Overview

overview

4

Static

static

1

MacOS/fsck_NTFS

macos-10.15-amd64

4

MacOS/ntfs...stantd

macos-10.15-amd64

1

MacOS/ntfsd

macos-10.15-amd64

1

MacOS/ntfs...elperd

macos-10.15-amd64

1

Analysis

  • max time kernel
    145s
  • max time network
    112s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    08/08/2026, 04:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    MacOS/ntfsassistantd.app/Contents/MacOS/ntfsassistantd
  • Size 149KB
  • Sample260808-e57aqattfy
  • SHA256 b134203ae3352f2bcf69658f4728f1108afe92af5d2c8e1ac71a70aff4407ecb
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
1/10

Malware Config

Signatures

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/MacOS/ntfsassistantd.app/Contents/MacOS/ntfsassistantd\""
    1⤵
      PID:472
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/MacOS/ntfsassistantd.app/Contents/MacOS/ntfsassistantd\""
      1⤵
        PID:472
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/MacOS/ntfsassistantd.app/Contents/MacOS/ntfsassistantd
        1⤵
          PID:472
          • /bin/zsh
            /bin/zsh -c /Users/run/MacOS/ntfsassistantd.app/Contents/MacOS/ntfsassistantd
            2⤵
              PID:473
            • /Users/run/MacOS/ntfsassistantd.app/Contents/MacOS/ntfsassistantd
              /Users/run/MacOS/ntfsassistantd.app/Contents/MacOS/ntfsassistantd
              2⤵
                PID:473
            • /bin/sh
              sh -c "killall -9 ntfshelperd"
              1⤵
                PID:474
              • /bin/bash
                sh -c "killall -9 ntfshelperd"
                1⤵
                  PID:474
                • /usr/bin/killall
                  killall -9 ntfshelperd
                  1⤵
                    PID:474
                  • /bin/sh
                    sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                    1⤵
                      PID:475
                    • /bin/bash
                      sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                      1⤵
                        PID:475
                        • /bin/launchctl
                          launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                          2⤵
                            PID:476
                          • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                            /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                            2⤵
                              PID:476
                          • /bin/sh
                            sh -c "mkdir /private/var/iboysoft"
                            1⤵
                              PID:477
                            • /bin/bash
                              sh -c "mkdir /private/var/iboysoft"
                              1⤵
                                PID:477
                              • /bin/mkdir
                                mkdir /private/var/iboysoft
                                1⤵
                                  PID:477
                                • /bin/sh
                                  sh -c "chmod -R 777 /private/var/iboysoft"
                                  1⤵
                                    PID:478
                                  • /bin/bash
                                    sh -c "chmod -R 777 /private/var/iboysoft"
                                    1⤵
                                      PID:478
                                    • /bin/chmod
                                      chmod -R 777 /private/var/iboysoft
                                      1⤵
                                        PID:478
                                      • /bin/sh
                                        sh -c "chmod -R 777 /private/var/tmp/com.iBoysoft.NTFS-Assistant-website"
                                        1⤵
                                          PID:479
                                        • /bin/bash
                                          sh -c "chmod -R 777 /private/var/tmp/com.iBoysoft.NTFS-Assistant-website"
                                          1⤵
                                            PID:479
                                          • /bin/chmod
                                            chmod -R 777 /private/var/tmp/com.iBoysoft.NTFS-Assistant-website
                                            1⤵
                                              PID:479
                                            • /bin/sh
                                              sh -c "chmod -R 777 /private/var/tmp/com.iBoysoft.NTFS-Assistant-website-zh"
                                              1⤵
                                                PID:480
                                              • /bin/bash
                                                sh -c "chmod -R 777 /private/var/tmp/com.iBoysoft.NTFS-Assistant-website-zh"
                                                1⤵
                                                  PID:480
                                                • /bin/chmod
                                                  chmod -R 777 /private/var/tmp/com.iBoysoft.NTFS-Assistant-website-zh
                                                  1⤵
                                                    PID:480
                                                  • /bin/sh
                                                    sh -c "chmod -R 777 /private/var/tmp/com.iBoysoft.NTFS-Assistant-website-setapp"
                                                    1⤵
                                                      PID:481
                                                    • /bin/bash
                                                      sh -c "chmod -R 777 /private/var/tmp/com.iBoysoft.NTFS-Assistant-website-setapp"
                                                      1⤵
                                                        PID:481
                                                      • /bin/chmod
                                                        chmod -R 777 /private/var/tmp/com.iBoysoft.NTFS-Assistant-website-setapp
                                                        1⤵
                                                          PID:481
                                                        • /bin/sh
                                                          sh -c "killall -9 ntfshelperd"
                                                          1⤵
                                                            PID:482
                                                          • /bin/bash
                                                            sh -c "killall -9 ntfshelperd"
                                                            1⤵
                                                              PID:482
                                                            • /usr/bin/killall
                                                              killall -9 ntfshelperd
                                                              1⤵
                                                                PID:482
                                                              • /bin/sh
                                                                sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                1⤵
                                                                  PID:483
                                                                • /bin/bash
                                                                  sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                  1⤵
                                                                    PID:483
                                                                    • /bin/launchctl
                                                                      launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                      2⤵
                                                                        PID:484
                                                                      • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                        /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                        2⤵
                                                                          PID:484
                                                                      • /bin/sh
                                                                        sh -c "killall -9 ntfshelperd"
                                                                        1⤵
                                                                          PID:510
                                                                        • /bin/bash
                                                                          sh -c "killall -9 ntfshelperd"
                                                                          1⤵
                                                                            PID:510
                                                                          • /usr/bin/killall
                                                                            killall -9 ntfshelperd
                                                                            1⤵
                                                                              PID:510
                                                                            • /bin/sh
                                                                              sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                              1⤵
                                                                                PID:511
                                                                              • /bin/bash
                                                                                sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                1⤵
                                                                                  PID:511
                                                                                  • /bin/launchctl
                                                                                    launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                    2⤵
                                                                                      PID:512
                                                                                    • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                      /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                      2⤵
                                                                                        PID:512
                                                                                    • /bin/sh
                                                                                      sh -c "killall -9 ntfshelperd"
                                                                                      1⤵
                                                                                        PID:514
                                                                                      • /bin/bash
                                                                                        sh -c "killall -9 ntfshelperd"
                                                                                        1⤵
                                                                                          PID:514
                                                                                        • /usr/bin/killall
                                                                                          killall -9 ntfshelperd
                                                                                          1⤵
                                                                                            PID:514
                                                                                          • /bin/sh
                                                                                            sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                            1⤵
                                                                                              PID:517
                                                                                            • /bin/bash
                                                                                              sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                              1⤵
                                                                                                PID:517
                                                                                                • /bin/launchctl
                                                                                                  launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                  2⤵
                                                                                                    PID:518
                                                                                                  • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                    /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                    2⤵
                                                                                                      PID:518
                                                                                                  • /bin/sh
                                                                                                    sh -c "killall -9 ntfshelperd"
                                                                                                    1⤵
                                                                                                      PID:523
                                                                                                    • /bin/bash
                                                                                                      sh -c "killall -9 ntfshelperd"
                                                                                                      1⤵
                                                                                                        PID:523
                                                                                                      • /usr/bin/killall
                                                                                                        killall -9 ntfshelperd
                                                                                                        1⤵
                                                                                                          PID:523
                                                                                                        • /bin/sh
                                                                                                          sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                          1⤵
                                                                                                            PID:524
                                                                                                          • /bin/bash
                                                                                                            sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                            1⤵
                                                                                                              PID:524
                                                                                                              • /bin/launchctl
                                                                                                                launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                2⤵
                                                                                                                  PID:525
                                                                                                                • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                  /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                  2⤵
                                                                                                                    PID:525
                                                                                                                • /bin/sh
                                                                                                                  sh -c "killall -9 ntfshelperd"
                                                                                                                  1⤵
                                                                                                                    PID:526
                                                                                                                  • /bin/bash
                                                                                                                    sh -c "killall -9 ntfshelperd"
                                                                                                                    1⤵
                                                                                                                      PID:526
                                                                                                                    • /usr/bin/killall
                                                                                                                      killall -9 ntfshelperd
                                                                                                                      1⤵
                                                                                                                        PID:526
                                                                                                                      • /bin/sh
                                                                                                                        sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                        1⤵
                                                                                                                          PID:527
                                                                                                                        • /bin/bash
                                                                                                                          sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                          1⤵
                                                                                                                            PID:527
                                                                                                                            • /bin/launchctl
                                                                                                                              launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                              2⤵
                                                                                                                                PID:528
                                                                                                                              • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                2⤵
                                                                                                                                  PID:528
                                                                                                                              • /bin/sh
                                                                                                                                sh -c "killall -9 ntfshelperd"
                                                                                                                                1⤵
                                                                                                                                  PID:529
                                                                                                                                • /bin/bash
                                                                                                                                  sh -c "killall -9 ntfshelperd"
                                                                                                                                  1⤵
                                                                                                                                    PID:529
                                                                                                                                  • /usr/bin/killall
                                                                                                                                    killall -9 ntfshelperd
                                                                                                                                    1⤵
                                                                                                                                      PID:529
                                                                                                                                    • /bin/sh
                                                                                                                                      sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                      1⤵
                                                                                                                                        PID:530
                                                                                                                                      • /bin/bash
                                                                                                                                        sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                        1⤵
                                                                                                                                          PID:530
                                                                                                                                          • /bin/launchctl
                                                                                                                                            launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                            2⤵
                                                                                                                                              PID:531
                                                                                                                                            • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                              /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                              2⤵
                                                                                                                                                PID:531
                                                                                                                                            • /bin/sh
                                                                                                                                              sh -c "killall -9 ntfshelperd"
                                                                                                                                              1⤵
                                                                                                                                                PID:532
                                                                                                                                              • /bin/bash
                                                                                                                                                sh -c "killall -9 ntfshelperd"
                                                                                                                                                1⤵
                                                                                                                                                  PID:532
                                                                                                                                                • /usr/bin/killall
                                                                                                                                                  killall -9 ntfshelperd
                                                                                                                                                  1⤵
                                                                                                                                                    PID:532
                                                                                                                                                  • /bin/sh
                                                                                                                                                    sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                    1⤵
                                                                                                                                                      PID:533
                                                                                                                                                    • /bin/bash
                                                                                                                                                      sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                      1⤵
                                                                                                                                                        PID:533
                                                                                                                                                        • /bin/launchctl
                                                                                                                                                          launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                          2⤵
                                                                                                                                                            PID:534
                                                                                                                                                          • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                            /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                            2⤵
                                                                                                                                                              PID:534
                                                                                                                                                          • /bin/sh
                                                                                                                                                            sh -c "killall -9 ntfshelperd"
                                                                                                                                                            1⤵
                                                                                                                                                              PID:538
                                                                                                                                                            • /bin/bash
                                                                                                                                                              sh -c "killall -9 ntfshelperd"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:538
                                                                                                                                                              • /usr/bin/killall
                                                                                                                                                                killall -9 ntfshelperd
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:538
                                                                                                                                                                • /bin/sh
                                                                                                                                                                  sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:539
                                                                                                                                                                  • /bin/bash
                                                                                                                                                                    sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:539
                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                        launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                        2⤵
                                                                                                                                                                          PID:540
                                                                                                                                                                        • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                          /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                          2⤵
                                                                                                                                                                            PID:540
                                                                                                                                                                        • /bin/sh
                                                                                                                                                                          sh -c "killall -9 ntfshelperd"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:541
                                                                                                                                                                          • /bin/bash
                                                                                                                                                                            sh -c "killall -9 ntfshelperd"
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:541
                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                              killall -9 ntfshelperd
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:541
                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:542
                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                  sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:542
                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                      launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                      2⤵
                                                                                                                                                                                        PID:543
                                                                                                                                                                                      • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                        /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                        2⤵
                                                                                                                                                                                          PID:543
                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                        sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:544
                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                          sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:544
                                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                                            killall -9 ntfshelperd
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:544
                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                              sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:545
                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:545
                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                    launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:546
                                                                                                                                                                                                    • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                      /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:546
                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                      sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:547
                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                        sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:547
                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                          killall -9 ntfshelperd
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:547
                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                            sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:548
                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                              sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:548
                                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                                  launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:549
                                                                                                                                                                                                                  • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                    /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                      PID:549
                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                    sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:551
                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                      sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:551
                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                        killall -9 ntfshelperd
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:551
                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                          sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:552
                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                            sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:552
                                                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                                                launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                  PID:553
                                                                                                                                                                                                                                • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                  /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                    PID:553
                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                  sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                    PID:554
                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                    sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                      PID:554
                                                                                                                                                                                                                                    • /usr/bin/killall
                                                                                                                                                                                                                                      killall -9 ntfshelperd
                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                        PID:554
                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                        sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                          PID:555
                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                          sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                            PID:555
                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                              launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                PID:556
                                                                                                                                                                                                                                              • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                  PID:556
                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                  PID:557
                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                  sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                    PID:557
                                                                                                                                                                                                                                                  • /usr/bin/killall
                                                                                                                                                                                                                                                    killall -9 ntfshelperd
                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                      PID:557
                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                      sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                        PID:558
                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                        sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                          PID:558
                                                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                                                            launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                              PID:559
                                                                                                                                                                                                                                                            • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                              /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                PID:559
                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                              sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                PID:560
                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                  PID:560
                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                  killall -9 ntfshelperd
                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                    PID:560
                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                    sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                      PID:561
                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                      sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                        PID:561
                                                                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                                                                          launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                            PID:562
                                                                                                                                                                                                                                                                          • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                            /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                              PID:562
                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                            sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                              PID:565
                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                              sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                PID:565
                                                                                                                                                                                                                                                                              • /usr/bin/killall
                                                                                                                                                                                                                                                                                killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                  PID:565
                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                  sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                    PID:566
                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                    sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                      PID:566
                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                        launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                          PID:567
                                                                                                                                                                                                                                                                                        • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                          /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                            PID:567
                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                          sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                            PID:570
                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                            sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                              PID:570
                                                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                                                              killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                PID:570
                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                  PID:571
                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                  sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                    PID:571
                                                                                                                                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                                                                                                                                      launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                        PID:572
                                                                                                                                                                                                                                                                                                      • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                        /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                          PID:572
                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                        sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                          PID:573
                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                          sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                            PID:573
                                                                                                                                                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                                                                                                                                                            killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                              PID:573
                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                              sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                PID:574
                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                  PID:574
                                                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                                                    launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                      PID:575
                                                                                                                                                                                                                                                                                                                    • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                      /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                        PID:575
                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                      sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                        PID:576
                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                        sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                          PID:576
                                                                                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                          killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                            PID:576
                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                            sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                              PID:577
                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                              sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                PID:577
                                                                                                                                                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                  launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                    PID:578
                                                                                                                                                                                                                                                                                                                                  • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                    /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                      PID:578
                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                    sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                      PID:579
                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                      sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                        PID:579
                                                                                                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                        killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                          PID:579
                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                          sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                            PID:580
                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                            sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                              PID:580
                                                                                                                                                                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                  PID:581
                                                                                                                                                                                                                                                                                                                                                • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                  /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                    PID:581
                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                  sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                    PID:582
                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                    sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                      PID:582
                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                      killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                        PID:582
                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                        sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                          PID:583
                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                          sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                            PID:583
                                                                                                                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                              launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                PID:584
                                                                                                                                                                                                                                                                                                                                                              • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:584
                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                  PID:585
                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                  sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                    PID:585
                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                    killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                      PID:585
                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                      sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                        PID:586
                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                        sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                          PID:586
                                                                                                                                                                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                            launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                              PID:587
                                                                                                                                                                                                                                                                                                                                                                            • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                              /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:587
                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                              sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                PID:588
                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                  PID:588
                                                                                                                                                                                                                                                                                                                                                                                • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                  killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                    PID:588
                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                    sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                      PID:589
                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                      sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                        PID:589
                                                                                                                                                                                                                                                                                                                                                                                        • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                          launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                            PID:590
                                                                                                                                                                                                                                                                                                                                                                                          • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                            /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:590
                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                            sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                              PID:591
                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                              sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                PID:591
                                                                                                                                                                                                                                                                                                                                                                                              • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                  PID:591
                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                    PID:592
                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                      PID:592
                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                        launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                          PID:593
                                                                                                                                                                                                                                                                                                                                                                                                        • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                          /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                          2⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:593
                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                            PID:594
                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                              PID:594
                                                                                                                                                                                                                                                                                                                                                                                                            • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                              killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                PID:594
                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                  PID:595
                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                    PID:595
                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                      launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                        PID:596
                                                                                                                                                                                                                                                                                                                                                                                                                      • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                        /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                        2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:596
                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                          PID:597
                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                            PID:597
                                                                                                                                                                                                                                                                                                                                                                                                                          • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                            killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                              PID:597
                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                PID:598
                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:598
                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                    launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:599
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                      /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:599
                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:600
                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:600
                                                                                                                                                                                                                                                                                                                                                                                                                                        • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                                          killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:600
                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:601
                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                              sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:601
                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                  launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:602
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                    /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:602
                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:603
                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:603
                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                                                        killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:603
                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                            sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:604
                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:605
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:605
                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:606
                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:606
                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:606
                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:607
                                                                                                                                                                                                                                                                                                                                                                                                                                                                        • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            PID:607
                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:608
                                                                                                                                                                                                                                                                                                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  PID:609
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  sh -c "killall -9 ntfshelperd"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    PID:609
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  • /usr/bin/killall
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    killall -9 ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      PID:609
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    • /bin/sh
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        PID:610
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      • /bin/bash
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        sh -c "launchctl asuser 502 '/Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd' &"
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          PID:610
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                          • /bin/launchctl
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            launchctl asuser 502 /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              PID:611
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            • /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              /Users/run/MacOS/ntfshelperd.app/Contents/MacOS/ntfshelperd
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                PID:611

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  MITRE ATT&CK Matrix

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  Downloads