Overview

overview

7

Static

static

3

Begin.exe

windows11-ltsc_2024-x64

7

Begin.exe

macos-10.15-amd64

4

Resubmissions

10/08/2026, 22:52

260810-2th53sv1cx7

10/08/2026, 22:48

260810-2rgt8szhrh8

Analysis

  • user interaction
    yes
  • max time kernel
    145s
  • max time network
    151s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    10/08/2026, 22:52

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    Begin.exe
  • Size 6.6MB
  • Sample260810-2th53sv1cx
  • SHA256 455fb8f05b964ace856d5b761cdae6e09e33a1a3dcba0097ac4a1d749aa24acd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
4/10
defense_evasion

Malware Config

Signatures

  • Resource Forking 1 TTPs 10 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

    defense_evasion

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"/Users/run/Begin.exe\""
    1⤵
      PID:497
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"/Users/run/Begin.exe\""
      1⤵
        PID:497
      • /usr/bin/sudo
        sudo /bin/zsh -c /Users/run/Begin.exe
        1⤵
          PID:497
          • /bin/zsh
            /bin/zsh -c /Users/run/Begin.exe
            2⤵
              PID:499
            • /Users/run/Begin.exe
              /Users/run/Begin.exe
              2⤵
                PID:499
            • /usr/libexec/xpcproxy
              xpcproxy com.apple.sysmond
              1⤵
                PID:504
              • /usr/libexec/sysmond
                /usr/libexec/sysmond
                1⤵
                  PID:504
                • /usr/libexec/xpcproxy
                  xpcproxy com.apple.audio.systemsoundserverd
                  1⤵
                    PID:506
                  • /usr/sbin/systemsoundserverd
                    /usr/sbin/systemsoundserverd
                    1⤵
                      PID:506
                    • /usr/libexec/xpcproxy
                      xpcproxy com.apple.audio.AudioComponentRegistrar
                      1⤵
                        PID:507
                      • /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
                        /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
                        1⤵
                          PID:507
                        • /usr/libexec/xpcproxy
                          xpcproxy com.apple.spindump
                          1⤵
                            PID:511
                          • /usr/sbin/spindump
                            /usr/sbin/spindump
                            1⤵
                              PID:511
                            • /usr/libexec/xpcproxy
                              xpcproxy com.apple.tailspind
                              1⤵
                                PID:513
                              • /usr/libexec/tailspind
                                /usr/libexec/tailspind
                                1⤵
                                  PID:513
                                • /usr/libexec/xpcproxy
                                  xpcproxy com.apple.spindump_agent
                                  1⤵
                                    PID:514
                                  • /usr/libexec/spindump_agent
                                    /usr/libexec/spindump_agent
                                    1⤵
                                      PID:514
                                    • /usr/libexec/xpcproxy
                                      xpcproxy com.apple.systemprofiler
                                      1⤵
                                        PID:521
                                      • /System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
                                        "/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
                                        1⤵
                                          PID:521
                                        • /usr/libexec/xpcproxy
                                          xpcproxy com.apple.replayd
                                          1⤵
                                            PID:524
                                          • /usr/libexec/replayd
                                            /usr/libexec/replayd
                                            1⤵
                                              PID:524
                                            • /usr/libexec/xpcproxy
                                              xpcproxy com.apple.ReportMemoryException
                                              1⤵
                                                PID:525
                                              • /usr/libexec/xpcproxy
                                                xpcproxy com.apple.storedownloadd
                                                1⤵
                                                  PID:526
                                                • /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                                  /System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
                                                  1⤵
                                                    PID:526
                                                  • /usr/libexec/xpcproxy
                                                    xpcproxy com.apple.installd
                                                    1⤵
                                                      PID:528
                                                    • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                                      /System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
                                                      1⤵
                                                        PID:528
                                                      • /usr/libexec/xpcproxy
                                                        xpcproxy com.apple.system_installd
                                                        1⤵
                                                          PID:530
                                                        • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                                          /System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
                                                          1⤵
                                                            PID:530
                                                          • /usr/libexec/ReportMemoryException
                                                            /usr/libexec/ReportMemoryException
                                                            1⤵
                                                              PID:525
                                                            • /usr/libexec/xpcproxy
                                                              xpcproxy com.apple.Safari.CacheDeleteExtension 522
                                                              1⤵
                                                                PID:532
                                                              • /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                                /Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
                                                                1⤵
                                                                  PID:532
                                                                • /usr/libexec/xpcproxy
                                                                  xpcproxy com.apple.nsurlstoraged
                                                                  1⤵
                                                                    PID:535
                                                                  • /usr/libexec/nsurlstoraged
                                                                    /usr/libexec/nsurlstoraged --privileged
                                                                    1⤵
                                                                      PID:535
                                                                    • /usr/libexec/xpcproxy
                                                                      xpcproxy com.apple.StreamingUnzipService 186
                                                                      1⤵
                                                                        PID:539
                                                                      • /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                                                        /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
                                                                        1⤵
                                                                          PID:539
                                                                        • /usr/libexec/xpcproxy
                                                                          xpcproxy com.apple.Photos.StorageManagementExtension 521
                                                                          1⤵
                                                                            PID:540
                                                                          • /System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
                                                                            /System/Applications/Photos.app/Contents/PlugIns/PhotosStorageExtension.appex/Contents/MacOS/PhotosStorageExtension
                                                                            1⤵
                                                                              PID:540
                                                                            • /System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
                                                                              /System/Applications/Podcasts.app/Contents/PlugIns/MacPodcastsStorageExtension.appex/Contents/MacOS/MacPodcastsStorageExtension
                                                                              1⤵
                                                                                PID:541
                                                                              • /usr/libexec/xpcproxy
                                                                                xpcproxy com.apple.messages.StorageManagementExtension 521
                                                                                1⤵
                                                                                  PID:542
                                                                                • /System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension
                                                                                  "/System/Applications/Messages.app/Contents/PlugIns/Messages Storage Management Extension.appex/Contents/MacOS/Messages Storage Management Extension"
                                                                                  1⤵
                                                                                    PID:542
                                                                                  • /usr/libexec/xpcproxy
                                                                                    xpcproxy com.apple.STMExtension.GarageBand 521
                                                                                    1⤵
                                                                                      PID:543
                                                                                    • /usr/libexec/xpcproxy
                                                                                      xpcproxy com.apple.CloudDocsDaemon.StorageManagement 521
                                                                                      1⤵
                                                                                        PID:544
                                                                                      • /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
                                                                                        /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/GarageBandStorageExtension.appex/Contents/MacOS/GarageBandStorageExtension
                                                                                        1⤵
                                                                                          PID:543
                                                                                        • /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
                                                                                          /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/PlugIns/CloudDocsStorageManagement.appex/Contents/MacOS/CloudDocsStorageManagement
                                                                                          1⤵
                                                                                            PID:544
                                                                                          • /usr/libexec/xpcproxy
                                                                                            xpcproxy com.apple.STMExtension.Mail 521
                                                                                            1⤵
                                                                                              PID:545
                                                                                            • /System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
                                                                                              /System/Applications/Mail.app/Contents/PlugIns/MailStorageManagement.appex/Contents/MacOS/MailStorageManagement
                                                                                              1⤵
                                                                                                PID:545
                                                                                              • /usr/libexec/xpcproxy
                                                                                                xpcproxy com.apple.STMExtension.Trash 521
                                                                                                1⤵
                                                                                                  PID:546
                                                                                                • /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
                                                                                                  /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/TrashStorageExtension.appex/Contents/MacOS/TrashStorageExtension
                                                                                                  1⤵
                                                                                                    PID:546
                                                                                                  • /usr/libexec/xpcproxy
                                                                                                    xpcproxy com.apple.STMExtension.AppleInternal 521
                                                                                                    1⤵
                                                                                                      PID:548
                                                                                                    • /System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
                                                                                                      /System/Applications/TV.app/Contents/PlugIns/TVStorageExtension.appex/Contents/MacOS/TVStorageExtension
                                                                                                      1⤵
                                                                                                        PID:547
                                                                                                      • /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
                                                                                                        /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/AppleInternalStorageExtension.appex/Contents/MacOS/AppleInternalStorageExtension
                                                                                                        1⤵
                                                                                                          PID:548
                                                                                                        • /usr/libexec/xpcproxy
                                                                                                          xpcproxy com.apple.STMExtension.OtherUsers 521
                                                                                                          1⤵
                                                                                                            PID:550
                                                                                                          • /System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
                                                                                                            /System/Applications/Music.app/Contents/PlugIns/MusicStorageExtension.appex/Contents/MacOS/MusicStorageExtension
                                                                                                            1⤵
                                                                                                              PID:549
                                                                                                            • /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
                                                                                                              /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/OtherUsersStorageExtension.appex/Contents/MacOS/OtherUsersStorageExtension
                                                                                                              1⤵
                                                                                                                PID:550
                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                xpcproxy com.apple.STMExtension.Applications 521
                                                                                                                1⤵
                                                                                                                  PID:551
                                                                                                                • /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
                                                                                                                  /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/ApplicationsStorageExtension.appex/Contents/MacOS/ApplicationsStorageExtension
                                                                                                                  1⤵
                                                                                                                    PID:551
                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                    xpcproxy com.apple.STMExtension.iOSFiles 521
                                                                                                                    1⤵
                                                                                                                      PID:552
                                                                                                                    • /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
                                                                                                                      /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/iOSFilesStorageExtension.appex/Contents/MacOS/iOSFilesStorageExtension
                                                                                                                      1⤵
                                                                                                                        PID:552
                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                        xpcproxy com.apple.STMExtension.CloudFiles 521
                                                                                                                        1⤵
                                                                                                                          PID:553
                                                                                                                        • /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
                                                                                                                          /System/Library/PrivateFrameworks/StorageManagement.framework/PlugIns/CloudFilesStorageExtension.appex/Contents/MacOS/CloudFilesStorageExtension
                                                                                                                          1⤵
                                                                                                                            PID:553
                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                            xpcproxy com.apple.iBooksX.DiskSpaceEfficiency
                                                                                                                            1⤵
                                                                                                                              PID:554
                                                                                                                            • /System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
                                                                                                                              /System/Applications/Books.app/Contents/PlugIns/DiskSpaceEfficiency.appex/Contents/MacOS/DiskSpaceEfficiency
                                                                                                                              1⤵
                                                                                                                                PID:554
                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                xpcproxy com.apple.CloudPhotosConfiguration
                                                                                                                                1⤵
                                                                                                                                  PID:555
                                                                                                                                • /System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
                                                                                                                                  /System/Library/PrivateFrameworks/CloudPhotoServices.framework/Versions/A/XPCServices/com.apple.CloudPhotosConfiguration.xpc/Contents/MacOS/com.apple.CloudPhotosConfiguration
                                                                                                                                  1⤵
                                                                                                                                    PID:555
                                                                                                                                  • /bin/launchctl
                                                                                                                                    /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
                                                                                                                                    1⤵
                                                                                                                                      PID:562
                                                                                                                                    • /bin/launchctl
                                                                                                                                      /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
                                                                                                                                      1⤵
                                                                                                                                        PID:563
                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                        xpcproxy com.apple.automountd
                                                                                                                                        1⤵
                                                                                                                                          PID:564
                                                                                                                                        • /usr/libexec/automountd
                                                                                                                                          automountd
                                                                                                                                          1⤵
                                                                                                                                            PID:564
                                                                                                                                            • /usr/libexec/od_user_homes
                                                                                                                                              /usr/libexec/od_user_homes .localized
                                                                                                                                              2⤵
                                                                                                                                                PID:565
                                                                                                                                              • /usr/libexec/od_user_homes
                                                                                                                                                /usr/libexec/od_user_homes .localized
                                                                                                                                                2⤵
                                                                                                                                                  PID:568
                                                                                                                                                • /usr/libexec/od_user_homes
                                                                                                                                                  /usr/libexec/od_user_homes .localized
                                                                                                                                                  2⤵
                                                                                                                                                    PID:581
                                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                                  xpcproxy com.apple.installandsetup.systemmigrationd
                                                                                                                                                  1⤵
                                                                                                                                                    PID:566
                                                                                                                                                  • /System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
                                                                                                                                                    /System/Library/PrivateFrameworks/SystemMigration.framework/Resources/systemmigrationd
                                                                                                                                                    1⤵
                                                                                                                                                      PID:566
                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                      xpcproxy com.apple.storagekitd
                                                                                                                                                      1⤵
                                                                                                                                                        PID:567
                                                                                                                                                      • /System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
                                                                                                                                                        /System/Library/PrivateFrameworks/StorageKit.framework/Resources/storagekitd
                                                                                                                                                        1⤵
                                                                                                                                                          PID:567
                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                          xpcproxy com.apple.iconservices.iconservicesagent
                                                                                                                                                          1⤵
                                                                                                                                                            PID:569
                                                                                                                                                          • /System/Library/CoreServices/iconservicesagent
                                                                                                                                                            /System/Library/CoreServices/iconservicesagent runAsRoot
                                                                                                                                                            1⤵
                                                                                                                                                              PID:569
                                                                                                                                                            • /usr/libexec/xpcproxy
                                                                                                                                                              xpcproxy com.apple.quicklook.satellite.666A742C-33E3-49A7-B64A-C8E71B266EC4 518
                                                                                                                                                              1⤵
                                                                                                                                                                PID:570
                                                                                                                                                              • /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
                                                                                                                                                                /System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:570
                                                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                                                  xpcproxy com.apple.softwareupdated
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:574
                                                                                                                                                                  • /System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
                                                                                                                                                                    "/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:574
                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                      xpcproxy com.apple.suhelperd
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:575
                                                                                                                                                                      • /System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
                                                                                                                                                                        "/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:575
                                                                                                                                                                        • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor
                                                                                                                                                                          /System/Library/PrivateFrameworks/PackageKit.framework/Resources/install_monitor -t /private/var/run/installd.commit.pid
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:578
                                                                                                                                                                          • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove
                                                                                                                                                                            /System/Library/PrivateFrameworks/PackageKit.framework/Resources/shove -f -s /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/BF964985-4B76-4F08-99AD-90107C570908.activeSandbox/Root /
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:579
                                                                                                                                                                            • /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update
                                                                                                                                                                              /System/Library/PrivateFrameworks/PackageKit.framework/Resources/efw_cache_update -c
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:580
                                                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                                                xpcproxy com.apple.ReportCrash.Root
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:582
                                                                                                                                                                                • /System/Library/CoreServices/ReportCrash
                                                                                                                                                                                  /System/Library/CoreServices/ReportCrash daemon
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:582
                                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                                    xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:583
                                                                                                                                                                                    • /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                                      /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:583
                                                                                                                                                                                      • /usr/libexec/xpcproxy
                                                                                                                                                                                        xpcproxy com.apple.mobile.keybagd
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:584
                                                                                                                                                                                        • /usr/libexec/keybagd
                                                                                                                                                                                          /usr/libexec/keybagd -t 15
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:584
                                                                                                                                                                                          • /usr/libexec/xpcproxy
                                                                                                                                                                                            xpcproxy com.apple.ReportMemoryException
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:585
                                                                                                                                                                                            • /usr/libexec/ReportMemoryException
                                                                                                                                                                                              /usr/libexec/ReportMemoryException
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:585
                                                                                                                                                                                              • /bin/sh
                                                                                                                                                                                                sh -c /usr/sbin/kextstat
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:586
                                                                                                                                                                                                • /bin/bash
                                                                                                                                                                                                  sh -c /usr/sbin/kextstat
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:586
                                                                                                                                                                                                  • /usr/sbin/kextstat
                                                                                                                                                                                                    /usr/sbin/kextstat
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:586
                                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                                      xpcproxy com.apple.ViewBridgeAuxiliary
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:587
                                                                                                                                                                                                      • /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                                                                                                                                                                                        /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:587
                                                                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                                                                          xpcproxy com.apple.mobileassetd
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:589
                                                                                                                                                                                                          • /usr/libexec/mobileassetd
                                                                                                                                                                                                            /usr/libexec/mobileassetd
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:589

                                                                                                                                                                                                            Network

                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                  com.apple.pkg.IncompatibleAppList.10_15.16U1923.bom
                                                                                                                                                                                                                  • Path /Library/Apple/System/Library/InstallerSandboxes/.PKInstallSandboxManager-SystemSoftware/BF964985-4B76-4F08-99AD-90107C570908.activeSandbox/Boms/com.apple.pkg.IncompatibleAppList.10_15.16U1923.bom
                                                                                                                                                                                                                  • Size 61KB
                                                                                                                                                                                                                  • SHA256 4bde0dc120c8239b758f62e655e23be5f09b41f32f666bffa05e0104e8109d46
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  tailspin-trace.2026-08-10_22-53-50.tailspin
                                                                                                                                                                                                                  • Path /private/var/db/spindump/tailspin-trace.2026-08-10_22-53-50.tailspin
                                                                                                                                                                                                                  • Size 16.7MB
                                                                                                                                                                                                                  • SHA256 343b933861fe990dd6c0070833796d0e207d92896de10f884150531db6e6f5e6
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  installd.commit.pid
                                                                                                                                                                                                                  • Path /private/var/run/installd.commit.pid
                                                                                                                                                                                                                  • Size 3B
                                                                                                                                                                                                                  • SHA256 87e29676d583c04a1682dbd5bc0d989f8311c888655ca66bc486b6f7f76d4702
                                                                                                                                                                                                                  • MD5 SHA1 SHA512
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  mdsDirectory.db
                                                                                                                                                                                                                  • Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.CloudPhotosConfiguration//mds/mdsDirectory.db
                                                                                                                                                                                                                  • Size 47KB
                                                                                                                                                                                                                  • SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  mdsObject.db
                                                                                                                                                                                                                  • Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/com.apple.CloudPhotosConfiguration//mds/mdsObject.db
                                                                                                                                                                                                                  • Size 4KB
                                                                                                                                                                                                                  • SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download

                                                                                                                                                                                                                  CFNetworkDownload_w5bu7Q.tmp
                                                                                                                                                                                                                  • Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/SMIncompatibleAppUpdate/CFNetworkDownload_w5bu7Q.tmp
                                                                                                                                                                                                                  • Size 324KB
                                                                                                                                                                                                                  • SHA256 a0ee16e403dd8609ce56b56a111b2926b591d368b6e99a41c836beb280dcf687
                                                                                                                                                                                                                  • MD5 SHA1 SHA512 SSDEEP TLSH
                                                                                                                                                                                                                  Submit Download