hxxp://salinewin[.]exe

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
599s
max time network
601s
platform
macos-10.15_amd64
resource
macos-20250619-en
resource tags

arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
03/09/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://salinewin.exe
Sample260903-e8ae6aycmf

Score

8^/10

defense_evasion discovery

Malware Config

Signatures

Path Permission 1 TTPs
Adversaries may modify directory permissions/attributes to evade access control lists (ACLs) and access protected files.
defense_evasion

Linux and Mac File and Directory Permissions Modification
T1222.002

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
261	drive.google.com
263	drive.google.com
264	drive.google.com

Gatekeeper Bypass 1 TTPs
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
defense_evasion

Gatekeeper Bypass
T1553.001
File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
defense_evasion

File Deletion
T1070.004

File and Directory Discovery. 1 TTPs 3 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName	Process not Found
dirname "/Library/Google/Google Chrome Brand.plist"	Process not Found
basename "/Volumes/Google Chrome/.keystone_install"	Process not Found

Resource Forking 1 TTPs 19 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid ECC65B3E-EC5D-42D3-AF97-F3427752A268 -post-exec 4	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid ECC65B3E-EC5D-42D3-AF97-F3427752A268	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2	Process not Found
/System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	Process not Found

/bin/sh
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'http://salinewin.exe'"
1⤵
PID:474

/bin/bash
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'http://salinewin.exe'"
1⤵
PID:474

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:502

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:502

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window http://salinewin.exe
1⤵
PID:474

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:503

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:503

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=9"
1⤵
PID:505

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:506

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:508

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:509

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:510

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=30"
1⤵
PID:511

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:512

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=30"
1⤵
PID:513

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=30"
1⤵
PID:514

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072"
1⤵
PID:515

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
1⤵
PID:516

/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
1⤵
PID:517

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
1⤵
PID:0
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=293474638" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=59"
  2⤵
  PID:520
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=293516501" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=59"
  2⤵
  PID:521
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
  2⤵
  PID:522
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
  2⤵
  PID:0
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
    3⤵
    PID:525
- - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
    3⤵
    PID:526
- - /usr/libexec/xpcproxy
    xpcproxy com.apple.SafariLaunchAgent
    3⤵
    PID:527
- - /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
    3⤵
    PID:527
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:528
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=298220324" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=76"
    3⤵
    PID:529
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=298838471" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=77"
    3⤵
    PID:530
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=299314331" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=78"
    3⤵
    PID:531
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=299384712" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=82"
    3⤵
    PID:532
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=90"
    3⤵
    PID:533
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=14" "--launch-time-ticks=300702483" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=90"
    3⤵
    PID:534
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=15" "--launch-time-ticks=307309828" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=80"
    3⤵
    PID:535
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update-internal" --system
    3⤵
    PID:1.8446744073709552e+19
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
    3⤵
    PID:1.8446744073709552e+19
- - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
    3⤵
    PID:539
- - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
    "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=16" "--launch-time-ticks=314342490" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=100"
    3⤵
    PID:540
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update" --system
    3⤵
    PID:0
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
      4⤵
      PID:1.8446744073709552e+19
  - - /usr/bin/profiles
      /usr/bin/profiles status -type enrollment
      4⤵
      PID:544
  - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
      /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
      4⤵
      PID:546
  - - /usr/sbin/system_profiler
      /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
      4⤵
      PID:551
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      GoogleUpdater --server "--service=update" --system
      4⤵
      PID:0
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=110"
        5⤵
        
        PID:557
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=110"
        5⤵
        
        PID:558
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=116"
        5⤵
        
        PID:559
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=117"
        5⤵
        
        PID:560
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=117"
        5⤵
        
        PID:561
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=23" "--launch-time-ticks=333769107" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=122"
        5⤵
        
        PID:563
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil attach /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.ATLyX3/GoogleChrome-128.0.6613.138.dmg -plist -nobrowse -readonly
        5⤵
        
        PID:567
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.hdiejectd
        5⤵
        
        PID:568
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        5⤵
        
        PID:568
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid ECC65B3E-EC5D-42D3-AF97-F3427752A268
        5⤵
        
        PID:569
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid ECC65B3E-EC5D-42D3-AF97-F3427752A268 -post-exec 4
        5⤵
        
        PID:570
    - - /bin/launchctl
        
        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
        5⤵
        
        PID:571
    - - /bin/launchctl
        
        /bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
        5⤵
        
        PID:572
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=126"
        5⤵
        
        PID:573
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=25" "--launch-time-ticks=360702583" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=126"
        5⤵
        
        PID:575
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=126"
        5⤵
        
        PID:576
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=27" "--launch-time-ticks=367786236" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=127"
        5⤵
        
        PID:577
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=111"
        5⤵
        
        PID:578
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
        5⤵
        
        PID:579
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
        5⤵
        
        PID:580
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
        5⤵
        
        PID:581
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.hdiejectd
        5⤵
        
        PID:582
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
        5⤵
        
        PID:583
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
        5⤵
        
        PID:584
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
        5⤵
        
        PID:585
    - - /sbin/mount
        
        /sbin/mount -t hfs -o "-u=99,-g=99,-m=755,nodev,noowners,nosuid,rdonly,nobrowse" /dev/disk3s2 "/Volumes/Google Chrome"
        5⤵
        
        PID:586
      - /sbin/mount_hfs
        
        /sbin/mount_hfs -u 99 -g 99 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o nobrowse /dev/disk3s2 "/Volumes/Google Chrome"
        6⤵
        
        PID:587
    - - /Volumes/Google Chrome/.keystone_install
        
        "/Volumes/Google Chrome/.keystone_install" "/Volumes/Google Chrome" "/Applications/Google Chrome.app" 101.0.4951.54
        5⤵
        
        PID:589
      - /usr/bin/basename
        
        basename "/Volumes/Google Chrome/.keystone_install"
        6⤵
        
        PID:590
      - /bin/mkdir
        
        mkdir -p "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions"
        6⤵
        
        PID:607
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-before "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138"
        6⤵
        
        PID:608
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/Volumes/Google Chrome/Google Chrome.app/" "/Applications/Google Chrome.app"
        6⤵
        
        PID:617
      - /bin/rm
        
        rm -f "/Applications/Google Chrome.app/.want_full_installer"
        6⤵
        
        PID:620
      - /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
        
        /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"
        6⤵
        
        PID:631
      - /usr/bin/dirname
        
        dirname "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:641
      - /bin/mkdir
        
        mkdir -p /Library/Google
        6⤵
        
        PID:642
      - /usr/bin/defaults
        
        defaults write "/Library/Google/Google Chrome Brand" KSBrandID -string GGRO
        6⤵
        
        PID:643
      - /usr/sbin/chown
        
        chown root:wheel "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:644
      - /bin/chmod
        
        chmod 644 "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:645
      - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        ksadmin --register --productid com.google.Chrome --version 128.0.6613.138 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion
        6⤵
        
        PID:650
      - /bin/rm
        
        rm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"
        6⤵
        
        PID:658
      - /usr/sbin/chown
        
        chown -Rh root:wheel "/Applications/Google Chrome.app"
        6⤵
        
        PID:659
      - /bin/chmod
        
        chmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"
        6⤵
        
        PID:661
      - /usr/bin/find
        
        find "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +
        6⤵
        
        PID:662
        
        /bin/chmod
        
        chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
        7⤵
        
        PID:663
      - /usr/bin/xattr
        
        xattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"
        6⤵
        
        PID:664
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        5⤵
        
        PID:582
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        5⤵
        
        PID:600
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=29" "--launch-time-ticks=373853782" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=125"
        5⤵
        
        PID:601
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump
        5⤵
        
        PID:611
    - - /usr/sbin/spindump
        
        /usr/sbin/spindump
        5⤵
        
        PID:611
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.tailspind
        5⤵
        
        PID:612
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump_agent
        5⤵
        
        PID:613
    - - /usr/libexec/tailspind
        
        /usr/libexec/tailspind
        5⤵
        
        PID:612
    - - /usr/libexec/spindump_agent
        
        /usr/libexec/spindump_agent
        5⤵
        
        PID:613
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=130"
        5⤵
        
        PID:614
    - - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        5⤵
        
        PID:600
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:615
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:616
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:616
    - - /usr/libexec/mobileassetd
        
        /usr/libexec/mobileassetd
        5⤵
        
        PID:615
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=131"
        5⤵
        
        PID:632
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.geod
        5⤵
        
        PID:634
    - - /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        
        /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        5⤵
        
        PID:634
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.geod
        5⤵
        
        PID:635
    - - /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        
        /System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
        5⤵
        
        PID:635
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secinitd
        5⤵
        
        PID:636
    - - /usr/libexec/secinitd
        
        /usr/libexec/secinitd
        5⤵
        
        PID:636
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.cfprefsd.xpc.agent
        5⤵
        
        PID:637
    - - /usr/sbin/cfprefsd
        
        /usr/sbin/cfprefsd agent
        5⤵
        
        PID:637
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.pbs
        5⤵
        
        PID:665
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=131"
        5⤵
        
        PID:666
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil detach "/Volumes/Google Chrome" -force
        5⤵
        
        PID:667
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ViewBridgeAuxiliary
        5⤵
        
        PID:668
    - - /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        
        /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        5⤵
        
        PID:668
    - - /System/Library/CoreServices/pbs
        
        /System/Library/CoreServices/pbs
        5⤵
        
        PID:665
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
        5⤵
        
        PID:669
    - - /usr/libexec/neagent
        
        /usr/libexec/neagent
        5⤵
        
        PID:669
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.coreduetd
        5⤵
        
        PID:670
    - - /usr/libexec/coreduetd
        
        /usr/libexec/coreduetd
        5⤵
        
        PID:670
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AddressBook.ContactsAccountsService
        5⤵
        
        PID:671
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:672
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:672
    - - /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
        
        /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
        5⤵
        
        PID:671
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=131"
        5⤵
        
        PID:673
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:674
    - - /usr/libexec/mobileassetd
        
        /usr/libexec/mobileassetd
        5⤵
        
        PID:674
    - - /sbin/umount
        
        /sbin/umount -f "/Volumes/Google Chrome"
        5⤵
        
        PID:675
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.DiskUnmountWatcher
        5⤵
        
        PID:677
    - - /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        
        /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        5⤵
        
        PID:677
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.suggestd
        5⤵
        
        PID:679
    - - /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
        
        /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
        5⤵
        
        PID:679
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump_agent
        5⤵
        
        PID:680
    - - /usr/libexec/spindump_agent
        
        /usr/libexec/spindump_agent
        5⤵
        
        PID:680
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=34" "--launch-time-ticks=476464181" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=130"
        5⤵
        
        PID:685
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.knowledge-agent
        5⤵
        
        PID:686
    - - /usr/libexec/knowledge-agent
        
        /usr/libexec/knowledge-agent
        5⤵
        
        PID:686
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.bird
        5⤵
        
        PID:689
    - - /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        
        /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        5⤵
        
        PID:689
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secd
        5⤵
        
        PID:690
    - - /usr/libexec/secd
        
        /usr/libexec/secd
        5⤵
        
        PID:690
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nsurlstoraged
        5⤵
        
        PID:691
    - - /usr/libexec/nsurlstoraged
        
        /usr/libexec/nsurlstoraged --privileged
        5⤵
        
        PID:691
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=135"
        5⤵
        
        PID:692
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.routined
        5⤵
        
        PID:694
    - - /usr/libexec/routined
        
        /usr/libexec/routined LAUNCHED_BY_LAUNCHD
        5⤵
        
        PID:694
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.Maps.mapspushd
        5⤵
        
        PID:695
    - - /System/Library/CoreServices/mapspushd
        
        /System/Library/CoreServices/mapspushd
        5⤵
        
        PID:695
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.siri.context.service
        5⤵
        
        PID:696
    - - /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
        
        /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
        5⤵
        
        PID:696
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=134"
        5⤵
        
        PID:697
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.StreamingUnzipService 188
        5⤵
        
        PID:698
    - - /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
        
        /System/Library/PrivateFrameworks/StreamingZip.framework/Versions/A/XPCServices/com.apple.StreamingUnzipService.xpc/Contents/MacOS/com.apple.StreamingUnzipService
        5⤵
        
        PID:698
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.iconservices.iconservicesagent
        5⤵
        
        PID:699
    - - /System/Library/CoreServices/iconservicesagent
        
        /System/Library/CoreServices/iconservicesagent
        5⤵
        
        PID:699
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.iconservices.iconservicesd
        5⤵
        
        PID:700
    - - /System/Library/CoreServices/iconservicesd
        
        /System/Library/CoreServices/iconservicesd
        5⤵
        
        PID:700
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.pluginkit.pkd
        5⤵
        
        PID:703
    - - /usr/libexec/pkd
        
        /usr/libexec/pkd
        5⤵
        
        PID:703
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=chrome.mojom.FileUtilService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=134"
        5⤵
        
        PID:704
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=chrome.mojom.FileUtilService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=134"
        5⤵
        
        PID:706
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=135"
        5⤵
        
        PID:707
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=40" "--launch-time-ticks=554006885" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=134"
        5⤵
        
        PID:709
    - - /usr/libexec/xpcproxy
        
        xpcproxy "com.apple.xpc.launchd.oneshot.0x10000001.Archive Utility"
        5⤵
        
        PID:710
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_180268
        5⤵
        
        PID:710
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.XprotectFramework.AnalysisService 410
        5⤵
        
        PID:711
    - - /System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
        
        /System/Library/PrivateFrameworks/XprotectFramework.framework/Versions/A/XPCServices/XprotectService.xpc/Contents/MacOS/XprotectService
        5⤵
        
        PID:711
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.dmd
        5⤵
        
        PID:712
    - - /usr/libexec/dmd
        
        /usr/libexec/dmd
        5⤵
        
        PID:712
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.GameController.gamecontrollerd
        5⤵
        
        PID:713
    - - /usr/libexec/gamecontrollerd
        
        /usr/libexec/gamecontrollerd
        5⤵
        
        PID:713
    - - /usr/bin/macbinary
        
        /usr/bin/macbinary probe --verbose /Users/run/Downloads/salinewin.exe-Malware-main.zip
        5⤵
        
        PID:715
    - - /usr/bin/file
        
        /usr/bin/file -b /Users/run/Downloads/salinewin.exe-Malware-main.zip
        5⤵
        
        PID:716
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.archiveutility.auhelperservice 710
        5⤵
        
        PID:717
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
        5⤵
        
        PID:717
    - - /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        
        /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        5⤵
        
        PID:719
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 710
        5⤵
        
        PID:720
    - - /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        
        /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        5⤵
        
        PID:720
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.ui.helper
        5⤵
        
        PID:722
    - - /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        
        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        5⤵
        
        PID:722
    - - /usr/libexec/xpcproxy
        
        xpcproxy "com.apple.xpc.launchd.oneshot.0x10000002.Archive Utility"
        5⤵
        
        PID:723
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_188462
        5⤵
        
        PID:723
    - - /usr/bin/macbinary
        
        /usr/bin/macbinary probe --verbose /Users/run/Downloads/salinewin.exe-Malware-main.zip
        5⤵
        
        PID:725
    - - /usr/bin/file
        
        /usr/bin/file -b /Users/run/Downloads/salinewin.exe-Malware-main.zip
        5⤵
        
        PID:726
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.archiveutility.auhelperservice 723
        5⤵
        
        PID:727
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
        5⤵
        
        PID:727
    - - /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        
        /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        5⤵
        
        PID:728
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 723
        5⤵
        
        PID:729
    - - /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        
        /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        5⤵
        
        PID:729
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=134"
        5⤵
        
        PID:730
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.ui.helper
        5⤵
        
        PID:748
    - - /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        
        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        5⤵
        
        PID:748
    - - /usr/libexec/xpcproxy
        
        xpcproxy "com.apple.xpc.launchd.oneshot.0x10000003.Archive Utility"
        5⤵
        
        PID:749
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_196656
        5⤵
        
        PID:749
    - - /usr/bin/macbinary
        
        /usr/bin/macbinary probe --verbose /Users/run/Downloads/salinewin.exe-Malware-main.zip
        5⤵
        
        PID:750
    - - /usr/bin/file
        
        /usr/bin/file -b /Users/run/Downloads/salinewin.exe-Malware-main.zip
        5⤵
        
        PID:751
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.archiveutility.auhelperservice 749
        5⤵
        
        PID:752
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
        5⤵
        
        PID:752
    - - /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        
        /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        5⤵
        
        PID:753
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 749
        5⤵
        
        PID:754
    - - /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        
        /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        5⤵
        
        PID:754
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.audio.systemsoundserverd
        5⤵
        
        PID:757
    - - /usr/sbin/systemsoundserverd
        
        /usr/sbin/systemsoundserverd
        5⤵
        
        PID:757
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.audio.AudioComponentRegistrar
        5⤵
        
        PID:758
    - - /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
        
        /System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
        5⤵
        
        PID:758
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=135"
        5⤵
        
        PID:759
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=136"
        5⤵
        
        PID:760
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=136"
        5⤵
        
        PID:761
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=136"
        5⤵
        
        PID:762
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=136"
        5⤵
        
        PID:763
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.sysmond
        5⤵
        
        PID:768
    - - /usr/libexec/sysmond
        
        /usr/libexec/sysmond
        5⤵
        
        PID:768
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.ui.helper
        5⤵
        
        PID:769
    - - /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        
        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        5⤵
        
        PID:769
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.ui.helper
        5⤵
        
        PID:770
    - - /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        
        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        5⤵
        
        PID:770
    - - /usr/libexec/xpcproxy
        
        xpcproxy "com.apple.xpc.launchd.oneshot.0x10000004.Archive Utility"
        5⤵
        
        PID:771
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_208947
        5⤵
        
        PID:771
    - - /usr/bin/macbinary
        
        /usr/bin/macbinary probe --verbose /Users/run/Downloads/salinewin.exe-Malware-main/old/salinewin.zip
        5⤵
        
        PID:772
    - - /usr/bin/file
        
        /usr/bin/file -b /Users/run/Downloads/salinewin.exe-Malware-main/old/salinewin.zip
        5⤵
        
        PID:773
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.archiveutility.auhelperservice 771
        5⤵
        
        PID:774
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
        5⤵
        
        PID:774
    - - /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        
        /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        5⤵
        
        PID:775
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 771
        5⤵
        
        PID:776
    - - /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        
        /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        5⤵
        
        PID:776
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.ui.helper
        5⤵
        
        PID:778
    - - /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        
        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        5⤵
        
        PID:778
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.helpviewer.1332
        5⤵
        
        PID:779
    - - /System/Library/CoreServices/HelpViewer.app/Contents/MacOS/HelpViewer
        
        /System/Library/CoreServices/HelpViewer.app/Contents/MacOS/HelpViewer
        5⤵
        
        PID:779
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.quicklook.ui.helper
        5⤵
        
        PID:780
    - - /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        
        /System/Library/Frameworks/Quartz.framework/Frameworks/QuickLookUI.framework/Resources/QuickLookUIHelper.app/Contents/MacOS/QuickLookUIHelper
        5⤵
        
        PID:780
    - - /usr/libexec/xpcproxy
        
        xpcproxy "com.apple.xpc.launchd.oneshot.0x10000005.Archive Utility"
        5⤵
        
        PID:781
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/MacOS/Archive Utility" -psn_0_225335
        5⤵
        
        PID:781
    - - /usr/bin/macbinary
        
        /usr/bin/macbinary probe --verbose "/Users/run/Downloads/salinewin.exe-Malware-main/old/salinewin.exe source code.zip"
        5⤵
        
        PID:783
    - - /usr/bin/file
        
        /usr/bin/file -b "/Users/run/Downloads/salinewin.exe-Malware-main/old/salinewin.exe source code.zip"
        5⤵
        
        PID:784
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.archiveutility.auhelperservice 781
        5⤵
        
        PID:785
    - - /System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService
        
        "/System/Library/CoreServices/Applications/Archive Utility.app/Contents/XPCServices/AUHelperService.xpc/Contents/MacOS/AUHelperService"
        5⤵
        
        PID:785
    - - /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        
        /System/Library/Frameworks/FileProvider.framework/XPCServices/ArchiveService.xpc/Contents/MacOS/ArchiveService
        5⤵
        
        PID:786
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.appkit.xpc.sandboxedServiceRunner 781
        5⤵
        
        PID:787
    - - /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        
        /System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/SandboxedServiceRunner.xpc/Contents/MacOS/SandboxedServiceRunner
        5⤵
        
        PID:787
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=47" "--launch-time-ticks=657812498" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=135"
        5⤵
        
        PID:788
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=48" "--launch-time-ticks=659992177" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=135"
        5⤵
        
        PID:789
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:790
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:790
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
        5⤵
        
        PID:793
    - - /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        
        /System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
        5⤵
        
        PID:793
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=135"
        5⤵
        
        PID:794
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.assistantd
        5⤵
        
        PID:796
    - - /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
        
        /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
        5⤵
        
        PID:796
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nehelper
        5⤵
        
        PID:800
    - - /usr/libexec/nehelper
        
        /usr/libexec/nehelper
        5⤵
        
        PID:800
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
        5⤵
        
        PID:801
    - - /usr/libexec/neagent
        
        /usr/libexec/neagent
        5⤵
        
        PID:801
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:802
    - - /usr/libexec/mobileassetd
        
        /usr/libexec/mobileassetd
        5⤵
        
        PID:802
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=50" "--launch-time-ticks=697294812" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=135"
        5⤵
        
        PID:807
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.TextInputMenuAgent
        5⤵
        
        PID:808
    - - /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
        
        /System/Library/CoreServices/TextInputMenuAgent.app/Contents/MacOS/TextInputMenuAgent
        5⤵
        
        PID:808
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.TextInputSwitcher
        5⤵
        
        PID:809
    - - /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
        
        /System/Library/CoreServices/TextInputSwitcher.app/Contents/MacOS/TextInputSwitcher
        5⤵
        
        PID:809
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.PerformanceAnalysis.animationperfd
        5⤵
        
        PID:810
    - - /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        
        /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        5⤵
        
        PID:810
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:811
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:811
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=51" "--launch-time-ticks=723141094" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=135"
        5⤵
        
        PID:813
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:814
    - - /usr/libexec/mobileassetd
        
        /usr/libexec/mobileassetd
        5⤵
        
        PID:814
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ViewBridgeAuxiliary
        5⤵
        
        PID:815
    - - /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        
        /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        5⤵
        
        PID:815
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.CodeSigningHelper
        5⤵
        
        PID:816
    - - /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/com.apple.CodeSigningHelper.xpc/Contents/MacOS/com.apple.CodeSigningHelper
        
        /System/Library/Frameworks/Security.framework/Versions/A/XPCServices/com.apple.CodeSigningHelper.xpc/Contents/MacOS/com.apple.CodeSigningHelper
        5⤵
        
        PID:816
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=audio.mojom.AudioService" "--lang=en-GB" "--service-sandbox-type=audio" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=135"
        5⤵
        
        PID:817
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mediaremoted
        5⤵
        
        PID:818
    - - /System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
        
        /System/Library/PrivateFrameworks/MediaRemote.framework/Support/mediaremoted
        5⤵
        
        PID:818
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump
        5⤵
        
        PID:820
    - - /usr/sbin/spindump
        
        /usr/sbin/spindump
        5⤵
        
        PID:820
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.tailspind
        5⤵
        
        PID:821
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump_agent
        5⤵
        
        PID:822
    - - /usr/libexec/tailspind
        
        /usr/libexec/tailspind
        5⤵
        
        PID:821
    - - /usr/libexec/spindump_agent
        
        /usr/libexec/spindump_agent
        5⤵
        
        PID:822
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Plugin).app/Contents/MacOS/Google Chrome Helper (Plugin)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Plugin).app/Contents/MacOS/Google Chrome Helper (Plugin)" "--type=utility" "--utility-sub-type=video_capture.mojom.VideoCaptureService" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072"
        5⤵
        
        PID:823
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.GameController.gamecontrollerd
        5⤵
        
        PID:825
    - - /usr/libexec/gamecontrollerd
        
        /usr/libexec/gamecontrollerd
        5⤵
        
        PID:825
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nehelper
        5⤵
        
        PID:826
    - - /usr/libexec/nehelper
        
        /usr/libexec/nehelper
        5⤵
        
        PID:826
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.pbs
        5⤵
        
        PID:827
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:828
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:828
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:829
    - - /usr/libexec/mobileassetd
        
        /usr/libexec/mobileassetd
        5⤵
        
        PID:829
    - - /System/Library/CoreServices/pbs
        
        /System/Library/CoreServices/pbs
        5⤵
        
        PID:827
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=54" "--launch-time-ticks=797337832" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=128"
        5⤵
        
        PID:830
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=55" "--launch-time-ticks=798688953" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=128"
        5⤵
        
        PID:831
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=56" "--launch-time-ticks=806392433" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=130"
        5⤵
        
        PID:835
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=57" "--launch-time-ticks=828491325" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=130"
        5⤵
        
        PID:837
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=58" "--launch-time-ticks=865857070" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=131"
        5⤵
        
        PID:843
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.CoreAuthentication.agent
        5⤵
        
        PID:844
    - - /System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
        
        /System/Library/Frameworks/LocalAuthentication.framework/Support/coreauthd
        5⤵
        
        PID:844
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ctkd
        5⤵
        
        PID:845
    - - /System/Library/Frameworks/CryptoTokenKit.framework/ctkd
        
        /System/Library/Frameworks/CryptoTokenKit.framework/ctkd -tw
        5⤵
        
        PID:845
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.pluginkit.pkd
        5⤵
        
        PID:846
    - - /usr/libexec/pkd
        
        /usr/libexec/pkd
        5⤵
        
        PID:846
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ctkd
        5⤵
        
        PID:847
    - - /System/Library/Frameworks/CryptoTokenKit.framework/ctkd
        
        /System/Library/Frameworks/CryptoTokenKit.framework/ctkd -s
        5⤵
        
        PID:847
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.CryptoTokenKit.setoken 845
        5⤵
        
        PID:848
    - - /System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
        
        /System/Library/Frameworks/CryptoTokenKit.framework/PlugIns/setoken.appex/Contents/MacOS/setoken
        5⤵
        
        PID:848
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secinitd
        5⤵
        
        PID:849
    - - /usr/libexec/secinitd
        
        /usr/libexec/secinitd
        5⤵
        
        PID:849
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=59" "--launch-time-ticks=868727219" --shared-files "--field-trial-handle=1718379636,r,14971380996459028899,8724800356328802700,131072" "--seatbelt-client=130"
        5⤵
        
        PID:850

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:592

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:594

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSProductID
1⤵
PID:596

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
ksadmin --ksadmin-version
1⤵
PID:599

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:604

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSBrandID
1⤵
PID:606

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:622

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:624

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL
1⤵
PID:626

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID
1⤵
PID:628

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName
1⤵
PID:630

/usr/bin/defaults
defaults read "/Library/Google/Google Chrome Brand" KSBrandID
1⤵
PID:640

/bin/ps
ps -ewwo "comm="
1⤵
PID:652

/usr/bin/grep
grep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"
1⤵
PID:654

/usr/bin/cut
cut -c 1-108
1⤵
PID:653

/usr/sbin/lsof
lsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"
1⤵
PID:656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

File and Directory Permissions Modification

T1222

Linux and Mac File and Directory Permissions Modification

T1222.002

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Subvert Trust Controls

T1553

Gatekeeper Bypass

T1553.001

Credential Access

Discovery

File and Directory Discovery

T1083

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3EC0B26B-4B0B-374B-8102-E1D5081611EB.isdata

Path /Library/Caches/com.apple.iconservices.store/3EC0B26B-4B0B-374B-8102-E1D5081611EB.isdata
Size 64KB
SHA256 3ec0b26b4b0be74b4102e1d5081611eba6fb1d880267e7866f54ce4b0bec3103
MD5 b9e32320ae71c86792ccb387b1d7f4fb
SHA1 9de1078f883d6618394d23c611bc62ff4398032d
SHA512 5838e2046bf0bc4882ee0b07272e112cb6aed9a26104ca000347bea93dd88e660be933e419edd05d390e1dc4ba90238b506163c013067cbc4a9ff8dd90ed83e4
SSDEEP 768:xQ3anFRdNG09fNQ6HYXjmHwPzxF5MyusAYIEbLMUZjLyq4D9TEfbegrPM54:O3anFRdNG09fNQ6HYXjmfsTZjLyAM5
TLSH
T17053931B6BB395BCD3C59CB9705B45401FBAF282C41E4A0EE56D59C2ECB40783E86B9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43D73E58-0B57-38E3-AB15-636F6D718C40.isdata

Path /Library/Caches/com.apple.iconservices.store/43D73E58-0B57-38E3-AB15-636F6D718C40.isdata
Size 1KB
SHA256 43d73e580b5728e3eb15636f6d718c4073f75da373c47f5bb21080564b8c2fe0
MD5 6b81a5b8fa1ce5e76c9470ccf2342781
SHA1 43b77f22e1ad62724465db19319dc5c820c2ff7c
SHA512 7586c6b3d15c26e9acfb781718348b6d391a8cb828b7a5e4e64ba9fc9ea1269b9e08810ac2ee06e254242879ad684408a5cc9f146cc2be93f583d58967de02ee
TLSH
T16911C277B784FCD0D49102B40EB1C59F116FFEC28D1A820F76A4B35DE635A521882222
MD5 SHA1 SHA512 TLSH

Submit Download

449DD0D8-2FC0-3745-AA9D-EC284BBB763C.isdata

Path /Library/Caches/com.apple.iconservices.store/449DD0D8-2FC0-3745-AA9D-EC284BBB763C.isdata
Size 16KB
SHA256 449dd0d82fc047456a9dec284bbb763c59e6b49a2c3333d0f6c7b0c14bbc3ca8
MD5 6360b3cf4f8249c63affc940d1d47c91
SHA1 816e722cfa0456aa2744c4bb18e2c359d23b9d8a
SHA512 b516aa313bb804f83088f10ac3adb589888a84b63130e759f56febdee220d426e3378e16f6eb24d72e3008a856d2e5e7be8708130815b37d161cca6108b464e1
SSDEEP 192:Auqf/+aw2estemQBwzzR7f95vHtmd1NRhUXXXXXXXXXXfmD5EmzHk2eX2:Au8/IwRT2
TLSH
T147723497F398CA91C801C3F09C2EC925106B6DE9E8B5019EB8CCF72D6673B51B01AD5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

B1BB74CB-1FBB-386B-BA1D-5EED1A60A425.isdata

Path /Library/Caches/com.apple.iconservices.store/B1BB74CB-1FBB-386B-BA1D-5EED1A60A425.isdata
Size 64KB
SHA256 b1bb74cb1fbb486bfa1d5eed1a60a425d42d8a0b4b039fd0a7f3ca6d3ca36bae
MD5 3d725d63073f6bd11b6aeea485b2ee28
SHA1 2afafa42702a902fe25ac6fe07cc74b3ed3655d9
SHA512 b09a2981ec6d5cb26223a81a3d9632fb59383f7c4ce549be5c0206eaede8ec2f020906b55d973f08a208a244b3d7ab6a336a1e52e51cfc009f2bd26e5f81495c
SSDEEP 384:V6e3pYNi4BfVv1NvSxq7B+j8B8nIrJ1RVNm1/5O:Vrpm1h
TLSH
T1EE53D151E345A851EC6943B5483B9B38036BFEA9D8714F1E304DB738AFB37167086A4B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 189B
SHA256 460eddea7792b701e670823539944edebdf935507d70c819ec3ed77c76f71e51
MD5 ddd2ce5805538488970319a51e010549
SHA1 a9c930e61ff8d6549ba67e78359ff03a86762427
SHA512 17ed8355f236d123a97d99e0b84c31924b42954cce0efa4560e7e2560f3cdfe5dc31f1699ad127b8f06f90166dc7d4f0a6fbf335e8f4bcb4cab0f2d6ff68ba2d
TLSH
T186C0800445D58590C4840DFD415833150D314BCCE9D737D967468CC01915910063137C
MD5 SHA1 SHA512 TLSH

Submit Download

com_apple_MobileAsset_TopLevelDomainDafsa.xml

Path /System/Library/AssetsV2/com_apple_MobileAsset_TopLevelDomainDafsa/com_apple_MobileAsset_TopLevelDomainDafsa.xml
Size 4KB
SHA256 b884b56bb23f204b6542275df4d76089f0850c558ec221ba01835001413190c3
MD5 7a2cdb997c59e00cae163f2cf870138a
SHA1 4fd07fb67753479d8d9287f7ff24cd8913494d6b
SHA512 ffe918dd0067d6c99e9b7427e834a413804b472e69dc4e8ae2c3982dce71a4112510aca6bfc50ffcc4165c553b70a596a5590700b540dbf99d7432954050862e
SSDEEP 48:cfyR/Jjb0x/WxzzcN7n0xmWzzc7W4Ut0Hmvh2/FQURUvnp7iZXSHFqedVGTLCn:Cy1Jjy/kA7m1QU+Hghy6pWZXsFq6sfCn
TLSH
T19BA12DF55E4D2E940C855A150B94A80D51EF3EDC1DF090FBF893987AF812E63A1F06AE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 182308.crdownload

Path /Users/run/Downloads/Unconfirmed 182308.crdownload
Size 512KB
SHA256 c427346375223dc2e0bbfa52f0194526a02e34dc5e1d5f82dfcbac20dc1e0b70
MD5 09eacfda0367ed5a860f13d727622fea
SHA1 7d5499b2b85b72f1d93829d057bcee665ce31213
SHA512 f208c1c86cbdc7059e1e539db5ccca16161023ed73ef41e3f7dbcb2d31bb5b556447164bb2a5d8990611d0dbc129cbb94e9e16b1570456eaa6d27b34ea873f98
SSDEEP 12288:tszE3TMx+hUJHqqbQTlZmNfsRuT25tZXjqpyJy1:tHruDmlZmw025bRJ+
TLSH
T14FB43320486487F0C656BCBC411694F76ABC0DED4726F9C9B681B6668FB895FE338CC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 759743.crdownload

Path /Users/run/Downloads/Unconfirmed 759743.crdownload
Size 40KB
SHA256 ee4b15987450df7d347b2ec0ed4479733ca716b6b23bf90a6ec935908833b553
MD5 2710b02007e3ffc06d36a121a8835232
SHA1 3d5ab7e9b5d2f972670707c4bbdd33a128ea78d0
SHA512 af2ffb8d6820668a3befb96a9ea7dc8c7fbaf8ca0d774cbefb5fd2ed2aac01c543c098f24c88dbf19d5a78ad8b5c1f0017d94385104f0ce356f3b8f6d6ce08ed
SSDEEP 768:wwmAL4EJobRe2AVh1fEa0gMvRQd/EAzeqIxmnIBUYC7igaVEhzgk+fbz:TmmgR/msguRQshqGHmYxbEZ5G3
TLSH
T18E13F278644CEB79C852781A233481833A70702C76BC7B9667D717E52BD1941FBADC1D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 759743.crdownload

Path /Users/run/Downloads/Unconfirmed 759743.crdownload
Size 22.7MB
SHA256 4fbf3166276ba34535d95b647614b6176699c2a1754d4efe5420af1024283a32
MD5 6ed03eb12a6ef61aa39ad682a183dfad
SHA1 2e7e0f5ca54e2bbfb866e9f1ef9a3b1940f135f3
SHA512 ecca633f1c86933e7aa78fab9118f11a1878361434f43d8a714b47a6cfb17df9101f5a40068da199f7073b3e2bd8c9af0f1ca1cd23ae40a3907b102c21a66822
SSDEEP 393216:5WK1J5ZA1mZ7oIWBb/P6VyeOgMt29aiGwLYBkVfK1oFmVjVbVMXCacSx3wVqjJHD:5/V61mZUIWBbXkyeOh6a8LYB2SakNVeP
TLSH
T1E73733B5C6FA8CC5F470394721F586A17F480BBEC78189E5E90D3AB1EA9874C1B95C83
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salinewin.exe source code.zip

Path /Users/run/Downloads/salinewin.exe-Malware-main/old/salinewin.exe source code.zip
Size 11.9MB
SHA256 78aefd46d31f2bb67f0b9bd0d831f10f21bfd9d44b9deebcfa52c45e85a72473
MD5 2a2aed5bbdbffbe427fae0495b39c303
SHA1 5443a547a7c6b921b50bf5bbc4348fa506f0b05f
SHA512 988ef2a1e45c55e4d9ed3e268af6d80c3cc39e2ffed4639693e2d610669b84b077394fdef7eabb978ed985b21586f40ee0e09f211c243e65d62e398007baee89
SSDEEP 196608:hk9XnGC99OO2DCvqZh2KgHwLGjbk+EA3GzSSLFSVkhI+QdJ6EnxBkmYtW2mc86EI:hk9Xn9WrSH8mbknZLFSVkECGCJaaoXnK
TLSH
T1F9C63369C7FB0CC2D870297F11F4818176594BAFDA9648B3E54E3D62EB907C40ABAC47
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

salinewin.zip

Path /Users/run/Downloads/salinewin.exe-Malware-main/old/salinewin.zip
Size 203KB
SHA256 b3020dd6c9ffceaba72c465c8d596cf04e2d7388b4fd58f10d78be6b91a7e99d
MD5 19a966f0b86c67659b15364e89f3748b
SHA1 94075399f5f8c6f73258024bf442c0bf8600d52b
SHA512 60a926114d21e43c867187c6890dd1b4809c855a8011fcc921e6c20b6d1fb274c2e417747f1eef0d64919bc4f3a9b6a7725c87240c20b70e87a5ff6eba563427
SSDEEP 6144:AX0xX7MnBGkuOtEZlwuO2lJwz7EeQG+YSGL:AWXKuVZQ27oEhVYbL
TLSH
T1DF142306C25025CBACEE660704F4D13218A34F5FFB5079ABD26B64E95FA1FA01D84B8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

visual_model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/ClientSidePhishing/29.0/visual_model.tflite
Size 3.0MB
SHA256 d38a4cda8912f9598b8701dac7d5ee90eff324ed1fb9d277b9784fe45a4e6c72
MD5 a9803d560544e4d1fe551b2c113c5370
SHA1 a998fdb1e80dbca61267db112812a7ee34b82dce
SHA512 65b8b6ecfea2aeae95a39581c39476a54721e07ee7c296650ccddea29a09b29a11cab15fdc89f97295bd61423dc13a66666faca371200bcb459dc1f25b6c89fd
SSDEEP 98304:0FkQ8+nTgV11233hz/v/U2P6tObWAOz+O2la+Ao:T+nMV112lU6b9O2rAo
TLSH
T1CEE502A5B811F1C2CA19C6729B56FF6F48317C265F05D027320DBB4D48B22EB8F4A6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path /Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat
Size 40B
SHA256 5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6
MD5 fcb4024c6dc53a5b72c492fd960762d7
SHA1 82c43024d9e274bf2b8a5d1e505d65cf3873fb92
SHA512 5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b
MD5 SHA1 SHA512

Submit Download

Unconfirmed 547796.crdownload

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/Unconfirmed 547796.crdownload
Size 27KB
SHA256 f9d0c34a362073513b3e394be792fd9d3b058a162651ac1b0e777ef140742ccf
MD5 b95134bbb256e0916a6b891abc3b2a75
SHA1 a636e09778bf642b09fce082698850c01efa30ed
SHA512 57c327df8fa2d28c039bd2b0f5f4db0d97fd6bd44e5e8f4afbfe510f04c4011d0ae037d12284da2ed171a3479adaec38b080ba151d7b6f8eb38f46ef7584a087
SSDEEP 768:0OXJvhizpyenF1glx9YRXsiwKNFAqyYgn8gAAl0Yf1QFWec+AX4LroU:08Kz2lx+ebKNq7b8gAG0YfmF9cJX4YU
TLSH
T131D2E1BF20191781AB952AA5EB1BD4E8CB43A49064CECDA537D89FD5E273148232F192
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d83c6d6e-ee87-49c5-9c14-e87a77033c20

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/d83c6d6e-ee87-49c5-9c14-e87a77033c20
Size 258KB
SHA256 8d21fe1bd251856bfaeaedd6a72ab78f153a047b6042e0fc614f57a32b56d340
MD5 5adf364735dcbe6bf26ebe3f705c9dbc
SHA1 a891521fea2f61a2fd16ea9f0a3fc3c2c5fb3a46
SHA512 5f77f8923ab3800ab754f4c60095077b529c5f5f230c6a0b6803dc28597f42ed682921267ed344e190d0f08e0a23eceace7bccbc9d22432029a3e6f4838420e0
SSDEEP 6144:771bE8xvMX08XghZNhvfhua/I4dMdYuw4/xCRxQkdE6oO:7p1xE3g3Nhvf39dMNxxyxGLO
TLSH
T12B4423A9480AFA919B0236F2BF61D07C234649142C9E2B9DDFE48F70E7FE715658F108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

craw_background.js

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_1/craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path /Users/run/Library/Application Support/Google/Chrome/Default/IndexedDB/https_github.com_0.indexeddb.leveldb/MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb
Size 339B
SHA256 9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5
MD5 61a867b6e4a24cfcfd32ddef25ac3229
SHA1 87cc4516fbce1700174d8ea27c9d2cb70a60a1fd
SHA512 3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc
TLSH
T115E0C2FB0A4984C1E9519BBB2524371D7B25CA2AD9448BE38E48E2528A284616609468
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb
Size 569B
SHA256 b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e
MD5 b5db1f091948de93d7fc96e14aef6da3
SHA1 74745f991e3dfe45037366e55c2e6df47d8e6593
SHA512 d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34
TLSH
T157F020631A2BD8A6C868A8325C94270C23A78F0D47B8865B6231CA301D668113A148AA
MD5 SHA1 SHA512 TLSH

Submit Download

000006.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000006.ldb
Size 13KB
SHA256 5d026793bc04ac97aba3ad9e892453c600a31389262d68f4b5b3af41d842607a
MD5 9ccabbe3dd73bfc63d7b22f58c4a1e45
SHA1 503ff14c2a6001fd9fe3e1232f021756e834ad04
SHA512 7ee3fe70459b295452871e26d0e766081d7a7ff39109512d26dbddceb6323b36064f7cb87c6f918d90fff9066d5936017201cc9033e176ab8004054a434e9e56
SSDEEP 384:43w3zsk4K3xCGnkgQ00Z+u6m2JUMdMPaiLETfgtipIH3SUzHCHBw5:ljsrnhgjFf/dMPFofQPJziHBw5
TLSH
T1AB523AAA6B0E46D4C567EA724F8429DB4E5FEAE401056FCB7998C20F3F070413936973
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
Size 269B
SHA256 241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172
MD5 6487e04972ecffd0aabf7b61bdda8119
SHA1 26f0b11a2529a35f6970a914deadfcf2e2d23286
SHA512 44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae
TLSH
T150D0231426B7C48FE44951B165C35F64736CF459F5154783561865E44F3F0043D44174
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Storage/ext/gfdkimpbcpahaombhbimeihdjnejgicl/def/Session Storage/000003.ldb
Size 141B
SHA256 085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8
MD5 38fc535a8f11d7e955ef58cc63158eff
SHA1 c45ad3ee106dbfb65dce7c09b53140f34454cd0e
SHA512 26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505
TLSH
T187C01210066B8863C417737106C417501310E8A40006471316C233600C740311F1045A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb
Size 136B
SHA256 935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132
MD5 fe382e791274914bee5950777e4f1fd3
SHA1 53b523b5fc87e66f2520a0b5f9ea080072668f4d
SHA512 a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67
TLSH
T156C012480B948CC3C9009736082443141301C920F72CDB434381B2A10D740CF5E00085
MD5 SHA1 SHA512 TLSH

Submit Download

Path /Users/run/Library/Application Support/Google/Chrome/Default/blob_storage/e1493b46-7073-4e6e-977d-1c91ccd8d5f6/0
Size 5.0MB
SHA256 69863aad0bafdac45d7584e8c27cbbbda092a5e52a36a6ea7364311e758efb00
MD5 fdcb70388d234ca3e88a3be5d6ca5b3d
SHA1 eee7085189137d17681fbf8b9530a6ec3e341994
SHA512 ccfc802f07aff26e3aa0df45d88f783fc6058a28cac581edea79b5b61e93395ef4b70a6192318380a1dfffe3d820b6849805e708d09b059427a51c2a94868956
SSDEEP 98304:WGINJN3mfH1LVhFXtpIw8Ki1p4VYx9bfGi2Qtbr7Buep:WGILNW9LVXtpInHDGLQdF
TLSH
T1073601327314DA36CDCF527E6C91C7408BB052D98951CAC27E488B6E35EBB98153B3DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Application Support/Google/Chrome/Default/blob_storage/e1493b46-7073-4e6e-977d-1c91ccd8d5f6/0
Size 10.0MB
SHA256 0898ec4f171ae51aa7d126d51f33359db671f11c8686b0065b6b854636b1b7c6
MD5 26a92a02569c58bd39308ff343d1fb94
SHA1 cebbc85d4c878e86384667378461d2563cbfc262
SHA512 66481c641ef960576ad1026f73a045177e51044fcdca41b7f018bba41ba5edaf5cf204b8457d53499dc5dabc90d3c1a5ab211a2b6e7b44b292d70056ba302740
SSDEEP 98304:WGINJN3mfH1LVhFXtpIw8Ki1p4VYx9bfGi2Qtbr7BuezPI3M91kNmqXu:WGILNW9LVXtpInHDGLQdnPI891kPe
TLSH
T18FB65BA6BAB8DF2FD625D139885C86F116205D954E20E7D73748B72FB4B32188F132D8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Application Support/Google/Chrome/Default/blob_storage/e1493b46-7073-4e6e-977d-1c91ccd8d5f6/0
Size 11.6MB
SHA256 dec2b3320023a22c6ad92e929a9f42f846f83e5460be449d0ad3ea024d3d7f7a
MD5 a7d78528507796636da62925053bd7c0
SHA1 a8aaf6b004898b9827065a205613fcbcc49adb83
SHA512 aacccb480ccd6224083847aec60c1cf668ee9a47a9d0f8de57b72fe62912a2f9aba8b8f17f3a965aec5a56636914dd9188fd6d2658b627f990e1604be28c8565
SSDEEP 98304:WGINJN3mfH1LVhFXtpIw8Ki1p4VYx9bfGi2Qtbr7BuezPI3M91kNmqXm9f:WGILNW9LVXtpInHDGLQdnPI891kPWV
TLSH
T152C66EA57A78DE2FC9259039891989F146A01D950E65D7D33B0CB72EFB7220CCF272E4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb
Size 2KB
SHA256 18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8
MD5 e0f65ad85a40a32fa91e551005e193ce
SHA1 a145766d5df23ae5fcd23dbb6937606f280f3502
SHA512 bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425
TLSH
T1F44164D3BDFD4BB2ED447E70D12ADB5C1015C6BE00564E0FAAE5A53C9274DA104F6076
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb
Size 288B
SHA256 79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06
MD5 b47a44bdd1b765b6af56b347447fd1b7
SHA1 8599a1870656af91e432bb35e3497863e34ddfbb
SHA512 bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0
TLSH
T129D09520FB93C021D7C0137D4D301F4C170555D1D5067759D43FF5642C74001784D430
MD5 SHA1 SHA512 TLSH

Submit Download

model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/OptimizationGuidePredictionModels/59c547f3-0f8e-475b-92eb-118602e7e272/model.tflite
Size 382KB
SHA256 a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534
MD5 6d7c2f9e94664539dec99b3233301b01
SHA1 85812b004742cc1c211c92911131ce270f8ba769
SHA512 4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33
SSDEEP 6144:4i8mNiZGi+jiwubrNEOB37+rNiyykvXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMl:WqEGi+GwGrNv9+r8bkvXpqQMLuNy5YmJ
TLSH
T10584C013460497BAD7FC237684C31D9E12A5F2625E73B86BF9363E464811B1BE62237C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.32.0/Ruleset Data
Size 138KB
SHA256 fed1557c8b4e40813114db3b546c043105892dd0895c4d7c02d45a8be351173a
MD5 132df2b999906be7b21cc21bc247b068
SHA1 0665be201a96e717410a4e61a263bb879b3f08d4
SHA512 6764c8a425cd010a67a4636f812d43e63bb0815943e9839cf9fa35f3e5f9ba52309ed842306dcffe32a72e7019cb0c28e1d402dfc22dca0603a0cd48d6a26451
SSDEEP 3072:nAwq4WU8BNptWsfvaWSzpjNSIy27mElP6vUGyA:nAw2fcFty27Js1
TLSH
T14FD373937718C4A2E391913A97CAC72145B2F7D9E487E6F779E2034F3C452B22F1468A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.71.0/Ruleset Data
Size 243KB
SHA256 ed64838d8f0c28e50ae8c604bc3875c7b6c319cb63418fcd5c1a81558c027c97
MD5 57ada31832ba30fdc131ee55bb97ec28
SHA1 fb78030234b7a843fae6f9afed5a38a9a643a64f
SHA512 9ce848422b7306ea45aec17c13c33ee304e48e7765e35a60b58bb6bc4874151e29970d409ed31b291a0487813500f1cef483939c906cf79da9f7912b414f3fb7
SSDEEP 3072:j3rnBjzZWgHg2OAxDg2D15w9yb3zNpigOqsPZb1qAtVnXSH3fQQpDL39bairbu6T:D1oCgH4TDMl8hPHu52MBYr
TLSH
T14734B452631CD511FBE1023A04E6CB226720F7E2AA81E6EF79A4534F3D4D6B72F1426D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Unindexed Rules/9.71.0/Filtering Rules
Size 154KB
SHA256 c7f77effdefd8a5767275e37efc231fbe446a7378c453964c76e73ebadf1c919
MD5 58112213fe64e09a595e5088c8587c58
SHA1 9f5f7a288299d2b1e18aa7cc8e38853586db7d78
SHA512 3906b377740069a6fe8f63cac3adb2593b87751deea4ceef183c93c240f06f687032365e73893e0c3e1a0251b5a93fefc874f17678fe28640b0d6229cf230cd2
SSDEEP 3072:myr9ZWXoZNIDFij7a1pNeFv9bbRlPj/GbEBOh/IS0UrUHdSv40r5P7C:BW0PVfJlIkmC
TLSH
T1C5F33E176215F0F10EB60A3E148AAD9556A032E543D7FDF18A29C38DB1F468FB2943F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ActiveTileGroup.pbd

Path /Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Size 141KB
SHA256 27e042a1264f59de5778dbfbaf6c0df27e661fc1b1cd1a293be3c5e5d09ee02b
MD5 f6fd766f7d2cfb60429be749b944b174
SHA1 c25fc7c760a56b251ec6f9886e97df7b3dcdfe8c
SHA512 b419e3ba397c538b4f3dcd67a3781179d1223fb29168cc188873b50f396a07e6755f6e18e0873587719cf6a2b3d59e42205d8bfd41cae52b0c2a0597b45a1692
SSDEEP 3072:Y0GpG1qcOoUw9LN0zlk7gD9ke7D3FqEZkgnReXB2DX0hb+UVAU29k:zGpGqcOon9LN0zaUBkmb0E4R2DX0hb+w
TLSH
T129E321035E2485171B613A5747918708FC2FB96FF837CCF79836A50B66A0CA6E71DB28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Experiments.pbd

Path /Users/run/Library/Caches/GeoServices/Experiments.pbd
Size 137B
SHA256 8a344a04c847c9403e72d6d5393cfa833ce98af5750b4cb5d0b6460ed84dbff6
MD5 efa1a060442c63a87f2fabea0591218a
SHA1 ebe7913b2649d0be0308f49c394342d31fbc985b
SHA512 520615312658db40d7f6c2dc6961cfaf6cb3ee9ab95fe85d71d5d07555c54a405dcd53a56c6e621655941857e93cbb6166b0d2938b916de0f5b14603ebbd861f
TLSH
T16DC02B23CC84F0E6B60D20811D00A9BB2D03C26D4AE10CC20CB5443DC0105F020042D3
MD5 SHA1 SHA512 TLSH

Submit Download

networkDefaults.plist

Path /Users/run/Library/Caches/GeoServices/networkDefaults.plist
Size 6KB
SHA256 8663a4bf97673dd5bdd453484fa0dedc94e844e789a9c4349eaf7cf5e9f66719
MD5 53e198ee59e585ca411a6c0cdbf4228e
SHA1 0773310b8fcdf18de3a0d317b0dcaef889c018f8
SHA512 80a17259da727c07397d35e0d2059312d19134a4e12f474dfe96b015088b54c0306eebc54d2202554a69816609a8e54a4924b84c86f76ee1767f276403300da0
SSDEEP 96:Df33Pfd+nraSkWsDSbCUJHF/ZJNl+a3pDahiI4/qaTsmAn54fnl:DnQn2SkbeV19ZJua3pmhiIVUsmg8nl
TLSH
T1D5E1467DF1C2FCB44B47AEC952C29596C7F9ABCBA086BDE18D343E4305939E0418B219
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

com.apple.nsservicescache.plist

Path /Users/run/Library/Caches/com.apple.nsservicescache.plist
Size 12KB
SHA256 b049567a943a2bbcb7504c802fcb9ad8eab49af07e5dac41a7aef43f58af83ff
MD5 49151fab93fb0b032d6fcc81edac1302
SHA1 69fafb6e0d3ec7c2bd22e50ecb127db141f1428b
SHA512 6130c106b2ec9a4ed3f0576bb3bd1d8c7a0a8142e460fb3e2c629f107a211367e43b03e795e5ef17c9482ffd41588559cdcb1ff6a646b2c5aeb730db3da02874
SSDEEP 192:0R/ImVGUdSibM7A3+AMwmDAQYkpeQ/mgpcWa3pSedwXnUfHb90TgUojxENbyhYMf:kJZcA3POYQODEeSXUfbRUoVENbUSQf
TLSH
T135420A2B39C64BB052D722F7F0A2E1D21A75509D96DFA28607DACE6444C7F0C0A79397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 35b5536f723545a4b465929006eea58a8f111beffb5e449060c1658e22491753
MD5 cbe81ff06e6e59ae3eda23122d25a87a
SHA1 e35ed8a66e32eef0fca011fd46ac9a3a85a6cc65
SHA512 2a289f5990fb45730aa2a3b5d74794394560f753af62581528e54e32565302356fccf781bc101d6be53f9d96ef680c09daf98d4e9a0fb7c29db34eca71bfdd30
SSDEEP 3072:kZr6c0dcNayr82FwVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmm:kopChJQk
TLSH
T111B383825B95ED75C05505BDF9B3A308B335D6AB97A363873391A483AC122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 45d3b6f113df3620b204ed1e273a073109aac2a5f836c7b43cd6e59b8f1b3f93
MD5 29d82cbe947dda7e3302cece83e876a5
SHA1 bf5f1cd474e1d105a1b25f52806242eaeeef5d5b
SHA512 ff558be29297be41aac69f9f1189ba750492aeb6ceea648e77d11c4fdf4f3eb9b831cbd3d1057c71bc212e1afeaa541b2b04bd932e929ece5874afe2c1a2ee7a
SSDEEP 3072:EZr6c0dcNayr82FwVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmF:EopChe
TLSH
T14EB383825BD5ED75C05505BDF9A3A308B335D6AB97A3638733A1A483AC122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 3ff6c2cb0de69fc1a407c33380a45c0559507b62603f7f964b6e7a056454abc6
MD5 f92c0abea2855914444d3bbbe5fa3d79
SHA1 cdf55209c57d75cdc5cbf64c5663bbee29cd94cf
SHA512 30de6d4a9fb051f1d28d12288f8d5dbab22569d6c589f3bc49ab83dd03fdec45ce9ce97d251918e2c29b710c4be3fab107935b2be76f05c136eeee0637655b57
SSDEEP 3072:hZr6c0dcNayr82FRVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXm5:hopCUO
TLSH
T182B383825B95E971C05505BEF9F3A308B335D6AB979363873390A483AD122E40F75BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 c7bc19ee10541a498fdfa59b1e4469061ffd4cfdea136ca3c1de6d36eadc91f3
MD5 9b519cddbf90c4ded87ca8910a1efc2a
SHA1 278e958592295d9b350004ec2be5061a02c9de65
SHA512 27de4b13ddd6ea1ff3d83fa9af26940b02d71491c0928a663447aed16bbe5265e0162dbc676c563caf4c7680cd6e5b8deb644e32005389a10a3ed2922502d3a6
SSDEEP 3072:lZr6c0dcNayr82FkVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmu:lopCVUQB
TLSH
T110B383825BD5ED76C05105BEF9A3A308B335D6AB976363873391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 cba7929ca0a7c188bd2a235df4cfe15465c302c61a48ed6e66c646904cf52590
MD5 8ac07d21f73de09ae70dd0efb9299c8f
SHA1 ed60e087e1e9f44f5ad0b53c9b8ca7d5e9e105bb
SHA512 502277f4cc1c3ec278319ee3c5c5551237cf4dcf9d2a759b8e5c636f9a84abaeaff9e361fb129ff8713b169878d8daa7f9d2dd0b75a5f15393d25b95b0fa44d7
SSDEEP 3072:+Zr6c0dcNayr82FkVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmj:+opCVk
TLSH
T1D7B383825B95ED76C05105BEF9E3A308B335D6AB976363873391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 bbc2da8d2955a2971570f1bea3914e4dfa5b0bfbdb045a5764b2c470fd51a1d5
MD5 75190f80e6fa420238c2bef98804d721
SHA1 487143b9a7ea4069b0ebef16c22b01b9c53a8a7a
SHA512 651f4f393341377b69b8fb60ac9fd9834b254df0c830a2cd5bcf3e32c9ad3b25864f020ae98185033ba15126ecd6e6e747475eef0f87d6273e738465dffa3653
SSDEEP 3072:ZZr6c0dcNayr82FBVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmC:ZopCkh
TLSH
T18EB383825B95E971C05505BEF9F3A308B335D6AB979363873390A483AD122E40F75BEC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persona.kb

Path /private/var/db//keybags/persona.kb
Size 3KB
SHA256 57375f36c349208bc72dbc4d7f42f354e9b24577c1691d7c9b5b1eb1eb5aa9f6
MD5 65cc2f5a9225e6a54e59bbcde4fa4df2
SHA1 32c778b7024f4a7629ea87260b36f06452778938
SHA512 596e889e03999b384fadc896c567af1db3ef74030d591786dc95ffcef19e33bbb63593b27114d53b4bae65456a4f6f3e309afcddd837c8eb9014072a06f52e38
TLSH
T1C771AC042F838917E40E0FF75B79DE1897C504CB80A8511586F29D87EF45EAC67A63EC
MD5 SHA1 SHA512 TLSH

Submit Download

persona.kb

Path /private/var/db//keybags/persona.kb
Size 3KB
SHA256 7bf79ea45235626c1ea7fc4a818506f1f91f4b88a88e5d8793bbfcf356f8de1a
MD5 91c946bac1a8e19c1d326b32a54c7a5f
SHA1 74984c3f381f8038b787dd106cb59fdabfa6e6fb
SHA512 6366436ff51ed7ffb4b02195145468b7ce4f8fe6a1cd2b73726fff87090001e6b37c135953970bc6094fe80b6cbe8ca94c01fe8647e4e2acbe17095436f8ecad
TLSH
T1EC71BA442F83881BE54E0FF79AB9DE1896C508CBD0A4511582B28D47AF05EAC67A63FC
MD5 SHA1 SHA512 TLSH

Submit Download

persona.kb

Path /private/var/db//keybags/persona.kb
Size 3KB
SHA256 300d3a4d25e1af9fab5fe0f89f14ecaf4671d4786accaf5d5a564a2b98f2ed2c
MD5 49665526c75515b700958e46d4c7daa9
SHA1 945fe38df32596b474cfcdbc1b27ea580db8654a
SHA512 1a7f54a6ab5cf054116e04f006af62fa1d64119c5693f3c8482ea479da072ce54e7c83be80a7563b9141367bfae80298c51d70111edbbcf64272db34be3b35de
TLSH
T1F971CB042F838807E80E0FF75BB9DE1896C404CB80A8521586B28D87DB45EAC67B63EC
MD5 SHA1 SHA512 TLSH

Submit Download

persona.kb

Path /private/var/db//keybags/persona.kb
Size 3KB
SHA256 ff525f0ec19401702622ff8134404a5363c0197815ea8c7a2852c6539357fdd5
MD5 eaf3e4bd9356d8ddc388cf7862fb2443
SHA1 f945f03f5e218a4a624f7696d8c37101b4fea2ec
SHA512 2c7f2e079a2d861bfce5ddc99b1b51cae8a1f6aa6fe00266bf9ce7c757f914217422b58877cb4c2a926eaec8e2c5aaed0ffc21bac0906c960110b19cb5e24c5b
TLSH
T1C271DD442F43880BD54D0FF79AB9DE1496C548CBD0A4511582B28D879F05E6C63763FC
MD5 SHA1 SHA512 TLSH

Submit Download

icon_128.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirEn7K8S/CRX_INSTALL/images/icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirEn7K8S/CRX_INSTALL/images/icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

altitude-1426.xml

Path /var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1426.xml
Size 405KB
SHA256 edfb96c2ed3030e39e614ea3e5d716739e9ddc1c3e490c9056ed4df9d13e2198
MD5 d85613141c8704587540afa61f5bdc79
SHA1 5f9ce4144852529db3d6d0f0d3c600e3f73cd919
SHA512 e5002ffbc00954fc2fefc23793f62cab320e220506df82cdfb875de4d27d3c9745a9cb344ab3859eccba338dd8a0be5ad33d777dbdd8220cc38086a7d39f8f83
SSDEEP 6144:l8fW1KAY+vyl7KkUsTuola+RTRZSqtIGXF5WDv3z6:W
TLSH
T190949024923DDFA775684A7C878EF1A113F99F2F400636E8D693D277AD9C5C02A9C384
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jflookgnkcckhobaglndicnbbgbonegd_3091_all_adfb4phbxwqsxsfvrtgwwtg25z6a.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.0w4Yxt/jflookgnkcckhobaglndicnbbgbonegd_3091_all_adfb4phbxwqsxsfvrtgwwtg25z6a.crx3
Size 184KB
SHA256 9bec6c2c0185d3305ac8495047a1aa01e725d58f8f18d219742a2988f07cd93a
MD5 e5e7439bcae6cbb81408e08e1ceaa799
SHA1 a166c00d6f4ef6f541da1a291afcef11a5d7e426
SHA512 6122ff4a5d2a652565c0d9ab600f5c2558c95fac1c7d3eeca7c9bc20d054cdb20f6c089aaf38d51200b0b0276519a52c390142e11989f3d90145d7f648618e71
SSDEEP 3072:YRLHCaFAH1Z2dUZ7ViebPO8B6wAppi+NKfDRdwt20xrFzg7NCmDAsf6B9d/:9lVAdkXPOaRdwtzre7NChsf6B9t
TLSH
T13E044C49F84703A06F0780C99BAD62972104B2F47395CDDFB77FB6A56E00C9B20995BA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

laoigpblnllgcgjnjnllmfolckpjlhki_1.1.0.3_all_adwgvw4jdcarox4vlsm7t4gq257a.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.1eUPUl/laoigpblnllgcgjnjnllmfolckpjlhki_1.1.0.3_all_adwgvw4jdcarox4vlsm7t4gq257a.crx3
Size 12KB
SHA256 7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
MD5 752fb191723f2ac933f27a4cf7b0e381
SHA1 143a9a509ebb85b228eb5e3721c0f4a3274e4f62
SHA512 bc04fcf4486206228df389b27e910bb38e926b0a2b625591f03d3c4f616befd96498b0c8355e83c36400969d2600aafe0f8d06c8ddf2e83636419de21cc68750
SSDEEP 384:KouyxMA8bnsa46GN1eRv/RR7J8jmmOsRJpJyV:dxMzsyGNUZj+jmmrpo
TLSH
T12842AE069D4E3A8FD90AD23D454A3E07377B326711D25449FB8B982980E97B1B0E89CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_ENGB500000_lof45en2yrc2tvvdfc42hhgnkq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.8KM51c/obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_ENGB500000_lof45en2yrc2tvvdfc42hhgnkq.crx3
Size 7.6MB
SHA256 95ff39d8ef1186d8b10dd3a57c6a4a426732b5fca36bdea4670fc4eb0f0b04b5
MD5 f33b5f649851bfaa5e3a9f813b586b1e
SHA1 d6b346fc53489779f07ce1a220e38d62a89b89dd
SHA512 940cf34538cf387663ecd8124e370dc5c95504bea41247ac0766088288c68ce53489a20ee7182a03dc99e5559e034f3a005b73c35f6dde6f3a9e5151112ab1ca
SSDEEP 98304:WBMCyPEP6vKwEHDrIq34e0zBNMv4XCq1Mbrp9hsvwxId1C+c:WpyPxCTIFNy4SV8YxG1S
TLSH
T18E86DF2DB774101B0DB61319D4471753A76A80D9C3844B5C91E8EEAA36926CF82FFAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.71.0_all_pfygnpfkdgwp6ktpnubtvytjbe.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.8qKjFO/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.71.0_all_pfygnpfkdgwp6ktpnubtvytjbe.crx3
Size 181KB
SHA256 1a7bce15b133e9626c1c823cf42daf6c0094c12a0bf5f78668be0d69e50a248d
MD5 0927d2485dbb52d65cac052b3e50f692
SHA1 e4ac59b3a09765dc6e7693243a07bb901355dc5b
SHA512 961cfe7f585e407ffc642df16e6c5828f0bf5d50d7ca24c13f996a3c5f633833e1abc8b522fb79bc10ed0849ccec02b90879d4d196198ce6a29ce759cfcd24af
SSDEEP 3072:fBTQ6byr9ZWXoZNIDFij7a1pNeFv9bbRlPj/GbEBOh/IS0UrUHdSv40r5P7lnee:fW6AW0PVfJlIkmlee
TLSH
T16A0482176215F1F20EB2053E148A6C9592A472E513D7E9F0BA19C24CB7F468FB3983F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gonpemdgkjcecdgbnaabipppbmgfggbe_2025.07.24.00_all_hou4jz7zmeg5zedchpigdjxhve.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.A31sfB/gonpemdgkjcecdgbnaabipppbmgfggbe_2025.07.24.00_all_hou4jz7zmeg5zedchpigdjxhve.crx3
Size 16KB
SHA256 56c21927faa028be6ce18c931660eec37e41da4bfbfd47cafa48350f828c0dbd
MD5 479078f9927c39f3ae015938f9a8b304
SHA1 31a6f9dbac78faad676ad3c1d9ee1cb85d87241f
SHA512 b1c098abc3f797dc2b498806a5181d4eea7f8b2e06b20e0ddf94a720fafe2a0677ae38049230d9830f918631ca1b10e4439698b11bb8994ae286b3c14cd3b2c2
SSDEEP 384:cTcwCd5CuqlL+kIVxRtRTGXvcxtsVjrs4rs9IJbjXaKYHuA:YOCuqlL+kIVxRtRTGXvcxt6phbjX/YOA
TLSH
T1A2724FFF46556504D7AA43F894AD3D4CD06B495E8FECE9E7DB22D82E4AB0AF410002DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khaoiebndkojlmppeemjhbpbandiljpe_145.0.7584.0_mac_adijmuudraws5pmse4bp2wpjlfpq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.HqUuit/khaoiebndkojlmppeemjhbpbandiljpe_145.0.7584.0_mac_adijmuudraws5pmse4bp2wpjlfpq.crx3
Size 11KB
SHA256 9f157bd09a986baa46110a0acb7e3d7407208e58d02250c637902962e5ed2c5e
MD5 c2425a80ea4d5f90463e346b50f9d7d3
SHA1 64831f252de87d662b290493e98ec9d917449e91
SHA512 b934b3071adb98db083ff5ef06b239465f075c43a1b33467cc97ea09d7138cbee016fa44d9e8b4ecb89eced44b91a14faf07bf2ef3754b926f014dc03678b510
SSDEEP 192:YM6V27mUXs0aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmi1XP44PZexJFV3faUUGOuX:kVf0aEW8SsWk/pvtHB3Nf5YKk6QKEa4q
TLSH
T149320E95883A16E9AC3183A5F1B9C2218D21EE2B941F548E1BF353CB7BC1D868F37157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.JO7Ba3/imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3
Size 2.4MB
SHA256 9738a550f51cdfb80146b1620b40a37d58c5136254ee1f0f03c20a864fab89d2
MD5 0fa505d26fd906c645e60aa05f12af36
SHA1 ecb1def63dba6d475dcd61c4d3a6938855e6f24a
SHA512 6c49784a21465a2b7348720003f072a279a7aaeb88783b98cdb968a54cb1ce6771122a6f1bbbfb8dd36507576c81d6caa000166f2dc0f81a3feca4e8d5131a00
SSDEEP 49152:7GGdTzNOf9v87G2whzy8x3ZOOK4G7tbbOWVc2JjrqnE1rmoGfi:qGVzGBolTA3ZOOK4Wtb6WpYnE1tGa
TLSH
T1AFC53381A8FC258A4F51BCD0740E58EB8E6CBB541DC7AD3207F926557F5120ACBB9EC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efniojlnjndmcbiieegkicadnoecjjef_1764_all_oujhwyamjbij7kcamdjnbuxynq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.K1hFEe/efniojlnjndmcbiieegkicadnoecjjef_1764_all_oujhwyamjbij7kcamdjnbuxynq.crx3
Size 418KB
SHA256 d9f562fb7b2462acc97c4a295f65009f1ece837fc184468e3c79ad55117021fe
MD5 b2d511d1fbe08c1e387d44c19e20bd0e
SHA1 af4689347d4830e37d8d0ec6671d3ef55fab504a
SHA512 ea6e4c382a085797e7f1c87a4cfb6e93807f59a1bccf62da0f39d5c7306f705d9fefca85c77383da33f29102e08b013dd3756c7917a37ba338abcd2ca1fe7d7e
SSDEEP 6144:u/CxJ26uUvVc2cc66oXpFTy3IXtw6xrWtefZBSy7EwNZbgWy56kGFUT+Se1GsH4B:p26TdApQIXt9BX7Emb19YB
TLSH
T16E949FBB2F247843AFD3DD7470C8E53BBDB272D179AA54869149C4B1A9823D13E4902F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.SH4Is9/dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3
Size 136KB
SHA256 0c24e9bd976adffa987e08fc54dc0950c84cf18f9cdb4c5caabc6acf24887c4f
MD5 667e9eec04509aa9e2b318f580addd8c
SHA1 346267ecad10c54de52a3aeb766ea72449500326
SHA512 a9d22d49290c164abf36dd7e887063ccdd2bf508eb2d16bbac6de749e5152805ecb38ca39352706150de29a76839fa6a56c084ea4f2757b61887b3a7912be917
SSDEEP 3072:SGYNExjxgL4glOAq2HgjlKr3dUqK9tXi606uuBTgilY09X:xYNExjxk48W2AMEt507uBUilY05
TLSH
T1F9D3125FDF1FB211ABE4E21CB68532C71284E58AC4BFA943884DF2E09FA89407865648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.Wj8oiN/ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3
Size 10KB
SHA256 e3a7322843834a5270a01c56533a34a24b1a253e3bda6f14046e10d818446165
MD5 cb79d407a4d6d8526b42060b9210b5c2
SHA1 331e3d66e82e130042897faf86dcbd05d7b227f1
SHA512 0ea283f2077ff874e1f2518565497864b11fd8a65f03d65e2b2996048bdba19849fcab81d9a8220cd51d4a09741b9cf222b1393f6ea4fde6db76dfe0590efdf9
SSDEEP 192:Hkgz/5MwS0wqF1GCEomF17IchyrIqVGqKI4eHiTSj:EIS01komF1FmIqQg4eHES
TLSH
T1C4229EE3AD249894CF2B1F3D59E6930709602A9E86E484908077CCCA1570FBDEB94F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.dKJWsi/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
Size 857KB
SHA256 545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
MD5 a40c655b337e082c76b6ab04042b7ae0
SHA1 3cc2a2b7178a29fd2d246cbc532684d6ae45bea8
SHA512 fb4d54b573eb2275d8a3580fff138ecd7bded27ec58086b909b12c03c8005e35105c354a4a1ff76ada608ee8bbabeaafe208bb9e557661bb74e4ca39ee5eee56
SSDEEP 24576:tN1HYqiefjuhBCLF9t3c7y04bfB8w2aQnVBg1jAQpdnBXAt5:tN1HYqi2z9c7y04rKSpdtzw
TLSH
T1E7152367F7534E87A693C0F101B9EF5CDC2EC6B863DD6D5862DB6405CB8A8014EF1A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.com.google.Chrome.mNwUI9

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.mNwUI9
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmelglejhemejginpboagddgdfbepgmp_738_all_ZZ_mfh7vnzrc5luuw3iulukw5s62y.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.qkupsG/lmelglejhemejginpboagddgdfbepgmp_738_all_ZZ_mfh7vnzrc5luuw3iulukw5s62y.crx3
Size 555KB
SHA256 28cfa389276e0c9ce1c7398250a7216df462a81a017e1069cbb78c2426ccaa50
MD5 4b17be65d30088312236e8c8451df2e1
SHA1 0c273af5d0026450147f2c03db89ed282dbd8693
SHA512 ebdade51d20f2a1da281703334c6f34a7ee6d6adc2b80fa9c433079990080e588ce7934039396ff6381168a57fcddaab2b6b2373d9525a3df6d94907f9abb308
SSDEEP 12288:/MqmHB4tKJJ03op1CrndoImSgigDUnqZMUB:RmHf+3ocdiHi2GqZMUB
TLSH
T16DC422FEF20C60B2EF91ADB0A96D3F18461336DE14858C858C981715C9C72BBB25B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfnkpimlhhgieaddgfemjhofmfblmnib_10753_all_c3zk3ffjcya24cut4rgzt7vgni.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.qlCPR8/hfnkpimlhhgieaddgfemjhofmfblmnib_10753_all_c3zk3ffjcya24cut4rgzt7vgni.crx3
Size 29KB
SHA256 5da93245b1b3ba1067f0826acfeea505360faa1033a58a6bde73808cc99b30cd
MD5 f682486ba86f2771123daab03d50bc99
SHA1 00546d16c85a4548a22691ae99d75977fd594bec
SHA512 cf96048743a93eaa5cdcd717cf5eef112673915277fe3cac10ff6dd85aa70f9e663fcce455e9c8ea6af918331a6719b4f16aaf063cd7375f701ffd46fd31b769
SSDEEP 768:d4nfpXKkx3t0K80O5HMMbdCeDgmPmcDE9iqh588phbj/iJ:Knxakx9D8rsMRgmxE9p/88plqJ
TLSH
T1B6D2E11AAEA82307C072227E0476BB5016BAD02A67A1C2731D75971CAEC7215EB37C77
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeigpngbgcognadeebkilcpcaedhellh_2025.06.13.084507_all_acip2yapafsolnpcvaohkisaowaq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.uZd6xt/eeigpngbgcognadeebkilcpcaedhellh_2025.06.13.084507_all_acip2yapafsolnpcvaohkisaowaq.crx3
Size 257KB
SHA256 4497d8060d0e53c12b4403aa9ebe7e827d4880bae3f4139a26a4feb7ed64c4a2
MD5 5a6371818d0598fc615c76004f226666
SHA1 9225ea4a8418a37f8d6d393040ba78f20c93366f
SHA512 69d50587a46ad60c535ba0dfba8f0816f6474205e63a8ae2a8fe0c5f002b3e14dd8739a4dc0d9c60106398fb8566c27bfba9ba5ead347898842606aeba0bbf4a
SSDEEP 6144:FHKYcaVcxaGDSdsAm16knUFEUrlaTiHzeQM+XuWU:BKYUxakSd21TUFEClamHzeQ7up
TLSH
T1FF442A3A59B00465C44D43797A8A3717F3FC8F38AAB16FC514F9195838EB9028B7E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsck_hfs.log

Path /var/log/fsck_hfs.log
Size 15KB
SHA256 815cd633e2f4050abd9eef25eef8f6fae25dda15f6889218070bbf76076561ee
MD5 fd86590b7df112afe7abb9ff71fad5b8
SHA1 a112c943006bd2bd0c366562e50820178ca096fa
SHA512 85cfd5876de44acd1a50f2c6b9ca48602ad7b3f8e2e13cf8d301fa8219963233928fbb0de56285d3e0c897291fc223ed79776c0b60be344a88b6f12c2247c1b0
SSDEEP 96:iAgQ8J+kny9DFE/4lrmwFmDWnUu4fp1f4flXAnAiPcv+cr9XsdOktYZgIvUnoH0Y:5gBnZ3R1SpidIL
TLSH
T19B7236849141E71DB98F11DCD377A68971CFAD8AC373D36B78A934D8720C82A57769C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads