Analysis

  • user interaction
    yes
  • max time kernel
    98s
  • max time network
    104s
  • platform
    macos-10.15_amd64
  • resource
    macos-20250619-en
  • resource tags

    arch:amd64arch:i386image:macos-20250619-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
  • submitted
    07/09/2026, 17:52

General

  • Target
    SKlauncher-3.2.18.dmg
  • Size 1.4MB
  • Sample260907-wf6fkasdja
  • SHA256 65d0c8a5ba00ae164aa68f7ad6c4aa305c46e1b0236fb3e2790bc8bd970f200f
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • File and Directory Discovery. 1 TTPs 18 IoCs

    Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

  • Resource Forking 1 TTPs 5 IoCs

    Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

Processes

  • /bin/sh
    sh -c "sudo /bin/zsh -c \"open /Volumes/SKlauncher/SKlauncher.app\""
    1⤵
      PID:526
    • /bin/bash
      sh -c "sudo /bin/zsh -c \"open /Volumes/SKlauncher/SKlauncher.app\""
      1⤵
        PID:526
      • /usr/bin/sudo
        sudo /bin/zsh -c "open /Volumes/SKlauncher/SKlauncher.app"
        1⤵
          PID:526
          • /bin/zsh
            /bin/zsh -c "open /Volumes/SKlauncher/SKlauncher.app"
            2⤵
              PID:527
            • /usr/bin/open
              open /Volumes/SKlauncher/SKlauncher.app
              2⤵
                PID:527
            • /usr/libexec/xpcproxy
              xpcproxy pl.skmedix.bootstrap.Main.2332
              1⤵
                PID:528
              • /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                1⤵
                  PID:528
                • /usr/bin/bash
                  bash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                  1⤵
                    PID:528
                  • /bin/bash
                    bash /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                    1⤵
                      PID:528
                      • /usr/bin/dirname
                        dirname /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                        2⤵
                          PID:529
                        • /usr/bin/basename
                          basename "\"/Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub\""
                          2⤵
                            PID:530
                          • /usr/bin/basename
                            basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                            2⤵
                              PID:531
                            • /usr/bin/syslog
                              syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][universalJavaApplicationStub\"] [StubDir] /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS"
                              2⤵
                                PID:532
                              • /usr/libexec/PlistBuddy
                                /usr/libexec/PlistBuddy -c "print :Java" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                2⤵
                                  PID:539
                                • /usr/libexec/PlistBuddy
                                  /usr/libexec/PlistBuddy -c "print :JavaX" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                  2⤵
                                    PID:540
                                  • /usr/bin/basename
                                    basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                    2⤵
                                      PID:541
                                    • /usr/bin/syslog
                                      syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [PlistStyle] Oracle"
                                      2⤵
                                        PID:542
                                      • /usr/bin/basename
                                        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                        2⤵
                                          PID:582
                                        • /usr/bin/syslog
                                          syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaRequirement] JVM minimum version: 21+"
                                          2⤵
                                            PID:583
                                          • /usr/bin/basename
                                            basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                            2⤵
                                              PID:584
                                            • /usr/bin/syslog
                                              syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaRequirement] JVM maximum version: "
                                              2⤵
                                                PID:585
                                              • /usr/bin/basename
                                                basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                2⤵
                                                  PID:588
                                                • /usr/bin/syslog
                                                  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [LanguageSearch] Checking preferred languages in macOS System Preferences..."
                                                  2⤵
                                                    PID:589
                                                  • /usr/bin/basename
                                                    basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                    2⤵
                                                      PID:596
                                                    • /usr/bin/syslog
                                                      syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [LanguageSearch] ... found [en-NL nl-NL de-NL]"
                                                      2⤵
                                                        PID:597
                                                      • /usr/bin/basename
                                                        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                        2⤵
                                                          PID:598
                                                        • /usr/bin/syslog
                                                          syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [LanguageSearch] ... selected 'en' (from 'en-NL') as the default language for the launcher stub"
                                                          2⤵
                                                            PID:599
                                                          • /usr/bin/basename
                                                            basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                            2⤵
                                                              PID:600
                                                            • /usr/bin/syslog
                                                              syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [Language] en"
                                                              2⤵
                                                                PID:601
                                                              • /usr/bin/basename
                                                                basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                                2⤵
                                                                  PID:626
                                                                • /usr/bin/syslog
                                                                  syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] Checking for \$JAVA_HOME ..."
                                                                  2⤵
                                                                    PID:627
                                                                  • /usr/bin/basename
                                                                    basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                                    2⤵
                                                                      PID:628
                                                                    • /usr/bin/syslog
                                                                      syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] ... using JAVA_HOME is disabled"
                                                                      2⤵
                                                                        PID:629
                                                                      • /usr/bin/basename
                                                                        basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                                        2⤵
                                                                          PID:630
                                                                        • /usr/bin/syslog
                                                                          syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] Searching for JavaVirtualMachines on the system ..."
                                                                          2⤵
                                                                            PID:631
                                                                          • /usr/libexec/java_home
                                                                            /usr/libexec/java_home --xml
                                                                            2⤵
                                                                              PID:632
                                                                            • /usr/bin/basename
                                                                              basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                                              2⤵
                                                                                PID:638
                                                                              • /usr/bin/syslog
                                                                                syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] ... found JVM: 1.8.0_301:/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java"
                                                                                2⤵
                                                                                  PID:639
                                                                                • /usr/bin/basename
                                                                                  basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                                                  2⤵
                                                                                    PID:640
                                                                                  • /usr/bin/syslog
                                                                                    syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaSearch] Filtering the result list for JVMs matching the min/max version requirement ..."
                                                                                    2⤵
                                                                                      PID:641
                                                                                    • /usr/bin/basename
                                                                                      basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                                                      2⤵
                                                                                        PID:651
                                                                                      • /usr/bin/syslog
                                                                                        syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaCommand] ''"
                                                                                        2⤵
                                                                                          PID:652
                                                                                        • /usr/bin/basename
                                                                                          basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                                                          2⤵
                                                                                            PID:658
                                                                                          • /usr/bin/syslog
                                                                                            syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [JavaVersion] "
                                                                                            2⤵
                                                                                              PID:659
                                                                                            • /usr/bin/basename
                                                                                              basename /Volumes/SKlauncher/SKlauncher.app/Contents/MacOS/universalJavaApplicationStub
                                                                                              2⤵
                                                                                                PID:665
                                                                                              • /usr/bin/syslog
                                                                                                syslog -s -k Facility com.apple.console Level Notice Sender universalJavaApplicationStub Message "[528][SKlauncher] [EXIT 3] No suitable Java version found on your system! This program requires Java 21 or later."
                                                                                                2⤵
                                                                                                  PID:666
                                                                                                • /usr/bin/osascript
                                                                                                  osascript
                                                                                                  2⤵
                                                                                                    PID:667
                                                                                                • /usr/libexec/PlistBuddy
                                                                                                  /usr/libexec/PlistBuddy -c "print :CFBundleName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                  1⤵
                                                                                                    PID:536
                                                                                                  • /usr/libexec/PlistBuddy
                                                                                                    /usr/libexec/PlistBuddy -c "print :CFBundleIconFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                    1⤵
                                                                                                      PID:538
                                                                                                    • /usr/libexec/PlistBuddy
                                                                                                      /usr/libexec/PlistBuddy -c "print :JVMMainClassName" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                      1⤵
                                                                                                        PID:544
                                                                                                      • /usr/libexec/PlistBuddy
                                                                                                        /usr/libexec/PlistBuddy -c "print :JVMSplashFile" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                        1⤵
                                                                                                          PID:546
                                                                                                        • /usr/bin/grep
                                                                                                          grep " "
                                                                                                          1⤵
                                                                                                            PID:549
                                                                                                          • /usr/libexec/PlistBuddy
                                                                                                            /usr/libexec/PlistBuddy -c "print :JVMOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                            1⤵
                                                                                                              PID:551
                                                                                                            • /usr/bin/sed
                                                                                                              sed "s/^ *//g"
                                                                                                              1⤵
                                                                                                                PID:550
                                                                                                              • /usr/libexec/PlistBuddy
                                                                                                                /usr/libexec/PlistBuddy -c "print :JVMClassPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                                1⤵
                                                                                                                  PID:553
                                                                                                                • /usr/bin/grep
                                                                                                                  grep -o " \\-.*"
                                                                                                                  1⤵
                                                                                                                    PID:556
                                                                                                                  • /usr/libexec/PlistBuddy
                                                                                                                    /usr/libexec/PlistBuddy -c "print :JVMDefaultOptions" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                                    1⤵
                                                                                                                      PID:557
                                                                                                                    • /usr/bin/tr
                                                                                                                      tr -d "\\n"
                                                                                                                      1⤵
                                                                                                                        PID:558
                                                                                                                      • /usr/bin/xargs
                                                                                                                        xargs
                                                                                                                        1⤵
                                                                                                                          PID:559
                                                                                                                        • /usr/bin/tr
                                                                                                                          tr -d "\\n"
                                                                                                                          1⤵
                                                                                                                            PID:565
                                                                                                                          • /usr/libexec/PlistBuddy
                                                                                                                            /usr/libexec/PlistBuddy -c "print :JVMArguments" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                                            1⤵
                                                                                                                              PID:566
                                                                                                                            • /usr/bin/sed
                                                                                                                              sed -E "s/Array \\{ *(.*) *\\}/\\1/g"
                                                                                                                              1⤵
                                                                                                                                PID:567
                                                                                                                              • /usr/bin/sed
                                                                                                                                sed "s/ */ /g"
                                                                                                                                1⤵
                                                                                                                                  PID:568
                                                                                                                                • /usr/bin/xargs
                                                                                                                                  xargs -n1
                                                                                                                                  1⤵
                                                                                                                                    PID:562
                                                                                                                                  • /usr/bin/xargs
                                                                                                                                    xargs
                                                                                                                                    1⤵
                                                                                                                                      PID:571
                                                                                                                                    • /usr/libexec/PlistBuddy
                                                                                                                                      /usr/libexec/PlistBuddy -c "print :JVMVersion" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                                                      1⤵
                                                                                                                                        PID:572
                                                                                                                                      • /bin/echo
                                                                                                                                        /bin/echo 21+
                                                                                                                                        1⤵
                                                                                                                                          PID:573
                                                                                                                                        • /usr/bin/xargs
                                                                                                                                          xargs
                                                                                                                                          1⤵
                                                                                                                                            PID:576
                                                                                                                                          • /usr/libexec/PlistBuddy
                                                                                                                                            /usr/libexec/PlistBuddy -c "print :JVMUseJavaHome" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                                                            1⤵
                                                                                                                                              PID:577
                                                                                                                                            • /usr/bin/xargs
                                                                                                                                              xargs
                                                                                                                                              1⤵
                                                                                                                                                PID:580
                                                                                                                                              • /usr/libexec/PlistBuddy
                                                                                                                                                /usr/libexec/PlistBuddy -c "print :JVMEmbeddedJavaPath" /Volumes/SKlauncher/SKlauncher.app/Contents/Info.plist
                                                                                                                                                1⤵
                                                                                                                                                  PID:581
                                                                                                                                                • /usr/bin/grep
                                                                                                                                                  grep "\\s\""
                                                                                                                                                  1⤵
                                                                                                                                                    PID:592
                                                                                                                                                  • /usr/bin/defaults
                                                                                                                                                    defaults read -g AppleLanguages
                                                                                                                                                    1⤵
                                                                                                                                                      PID:591
                                                                                                                                                    • /usr/bin/tr
                                                                                                                                                      tr -d ","
                                                                                                                                                      1⤵
                                                                                                                                                        PID:593
                                                                                                                                                      • /usr/bin/xargs
                                                                                                                                                        xargs
                                                                                                                                                        1⤵
                                                                                                                                                          PID:594
                                                                                                                                                        • /bin/echo
                                                                                                                                                          /bin/echo en-NL nl-NL de-NL
                                                                                                                                                          1⤵
                                                                                                                                                            PID:595
                                                                                                                                                          • /Library/Java/Home/bin/java
                                                                                                                                                            /Library/Java/Home/bin/java -version
                                                                                                                                                            1⤵
                                                                                                                                                              PID:604
                                                                                                                                                            • /usr/bin/sed
                                                                                                                                                              sed -E "s/\"//g;s/-ea//g"
                                                                                                                                                              1⤵
                                                                                                                                                                PID:606
                                                                                                                                                              • /usr/bin/awk
                                                                                                                                                                awk "/version/{print \$3}"
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:605
                                                                                                                                                                • /usr/bin/awk
                                                                                                                                                                  awk "/version/{print \$3}"
                                                                                                                                                                  1⤵
                                                                                                                                                                    PID:610
                                                                                                                                                                  • /usr/bin/sed
                                                                                                                                                                    sed -E "s/\"//g;s/-ea//g"
                                                                                                                                                                    1⤵
                                                                                                                                                                      PID:611
                                                                                                                                                                    • /Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java
                                                                                                                                                                      "/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/java" -version
                                                                                                                                                                      1⤵
                                                                                                                                                                        PID:609
                                                                                                                                                                      • /usr/bin/sed
                                                                                                                                                                        sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
                                                                                                                                                                        1⤵
                                                                                                                                                                          PID:615
                                                                                                                                                                        • /usr/bin/sed
                                                                                                                                                                          sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
                                                                                                                                                                          1⤵
                                                                                                                                                                            PID:622
                                                                                                                                                                          • /usr/libexec/PlistBuddy
                                                                                                                                                                            /usr/libexec/PlistBuddy -c Print /dev/stdin
                                                                                                                                                                            1⤵
                                                                                                                                                                              PID:634
                                                                                                                                                                            • /usr/bin/grep
                                                                                                                                                                              grep Dict
                                                                                                                                                                              1⤵
                                                                                                                                                                                PID:635
                                                                                                                                                                              • /usr/bin/tr
                                                                                                                                                                                tr -d " "
                                                                                                                                                                                1⤵
                                                                                                                                                                                  PID:637
                                                                                                                                                                                • /usr/bin/wc
                                                                                                                                                                                  wc -l
                                                                                                                                                                                  1⤵
                                                                                                                                                                                    PID:636
                                                                                                                                                                                  • /usr/bin/sed
                                                                                                                                                                                    sed -E "s/^1\\.//g;s/-b[0-9]+-[0-9]+\$//g;s/[a-zA-Z+*\\-]//g;s/_/./g"
                                                                                                                                                                                    1⤵
                                                                                                                                                                                      PID:645
                                                                                                                                                                                    • /usr/bin/sort
                                                                                                                                                                                      sort -nr
                                                                                                                                                                                      1⤵
                                                                                                                                                                                        PID:650
                                                                                                                                                                                      • /usr/bin/sed
                                                                                                                                                                                        sed -E "s/\"//g;s/-ea//g"
                                                                                                                                                                                        1⤵
                                                                                                                                                                                          PID:657
                                                                                                                                                                                        • /usr/bin/awk
                                                                                                                                                                                          awk "/version/{print \$3}"
                                                                                                                                                                                          1⤵
                                                                                                                                                                                            PID:656
                                                                                                                                                                                          • /usr/bin/sed
                                                                                                                                                                                            sed -E "s/^1\\.([0-9+*]+)\$/\\1/g"
                                                                                                                                                                                            1⤵
                                                                                                                                                                                              PID:662
                                                                                                                                                                                            • /usr/bin/sed
                                                                                                                                                                                              sed "s/+/ or later/;s/*/(latest update)/"
                                                                                                                                                                                              1⤵
                                                                                                                                                                                                PID:663
                                                                                                                                                                                              • /usr/libexec/xpcproxy
                                                                                                                                                                                                xpcproxy com.apple.systempreferences.2140
                                                                                                                                                                                                1⤵
                                                                                                                                                                                                  PID:676
                                                                                                                                                                                                • /System/Applications/System Preferences.app/Contents/MacOS/System Preferences
                                                                                                                                                                                                  "/System/Applications/System Preferences.app/Contents/MacOS/System Preferences"
                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                    PID:676
                                                                                                                                                                                                  • /usr/libexec/xpcproxy
                                                                                                                                                                                                    xpcproxy com.apple.AccountProfileRemoteViewService 676
                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                      PID:677
                                                                                                                                                                                                    • /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
                                                                                                                                                                                                      /System/Library/PrivateFrameworks/AOSUI.framework/Versions/A/XPCServices/AccountProfileRemoteViewService.xpc/Contents/MacOS/AccountProfileRemoteViewService
                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                        PID:677
                                                                                                                                                                                                      • /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
                                                                                                                                                                                                        /System/Library/PreferencePanes/ClassroomSettings.prefPane/Contents/Resources/ClassroomSettingsVisibilityCheckTool
                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                          PID:678
                                                                                                                                                                                                        • /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
                                                                                                                                                                                                          /System/Library/PreferencePanes/Profiles.prefPane/Contents/Resources/CPPrefPaneEnabledTool
                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                            PID:679
                                                                                                                                                                                                          • /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
                                                                                                                                                                                                            /System/Library/PreferencePanes/Sidecar.prefPane/Contents/Resources/sidecarPrefCheck
                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                              PID:680
                                                                                                                                                                                                            • /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
                                                                                                                                                                                                              /System/Library/PreferencePanes/TouchID.prefPane/Contents/Resources/AllowPasswordPref
                                                                                                                                                                                                              1⤵
                                                                                                                                                                                                                PID:681
                                                                                                                                                                                                              • /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
                                                                                                                                                                                                                /System/Library/PreferencePanes/Wallet.prefPane/Contents/Resources/walletAvailabilityCheckTool
                                                                                                                                                                                                                1⤵
                                                                                                                                                                                                                  PID:682
                                                                                                                                                                                                                • /usr/libexec/xpcproxy
                                                                                                                                                                                                                  xpcproxy com.apple.nfcd
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:684
                                                                                                                                                                                                                  • /usr/libexec/nfcd
                                                                                                                                                                                                                    /usr/libexec/nfcd
                                                                                                                                                                                                                    1⤵
                                                                                                                                                                                                                      PID:684
                                                                                                                                                                                                                    • /usr/libexec/xpcproxy
                                                                                                                                                                                                                      xpcproxy com.apple.studentd
                                                                                                                                                                                                                      1⤵
                                                                                                                                                                                                                        PID:685
                                                                                                                                                                                                                      • /usr/libexec/studentd
                                                                                                                                                                                                                        /usr/libexec/studentd
                                                                                                                                                                                                                        1⤵
                                                                                                                                                                                                                          PID:685
                                                                                                                                                                                                                        • /usr/libexec/xpcproxy
                                                                                                                                                                                                                          xpcproxy com.apple.ReportMemoryException
                                                                                                                                                                                                                          1⤵
                                                                                                                                                                                                                            PID:686
                                                                                                                                                                                                                          • /usr/libexec/ReportMemoryException
                                                                                                                                                                                                                            /usr/libexec/ReportMemoryException
                                                                                                                                                                                                                            1⤵
                                                                                                                                                                                                                              PID:686

                                                                                                                                                                                                                            Network

                                                                                                                                                                                                                                  MITRE ATT&CK Enterprise v16

                                                                                                                                                                                                                                  Replay Monitor

                                                                                                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                                                                                                  Downloads

                                                                                                                                                                                                                                  sh-thd-1788817829

                                                                                                                                                                                                                                  • Path /var/tmp//sh-thd-1788817829
                                                                                                                                                                                                                                  • Size 182B
                                                                                                                                                                                                                                  • SHA256 b6b1b914ea63ef79a16f0f0e361371a0df82b27c554c7bbc2384161a0170ddb1
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH

                                                                                                                                                                                                                                  sh-thd-1788818485

                                                                                                                                                                                                                                  • Path /var/tmp//sh-thd-1788818485
                                                                                                                                                                                                                                  • Size 555B
                                                                                                                                                                                                                                  • SHA256 8147bf5e15930597be48929686291e59d57687333e87eaa9c199bede9323c778
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512 TLSH

                                                                                                                                                                                                                                  sh-thd-1788833835

                                                                                                                                                                                                                                  • Path /var/tmp//sh-thd-1788833835
                                                                                                                                                                                                                                  • Size 1B
                                                                                                                                                                                                                                  • SHA256 01ba4719c80b6fe911b091a7c05124b64eeece964e09c058ef8f9805daca546b
                                                                                                                                                                                                                                  • MD5 SHA1 SHA512