65d0c8a5ba00ae164aa68f7ad6c4aa305c46e1b0236fb3e2790bc8bd970f200f

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
770s
max time network
907s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
26/08/2026, 11:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SKlauncher-3.2.18.dmg
Size 1.4MB
Sample260826-m5hlcsvsaz
SHA256 65d0c8a5ba00ae164aa68f7ad6c4aa305c46e1b0236fb3e2790bc8bd970f200f
MD5 f0c830ad8707f58093b8cea694f1d9a6
SHA1 f43922ad06985911e3d8628e6e9efa0bff62f411
SHA512 6c9fa5f30016ec26b61fdacf10814c3af49871d8a9b05b3aa9b59dee256c1e55be97d6a24aa8affa94010ce2f133040ca3c0bba8af2420e11257c6a7f38ed366
SSDEEP 24576:3prpWsSHTkRGrpqk4P8Tqut93SqhrV60n7hayrpaoIXP5jS3YonrZc8AujlWIZ6Z:ZpmkR6ck1TdVL7My9aPZS35ZX3lW3Z
TLSH
T13F65337E998EBA48ED50FA30DCB954150EBC36E7E472C7B7BC3F092A5350641216E12B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Path Permission 1 TTPs
Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002
Gatekeeper Bypass 1 TTPs
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
defense_evasion

Gatekeeper Bypass
T1553.001
File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
defense_evasion

File Deletion
T1070.004

File and Directory Discovery. 1 TTPs 57 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename "/Volumes/Google Chrome/.keystone_install"	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
dirname /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
dirname /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename "\"/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub\""	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
dirname /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName	Process not Found
dirname "/Library/Google/Google Chrome Brand.plist"	Process not Found
basename "\"/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub\""	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename "\"/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub\""	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found
basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub	Process not Found

Resource Forking 1 TTPs 20 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid A2367C5A-A511-4A49-97BA-036EA43FBCBC	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 2A4256C3-52BF-4B84-B85B-56924758424B	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s1	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s1 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s1	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 2A4256C3-52BF-4B84-B85B-56924758424B -post-exec 4	Process not Found
"/System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/Resources/DiskImages UI Agent.app/Contents/MacOS/DiskImages UI Agent" 2A4256C3-52BF-4B84-B85B-56924758424B	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s1 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s1	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid A2367C5A-A511-4A49-97BA-036EA43FBCBC -post-exec 4	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s1	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"open /Volumes/SKlauncher/SKlauncher.app\""
1⤵
PID:510

/bin/bash
sh -c "sudo /bin/zsh -c \"open /Volumes/SKlauncher/SKlauncher.app\""
1⤵
PID:510

/usr/bin/sudo
sudo /bin/zsh -c "open /Volumes/SKlauncher/SKlauncher.app"
1⤵
PID:510
- /bin/zsh
  /bin/zsh -c "open /Volumes/SKlauncher/SKlauncher.app"
  2⤵
  PID:511
- /usr/bin/open
  open /Volumes/SKlauncher/SKlauncher.app
  2⤵
  PID:511

/usr/libexec/xpcproxy
xpcproxy pl.skmedix.bootstrap.Main.2332
1⤵
PID:512

/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
1⤵
PID:512

/usr/bin/bash
bash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
1⤵
PID:512

/bin/bash
bash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
1⤵
PID:512
- /usr/bin/dirname
  dirname /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:514
- /usr/bin/basename
  basename "\"/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub\""
  2⤵
  PID:515
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:516
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][universalJavaApplicationStub\"] [StubDir] /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS"
  2⤵
  PID:517
- /usr/libexec/PlistBuddy
  /usr/libexec/PlistBuddy -c "print :Java" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
  2⤵
  PID:524
- /usr/libexec/PlistBuddy
  /usr/libexec/PlistBuddy -c "print :JavaX" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
  2⤵
  PID:525
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:526
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [PlistStyle] Oracle"
  2⤵
  PID:527
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:567
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [JavaRequirement] JVM minimum version: 21+"
  2⤵
  PID:568
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:569
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [JavaRequirement] JVM maximum version: "
  2⤵
  PID:570
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:573
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [LanguageSearch] Checking preferred languages in macOS System Preferences..."
  2⤵
  PID:574
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:581
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [LanguageSearch] ... found [en-NL nl-NL de-NL]"
  2⤵
  PID:582
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:583
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [LanguageSearch] ... selected 'en' (from 'en-NL') as the default language for the launcher stub"
  2⤵
  PID:584
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:585
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [Language] en"
  2⤵
  PID:586
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:614
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [JavaSearch] Checking for \$JAVA_HOME ..."
  2⤵
  PID:615
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:616
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [JavaSearch] ... using JAVA_HOME is disabled"
  2⤵
  PID:617
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:618
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [JavaSearch] Searching for JavaVirtualMachines on the system ..."
  2⤵
  PID:619
- /usr/libexec/java_home
  /usr/libexec/java_home --xml
  2⤵
  PID:620
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:626
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [JavaSearch] ... found JVM: 1.8.0_301:/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java"
  2⤵
  PID:627
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:628
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [JavaSearch] Filtering the result list for JVMs matching the min/max version requirement ..."
  2⤵
  PID:629
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:639
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [JavaCommand] ''"
  2⤵
  PID:640
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:646
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [JavaVersion] "
  2⤵
  PID:647
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:653
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[512][SKlauncher] [EXIT 3] No suitable Java version found on your system! This program requires Java 21 or later."
  2⤵
  PID:654
- /usr/bin/osascript
  osascript
  2⤵
  PID:655

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :CFBundleName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:521

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :CFBundleIconFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:523

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMMainClassName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:529

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMSplashFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:531

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:535

/usr/bin/grep
grep " "
1⤵
PID:534

/usr/bin/sed
sed "s/^ *//g"
1⤵
PID:536

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMClassPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:538

/usr/bin/grep
grep -o " \\-.*"
1⤵
PID:541

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMDefaultOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:542

/usr/bin/tr
tr -d "\\n"
1⤵
PID:543

/usr/bin/xargs
xargs
1⤵
PID:544

/usr/bin/tr
tr -d "\\n"
1⤵
PID:550

/usr/bin/sed
sed -E "s/Array \\{ *(.*) *\\}/\\1/g"
1⤵
PID:551

/usr/bin/sed
sed "s/ */ /g"
1⤵
PID:553

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMArguments" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:552

/usr/bin/xargs
xargs -n1
1⤵
PID:547

/usr/bin/xargs
xargs
1⤵
PID:556

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMVersion" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:557

/bin/echo
/bin/echo 21+
1⤵
PID:558

/usr/bin/xargs
xargs
1⤵
PID:561

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMUseJavaHome" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:562

/usr/bin/xargs
xargs
1⤵
PID:565

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMEmbeddedJavaPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:566

/usr/bin/grep
grep "\\s\""
1⤵
PID:577

/usr/bin/defaults
defaults read -g AppleLanguages
1⤵
PID:576

/usr/bin/tr
tr -d ","
1⤵
PID:578

/usr/bin/xargs
xargs
1⤵
PID:579

/bin/echo
/bin/echo en-NL nl-NL de-NL
1⤵
PID:580

/Library/Java/Home/bin/java
/Library/Java/Home/bin/java -version
1⤵
PID:589

/usr/bin/sed
sed -E "s/\"//g;s/-ea//g"
1⤵
PID:591

/usr/bin/awk
awk "/version/{print \$3}"
1⤵
PID:590

/usr/bin/awk
awk "/version/{print \$3}"
1⤵
PID:595

/usr/bin/sed
sed -E "s/\"//g;s/-ea//g"
1⤵
PID:596

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -version
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump
1⤵
PID:597

/usr/sbin/spindump
/usr/sbin/spindump
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:598

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.spindump_agent
1⤵
PID:599

/usr/libexec/spindump_agent
/usr/libexec/spindump_agent
1⤵
PID:599

/usr/bin/sed
sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
1⤵
PID:603

/usr/bin/sed
sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
1⤵
PID:610

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c Print /dev/stdin
1⤵
PID:622

/usr/bin/grep
grep Dict
1⤵
PID:623

/usr/bin/tr
tr -d " "
1⤵
PID:625

/usr/bin/wc
wc -l
1⤵
PID:624

/usr/bin/sed
sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
1⤵
PID:633

/usr/bin/sort
sort -nr
1⤵
PID:638

/usr/bin/awk
awk "/version/{print \$3}"
1⤵
PID:644

/usr/bin/sed
sed -E "s/\"//g;s/-ea//g"
1⤵
PID:645

/usr/bin/sed
sed -E "s/^1\\.([0-9+*]+)\$/\\1/g"
1⤵
PID:650

/usr/bin/sed
sed "s/+/ or later/;s/*/(latest update)/"
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy pl.skmedix.bootstrap.Main.3100
1⤵
PID:656

/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
1⤵
PID:656

/usr/bin/bash
bash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
1⤵
PID:656

/bin/bash
bash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
1⤵
PID:656
- /usr/bin/dirname
  dirname /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:657
- /usr/bin/basename
  basename "\"/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub\""
  2⤵
  PID:658
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:659
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][universalJavaApplicationStub\"] [StubDir] /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS"
  2⤵
  PID:660
- /usr/libexec/PlistBuddy
  /usr/libexec/PlistBuddy -c "print :Java" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
  2⤵
  PID:667
- /usr/libexec/PlistBuddy
  /usr/libexec/PlistBuddy -c "print :JavaX" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
  2⤵
  PID:668
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:669
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [PlistStyle] Oracle"
  2⤵
  PID:670
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:710
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [JavaRequirement] JVM minimum version: 21+"
  2⤵
  PID:711
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:712
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [JavaRequirement] JVM maximum version: "
  2⤵
  PID:713
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:716
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [LanguageSearch] Checking preferred languages in macOS System Preferences..."
  2⤵
  PID:717
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:724
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [LanguageSearch] ... found [en-NL nl-NL de-NL]"
  2⤵
  PID:725
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:726
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [LanguageSearch] ... selected 'en' (from 'en-NL') as the default language for the launcher stub"
  2⤵
  PID:727
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:728
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [Language] en"
  2⤵
  PID:729
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:754
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [JavaSearch] Checking for \$JAVA_HOME ..."
  2⤵
  PID:755
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:756
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [JavaSearch] ... using JAVA_HOME is disabled"
  2⤵
  PID:757
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:758
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [JavaSearch] Searching for JavaVirtualMachines on the system ..."
  2⤵
  PID:759
- /usr/libexec/java_home
  /usr/libexec/java_home --xml
  2⤵
  PID:760
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:766
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [JavaSearch] ... found JVM: 1.8.0_301:/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java"
  2⤵
  PID:767
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:768
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [JavaSearch] Filtering the result list for JVMs matching the min/max version requirement ..."
  2⤵
  PID:769
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:779
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [JavaCommand] ''"
  2⤵
  PID:780
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:786
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [JavaVersion] "
  2⤵
  PID:787
- /usr/bin/basename
  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
  2⤵
  PID:793
- /usr/bin/syslog
  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[656][SKlauncher] [EXIT 3] No suitable Java version found on your system! This program requires Java 21 or later."
  2⤵
  PID:794
- /usr/bin/osascript
  osascript
  2⤵
  PID:795

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :CFBundleName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:664

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :CFBundleIconFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:666

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMMainClassName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:672

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMSplashFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:674

/usr/bin/grep
grep " "
1⤵
PID:677

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:678

/usr/bin/sed
sed "s/^ *//g"
1⤵
PID:679

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMClassPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:681

/usr/bin/grep
grep -o " \\-.*"
1⤵
PID:684

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMDefaultOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:685

/usr/bin/tr
tr -d "\\n"
1⤵
PID:686

/usr/bin/xargs
xargs
1⤵
PID:687

/usr/bin/tr
tr -d "\\n"
1⤵
PID:693

/usr/bin/sed
sed -E "s/Array \\{ *(.*) *\\}/\\1/g"
1⤵
PID:694

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMArguments" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:695

/usr/bin/sed
sed "s/ */ /g"
1⤵
PID:696

/usr/bin/xargs
xargs -n1
1⤵
PID:690

/usr/bin/xargs
xargs
1⤵
PID:699

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMVersion" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:700

/bin/echo
/bin/echo 21+
1⤵
PID:701

/usr/bin/xargs
xargs
1⤵
PID:704

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMUseJavaHome" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:705

/usr/bin/xargs
xargs
1⤵
PID:708

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMEmbeddedJavaPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:709

/usr/bin/defaults
defaults read -g AppleLanguages
1⤵
PID:719

/usr/bin/grep
grep "\\s\""
1⤵
PID:720

/usr/bin/tr
tr -d ","
1⤵
PID:721

/usr/bin/xargs
xargs
1⤵
PID:722

/bin/echo
/bin/echo en-NL nl-NL de-NL
1⤵
PID:723

/Library/Java/Home/bin/java
/Library/Java/Home/bin/java -version
1⤵
PID:732

/usr/bin/awk
awk "/version/{print \$3}"
1⤵
PID:733

/usr/bin/sed
sed -E "s/\"//g;s/-ea//g"
1⤵
PID:734

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -version
1⤵
PID:737

/usr/bin/awk
awk "/version/{print \$3}"
1⤵
PID:738

/usr/bin/sed
sed -E "s/\"//g;s/-ea//g"
1⤵
PID:739

/usr/bin/sed
sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
1⤵
PID:743

/usr/bin/sed
sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
1⤵
PID:750

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c Print /dev/stdin
1⤵
PID:762

/usr/bin/grep
grep Dict
1⤵
PID:763

/usr/bin/wc
wc -l
1⤵
PID:764

/usr/bin/tr
tr -d " "
1⤵
PID:765

/usr/bin/sed
sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
1⤵
PID:773

/usr/bin/sort
sort -nr
1⤵
PID:778

/usr/bin/awk
awk "/version/{print \$3}"
1⤵
PID:784

/usr/bin/sed
sed -E "s/\"//g;s/-ea//g"
1⤵
PID:785

/usr/bin/sed
sed -E "s/^1\\.([0-9+*]+)\$/\\1/g"
1⤵
PID:790

/usr/bin/sed
sed "s/+/ or later/;s/*/(latest update)/"
1⤵
PID:791

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportMemoryException
1⤵
PID:800

/usr/libexec/ReportMemoryException
/usr/libexec/ReportMemoryException
1⤵
PID:800

/usr/libexec/xpcproxy
xpcproxy com.google.Chrome.3056
1⤵
PID:801

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome"
1⤵
PID:801

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:805

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:805

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=5"
1⤵
PID:807

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:808

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:809

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:810

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:811

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:813

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=19"
1⤵
PID:814

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=19"
1⤵
PID:815

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
1⤵
PID:816

/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
1⤵
PID:817

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=26"
1⤵
PID:818

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072"
1⤵
PID:819

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
1⤵
PID:0
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
  2⤵
  PID:822
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
  2⤵
  PID:0
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
    3⤵
    PID:825
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=330477806" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=60"
    3⤵
    PID:826
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=330580737" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=60"
    3⤵
    PID:827
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=337804339" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=69"
    3⤵
    PID:828
- - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
    3⤵
    PID:829
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.SafariLaunchAgent
    3⤵
    PID:830
- - /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    3⤵
    PID:830
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=9" "--launch-time-ticks=340602500" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=70"
    3⤵
    PID:831
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:832
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=13" "--launch-time-ticks=341805827" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=78"
    3⤵
    PID:833
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=341948043" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=70"
    3⤵
    PID:834
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=342184907" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=70"
    3⤵
    PID:835
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=86"
    3⤵
    PID:836
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update-internal" --system
    3⤵
    PID:0
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
      4⤵
      PID:1.8446744073709552e+19
  - - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
      "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
      4⤵
      PID:842
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      GoogleUpdater --server "--service=update" --system
      4⤵
      PID:0
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /usr/bin/profiles
        
        /usr/bin/profiles status -type enrollment
        5⤵
        
        PID:846
    - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
        5⤵
        
        PID:847
    - - /usr/sbin/system_profiler
        
        /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
        5⤵
        
        PID:848
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=91"
        5⤵
        
        PID:850
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=101"
        5⤵
        
        PID:851
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        GoogleUpdater --server "--service=update" --system
        5⤵
        
        PID:1.8446744073709552e+19
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=113"
        5⤵
        
        PID:855
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=114"
        5⤵
        
        PID:856
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=113"
        5⤵
        
        PID:857
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=116"
        5⤵
        
        PID:858
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=116"
        5⤵
        
        PID:859
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=116"
        5⤵
        
        PID:860
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=24" "--launch-time-ticks=410994408" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=121"
        5⤵
        
        PID:862
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=97"
        5⤵
        
        PID:863
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=120"
        5⤵
        
        PID:864
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil attach /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.SHYd9i/GoogleChrome-128.0.6613.138.dmg -plist -nobrowse -readonly
        5⤵
        
        PID:865
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid A2367C5A-A511-4A49-97BA-036EA43FBCBC
        5⤵
        
        PID:866
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid A2367C5A-A511-4A49-97BA-036EA43FBCBC -post-exec 4
        5⤵
        
        PID:867
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=91"
        5⤵
        
        PID:868
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=120"
        5⤵
        
        PID:869
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=91"
        5⤵
        
        PID:870
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:871
    - - /usr/libexec/mobileassetd
        
        /usr/libexec/mobileassetd
        5⤵
        
        PID:871
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:872
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:872
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly
        5⤵
        
        PID:873
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2
        5⤵
        
        PID:874
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2
        5⤵
        
        PID:875
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s2 removable readonly
        5⤵
        
        PID:876
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s2
        5⤵
        
        PID:877
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s2
        5⤵
        
        PID:878
    - - /sbin/mount
        
        /sbin/mount -t hfs -o "-u=99,-g=99,-m=755,nodev,noowners,nosuid,rdonly,nobrowse" /dev/disk4s2 "/Volumes/Google Chrome"
        5⤵
        
        PID:879
      - /sbin/mount_hfs
        
        /sbin/mount_hfs -u 99 -g 99 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o nobrowse /dev/disk4s2 "/Volumes/Google Chrome"
        6⤵
        
        PID:880
    - - /Volumes/Google Chrome/.keystone_install
        
        "/Volumes/Google Chrome/.keystone_install" "/Volumes/Google Chrome" "/Applications/Google Chrome.app" 101.0.4951.54
        5⤵
        
        PID:882
      - /usr/bin/basename
        
        basename "/Volumes/Google Chrome/.keystone_install"
        6⤵
        
        PID:883
      - /bin/mkdir
        
        mkdir -p "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions"
        6⤵
        
        PID:898
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-before "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138"
        6⤵
        
        PID:899
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/Volumes/Google Chrome/Google Chrome.app/" "/Applications/Google Chrome.app"
        6⤵
        
        PID:922
      - /bin/rm
        
        rm -f "/Applications/Google Chrome.app/.want_full_installer"
        6⤵
        
        PID:925
      - /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
        
        /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"
        6⤵
        
        PID:936
      - /usr/bin/dirname
        
        dirname "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:940
      - /bin/mkdir
        
        mkdir -p /Library/Google
        6⤵
        
        PID:941
      - /usr/bin/defaults
        
        defaults write "/Library/Google/Google Chrome Brand" KSBrandID -string GGRO
        6⤵
        
        PID:942
      - /usr/sbin/chown
        
        chown root:wheel "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:943
      - /bin/chmod
        
        chmod 644 "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:944
      - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        ksadmin --register --productid com.google.Chrome --version 128.0.6613.138 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion
        6⤵
        
        PID:949
      - /bin/rm
        
        rm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"
        6⤵
        
        PID:959
      - /usr/sbin/chown
        
        chown -Rh root:wheel "/Applications/Google Chrome.app"
        6⤵
        
        PID:960
      - /bin/chmod
        
        chmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"
        6⤵
        
        PID:961
      - /usr/bin/find
        
        find "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +
        6⤵
        
        PID:962
        
        /bin/chmod
        
        chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
        7⤵
        
        PID:963
      - /usr/bin/xattr
        
        xattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"
        6⤵
        
        PID:964
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=91"
        5⤵
        
        PID:904
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=91"
        5⤵
        
        PID:910
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=91"
        5⤵
        
        PID:911
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=91"
        5⤵
        
        PID:912
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=91"
        5⤵
        
        PID:917
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=91"
        5⤵
        
        PID:919
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=121"
        5⤵
        
        PID:920
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=121"
        5⤵
        
        PID:921
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.assistantd
        5⤵
        
        PID:966
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.bird
        5⤵
        
        PID:967
    - - /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        
        /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        5⤵
        
        PID:967
    - - /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
        
        /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
        5⤵
        
        PID:966
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil detach "/Volumes/Google Chrome" -force
        5⤵
        
        PID:969
    - - /sbin/umount
        
        /sbin/umount -f "/Volumes/Google Chrome"
        5⤵
        
        PID:970
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.DiskUnmountWatcher
        5⤵
        
        PID:972
    - - /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        
        /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        5⤵
        
        PID:972
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secd
        5⤵
        
        PID:974
    - - /usr/libexec/secd
        
        /usr/libexec/secd
        5⤵
        
        PID:974
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nsurlstoraged
        5⤵
        
        PID:975
    - - /usr/libexec/nsurlstoraged
        
        /usr/libexec/nsurlstoraged
        5⤵
        
        PID:975
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
        5⤵
        
        PID:977
    - - /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        
        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        5⤵
        
        PID:977
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.suggestd
        5⤵
        
        PID:978
    - - /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
        
        /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
        5⤵
        
        PID:978
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.knowledge-agent
        5⤵
        
        PID:980
    - - /usr/libexec/knowledge-agent
        
        /usr/libexec/knowledge-agent
        5⤵
        
        PID:980
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.sysmond
        5⤵
        
        PID:982
    - - /usr/libexec/sysmond
        
        /usr/libexec/sysmond
        5⤵
        
        PID:982
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=38" "--launch-time-ticks=639816845" --shared-files "--field-trial-handle=1718379636,r,4155216252732609713,4209101418657334856,131072" "--seatbelt-client=120"
        5⤵
        
        PID:984
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.pluginkit.pkd
        5⤵
        
        PID:986
    - - /usr/libexec/pkd
        
        /usr/libexec/pkd
        5⤵
        
        PID:986
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.xpc.launchd.oneshot.0x10000001.DiskImageMounter
        5⤵
        
        PID:988
    - - /System/Library/CoreServices/DiskImageMounter.app/Contents/MacOS/DiskImageMounter
        
        /System/Library/CoreServices/DiskImageMounter.app/Contents/MacOS/DiskImageMounter -psn_0_192559
        5⤵
        
        PID:988
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.XprotectFramework.AnalysisService 413
        5⤵
        
        PID:989
    - - /System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
        
        /System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
        5⤵
        
        PID:989
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 2A4256C3-52BF-4B84-B85B-56924758424B
        5⤵
        
        PID:990
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 2A4256C3-52BF-4B84-B85B-56924758424B -post-exec 4
        5⤵
        
        PID:991
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/Resources/DiskImages UI Agent.app/Contents/MacOS/DiskImages UI Agent
        
        "/System/Library/PrivateFrameworks/DiskImages.framework/Versions/A/Resources/DiskImages UI Agent.app/Contents/MacOS/DiskImages UI Agent" 2A4256C3-52BF-4B84-B85B-56924758424B
        5⤵
        
        PID:992
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s1 removable readonly
        5⤵
        
        PID:993
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s1
        5⤵
        
        PID:994
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s1
        5⤵
        
        PID:995
    - - /sbin/fsck_hfs
        
        /sbin/fsck_hfs -f -n /dev/disk4s1
        5⤵
        
        PID:996
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk4s1 removable readonly
        5⤵
        
        PID:997
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk4s1
        5⤵
        
        PID:998
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk4s1
        5⤵
        
        PID:999
    - - /sbin/mount
        
        /sbin/mount -t hfs -o "-u=502,-g=20,-m=755,nodev,noowners,nosuid,rdonly,quarantine" /dev/disk4s1 "/Volumes/Java 8 Update 503"
        5⤵
        
        PID:1000
      - /sbin/mount_hfs
        
        /sbin/mount_hfs -u 502 -g 20 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o quarantine /dev/disk4s1 "/Volumes/Java 8 Update 503"
        6⤵
        
        PID:1001
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.TextInputMenuAgent
        5⤵
        
        PID:1003
    - - /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
        
        /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
        5⤵
        
        PID:1003
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.TextInputSwitcher
        5⤵
        
        PID:1005
    - - /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
        
        /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
        5⤵
        
        PID:1005
    - - /usr/libexec/xpcproxy
        
        xpcproxy pl.skmedix.bootstrap.Main.3100
        5⤵
        
        PID:1007
    - - /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        
        /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        5⤵
        
        PID:1007
    - - /usr/bin/bash
        
        bash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        5⤵
        
        PID:1007
    - - /bin/bash
        
        bash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        5⤵
        
        PID:1007
      - /usr/bin/dirname
        
        dirname /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1008
      - /usr/bin/basename
        
        basename "\"/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub\""
        6⤵
        
        PID:1009
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1010
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][universalJavaApplicationStub\"] [StubDir] /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS"
        6⤵
        
        PID:1011
      - /usr/libexec/PlistBuddy
        
        /usr/libexec/PlistBuddy -c "print :Java" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
        6⤵
        
        PID:1018
      - /usr/libexec/PlistBuddy
        
        /usr/libexec/PlistBuddy -c "print :JavaX" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
        6⤵
        
        PID:1019
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1020
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [PlistStyle] Oracle"
        6⤵
        
        PID:1021
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1061
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [JavaRequirement] JVM minimum version: 21+"
        6⤵
        
        PID:1062
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1063
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [JavaRequirement] JVM maximum version: "
        6⤵
        
        PID:1064
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1067
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [LanguageSearch] Checking preferred languages in macOS System Preferences..."
        6⤵
        
        PID:1068
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1075
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [LanguageSearch] ... found [en-NL nl-NL de-NL]"
        6⤵
        
        PID:1076
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1077
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [LanguageSearch] ... selected 'en' (from 'en-NL') as the default language for the launcher stub"
        6⤵
        
        PID:1078
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1079
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [Language] en"
        6⤵
        
        PID:1080
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1105
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [JavaSearch] Checking for \$JAVA_HOME ..."
        6⤵
        
        PID:1106
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1107
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [JavaSearch] ... using JAVA_HOME is disabled"
        6⤵
        
        PID:1108
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1109
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [JavaSearch] Searching for JavaVirtualMachines on the system ..."
        6⤵
        
        PID:1110
      - /usr/libexec/java_home
        
        /usr/libexec/java_home --xml
        6⤵
        
        PID:1111
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1117
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [JavaSearch] ... found JVM: 1.8.0_301:/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java"
        6⤵
        
        PID:1118
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1119
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [JavaSearch] Filtering the result list for JVMs matching the min/max version requirement ..."
        6⤵
        
        PID:1120
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1130
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [JavaCommand] ''"
        6⤵
        
        PID:1131
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1137
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [JavaVersion] "
        6⤵
        
        PID:1138
      - /usr/bin/basename
        
        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
        6⤵
        
        PID:1144
      - /usr/bin/syslog
        
        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[1007][SKlauncher] [EXIT 3] No suitable Java version found on your system! This program requires Java 21 or later."
        6⤵
        
        PID:1145
      - /usr/bin/osascript
        
        osascript
        6⤵
        
        PID:1146
    - - /bin/echo
        
        /bin/echo 21+
        5⤵
        
        PID:1052
    - - /bin/echo
        
        /bin/echo en-NL nl-NL de-NL
        5⤵
        
        PID:1074
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nsurlstoraged
        5⤵
        
        PID:1147
    - - /usr/libexec/nsurlstoraged
        
        /usr/libexec/nsurlstoraged --privileged
        5⤵
        
        PID:1147
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.StreamingUnzipService 188
        5⤵
        
        PID:1148
    - - /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
        
        /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
        5⤵
        
        PID:1148
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.routined
        5⤵
        
        PID:1161
    - - /usr/libexec/routined
        
        /usr/libexec/routined LAUNCHED_BY_LAUNCHD
        5⤵
        
        PID:1161
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secinitd
        5⤵
        
        PID:1163
    - - /usr/libexec/secinitd
        
        /usr/libexec/secinitd
        5⤵
        
        PID:1163
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Maps.mapspushd
        5⤵
        
        PID:1165
    - - /System/Library/CoreServices/mapspushd
        
        /System/Library/CoreServices/mapspushd
        5⤵
        
        PID:1165
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.akd
        5⤵
        
        PID:1166
    - - /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
        
        /System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/Support/akd
        5⤵
        
        PID:1166
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.adid
        5⤵
        
        PID:1167
    - - /System/Library/PrivateFrameworks/CoreADI.framework/adid
        
        /System/Library/PrivateFrameworks/CoreADI.framework/adid
        5⤵
        
        PID:1167
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.geod
        5⤵
        
        PID:1168
    - - /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        
        /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        5⤵
        
        PID:1168
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.geod
        5⤵
        
        PID:1170
    - - /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        
        /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        5⤵
        
        PID:1170
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secinitd
        5⤵
        
        PID:1171
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
        5⤵
        
        PID:1172
    - - /usr/libexec/neagent
        
        /usr/libexec/neagent
        5⤵
        
        PID:1172
    - - /usr/libexec/secinitd
        
        /usr/libexec/secinitd
        5⤵
        
        PID:1171
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.cfprefsd.xpc.agent
        5⤵
        
        PID:1173
    - - /usr/sbin/cfprefsd
        
        /usr/sbin/cfprefsd agent
        5⤵
        
        PID:1173
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ScreenTimeAgent
        5⤵
        
        PID:1174
    - - /System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
        
        /System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
        5⤵
        
        PID:1174

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:885

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:887

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSProductID
1⤵
PID:889

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
ksadmin --ksadmin-version
1⤵
PID:892

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:895

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSBrandID
1⤵
PID:897

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:927

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:929

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL
1⤵
PID:931

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID
1⤵
PID:933

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName
1⤵
PID:935

/usr/bin/defaults
defaults read "/Library/Google/Google Chrome Brand" KSBrandID
1⤵
PID:939

/bin/ps
ps -ewwo "comm="
1⤵
PID:951

/usr/bin/cut
cut -c 1-108
1⤵
PID:952

/usr/bin/grep
grep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"
1⤵
PID:953

/usr/sbin/lsof
lsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"
1⤵
PID:956

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :CFBundleName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1015

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :CFBundleIconFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1017

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMMainClassName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1023

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMSplashFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1025

/usr/bin/grep
grep " "
1⤵
PID:1028

/usr/bin/sed
sed "s/^ *//g"
1⤵
PID:1029

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1030

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMClassPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1032

/usr/bin/grep
grep -o " \\-.*"
1⤵
PID:1035

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMDefaultOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1038

/usr/bin/tr
tr -d "\\n"
1⤵
PID:1036

/usr/bin/xargs
xargs
1⤵
PID:1037

/usr/bin/tr
tr -d "\\n"
1⤵
PID:1044

/usr/bin/sed
sed -E "s/Array \\{ *(.*) *\\}/\\1/g"
1⤵
PID:1045

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMArguments" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1046

/usr/bin/sed
sed "s/ */ /g"
1⤵
PID:1047

/usr/bin/xargs
xargs -n1
1⤵
PID:1041

/usr/bin/xargs
xargs
1⤵
PID:1050

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMVersion" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1051

/usr/bin/xargs
xargs
1⤵
PID:1055

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMUseJavaHome" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1056

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c "print :JVMEmbeddedJavaPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
1⤵
PID:1060

/usr/bin/xargs
xargs
1⤵
PID:1059

/usr/bin/grep
grep "\\s\""
1⤵
PID:1071

/usr/bin/tr
tr -d ","
1⤵
PID:1072

/usr/bin/defaults
defaults read -g AppleLanguages
1⤵
PID:1070

/usr/bin/xargs
xargs
1⤵
PID:1073

/Library/Java/Home/bin/java
/Library/Java/Home/bin/java -version
1⤵
PID:1083

/usr/bin/awk
awk "/version/{print \$3}"
1⤵
PID:1084

/usr/bin/sed
sed -E "s/\"//g;s/-ea//g"
1⤵
PID:1085

/usr/bin/awk
awk "/version/{print \$3}"
1⤵
PID:1089

/usr/bin/sed
sed -E "s/\"//g;s/-ea//g"
1⤵
PID:1090

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -version
1⤵
PID:1088

/usr/bin/sed
sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
1⤵
PID:1094

/usr/bin/sed
sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
1⤵
PID:1101

/usr/bin/grep
grep Dict
1⤵
PID:1114

/usr/libexec/PlistBuddy
/usr/libexec/PlistBuddy -c Print /dev/stdin
1⤵
PID:1113

/usr/bin/tr
tr -d " "
1⤵
PID:1116

/usr/bin/wc
wc -l
1⤵
PID:1115

/usr/bin/sed
sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
1⤵
PID:1124

/usr/bin/sort
sort -nr
1⤵
PID:1129

/usr/bin/awk
awk "/version/{print \$3}"
1⤵
PID:1135

/usr/bin/sed
sed -E "s/\"//g;s/-ea//g"
1⤵
PID:1136

/usr/bin/sed
sed -E "s/^1\\.([0-9+*]+)\$/\\1/g"
1⤵
PID:1141

/usr/bin/sed
sed "s/+/ or later/;s/*/(latest update)/"
1⤵
PID:1142

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Subvert Trust Controls

T1553

Gatekeeper Bypass

T1553.001

Credential Access

Discovery

File and Directory Discovery

T1083

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com_apple_MobileAsset_TopLevelDomainDafsa.xml

Path /System/Library/AssetsV2/com_apple_MobileAsset_TopLevelDomainDafsa/com_apple_MobileAsset_TopLevelDomainDafsa.xml
Size 4KB
SHA256 225b426f8b02a92b10bc7414670d63b4613696312dd1e480374423fde11eec13
MD5 a057f5db60a2a3dc32a181a2151bb092
SHA1 b0bbbf656feb3ececebd3ef93e3668f9d026016f
SHA512 653973da08dac23ce2394e8b6948ce7f8b1466b30e329245c78bb23fd77ba1829074aad0be490b9c3a3b4e278e21854ef1f85ab4a733731d531f77f378cd941c
SSDEEP 48:cfyR/Jjb0x/WxzzcN7n0xmWzzc7W4Ut0Hmvh2/FQURUvnp7iZXSHFqedVGTL3n:Cy1Jjy/kA7m1QU+Hghy6pWZXsFq6sf3n
TLSH
T1F3A11DF55E4D2E940C855A140B94A80E51EF3EDC1DF050FBF893987AF812E63A1F46AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 321897.crdownload

Path /Users/run/Downloads/Unconfirmed 321897.crdownload
Size 33KB
SHA256 a46b17e4b83ab060c99ac070edc9a9bcbb558a7908397b0955e251f48340ca8c
MD5 4258441dc62a3c72cceeb4cdb52e2d7e
SHA1 f36215be45d1fa1114c1e4eed148b52b78474266
SHA512 2f5ec5f07b9efe64856b8440a9142918154f5bc4f711900fa457ac0b050e4f037fdac6d308cb618537f5e331d9ad20cbd103ef66a772a14306cab81223c6541f
SSDEEP 768:/i+NqlUi9xnWdg13GHqaTW4imDZxOwtA7i/RRYCpDc:qrl5dN3GK74i4x/tBTNpDc
TLSH
T1F9F2F1D6AA07B11BEE6130BB0E63B0E5ED741384F83D43D50298AA171D1AC48F9E4C7B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jre-8u503-macosx-aarch64.dmg

Path /Users/run/Downloads/jre-8u503-macosx-aarch64.dmg
Size 93.2MB
SHA256 0837dc7d56bcf9863daba5d3183c6bd03c9c347551b4bc137275e1e9dd135060
MD5 a21b671c35ac528c9c66ebce0c3b9667
SHA1 6bdaeca4dbe2040fbdd12d8f2076c587837049bc
SHA512 9ccc1535d7934f6020e87dc20d7cddd02d90ea6f071e80e8589c36c1ce1b8c852299bed869a7ec85ff20940835907d1fdc27b0533e5e0db5d212b0187831d7a9
SSDEEP 1572864:X7iVCs4KCv+HZOXEN1YBuBQ5k9RYfUoJE3EWit6r9VUpS0VWsaUUsVVGJ8QiI8pr:XCm+56yaSpYUEWiaIpZWzsrLe8pVt
TLSH
T18728337AE0A6C09B58334160A5A0F84FCDF907BBD5B7D8B98F8107239DD97BD724841A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

visual_model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/ClientSidePhishing/29.0/visual_model.tflite
Size 3.0MB
SHA256 d38a4cda8912f9598b8701dac7d5ee90eff324ed1fb9d277b9784fe45a4e6c72
MD5 a9803d560544e4d1fe551b2c113c5370
SHA1 a998fdb1e80dbca61267db112812a7ee34b82dce
SHA512 65b8b6ecfea2aeae95a39581c39476a54721e07ee7c296650ccddea29a09b29a11cab15fdc89f97295bd61423dc13a66666faca371200bcb459dc1f25b6c89fd
SSDEEP 98304:0FkQ8+nTgV11233hz/v/U2P6tObWAOz+O2la+Ao:T+nMV112lU6b9O2rAo
TLSH
T1CEE502A5B811F1C2CA19C6729B56FF6F48317C265F05D027320DBB4D48B22EB8F4A6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path /Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat
Size 40B
SHA256 5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6
MD5 fcb4024c6dc53a5b72c492fd960762d7
SHA1 82c43024d9e274bf2b8a5d1e505d65cf3873fb92
SHA512 5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b
MD5 SHA1 SHA512

Submit Download

79f46d08-0eab-4860-af12-59f634113f04

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/79f46d08-0eab-4860-af12-59f634113f04
Size 258KB
SHA256 8d21fe1bd251856bfaeaedd6a72ab78f153a047b6042e0fc614f57a32b56d340
MD5 5adf364735dcbe6bf26ebe3f705c9dbc
SHA1 a891521fea2f61a2fd16ea9f0a3fc3c2c5fb3a46
SHA512 5f77f8923ab3800ab754f4c60095077b529c5f5f230c6a0b6803dc28597f42ed682921267ed344e190d0f08e0a23eceace7bccbc9d22432029a3e6f4838420e0
SSDEEP 6144:771bE8xvMX08XghZNhvfhua/I4dMdYuw4/xCRxQkdE6oO:7p1xE3g3Nhvf39dMNxxyxGLO
TLSH
T12B4423A9480AFA919B0236F2BF61D07C234649142C9E2B9DDFE48F70E7FE715658F108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 65898.crdownload

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/Unconfirmed 65898.crdownload
Size 19KB
SHA256 15275b34a2995f83aa20e2ae657b6f8d89a02327951089d201d5327a932bb712
MD5 89b55e34569b40500beb37203a5da913
SHA1 8ad23fb2b2febe58618edc869b56aa755d0be2e3
SHA512 e99bb680e8b06e390b7afb8ef12c3dfa3de860f5c52aadb7e11d197e7f9a0ef933ecb060fe8698399fb0cf04960516cf4c3820db76353c7ec608a8281351668e
SSDEEP 384:2TxDcXJvlppizpyBgvPF1gLBogn9YRXsiw8oANS2voqyYgn8Ovr:0OXJvhizpyenF1glx9YRXsiwKNFAqyYY
TLSH
T16D92E15E041747C0BE602992AB1BC1D4C992A8E138CFCFB9B794ABEDE5B3144232F411
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

craw_background.js

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_1/craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb
Size 339B
SHA256 9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5
MD5 61a867b6e4a24cfcfd32ddef25ac3229
SHA1 87cc4516fbce1700174d8ea27c9d2cb70a60a1fd
SHA512 3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc
TLSH
T115E0C2FB0A4984C1E9519BBB2524371D7B25CA2AD9448BE38E48E2528A284616609468
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb
Size 569B
SHA256 b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e
MD5 b5db1f091948de93d7fc96e14aef6da3
SHA1 74745f991e3dfe45037366e55c2e6df47d8e6593
SHA512 d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34
TLSH
T157F020631A2BD8A6C868A8325C94270C23A78F0D47B8865B6231CA301D668113A148AA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
Size 269B
SHA256 241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172
MD5 6487e04972ecffd0aabf7b61bdda8119
SHA1 26f0b11a2529a35f6970a914deadfcf2e2d23286
SHA512 44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae
TLSH
T150D0231426B7C48FE44951B165C35F64736CF459F5154783561865E44F3F0043D44174
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Storage/ext/gfdkimpbcpahaombhbimeihdjnejgicl/def/Session Storage/000003.ldb
Size 141B
SHA256 085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8
MD5 38fc535a8f11d7e955ef58cc63158eff
SHA1 c45ad3ee106dbfb65dce7c09b53140f34454cd0e
SHA512 26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505
TLSH
T187C01210066B8863C417737106C417501310E8A40006471316C233600C740311F1045A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb
Size 136B
SHA256 935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132
MD5 fe382e791274914bee5950777e4f1fd3
SHA1 53b523b5fc87e66f2520a0b5f9ea080072668f4d
SHA512 a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67
TLSH
T156C012480B948CC3C9009736082443141301C920F72CDB434381B2A10D740CF5E00085
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb
Size 2KB
SHA256 18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8
MD5 e0f65ad85a40a32fa91e551005e193ce
SHA1 a145766d5df23ae5fcd23dbb6937606f280f3502
SHA512 bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425
TLSH
T1F44164D3BDFD4BB2ED447E70D12ADB5C1015C6BE00564E0FAAE5A53C9274DA104F6076
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb
Size 288B
SHA256 79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06
MD5 b47a44bdd1b765b6af56b347447fd1b7
SHA1 8599a1870656af91e432bb35e3497863e34ddfbb
SHA512 bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0
TLSH
T129D09520FB93C021D7C0137D4D301F4C170555D1D5067759D43FF5642C74001784D430
MD5 SHA1 SHA512 TLSH

Submit Download

model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/OptimizationGuidePredictionModels/677b0e29-fb2c-4aeb-b2db-e6ce90e9a157/model.tflite
Size 382KB
SHA256 a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534
MD5 6d7c2f9e94664539dec99b3233301b01
SHA1 85812b004742cc1c211c92911131ce270f8ba769
SHA512 4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33
SSDEEP 6144:4i8mNiZGi+jiwubrNEOB37+rNiyykvXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMl:WqEGi+GwGrNv9+r8bkvXpqQMLuNy5YmJ
TLSH
T10584C013460497BAD7FC237684C31D9E12A5F2625E73B86BF9363E464811B1BE62237C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.32.0/Ruleset Data
Size 138KB
SHA256 fed1557c8b4e40813114db3b546c043105892dd0895c4d7c02d45a8be351173a
MD5 132df2b999906be7b21cc21bc247b068
SHA1 0665be201a96e717410a4e61a263bb879b3f08d4
SHA512 6764c8a425cd010a67a4636f812d43e63bb0815943e9839cf9fa35f3e5f9ba52309ed842306dcffe32a72e7019cb0c28e1d402dfc22dca0603a0cd48d6a26451
SSDEEP 3072:nAwq4WU8BNptWsfvaWSzpjNSIy27mElP6vUGyA:nAw2fcFty27Js1
TLSH
T14FD373937718C4A2E391913A97CAC72145B2F7D9E487E6F779E2034F3C452B22F1468A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.70.0/Ruleset Data
Size 242KB
SHA256 cc9b02f3f064329064c03d467d316f75aa26f670625cf09aa5291a75e875bb9c
MD5 cfbba585a1ba77e348f7b68c7712a433
SHA1 2bdf5f3ba9816f8fbf38262dc97ce1142a3a754d
SHA512 5718bbdf9603b6c9b3121c33bb8ff05704586f480bd03c5daf9c3b181be7a43d9ef2fa983f0bcc4415596a941e0383b516199aa68ea40a583bd7204b243ed84d
SSDEEP 3072:8dr1EBspkgGj4fz4tj+1cl4VwyyqNmLls291hDZeqNChbav8IinXkHWTQrh28Hai:8AmkgGE0tj6bXehlekgSmW9vP9j
TLSH
T15134C516631CD511FBE1023B04E6CB226720F7E26A82E6EE79A4534F3D4D6B72F1426D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Unindexed Rules/9.70.0/Filtering Rules
Size 152KB
SHA256 6b7e98d71a5d85202f359344828ac98b03c41e5887a13189a053350ef3263a0f
MD5 d291a3e65281842163026333d76f8db1
SHA1 efc85b89cd21cb6fb6b3a472e0a0ce7f4af7432b
SHA512 202a9bc9f7707bcbb6a1016cc64d1b9b88b6aab602f7df88e6864d2d428713b449fed8d8496bd8b63b6c230bb332977109fa3029e3439454778ddcb4da7200b5
SSDEEP 3072:3ntegWjlKAnKYZCZMGuHD+t2xfb9ZnDL8JGpJ00kG6Gdce/6ujPvF:3HW5ZHyEfvnF
TLSH
T1EFE33D176215F1F10EB60A3E148AAD9556B032E443D7F9F18A29C38DB1F468FB2943F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 140KB
SHA256 9f8cb8d15e4ab85c6194a6924ffc1dbbc29337be8b597f5d3a3de0a6d1553204
MD5 dc0ef280952ea25f5997e5f4f4515813
SHA1 5db519673ad74348505fdbbdf9e8f2dff0215b0d
SHA512 11f0748e726155b27c383ea6363be56b2fe3b619995178ae45277c04d9c44564a143e6d698dc901af073088da03456042f88522086b6ae0db8bc6b8d69738e0b
SSDEEP 3072:KlGpG1qcOCk49LN0ilk7Wjiye7DiXFbjkgnReXENechb+UVAU29+:sGpGqcOCr9LN0ia6uymGXFWUNechb+UR
TLSH
T12AE331035E2485171B613A5747918708FC2FB96FF837CCF79836A50B66A0CA6E71DB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Experiments.pbd

Path /Users/run/Library/Caches/GeoServices/Experiments.pbd
Size 137B
SHA256 22bd927b0ea69ff5878fcc5981d17fde83db6580399ba82934ba6ee91632b9e6
MD5 719237af38bb91b4f3e4d44936d4bc98
SHA1 9b3346360a6ed61a45150591a652ad69ab2d3e2a
SHA512 5cdb291eb77f9477795f6229d946e29ed050ee87cf9cbf78f384f43907d796ae46d24043fe08c3a4458c7f60179a6a15caf9515581571b74f55af7b2c302138a
TLSH
T1BDC02B070940E12FD60F00D11204BD72044ED61C1D134C40013645D6D131D30DC1059C
MD5 SHA1 SHA512 TLSH

Submit Download

altitude-1426.xml

Path /Users/run/Library/Caches/GeoServices/Resources/altitude-1426.xml
Size 405KB
SHA256 edfb96c2ed3030e39e614ea3e5d716739e9ddc1c3e490c9056ed4df9d13e2198
MD5 d85613141c8704587540afa61f5bdc79
SHA1 5f9ce4144852529db3d6d0f0d3c600e3f73cd919
SHA512 e5002ffbc00954fc2fefc23793f62cab320e220506df82cdfb875de4d27d3c9745a9cb344ab3859eccba338dd8a0be5ad33d777dbdd8220cc38086a7d39f8f83
SSDEEP 6144:l8fW1KAY+vyl7KkUsTuola+RTRZSqtIGXF5WDv3z6:W
TLSH
T190949024923DDFA775684A7C878EF1A113F99F2F400636E8D693D277AD9C5C02A9C384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

networkDefaults.plist

Path /Users/run/Library/Caches/GeoServices/networkDefaults.plist
Size 6KB
SHA256 8663a4bf97673dd5bdd453484fa0dedc94e844e789a9c4349eaf7cf5e9f66719
MD5 53e198ee59e585ca411a6c0cdbf4228e
SHA1 0773310b8fcdf18de3a0d317b0dcaef889c018f8
SHA512 80a17259da727c07397d35e0d2059312d19134a4e12f474dfe96b015088b54c0306eebc54d2202554a69816609a8e54a4924b84c86f76ee1767f276403300da0
SSDEEP 96:Df33Pfd+nraSkWsDSbCUJHF/ZJNl+a3pDahiI4/qaTsmAn54fnl:DnQn2SkbeV19ZJua3pmhiIVUsmg8nl
TLSH
T1D5E1467DF1C2FCB44B47AEC952C29596C7F9ABCBA086BDE18D343E4305939E0418B219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 fe7908371747c79894f9e478d6ccbbe6b5459f3ac4f4b7389aec8311a2ddc4c0
MD5 0b6e7700584019d5590f627ea969c523
SHA1 6f022f06395e62b3c1b3f0b0f36f7d2e885ed516
SHA512 3b78a7dbbc2610a79c8859fddbf606f8eaab09649593e3a27ca232333566918a1b782ec4e526c4a3e4ce817322b83f1f13d12f49a7a9fb0232e6447850baf8da
SSDEEP 3072:UZr6c0dcAcyr8eiUVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmC:Uopv2T79Qk
TLSH
T196B383825BD5ED75C05105BEF9A3A308B735D6AB97A363873391A483AC122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 04ed7b125c68da6838cc3e729aa737db73554ce256be04cdf04b376504e0816b
MD5 91867d711b19941d41b97f7ab99d6111
SHA1 579fd4290aa6faaf38bf6414bc4e9a1dd5c4605e
SHA512 569e0ad311996f8cb23a8a336d7f3d599f42c59e6a8a7013e02b918b35a77e859f262e03668203c9a2ecd29f0c71255721b7b239213560f7f2e2d97ed6ba1c20
SSDEEP 3072:EZr6c0dcAcyr8eiUVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmh:Eopv2u7N
TLSH
T115B383825BD5E975C05105BEF9E3A308B335D6AB97A363873391A483AC122E40F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 4267e52b21eb5cfce14a36c6281cbd791a9207fd1d45e704d3d1b1dad778453a
MD5 187e32b6dea762145be58d02c463b6d2
SHA1 13b191e7e77e9d83261b8f4104d9c5f8bffb27cc
SHA512 032a660bbb97792aa2a15958c9d046d478f33a824f02280217ca89fb1048d565fa70fb27925795495fd8ee47b472442d76087ee6d2a2e91f6ae138b032fda8cd
SSDEEP 3072:RZr6c0dcAcyr8eilVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmR:RopvHx7M
TLSH
T1F5B384825BD5E975C05205BEF9E3A308B335D6AB979363873390A483AD122E40F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 ba808ab6625b05dec346b987ba391052f744a92b1be7653a8c27f039ce22751e
MD5 c8b3978ef2a58177e0f5b8436793da4e
SHA1 40efd63d157132febb204f51474ca727acd588d6
SHA512 50a3dd0e1fa0e744a61a7d7babad4a54f30f187fdbabe19ccf60c64a056fc8e5eb281c79e45ab9ee081ced85b24e8e4534d65f9ba8ce15953289965025219223
SSDEEP 3072:FZr6c0dcAcyr8ei4VB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmK:FopvKl7WQB
TLSH
T137B373825B95ED76C05105BEF9E3A308B335D6AB975363873391A483AD122E00F79BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 d75a7c2282664ee4ec1b6de29bd425be77dff2d81be23b83b78972758dd5c6b3
MD5 7eea542c5591c48f0a30cf5d3be508cd
SHA1 11b7a299411cbcc466d414013352c49ecdac041d
SHA512 5498c63252862654a1edf1f59423bcb29512c31bb2f01f76fbe31d5fc13bbace9ee0117e79c43ca2a45b94e6d177ee372eb29ba6788ecbf813070547b2a90376
SSDEEP 3072:eZr6c0dcAcyr8ei4VB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXm2:eopvKh73
TLSH
T163B373825BD5E976C05106BEF9E3A308B335D6AB975363873391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 10a7b5e346c22d223a2a4ebfd9154f89716956cfa74aca0a57a2aafa6f4e734a
MD5 c48b376f27310e1dc6047c92c4ecd06c
SHA1 f94b2d5649c22e1c0ac6818a09efe2bdd2c52443
SHA512 ae8b06b54ea7b578e08e9628dc0399b4581209e476abeecbfed02c572c9b20c527938794cd3f7610472ca923555e1959f763a9fc5e84071253bcf4d3c0a32440
SSDEEP 3072:5Zr6c0dcAcyr8ei1VB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmi:5opvns70
TLSH
T141B383825BD5E975C05105BEF9E3A308B335D6AB979363873390A483AC122E40F79BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

data.data

Path /Users/run/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 5a70b44013ecf68f91c6848115fe35e91acf407d031c7c107ca045532acd5cb5
MD5 53366baa6a039a15a649a3b7b7325271
SHA1 8c04ec8cf23ba168fc5b523c3e2559c4b06a5c9a
SHA512 c66302a5983e4219f7b9e9e90c9f1ae0e5a85ff080d89e6d95f36f7b7396ffeacec31419735969a04c4db925b8c358e2e39aeb4997d2c2b533930f60414554c1
TLSH
T18421EAED1201F80764E0D72205ADF9C15620A6D34D1B6E11EEAD06759DE7F0A7C1C509
MD5 SHA1 SHA512 TLSH

Submit Download

data.data

Path /Users/run/Library/Saved Application State/com.apple.osascript.savedState/data.data
Size 1KB
SHA256 9cee7fc79091e74d445b0e90bde1c9bd09e8e8345dccf3fb1c95a568ed908312
MD5 c99845f994604f977d8b500f2357f79f
SHA1 8cbc7756317c704da8e437308b884f2ecc498a4d
SHA512 91ae05a51859846518746350a3a9dccdfcb37de51d502cd8ee7c8f4ff25401361c00a882c01744136f7ff5754b06d6094ac94ba285de697ed92ff0fda86d2f1a
TLSH
T128412AED5741F34B88F0C73305DAFD612604D2DB0C2EAA10EFAD12299B26F052C3D918
MD5 SHA1 SHA512 TLSH

Submit Download

icon_128.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirVaDYSz/CRX_INSTALL/images/icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirVaDYSz/CRX_INSTALL/images/icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_ENGB500000_lof45en2yrc2tvvdfc42hhgnkq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.4jwr1m/obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_ENGB500000_lof45en2yrc2tvvdfc42hhgnkq.crx3
Size 7.6MB
SHA256 95ff39d8ef1186d8b10dd3a57c6a4a426732b5fca36bdea4670fc4eb0f0b04b5
MD5 f33b5f649851bfaa5e3a9f813b586b1e
SHA1 d6b346fc53489779f07ce1a220e38d62a89b89dd
SHA512 940cf34538cf387663ecd8124e370dc5c95504bea41247ac0766088288c68ce53489a20ee7182a03dc99e5559e034f3a005b73c35f6dde6f3a9e5151112ab1ca
SSDEEP 98304:WBMCyPEP6vKwEHDrIq34e0zBNMv4XCq1Mbrp9hsvwxId1C+c:WpyPxCTIFNy4SV8YxG1S
TLSH
T18E86DF2DB774101B0DB61319D4471753A76A80D9C3844B5C91E8EEAA36926CF82FFAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gonpemdgkjcecdgbnaabipppbmgfggbe_2025.07.24.00_all_hou4jz7zmeg5zedchpigdjxhve.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.6Pg3hu/gonpemdgkjcecdgbnaabipppbmgfggbe_2025.07.24.00_all_hou4jz7zmeg5zedchpigdjxhve.crx3
Size 16KB
SHA256 56c21927faa028be6ce18c931660eec37e41da4bfbfd47cafa48350f828c0dbd
MD5 479078f9927c39f3ae015938f9a8b304
SHA1 31a6f9dbac78faad676ad3c1d9ee1cb85d87241f
SHA512 b1c098abc3f797dc2b498806a5181d4eea7f8b2e06b20e0ddf94a720fafe2a0677ae38049230d9830f918631ca1b10e4439698b11bb8994ae286b3c14cd3b2c2
SSDEEP 384:cTcwCd5CuqlL+kIVxRtRTGXvcxtsVjrs4rs9IJbjXaKYHuA:YOCuqlL+kIVxRtRTGXvcxt6phbjX/YOA
TLSH
T1A2724FFF46556504D7AA43F894AD3D4CD06B495E8FECE9E7DB22D82E4AB0AF410002DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.E7SFNO/dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3
Size 136KB
SHA256 0c24e9bd976adffa987e08fc54dc0950c84cf18f9cdb4c5caabc6acf24887c4f
MD5 667e9eec04509aa9e2b318f580addd8c
SHA1 346267ecad10c54de52a3aeb766ea72449500326
SHA512 a9d22d49290c164abf36dd7e887063ccdd2bf508eb2d16bbac6de749e5152805ecb38ca39352706150de29a76839fa6a56c084ea4f2757b61887b3a7912be917
SSDEEP 3072:SGYNExjxgL4glOAq2HgjlKr3dUqK9tXi606uuBTgilY09X:xYNExjxk48W2AMEt507uBUilY05
TLSH
T1F9D3125FDF1FB211ABE4E21CB68532C71284E58AC4BFA943884DF2E09FA89407865648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.FD0TCC/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
Size 857KB
SHA256 545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
MD5 a40c655b337e082c76b6ab04042b7ae0
SHA1 3cc2a2b7178a29fd2d246cbc532684d6ae45bea8
SHA512 fb4d54b573eb2275d8a3580fff138ecd7bded27ec58086b909b12c03c8005e35105c354a4a1ff76ada608ee8bbabeaafe208bb9e557661bb74e4ca39ee5eee56
SSDEEP 24576:tN1HYqiefjuhBCLF9t3c7y04bfB8w2aQnVBg1jAQpdnBXAt5:tN1HYqi2z9c7y04rKSpdtzw
TLSH
T1E7152367F7534E87A693C0F101B9EF5CDC2EC6B863DD6D5862DB6405CB8A8014EF1A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.70.0_all_gze4pzamdfkushbzoar2cohifm.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.JT60TG/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.70.0_all_gze4pzamdfkushbzoar2cohifm.crx3
Size 180KB
SHA256 733776833212346a1018b95197c61bed2d107fbb7790a985ef692780e02f31cb
MD5 567e79e44cc07a2da9454bbbec53fab5
SHA1 0e7c566060d07c0500192a7d6b609692519785f6
SHA512 231e60e73649833c0207cc80f931f1937e029acf14331ef8be372c1338ff680da03aa256492d5f6661be96d4a6a1e09b7e167dd424460455478ed957626df028
SSDEEP 3072:/BTQ6qntegWjlKAnKYZCZMGuHD+t2xfb9ZnDL8JGpJ00kG6Gdce/6ujPvy8:/W6qHW5ZHyEfvnt
TLSH
T19E0471076215F1F20EB2093E148A6C9592A472E513D7E9F0BA19C24CB7F469FB3943F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jflookgnkcckhobaglndicnbbgbonegd_3091_all_adfb4phbxwqsxsfvrtgwwtg25z6a.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.JV6mtR/jflookgnkcckhobaglndicnbbgbonegd_3091_all_adfb4phbxwqsxsfvrtgwwtg25z6a.crx3
Size 184KB
SHA256 9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
MD5 e5e7439bcae6cbb81408e08e1ceaa799
SHA1 a166c00d6f4ef6f541da1a291afcef11a5d7e426
SHA512 6122ff4a5d2a652565c0d9ab600f5c2558c95fac1c7d3eeca7c9bc20d054cdb20f6c089aaf38d51200b0b0276519a52c390142e11989f3d90145d7f648618e71
SSDEEP 3072:YRLHCaFAH1Z2dUZ7ViebPO8B6wAppi+NKfDRdwt20xrFzg7NCmDAsf6B9d/:9lVAdkXPOaRdwtzre7NChsf6B9t
TLSH
T13E044C49F84703A06F0780C99BAD62972104B2F47395CDDFB77FB6A56E00C9B20995BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khaoiebndkojlmppeemjhbpbandiljpe_145.0.7584.0_mac_adijmuudraws5pmse4bp2wpjlfpq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.KgI4fu/khaoiebndkojlmppeemjhbpbandiljpe_145.0.7584.0_mac_adijmuudraws5pmse4bp2wpjlfpq.crx3
Size 11KB
SHA256 9f157bd09a986baa46110a0acb7e3d7407208e58d02250c637902962e5ed2c5e
MD5 c2425a80ea4d5f90463e346b50f9d7d3
SHA1 64831f252de87d662b290493e98ec9d917449e91
SHA512 b934b3071adb98db083ff5ef06b239465f075c43a1b33467cc97ea09d7138cbee016fa44d9e8b4ecb89eced44b91a14faf07bf2ef3754b926f014dc03678b510
SSDEEP 192:YM6V27mUXs0aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmi1XP44PZexJFV3faUUGOuX:kVf0aEW8SsWk/pvtHB3Nf5YKk6QKEa4q
TLSH
T149320E95883A16E9AC3183A5F1B9C2218D21EE2B941F548E1BF353CB7BC1D868F37157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeigpngbgcognadeebkilcpcaedhellh_2025.06.13.084507_all_acip2yapafsolnpcvaohkisaowaq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.TnLg01/eeigpngbgcognadeebkilcpcaedhellh_2025.06.13.084507_all_acip2yapafsolnpcvaohkisaowaq.crx3
Size 257KB
SHA256 4497d8060d0e53c12b4403aa9ebe7e827d4880bae3f4139a26a4feb7ed64c4a2
MD5 5a6371818d0598fc615c76004f226666
SHA1 9225ea4a8418a37f8d6d393040ba78f20c93366f
SHA512 69d50587a46ad60c535ba0dfba8f0816f6474205e63a8ae2a8fe0c5f002b3e14dd8739a4dc0d9c60106398fb8566c27bfba9ba5ead347898842606aeba0bbf4a
SSDEEP 6144:FHKYcaVcxaGDSdsAm16knUFEUrlaTiHzeQM+XuWU:BKYUxakSd21TUFEClamHzeQ7up
TLSH
T1FF442A3A59B00465C44D43797A8A3717F3FC8F38AAB16FC514F9195838EB9028B7E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmelglejhemejginpboagddgdfbepgmp_733_all_ZZ_fsye6hekqo7axuonh4y53w5tye.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.Xyigx6/lmelglejhemejginpboagddgdfbepgmp_733_all_ZZ_fsye6hekqo7axuonh4y53w5tye.crx3
Size 556KB
SHA256 b4f8a709e6d95b3bb41a17dc4922be09f0eae7d08581d2c535ce001116474aaf
MD5 0d7f34cde6ac7cc89c3d7b95766cb9be
SHA1 8ea64398f56a442cae6bd42f18193fb4fc5e0294
SHA512 e6c65afc286e23dc98a6db590b6f75a955da49b2165b4262717fd3fa0e732d15d78eb14255f671145d3505d6c4d8921655a87bca134b33e6da4b60f4c29a4235
SSDEEP 12288:nMqmHB47JkibsQt+/aCrndoImSgigDUnqZMUr:JmHuR+DdiHi2GqZMUr
TLSH
T1F1C423FBF60880B6EFD0EDB0986C7F1C41137AAE51C89C4A4D9457484D535BB63632AB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfnkpimlhhgieaddgfemjhofmfblmnib_10737_all_ky3wbgcu7x5owq2tsfr65uda5u.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.e8ymKv/hfnkpimlhhgieaddgfemjhofmfblmnib_10737_all_ky3wbgcu7x5owq2tsfr65uda5u.crx3
Size 29KB
SHA256 13a4aeedd6da5532a4f2a10e131a6d95924bb1648520cd927d303683b077f3ba
MD5 ecd37251ae6b9f233f5ca10e42b0c4d1
SHA1 70588bf3cb1d47f1ecd0f8eec991df0d837f0df9
SHA512 f91052c3914e7146070bf0c181325e40e63583b1bad9b766f33154225a10a83fde5897de27fe9774eabcd0f7d5275496a06e6f82b07624f585e8c7a114a94147
SSDEEP 768:60t/HnfpXAkx3t0K80O5HMMbdCeDgmPmcDE9i+h58MphbjnF5:601nxQkx9D8rsMRgmxE9B/8MplnF5
TLSH
T199D2D01AED986706C076123F0536B76106BAE01A67A2D6731D39971CBDC7218FB36C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.f2dj7K/imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3
Size 2.4MB
SHA256 9738a550f51cdfb80146b1620b40a37d58c5136254ee1f0f03c20a864fab89d2
MD5 0fa505d26fd906c645e60aa05f12af36
SHA1 ecb1def63dba6d475dcd61c4d3a6938855e6f24a
SHA512 6c49784a21465a2b7348720003f072a279a7aaeb88783b98cdb968a54cb1ce6771122a6f1bbbfb8dd36507576c81d6caa000166f2dc0f81a3feca4e8d5131a00
SSDEEP 49152:7GGdTzNOf9v87G2whzy8x3ZOOK4G7tbbOWVc2JjrqnE1rmoGfi:qGVzGBolTA3ZOOK4Wtb6WpYnE1tGa
TLSH
T1AFC53381A8FC258A4F51BCD0740E58EB8E6CBB541DC7AD3207F926557F5120ACBB9EC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.com.google.Chrome.jeNv3F

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.jeNv3F
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.oNNZKx/ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3
Size 10KB
SHA256 e3a7322843834a5270a01c56533a34a24b1a253e3bda6f14046e10d818446165
MD5 cb79d407a4d6d8526b42060b9210b5c2
SHA1 331e3d66e82e130042897faf86dcbd05d7b227f1
SHA512 0ea283f2077ff874e1f2518565497864b11fd8a65f03d65e2b2996048bdba19849fcab81d9a8220cd51d4a09741b9cf222b1393f6ea4fde6db76dfe0590efdf9
SSDEEP 192:Hkgz/5MwS0wqF1GCEomF17IchyrIqVGqKI4eHiTSj:EIS01komF1FmIqQg4eHES
TLSH
T1C4229EE3AD249894CF2B1F3D59E6930709602A9E86E484908077CCCA1570FBDEB94F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

laoigpblnllgcgjnjnllmfolckpjlhki_1.1.0.3_all_adwgvw4jdcarox4vlsm7t4gq257a.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.rFg8gN/laoigpblnllgcgjnjnllmfolckpjlhki_1.1.0.3_all_adwgvw4jdcarox4vlsm7t4gq257a.crx3
Size 12KB
SHA256 7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
MD5 752fb191723f2ac933f27a4cf7b0e381
SHA1 143a9a509ebb85b228eb5e3721c0f4a3274e4f62
SHA512 bc04fcf4486206228df389b27e910bb38e926b0a2b625591f03d3c4f616befd96498b0c8355e83c36400969d2600aafe0f8d06c8ddf2e83636419de21cc68750
SSDEEP 384:KouyxMA8bnsa46GN1eRv/RR7J8jmmOsRJpJyV:dxMzsyGNUZj+jmmrpo
TLSH
T12842AE069D4E3A8FD90AD23D454A3E07377B326711D25449FB8B982980E97B1B0E89CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efniojlnjndmcbiieegkicadnoecjjef_1759_all_adzamcjnbie3ewzfcan6rgx37tsq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.xwY8BX/efniojlnjndmcbiieegkicadnoecjjef_1759_all_adzamcjnbie3ewzfcan6rgx37tsq.crx3
Size 412KB
SHA256 4a30c25497c9e654a8d72509e39f6e7a4844dbe7c570379c0ac18d552bac317f
MD5 dadc2dca87d7535b619575374c4d328e
SHA1 e36b0862dc663a4c6d04df8566b1a3342b1716d8
SHA512 d4d600742e11883e2e95ad4e7ce69c0d7bd22cdc8aab5b1eb1ed324fda2108c57e8d31988f592a3a765e71c2563115b16cf8a1ef68d91155944750eaabf95541
SSDEEP 6144:e/pxJ26uUvVc2cc66oXpFTy3IXtw6xrWtefZBSy7EwNZbgWy56kGFUT+Skyuke/c:026TdApQIXt9BX7Emwuxc
TLSH
T124949FAB2F247C43AFD3DD7470C8E53BBDB272D179AA54969149C0B1A9813D13E8902F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsck_hfs.log

Path /var/log/fsck_hfs.log
Size 16KB
SHA256 c8dd64351b54b611f839b209a67c00079f4d6c74e38ae8978b34bf3da68b95e3
MD5 bb07c0c35984239df93e6731a2ff4fbf
SHA1 f744761695b1d1bd571ecbb5a5e69bb8070d9e98
SHA512 ad1d1b41fdd3b911355f2bb7611d947c9a71f93cef4bc32ccb902784fc2011cffbc27ac31f078fc4aae73bceb9529b6b3ed67b4acfe982022fbbd0e0a059417a
SSDEEP 96:iAgQ8J+kny9DFE/4lrmwFmDWnUu4fp1f4flXAnAiPcv+cr9XsdOktYZgIvUnoH0Z:5gBnZ3R1SpidIO
TLSH
T18A7214849141E71DBA8F11DDD377A68A71CFAD8AC373D36B38A934D8720C82A57769C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsck_hfs.log

Path /var/log/fsck_hfs.log
Size 16KB
SHA256 0dbb969d95653b99586b5011836954b5590db807eeb0bab641eb9676d2f0e253
MD5 98dabdb34c279beb40a1bffbdb8f3288
SHA1 7784e79b44668c0538dd72843d2c7db6c73e552c
SHA512 7cf5af6af6a79c90553393db5346c9f10154138deade11b45fa91bb1148e37bb4913c54285cbf859eeb5ea7c3094eadd78ba82fb9452de2458d7ced581a5d198
SSDEEP 96:iAgQ8J+kny9DFE/4lrmwFmDWnUu4fp1f4flXAnAiPcv+cr9XsdOktYZgIvUnoH0i:5gBnZ3R1SpidIt
TLSH
T1857224849101E71DBA8E11DDD377A68A71CFAD4AC373D76B38A934D8720C83A57769C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsck_hfs.log

Path /var/log/fsck_hfs.log
Size 16KB
SHA256 2f10c7fdcc2561e9d20ef647572010be9ed7cd9700b2821cd27e34451e082afc
MD5 b68a8740d470ec1b429c0fd0e646d2e4
SHA1 1889c6e0478a9078678322bebd31182b93772cd0
SHA512 2a48954054f75ceb2f5e147f5f0fe64d15c6b4c10b093d438a22c45b14e98dbd9aeebfe66d01cf6ede56168b9486e4e723ebb21c0474b47971c1b3737b53b473
SSDEEP 96:iAgQ8J+kny9DFE/4lrmwFmDWnUu4fp1f4flXAnAiPcv+cr9XsdOktYZgIvUnoH0i:5gBnZ3R1SpidIl
TLSH
T1D07224849141E71DBA8F11DDD377A68A71CFAD8AC373D36B38A934D8720C82A57769C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sh-thd-1787758906

Path /var/tmp//sh-thd-1787758906
Size 1B
SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
MD5 68b329da9893e34099c7d8ad5cb9c940
SHA1 adc83b19e793491b1c6ea0fd8b46cd9f32e592fc
SHA512 be688838ca8686e5c90689bf2ab585cef1137c999b48c70b92f67a5c34dc15697b5d11c982ed6d71be1e1e7f7b4e0733884aa97c3f7a339a8ed03577cf74be09
MD5 SHA1 SHA512

Submit Download

sh-thd-1787773342

Path /var/tmp//sh-thd-1787773342
Size 182B
SHA256 b6b1b914ea63ef79a16f0f0e361371a0df82b27c554c7bbc2384161a0170ddb1
MD5 b9b44e0346dfd1cf6cb1079e05af6180
SHA1 62eab631a6d419c7f649bcd7f14f7bc411029711
SHA512 dfdf73e3622bf203a83bd2aceda23c50e247e5c2a14e1da41f28052d6d44ffe9a5e009f7eca1764ac0e24750bf061ae866271cd608a7082b4d5527f21b08714b
TLSH
T1A7C022454640E86900C08B8B1729E1445310F39689B0059C00D01C824A07195930026E
MD5 SHA1 SHA512 TLSH

Submit Download

sh-thd-1787776238

Path /var/tmp//sh-thd-1787776238
Size 555B
SHA256 8147bf5e15930597be48929686291e59d57687333e87eaa9c199bede9323c778
MD5 1d228cd384645fed5912c334df6197a8
SHA1 343fe4876d22511c3191604c18f9db485893bbf0
SHA512 279336c73afcb4680c224e34c3a9844bc0763d93df4315b7c45e03f3e11bdd19ad4d3f616c687fdc61ba671538da4f8f8026dc3fb8467cf77f1bc006abddd338
TLSH
T1E8F081579784D23E6F0341D0650B05A9F71DD48423D1E07B95C680DFE4C523F17A5866
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads