
SSDEEP 3072:nAwq4WU8BNptWsfvaWSzpjNSIy27mElP6vUGyA:nAw2fcFty27Js1
TLSH
T14FD373937718C4A2E391913A97CAC72145B2F7D9E487E6F779E2034F3C452B22F1468A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 45f23f39005417929143d400c01584982db7e81425cafe9022d550a7bdbd3e48
MD5 41526a29e19125eb8331b9d686614b8a
SHA1 7e89ee64b05f976518c9dfb929cb74a24052228b
SHA512 7f9d0ac95d9f44755593450bd89d9038203fbc9e5e1ff45e06bbb12a40f247aebe908228390ac5ddcf2a9728ba7654c3c0a5ee7c35cceb4c32a046cff12e699c
SSDEEP 3072:UZr6c0dcQDyr8G3xVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmb:UopmqZqQk
TLSH
T149B393825BD5ED75C05105BEF9A3A308B735D6AB97A363873391A483AC122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 f2b4065de3df1db61fe3c567fdab3588848bde85f9409915dd95f95bb5886bb5
MD5 6b558557757f7174aeb4966543ae2b63
SHA1 c3295b19668252a77476e33068265df5757f55a5
SHA512 c624c28f27d66eab0b33fcb7010188c0868aef90a3f7c2d85fc728adc1d34bb0dcec0258b5ff3bc0bf96f385047395c727fa78e8e571ab715deb900e04c4fe61
SSDEEP 3072:EZr6c0dcQDyr8G3xVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmk:Eopmqka
TLSH
T1A1B383825BD5ED75C05105BEF9A3A308B335D6AB97A363873391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 9bb6dc33fd349cf39e60c20ba442fa2c15307d4241cf746512ab648502568aa3
MD5 d153af0ebff6ef4d97f6cc0cabf7a319
SHA1 19a6bd90705cf87bc8ff1d2e3e926520ebcd2289
SHA512 aeede9d9e1d00265c1d19819a2af9b3ff7a15e32e349cb4b36d13b8182bb144ae4740721e14190365cd20f7579c31117f5a10498aa735432c4023b1943b4bd1f
SSDEEP 3072:RZr6c0dcQDyr8G3kVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmc:RopmLPb
TLSH
T10BB383825FD5E971C05105BEF9E3A308B335D6AB9793638B2391A483AD122E40F797DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 0a20bf4061031167ded1411ac4d8dc427a56f02911cf071c6fd008c4a86ac76f
MD5 58f68431136ec2bf2791c10d5187ca1f
SHA1 260bdd36c81b48e9dbac39bcc965ad41a37d59a4
SHA512 e9f178c402dbdc4fbbcf406c6255b75a92065cfb12e76f641840ab77ac5af3dcd851447111737bf3e12d7e5e3c80f3be83d5759962ac37c8c8a06ea104cecd3a
SSDEEP 3072:FZr6c0dcQDyr8G3lVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmn:FopmeOqQB
TLSH
T1F9B394825FD5ED75C05105BEF9A3A308B335D6AB97A363872391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 b6b8574a5ab52ddccd21e398790287df8cdc7b187f7b135fe4bfd5fdc86f64cd
MD5 ddc49dc26d9b7fa25a078773539d8b4e
SHA1 bb1e40b18001eb5f96b906a88c741291db8f7258
SHA512 c8e298eb769e2cb43c10e488bafacf31252bf0f2f4d5e5f2c99a7f4bc41a0ea9dfd748d7c5ba3c5796957a9346ce2503d95126a15a260d9f6dc5b44dade531a2
SSDEEP 3072:eZr6c0dcQDyr8G3lVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmT:eopmeSn
TLSH
T1BFB383825FD5ED76C05105BEF9A3A308B335D6AB979363872391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 ffca330c735ca635858bad2b74570e7b4c8a4a0fbf6a5c65000af76a9de91dde
MD5 d273bd51cbe745b28fc08ee27a55a69a
SHA1 418d5d65a26fc77320e6e3fd65d145452a2746fc
SHA512 bada20dbbb641c9dc9c94d22711c6481e26026156a7dbdcb60976bb653ece43073526ba18a734c04fa26a86fb8a215fa7a5e9f6050413d6e9dc356ed86df1e02
SSDEEP 3072:5Zr6c0dcQDyr8G30VB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXm2:5opmbIk
TLSH
T118B384825BD5E971C05505BEF9F3A308B335D6AB9793638B2390A483AD122E40F757DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tailspin-trace.2026-05-08_20-30-25.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-05-08_20-30-25.tailspin
Size 16.2MB
SHA256 5a825507e55c806beaff1ee697bfd539845b3738c0cffc0007e28b817ae0fc13
MD5 734973330f95c9dc501f1f730e138ae6
SHA1 d01fc9f4465bb89034cdfba428205fe2730c2229
SHA512 68c5da56bcf6ad5ca862a1cb86febffe57b6ec724c73b6407b8335adc87d1661933b30d7294b7e92776c4f2443e83e6aad9e4282e344d804b37e96b337fddbb2
SSDEEP 196608:WkMldaDxXhqoJjcBl/BRnTJTrcd9cKshV9U5o:7MvaxXhdJjmfRxrcdCf/
TLSH
T194079EB17C8ADCF0DCD0A9B306E306566BF333F5DC5586FA10952ECE81567030D6AAA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tailspin-trace.2026-05-08_20-30-30.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-05-08_20-30-30.tailspin
Size 3.6MB
SHA256 fbfe11e7933ce38b4628804873e652346271b21ade38557db4bb8ce905c4739a
MD5 a3c42a891615841f89d311eb24cc3cc7
SHA1 568f6b28f9395c44b6f0f48908decbaf877df7d6
SHA512 9d563f2bedc75d173b6dff91597998928b81bc896937a5f82f53643f2cabeab2d09d310b5d36cba61035c72a1862c91447a9d8bae59fd833cc12340cc8ad5676
SSDEEP 24576:fDKQ4Ug/XbZziGAOonVSeEwkLuo+Zi433b0w0I4WQwHoL+wTfu3TlgfChgCvEumn:bAUI1Eee7kj743OI4/SvjmX6MeQwC2WJ
TLSH
T173065CF0AD0CBDF1CCC819320593811B25F739F5EDA542BF609B9AADA451B0206FDB5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirahv2Nx/CRX_INSTALL/images/icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirahv2Nx/CRX_INSTALL/images/icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.apple.colorsync.profiles.502

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.colorsync.profiles.502
Size 21KB
SHA256 340ddd06aa66bd76ecb07df7c034558bd82fbb33214f7353e6b268bc9ee7bc56
MD5 be2bfd403b85391065d2bfc0a74c544c
SHA1 4c786269662f5ef9fb63823b507b06ec084f3324
SHA512 dc9f21ff0de4c0ba57b6f632cf64511a8ba3034eafe05b2aa1aa2c42feee503812fef9e40e92f15056d66507727c120a853b39e570f2b4dbd4ff14bac3e5d519
SSDEEP 48:QrB07+EorluafSDojes6GVYjTWOS6Elwje+d3elNVrJfZi1w8E5j9554bCBkYpd7:QrZplfSDCeZGKS0QFrfic59ZU96AeB
TLSH
T1EAA20CB78BAC3142DEF27AF820F48EB55B37BB10F6676D6D44C616191A03C909270B35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.com.google.Chrome.KisTR1

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.KisTR1
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.2.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.2.txt
Size 140KB
SHA256 eb2c5c738dd8ca81ae464e8568f7a6068740c06f008c77224e7989a683a4d6a0
MD5 2d3de2395635f7cb3ada41f19803b40d
SHA1 754377827aab8929ac6bb7f8b8a551bd0a6ad3fb
SHA512 86244a068bd92246d3b14b05d201309df77f675d3617e9fbbed71d13b7552f3fb6011a8bdfd39b6a524d10724ebaee0f3ca42b2ab6d1c77e8575fe36b9588b88
SSDEEP 1536:fE9JkFL3orOGn+Cd+9arwl2GVQqJf5iJzltvfG:oJWoyG+Hcrwl37f50i
TLSH
T129E370E4981D0B90A07BCA6B574B51010168E16BBC8A3C7DB15F7A389F46933E7EF835
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.2.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.2.txt
Size 3.8MB
SHA256 463aabaeba8cf997548c0d657814560be2aee9cb1709e81e00e11d1efcb5d13d
MD5 ff281ffdbd1eecc61ac015585adf411c
SHA1 e9c648818fb9c3bb1f0e18984e07c5bf1e95b326
SHA512 56f9d9b7f6eaad48a948ddd2820e09cd368d60df6015d0bc38319cbb9129130f3000f85f3180b70d0847d216970d2a340f01f12002249d784d333ee34e210dc1
SSDEEP 12288:cDW21qkegf87CDok8qnrytrqmlH0SMTWm+eC+CJYjlFbaH3CWnRO8Ot6E8o9XOcl:Dt67AmFe6eOel0
TLSH
T1480694E08CEE159470BAC0533B57650041A9F00AB54E397DB54EDA38AF45A3BF3EB936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 220KB
SHA256 1379430897fbd2c96a92fb17e72b775385cd2bd74531a0591a36dc2b282ac83c
MD5 6072d4bb121af2aadbfad014a6700405
SHA1 4f2350ccfeb614047b8c9cd0a538c301dc0e3e57
SHA512 2f71226c7b7fa3c56eece56c2824c760afe0ffaf4193f5d7f3f5464a876ab6a52570f116ff77fc3552e9b6b8368bcaae4d8c9bd702c88f7cc214f3745c03073d
SSDEEP 1536:VqDBgQkW+ft3l2VKtV17YFBB1TRaO0WvSThYzjbCfMeSxRg/q7F2ta4si+zSHVyn:+kW+n2VKtD7YFD2ECGOO
TLSH
T1A32461D488D91690B0BEC597678B54000175E22BFC1A3C7EB56EAA380F86933E7EF535
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 2.1MB
SHA256 3ff2a160069b0efa726c8edf86e11e7c4176ec1513ad0ae637fb53a3f9bf91c2
MD5 12410110597ed1cb832ce0da707d4c7e
SHA1 c482cdb731b821c479d8bf4c712903c9ab1ddca2
SHA512 9460b5137d3fd6c7657bffbbce0f189a7bade1e03fdc69cef5e658c0efa864a48b878e8080c1b03a663768de1395541fa5387bf88c1b90a2c26bf0d728b899b1
SSDEEP 12288:1S+JkOF3wIpyTLmmRyDXX+mKcfAIhGPsvm0q0c6ezHB3C/li5TL0zcvgNI0fBTjI:yWOr9
TLSH
T113A591E08DED149031B9C0522B63610145AAF01EF9063CBDB69EC6389F56B77E3E7936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads