ad3cb06ad5444b5c599ba3b4023974e1da7630cd392b7e6fc9b6e6fed1e7e404

Analysis

user interaction
yes
max time kernel
120s
max time network
122s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
14/08/2026, 17:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
tsetup-x64.7.0.9.exe
Size 52.0MB
Sample260814-vh697sysfz
SHA256 ad3cb06ad5444b5c599ba3b4023974e1da7630cd392b7e6fc9b6e6fed1e7e404
MD5 fba73efb30063377c4d2f3bcc3c421fd
SHA1 7776e26153d1bcca8c31df792786841f9af0cb69
SHA512 f96dc8cf32ee16eed31c33891a839a5ea2003cc4f3061c666fc24b9c9dfc38e5bc32f7a5a55489df8b1088c367da3f549a985aa1ebc3d4d4272b591bfc2d33a5
SSDEEP 1572864:/XP/NhixzznPSdLlVHIQ9qQFO1Y9kmsGTLeap8AyA5s:nOTS7qjPb+eu95s
TLSH
T1CFC7336A72CBF07DE50D1B7706B6E345A8F76965F026AD2387E48088CE611206E3F717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 11 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"	Process not Found
/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager	Process not Found
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd	Process not Found
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool	Process not Found
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool	Process not Found
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck	Process not Found
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref	Process not Found
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool	Process not Found
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/tsetup-x64.7.0.9.exe\""
1⤵
PID:457

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/tsetup-x64.7.0.9.exe\""
1⤵
PID:457

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/tsetup-x64.7.0.9.exe
1⤵
PID:457
- /bin/zsh
  /bin/zsh -c /Users/run/tsetup-x64.7.0.9.exe
  2⤵
  PID:458
- /Users/run/tsetup-x64.7.0.9.exe
  /Users/run/tsetup-x64.7.0.9.exe
  2⤵
  PID:458

/usr/libexec/xpcproxy
xpcproxy com.apple.quicklook.satellite.B73201A3-3DBD-4E8C-AF3C-D9484E6DE4D6 459
1⤵
PID:461

/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
/System/Library/Frameworks/QuickLook.framework/Versions/A/XPCServices/QuickLookSatellite.xpc/Contents/MacOS/QuickLookSatellite
1⤵
PID:461

/usr/libexec/xpcproxy
xpcproxy com.apple.systemprofiler
1⤵
PID:484

/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information
"/System/Applications/Utilities/System Information.app/Contents/MacOS/System Information"
1⤵
PID:484

/usr/libexec/xpcproxy
xpcproxy com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:487

/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
/System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
1⤵
PID:487

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:488

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:488

/usr/libexec/xpcproxy
xpcproxy com.apple.storedownloadd
1⤵
PID:490

/usr/libexec/xpcproxy
xpcproxy com.apple.installd
1⤵
PID:491

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
1⤵
PID:491

/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
/System/Library/PrivateFrameworks/CommerceKit.framework/Versions/A/Resources/storedownloadd
1⤵
PID:490

/usr/libexec/xpcproxy
xpcproxy com.apple.system_installd
1⤵
PID:492

/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/system_installd
1⤵
PID:492

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.CacheDeleteExtension 485
1⤵
PID:494

/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
/Applications/Safari.app/Contents/PlugIns/CacheDeleteExtension.appex/Contents/MacOS/CacheDeleteExtension
1⤵
PID:494

/usr/libexec/xpcproxy
xpcproxy com.apple.replayd
1⤵
PID:497

/usr/libexec/replayd
/usr/libexec/replayd
1⤵
PID:497

/usr/libexec/xpcproxy
xpcproxy com.apple.systempreferences.2140
1⤵
PID:504

/System/Applications/System Preferences.app/Contents/MacOS/System Preferences
"/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
1⤵
PID:504

/usr/libexec/xpcproxy
xpcproxy com.apple.metadata.mdwrite
1⤵
PID:505

/usr/libexec/xpcproxy
xpcproxy com.apple.AccountProfileRemoteViewService 504
1⤵
PID:506

/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
/System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
1⤵
PID:506

/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
/System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
1⤵
PID:508

/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
/System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
1⤵
PID:509

/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
/System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
1⤵
PID:510

/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
/System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
1⤵
PID:511

/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
/System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
1⤵
PID:512

/usr/libexec/xpcproxy
xpcproxy com.apple.nfcd
1⤵
PID:514

/usr/libexec/nfcd
/usr/libexec/nfcd
1⤵
PID:514

/usr/libexec/xpcproxy
xpcproxy com.apple.studentd
1⤵
PID:515

/usr/libexec/studentd
/usr/libexec/studentd
1⤵
PID:515

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:516

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:516

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:517

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.preferences.softwareupdate.remoteservice 504
1⤵
PID:518

/System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
/System/Library/PreferencePanes/SoftwareUpdate.prefPane/Contents/XPCServices/com.apple.preferences.softwareupdate.remoteservice.xpc/Contents/MacOS/com.apple.preferences.softwareupdate.remoteservice
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.softwareupdated
1⤵
PID:519

/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
"/System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated"
1⤵
PID:519

/usr/libexec/xpcproxy
xpcproxy com.apple.suhelperd
1⤵
PID:521

/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd
"/System/Library/CoreServices/Software Update.app/Contents/Resources/suhelperd"
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:524

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.SoftwareUpdateNotificationManager
1⤵
PID:525

/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager
/System/Library/PrivateFrameworks/SoftwareUpdate.framework/Resources/SoftwareUpdateNotificationManager.app/Contents/MacOS/SoftwareUpdateNotificationManager
1⤵
PID:525

/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues
/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues -z
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.rtcreportingd
1⤵
PID:530

/usr/libexec/rtcreportingd
/usr/libexec/rtcreportingd
1⤵
PID:530

/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues
/System/Library/SystemConfiguration/PrinterNotifications.bundle/Contents/MacOS/makequeues -z
1⤵
PID:531

/usr/libexec/xpcproxy
xpcproxy com.apple.security.agent
1⤵
PID:532

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/SecurityAgent.bundle/Contents/MacOS/SecurityAgent
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authhost.00000000-0000-0000-0000-0000000186A5
1⤵
PID:533

/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
/System/Library/Frameworks/Security.framework/Versions/A/MachServices/authorizationhost.bundle/Contents/MacOS/authorizationhost
1⤵
PID:533

/bin/sh
sh -c /usr/sbin/kextstat
1⤵
PID:534

/bin/bash
sh -c /usr/sbin/kextstat
1⤵
PID:534

/usr/sbin/kextstat
/usr/sbin/kextstat
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.2028
1⤵
PID:537

/Applications/Safari.app/Contents/MacOS/Safari
/Applications/Safari.app/Contents/MacOS/Safari
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.History
1⤵
PID:538

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.History.xpc/Contents/MacOS/com.apple.Safari.History
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.1BEA6A13-DB77-4C48-898C-FCDA50742809 537
1⤵
PID:539

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:544

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.A8B6B54E-B963-432D-968B-CC5E84F2B70D 537
1⤵
PID:545

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:545

/usr/libexec/xpcproxy
xpcproxy com.apple.StreamingUnzipService 195
1⤵
PID:546

/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
/System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SearchHelper 537
1⤵
PID:548

/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
/System/Library/PrivateFrameworks/SafariShared.framework/Versions/A/XPCServices/com.apple.Safari.SearchHelper.xpc/Contents/MacOS/com.apple.Safari.SearchHelper
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy com.apple.Safari.SafeBrowsing.Service
1⤵
PID:549

/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
/System/Library/PrivateFrameworks/SafariSafeBrowsing.framework/com.apple.Safari.SafeBrowsing.Service
1⤵
PID:549

/usr/libexec/xpcproxy
xpcproxy com.apple.WebKit.WebContent.2174E32F-6E7A-4625-B412-72E55B7B52FF 537
1⤵
PID:551

/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
/System/Library/Frameworks/WebKit.framework/Versions/A/XPCServices/com.apple.WebKit.WebContent.xpc/Contents/MacOS/com.apple.WebKit.WebContent
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:552

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.SandboxHelper 545
1⤵
PID:553

/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
/System/Library/Frameworks/AudioToolbox.framework/XPCServices/com.apple.audio.SandboxHelper.xpc/Contents/MacOS/com.apple.audio.SandboxHelper
1⤵
PID:553

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

InstalledPrinters.plist

Path /Library/Printers/InstalledPrinters.plist
Size 495B
SHA256 aec405d7619e28da751fafd97782015affebdb36e863c58eea2b658551a59e7b
MD5 3439dcb6d4ce19d3ea022b8bb17cba7a
SHA1 e412c16548b6fcc5fd488315cd70b324ca4d782e
SHA512 8ca944a1a157f6933a5efeea35aa7626d0dd5f6fd4b5d9fe08c3760b39b6f54289e502923ca7616110c468173f0389f2ce1e35899d171bd08873678759aba93b
TLSH
T163F052C80A187EBE0DC802022AA7985D52AE82CD8C3100FBE1D35CCE7E09492A234958
MD5 SHA1 SHA512 TLSH

Submit Download

tailspin-trace.2026-08-14_17-00-52.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-08-14_17-00-52.tailspin
Size 17.4MB
SHA256 b87b72f8366f1b02ee6b5fee52a77a028b8f05c5b86bfadd5fdbc8cb4e030c2d
MD5 770ceb8f6e8ec8ba16dcfc5ce4d88ee7
SHA1 e4b888d371f10b135fa7f4b916ae1ba403d43b02
SHA512 b839e8715aaf4a6c95a1c219cacf6d42e99c79d026ac2014dbaef634dd336c369e82c638967d7cb018f90ccd8d941d3111c423850970d7e08f8c8d294caa5df3
SSDEEP 196608:AmnYZKeTHz2LfXEsdlNiV0Y0dHkDYT39a3tlJYcJWAvZ6WqNfRe:AmnwNrCzU6XuuYYr9GbtcdY
TLSH
T11E079E719C8BACF0DC84B57208E38F5717F332FAED5585BA00D52FD944A7B024E992A6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tailspin-trace.2026-08-14_17-01-45.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-08-14_17-01-45.tailspin
Size 18.1MB
SHA256 ce93fc75e40f8405d3d23e162a64d4871ba8eec135b053513aeeb1902e2fb02e
MD5 121a6c721b52b8b1bed92a4cfb73dd6c
SHA1 c7373bdfa21ec62a5997fe05f0f4688032f6821c
SHA512 8712cde24bd0b62173e4facd4852d56da7f6e318425fcabd8b19e19193969fc5883da3e3e70ca7aff91b540e7cd500125bc96aad78a46f2561eaffdacd1f5ea3
SSDEEP 393216:BjZBdQJJmAMlPcD2eERBafi/8VeG8Ygi4wg+:zgL6fekafi/8EYgi4wg+
TLSH
T188179EB2AD869CE0CCC8B97105E3CE1603F332FEDD558AB510D51FA954D7B024E987AA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 17KB
SHA256 bff83495bf732ffe50fe29b1816d4df50031c191216e9ddb3ed4ecb316145ccb
MD5 770d1224f66fba1580c5059408494696
SHA1 0481eb1252923b57b138a2f1ad73c7bda0202ef2
SHA512 782e6e1cfcfd33958bdfb09cc6bd91399ee353757475fcb614d8448a48b64decd62ec1ac3373eaa9cf6941d0f13b20dc56ef6d3457a9eaf97e76b62d5c01c951
SSDEEP 384:br9UOKaGn/3bjGTuJNOyX0LGSKGoLQ19UzcaGCFGbGpF2FKYdxFfYHG+6GQoW9UO:bBUOK7/uT7yvoUIGciF4x+iUv5/jo
TLSH
T1578256E079B80AF4717302E9271793040466E16FE8523C7C366CCA549F53972E9EB9BE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

spindump.txt

Path /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T//spindump.txt
Size 1.4MB
SHA256 d3c10cb6c0bfcd7962d9cec0526e7f138510eb64b306b77cc9b4db80c585f9b1
MD5 f12cb1af01d771da8771687c8a22b14e
SHA1 fe12db9f09d580c8d528029a7d48de3473a1dd68
SHA512 ec224a2e05480860cafe7c6539a5f3f1355fa60c1af9b0c840c00694e6d2e3eaed5611e3f31e61e3ce7b722260df694eaf5de946811313323bdedefa7fcdf36c
SSDEEP 12288:GAZkbf40gMmL1ypgrtU+S6ZR5he2DAwVTveM2kSgU71xyuhIrTfRIeh6ipUwG9wt:z8CX
TLSH
T1B06564919DFC09D072B990922723920144AAE01E7412387DB6DEC7349F5BA77E7EB93C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsDirectory.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/softwareupdated//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/softwareupdated//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

089-33637.English.dist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/softwareupdated/com.apple.SoftwareUpdate.SUCatalogDataManager/h/089-33637/089-33637.English.dist
Size 2KB
SHA256 54e631eadd688c93ca7318339f9c318f414428f6fb38a0d8e6523739b5ed83d8
MD5 3c1aeb204b6bc0e279784dcf33e0d3db
SHA1 3690899046341bf065f710e92533878372291b38
SHA512 f51fa8b8ad26a20396ffe2ff1ea5788d8dd4f6668483b899408143c77610d88df8bfb77f4822dc9f670e54b754167863f4eb8a55a6da4c5516335729798d9559
TLSH
T133517604A6F6C0F2552011911DB096496EF1BBC73A5CD89CF4CE86A1AF4AF0E9773731
MD5 SHA1 SHA512 TLSH

Submit Download

140-92759.English.dist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/softwareupdated/com.apple.SoftwareUpdate.SUCatalogDataManager/t/140-92759/140-92759.English.dist
Size 2KB
SHA256 cba690df611b6a503d25703b1e94f3730751ee9eaf2733ba7be78bc1340ea79d
MD5 26f393c0c3d5f50eba908fb533d64808
SHA1 8104a171260d078c04b6f6ed83bd791ad4c4c9d5
SHA512 71ed933f36d1b4cd13679edcd991720cc3d59d8153eaaef2ca7a0ea76d7ca5f619cc79c8d341c9f02db45bc8747f4e0f3dc63d7a3c5d72d435e136a29418a759
TLSH
T11351720166FA81F39151229128A0844DAEF1E7C3629CD89CF4CF96D45F4EF0F8673B61
MD5 SHA1 SHA512 TLSH

Submit Download

InstallAssistant.pkg.partialState

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/softwareupdated/com.apple.SoftwareUpdate/swcdn.apple.com/content/downloads/18/16/082-29060-A_BSNXDIG22J/bi6npw22cnv40hfvzbcdzvsdaucmjjuxyo/InstallAssistant.pkg.partialState
Size 436B
SHA256 058a21d6669e7dfa9888f09cd36dfee50ea8ed9b88ccb4dfdcfc6f94e4a66137
MD5 c71536c180aa2bd446a70d9253210eaf
SHA1 f5f3b9a46112d7a662c0f5d88faf009eb66ce1a6
SHA512 4ace5ed994a83319db6691ac5256c351919dffa4bde46aa886095a32d0b011b1ce69b5f895731fdd8835c0a13622802f0ada3a1cd19388799cc98653fff33139
TLSH
T1AAE0AB945D9BD4A0E95381FD11C56FECEF65D2FE00E5D38228E018CAC09C1430C0032F
MD5 SHA1 SHA512 TLSH

Submit Download

MajorOSInfo.pkg

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/140-77964_0B879BA7-748D-46AF-87CA-0697EA64509B/MajorOSInfo.pkg
Size 1.3MB
SHA256 7d3a8690508ad2bd5385b27d266ea02b03a08c0625aac59f81240491382e3d91
MD5 7e7849b7a208e860db55d3118a919e74
SHA1 e6875dc4d0533aa48e616cf246ce919712808f85
SHA512 2d3c273e46cf2a550ed6061c32dcb9443056a3a8ad023444ea3d3ebc81aea2110d0e8e144a55d0044a764138a3c52c4de103dddf268ed08516dfa7a08e8735c0
SSDEEP 24576:GJGzco1FHw4Ormua/EfKkFUpqKhRTuX7q4Tr+NCJkMXcaxl8TkkCFxCfbwHAptOl:9jQ4luTFUxH94VxcC8lCFxCfbwgptm
TLSH
T1DF5533F8E0B20056D030B82DA69ED8378F4E3957952B3379C68DCAEB1DF4664DB5D01A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Info.plist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/140-77964_0B879BA7-748D-46AF-87CA-0697EA64509B/Payload/System/Library/CoreServices/MajorOSInfo.bundle/Contents/Info.plist
Size 859B
SHA256 8089e76506793eba9b38183493a0d5ce561e72d9609b37653f4d8fc89448ebe2
MD5 208dc5d75ddbba9b47aaeea6b67631b8
SHA1 6a893e5afc5da520feb82e0ace98579a887f5b88
SHA512 881f174aead31e48dbf117bd0304b034dfd0d4747d7000f3df7c40359c4a51591552ac7d7f4f8a7ecae9c0027282cd63e2c02e9d767ba77d276356d279f7fce2
TLSH
T19E116FF40E5478981CC612D76AD1914E01CC71CC8C7222FEF9C6A618AD0E40563B0AD8
MD5 SHA1 SHA512 TLSH

Submit Download

OSBadge.icns

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/140-77964_0B879BA7-748D-46AF-87CA-0697EA64509B/Payload/System/Library/CoreServices/MajorOSInfo.bundle/Contents/Resources/OSBadge.icns
Size 1.6MB
SHA256 2e44e080a3bd5c3d3d21495a9eeb49105f2bdfe4a454e4d0361a23bf43f2b6d9
MD5 66df0ace78e06471f4c29f1a45665713
SHA1 254c4b1a5d85669a98538362b8f3334f8e2656e7
SHA512 f0a230a3607961ffe4067164430f40818c3d972a2e2af81767e687c486c2180f9ea622d4aaf48489ffe5afcfdfc552e39a9d3e8741b4e4800021b8d1027e8bd2
SSDEEP 49152:wRz4wGHuRz4wGHQFppD9DmfzCC7CAxCf5wgEva:i8wGI8wGwND9DmfzCC7VxI55R
TLSH
T1807533E5D1F70022C8B9A83E7ADE94738A2F3E52441B77D19588F2EB2CB0A70575D14E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Localizable.strings

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/140-77964_0B879BA7-748D-46AF-87CA-0697EA64509B/Payload/System/Library/CoreServices/MajorOSInfo.bundle/Contents/Resources/en.lproj/Localizable.strings
Size 137B
SHA256 255eb0ade6c48c4972f0e75deefbcadf6868d83a3d7478c09b48bd84ecc60826
MD5 56b3c9731e51466c752f3a2461802ae7
SHA1 cff3765d7139bbc82ed17ed9b87d0a66e64eceb9
SHA512 e99ce17dd5a5a0a36957b75f17129d60ec47ff4f7589d6f422a851ce17bd15a6dadd9eae281f6a78e723c1fd75650f0fb6ea7a4ae6c48f4632214d0a793c6cc4
TLSH
T1D4C02BB3CF469559C00044B45436520CA241E2C8DAA81E201000041518C84420513100
MD5 SHA1 SHA512 TLSH

Submit Download

ProductMetadata.plist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/ProductMetadata.plist
Size 1.1MB
SHA256 e2e0d06d6d58d25c57ad93fbb3e1b635a778ee91e4e7871d0267507f8a12939d
MD5 eef65e285101bc40486aacf744877784
SHA1 fdf00dd6acdc4cd6a3690c74860230df50084bf1
SHA512 d4f3de917c01791fe1990e4514a425697efdfa0b912a250880ac47e07e6a164d37663b15e6825f650da3068384cee7d5643674c741163a8bea23027f9fd0f1a5
SSDEEP 3072:qsAe6W+9Ntzu1qSCG3neCuiKSx0OEKGAVK424KORCayCSxg14NcREUkx0k4F4sEp:qJA+9Ntzu1qSDRWLa4yrCT
TLSH
T1DA358CEC895C38296DCF052518F159990EBEA9DE8C3518FBF2CBA98E748D876C174D30
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ProductMetadata.plist

Path /var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/softwareupdated/ProductMetadata.plist
Size 425B
SHA256 f303f72adbd8e34833760ffba9895640db9bd997b3fe08b5f799e697548c9b8f
MD5 c10acdb827d32bfa636091e5eebdea12
SHA1 f31fb9028d2cebc00607a6051d50f606a978db3e
SHA512 b592e2b3e350c799d25954f64ab534c90169fce716d7671d6f6a72bdada7192b3c199540bbb56f6c025bf62f85b07fa9e004b3258dc29a9aae5908d3c9436f48
TLSH
T106E0ABC419087EBD0CC806D72B9591880687978D8D7000FDA5D34D80AA8AA9A13306DD
MD5 SHA1 SHA512 TLSH

Submit Download

NRM_Events_2026-08-14-17-00-39.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2026-08-14-17-00-39.event
Size 4KB
SHA256 375a74bc9e9178cecc48d559b60ba22720f3705b5bb25a8ff657ebc2a0f16ef9
MD5 c245a7ed6ff9163d5e75dd3b1b520361
SHA1 9f81ab82f5d1e7d84774bca73b40e41d5e1245cf
SHA512 36fec8bd90612931b4fde94b79396e5e0064b31ecc83bc0e09f3f96105d8193d45be3804af00ef555c7dbb5b5c306bd5d345ecf8e42965d52bb15a4f60ebc204
SSDEEP 96:PuliEoqtZACZp/ansKFka0OEJQ39fMIJ7JKxX1pj:mdAzsKcJAfb7J4pj
TLSH
T1C3A1C9B6F941A9BACC294575BA4751E7EF1D930FBCB859B91093CDC808DFB088E0D198
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NRM_Events_2026-08-14-17-00-39.event

Path /var/root/Library/Caches/rtcreportingd/events/NRM_Events_2026-08-14-17-00-39.event
Size 8KB
SHA256 afd5301b8b44ed48d36057123782f5a2452849f0f55375cc02e7a60988ebb642
MD5 6052fa0f16bc570ab4c8335f81a62fe4
SHA1 176315e64ecc6237165ebd5ca9e888be3a8b6f3c
SHA512 9d228f818cf585f6b0d56cf7cea9e457fe86d7d7a9ca2915f9ddf6b2b01544af4ae8c72ad3411524dfc81fd92bcc5a410726b7ae0159f3cce8dc70965750322b
SSDEEP 96:PuliEoqtZACZp/ansKFka0OEJQ39fMIJ7JKxX1pjulHEoqtZACZp8abP/Q48Gmo3:mdAzsKcJAfb7J4pKgAyP/d8GyeNWfpFU
TLSH
T1C802A6B6F94169B6CD2446B5BB4752E3EF5C934FBCA865B91093CDC848CBB588E0C188
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads