hxxp://youareanidiot[.]cc

Resubmissions

15/10/2026, 01:36

261015-b1laxasz3l3

14/10/2026, 19:58

261014-yp4pfahs2n6

Analysis

user interaction
yes
max time kernel
899s
max time network
875s
platform
macos-10.15_amd64
resource
macos-20260915-en
resource tags

arch:amd64arch:i386image:macos-20260915-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
14/10/2026, 19:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://youareanidiot.cc
Sample261014-yp4pfahs2n

Score

6^/10

defense_evasion discovery

Malware Config

Signatures

Gatekeeper Bypass 1 TTPs
Adversaries may modify file attributes and subvert Gatekeeper functionality to evade user prompts and execute untrusted programs. Gatekeeper is a set of technologies that act as layer of Apples security model to ensure only trusted applications are executed on a host.
defense_evasion

Gatekeeper Bypass
T1553.001
File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer) may leave traces to indicate to what was done within a network and how. Removal of these files can occur.
defense_evasion

File Deletion
T1070.004

File and Directory Discovery. 1 TTPs 3 IoCs

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system.

discovery

File and Directory Discovery

T1083

ioc	Process
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName	Process not Found
dirname "/Library/Google/Google Chrome Brand.plist"	Process not Found
basename "/Volumes/Google Chrome/.keystone_install"	Process not Found

Resource Forking 1 TTPs 18 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/PrivateFrameworks/CoreCDP.framework/Versions/A/Resources/cdpd	Process not Found
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2	Process not Found
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid E53A3D04-AA42-440E-BC61-EF6F1B4A858C -post-exec 4	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2	Process not Found
/System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2	Process not Found
/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd	Process not Found
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	Process not Found
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	Process not Found
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	Process not Found
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid E53A3D04-AA42-440E-BC61-EF6F1B4A858C	Process not Found
/System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy	Process not Found

/bin/sh
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'http://youareanidiot.cc'"
1⤵
PID:462

/bin/bash
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'http://youareanidiot.cc'"
1⤵
PID:462

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:451

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:454

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:457

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:449

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window http://youareanidiot.cc
1⤵
PID:462

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:458

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:468

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:468

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=9"
1⤵
PID:470

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:472

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
1⤵
PID:474

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
1⤵
PID:475

/usr/bin/tar
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
1⤵
PID:476

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
1⤵
PID:477

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
1⤵
PID:479

/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
1⤵
PID:480

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
1⤵
PID:0
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
  2⤵
  PID:483
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
  2⤵
  PID:0
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher
    "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
    3⤵
    PID:486
- - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
    GoogleUpdater --server "--service=update-internal" --system
    3⤵
    PID:0
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
      4⤵
      PID:1.8446744073709552e+19
  - - /Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
      "/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
      4⤵
      PID:491
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      GoogleUpdater --server "--service=update" --system
      4⤵
      PID:0
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
        5⤵
        
        PID:1.8446744073709552e+19
    - - /usr/bin/profiles
        
        /usr/bin/profiles status -type enrollment
        5⤵
        
        PID:514
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=19"
        5⤵
        
        PID:515
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=en-GB" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=19"
        5⤵
        
        PID:516
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=19"
        5⤵
        
        PID:517
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=en-GB" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072"
        5⤵
        
        PID:518
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=289677941" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=62"
        5⤵
        
        PID:519
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=289731997" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=62"
        5⤵
        
        PID:520
    - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
        5⤵
        
        PID:521
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.SafariLaunchAgent
        5⤵
        
        PID:522
    - - /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
        
        /Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
        5⤵
        
        PID:522
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=291450619" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=76"
        5⤵
        
        PID:523
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=291522083" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=77"
        5⤵
        
        PID:524
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=291528733" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=77"
        5⤵
        
        PID:525
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=291643319" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=74"
        5⤵
        
        PID:526
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=84"
        5⤵
        
        PID:527
    - - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
        5⤵
        
        PID:528
    - - /usr/sbin/system_profiler
        
        /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
        5⤵
        
        PID:529
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=100"
        5⤵
        
        PID:532
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=106"
        5⤵
        
        PID:533
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=104"
        5⤵
        
        PID:534
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=116"
        5⤵
        
        PID:535
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=85"
        5⤵
        
        PID:536
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=20" "--launch-time-ticks=299206140" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=121"
        5⤵
        
        PID:537
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=21" "--launch-time-ticks=302569331" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=124"
        5⤵
        
        PID:541
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=124"
        5⤵
        
        PID:542
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=en-GB" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=123"
        5⤵
        
        PID:564
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=123"
        5⤵
        
        PID:565
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=audio.mojom.AudioService" "--lang=en-GB" "--service-sandbox-type=audio" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=123"
        5⤵
        
        PID:566
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:569
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:570
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:570
    - - /usr/libexec/mobileassetd
        
        /usr/libexec/mobileassetd
        5⤵
        
        PID:569
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=125"
        5⤵
        
        PID:571
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=126"
        5⤵
        
        PID:572
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=28" "--launch-time-ticks=363711437" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=126"
        5⤵
        
        PID:573
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump
        5⤵
        
        PID:575
    - - /usr/sbin/spindump
        
        /usr/sbin/spindump
        5⤵
        
        PID:575
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ViewBridgeAuxiliary
        5⤵
        
        PID:576
    - - /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        
        /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        5⤵
        
        PID:576
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.tailspind
        5⤵
        
        PID:577
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump_agent
        5⤵
        
        PID:578
    - - /usr/libexec/tailspind
        
        /usr/libexec/tailspind
        5⤵
        
        PID:577
    - - /usr/libexec/spindump_agent
        
        /usr/libexec/spindump_agent
        5⤵
        
        PID:578
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportCrash.Root
        5⤵
        
        PID:579
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil attach /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.EIZfZR/GoogleChrome-128.0.6613.138.dmg -plist -nobrowse -readonly
        5⤵
        
        PID:580
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.hdiejectd
        5⤵
        
        PID:581
    - - /System/Library/CoreServices/ReportCrash
        
        /System/Library/CoreServices/ReportCrash daemon
        5⤵
        
        PID:579
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        5⤵
        
        PID:581
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid E53A3D04-AA42-440E-BC61-EF6F1B4A858C
        5⤵
        
        PID:582
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid E53A3D04-AA42-440E-BC61-EF6F1B4A858C -post-exec 4
        5⤵
        
        PID:583
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:584
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:584
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.bird
        5⤵
        
        PID:585
    - - /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        
        /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        5⤵
        
        PID:585
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.GameController.gamecontrollerd
        5⤵
        
        PID:586
    - - /usr/libexec/gamecontrollerd
        
        /usr/libexec/gamecontrollerd
        5⤵
        
        PID:586
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.PerformanceAnalysis.animationperfd
        5⤵
        
        PID:587
    - - /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        
        /System/Library/PrivateFrameworks/PerformanceAnalysis.framework/Versions/A/XPCServices/com.apple.PerformanceAnalysis.animationperfd.xpc/Contents/MacOS/com.apple.PerformanceAnalysis.animationperfd
        5⤵
        
        PID:587
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=en-GB" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=29" "--launch-time-ticks=455369971" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=125"
        5⤵
        
        PID:588
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.iconservices.iconservicesagent
        5⤵
        
        PID:589
    - - /System/Library/CoreServices/iconservicesagent
        
        /System/Library/CoreServices/iconservicesagent
        5⤵
        
        PID:589
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.iconservices.iconservicesd
        5⤵
        
        PID:590
    - - /System/Library/CoreServices/iconservicesd
        
        /System/Library/CoreServices/iconservicesd
        5⤵
        
        PID:590
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
        5⤵
        
        PID:592
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
        5⤵
        
        PID:593
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
        5⤵
        
        PID:594
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.hdiejectd
        5⤵
        
        PID:595
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -p disk3s2 removable readonly
        5⤵
        
        PID:596
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./hfs.util -k disk3s2
        5⤵
        
        PID:597
    - - /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs
        
        /System/Library/Filesystems/hfs.fs/Contents/Resources/./fsck_hfs -q /dev/rdisk3s2
        5⤵
        
        PID:598
    - - /sbin/mount
        
        /sbin/mount -t hfs -o "-u=99,-g=99,-m=755,nodev,noowners,nosuid,rdonly,nobrowse" /dev/disk3s2 "/Volumes/Google Chrome"
        5⤵
        
        PID:599
      - /sbin/mount_hfs
        
        /sbin/mount_hfs -u 99 -g 99 -m 755 -o nodev -o noowners -o nosuid -o rdonly -o nobrowse /dev/disk3s2 "/Volumes/Google Chrome"
        6⤵
        
        PID:600
    - - /Volumes/Google Chrome/.keystone_install
        
        "/Volumes/Google Chrome/.keystone_install" "/Volumes/Google Chrome" "/Applications/Google Chrome.app" 101.0.4951.54
        5⤵
        
        PID:603
      - /usr/bin/basename
        
        basename "/Volumes/Google Chrome/.keystone_install"
        6⤵
        
        PID:604
      - /bin/mkdir
        
        mkdir -p "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions"
        6⤵
        
        PID:619
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-before "/Volumes/Google Chrome/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138"
        6⤵
        
        PID:620
      - /usr/bin/rsync
        
        rsync --ignore-times --links --perms --recursive --times --delete-after "--include=/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "--exclude=/Contents/Frameworks/Google Chrome Framework.framework/Versions/*" "--exclude=/Contents/Versions/*" "/Volumes/Google Chrome/Google Chrome.app/" "/Applications/Google Chrome.app"
        6⤵
        
        PID:624
      - /bin/rm
        
        rm -f "/Applications/Google Chrome.app/.want_full_installer"
        6⤵
        
        PID:627
      - /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister
        
        /System/Library/Frameworks/CoreServices.framework/Frameworks/LaunchServices.framework/Support/lsregister -f "/Applications/Google Chrome.app"
        6⤵
        
        PID:638
      - /usr/bin/dirname
        
        dirname "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:642
      - /bin/mkdir
        
        mkdir -p /Library/Google
        6⤵
        
        PID:643
      - /usr/bin/defaults
        
        defaults write "/Library/Google/Google Chrome Brand" KSBrandID -string GGRO
        6⤵
        
        PID:644
      - /usr/sbin/chown
        
        chown root:wheel "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:645
      - /bin/chmod
        
        chmod 644 "/Library/Google/Google Chrome Brand.plist"
        6⤵
        
        PID:646
      - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
        
        ksadmin --register --productid com.google.Chrome --version 128.0.6613.138 --xcpath "/Applications/Google Chrome.app" --url https://tools.google.com/service/update2 --tag universal --tag-path "/Applications/Google Chrome.app/Contents/Info.plist" --tag-key KSChannelID --brand-path "/Library/Google/Google Chrome Brand.plist" --brand-key KSBrandID --version-path "/Applications/Google Chrome.app/Contents/Info.plist" --version-key KSVersion
        6⤵
        
        PID:651
      - /bin/rm
        
        rm -rf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69"
        6⤵
        
        PID:659
      - /usr/sbin/chown
        
        chown -Rh root:wheel "/Applications/Google Chrome.app"
        6⤵
        
        PID:660
      - /bin/chmod
        
        chmod -R "a+rX,u+w,go-w" "/Applications/Google Chrome.app"
        6⤵
        
        PID:661
      - /usr/bin/find
        
        find "/Applications/Google Chrome.app" -type l -exec chmod -h "a+rX,u+w,go-w" "{}" +
        6⤵
        
        PID:662
        
        /bin/chmod
        
        chmod -h "a+rX,u+w,go-w" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Default Apps" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/KeystoneRegistration" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/Current" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/128.0.6613.138/Helpers/GoogleUpdater.app/Contents/Helpers/GoogleSoftwareUpdate.bundle/Contents/MacOS/ksadmin" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Libraries" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Google Chrome Framework" "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Helpers"
        7⤵
        
        PID:663
      - /usr/bin/xattr
        
        xattr -d -r com.apple.quarantine "/Applications/Google Chrome.app"
        6⤵
        
        PID:664
    - - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        
        /System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
        5⤵
        
        PID:595
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nehelper
        5⤵
        
        PID:639
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.assistantd
        5⤵
        
        PID:665
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.dmd
        5⤵
        
        PID:667
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.pbs
        5⤵
        
        PID:668
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobileassetd
        5⤵
        
        PID:669
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:670
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:670
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ViewBridgeAuxiliary
        5⤵
        
        PID:671
    - - /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        
        /System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
        5⤵
        
        PID:671
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.cfprefsd.xpc.agent
        5⤵
        
        PID:672
    - - /usr/sbin/cfprefsd
        
        /usr/sbin/cfprefsd agent
        5⤵
        
        PID:672
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportCrash.Root
        5⤵
        
        PID:673
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.mobile.keybagd
        5⤵
        
        PID:676
    - - /usr/libexec/keybagd
        
        /usr/libexec/keybagd -t 15
        5⤵
        
        PID:676
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.bird
        5⤵
        
        PID:677
    - - /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        
        /System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
        5⤵
        
        PID:677
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.accountsd
        5⤵
        
        PID:678
    - - /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
        
        /System/Library/Frameworks/Accounts.framework/Versions/A/Support/accountsd
        5⤵
        
        PID:678
    - - /usr/libexec/mobileassetd
        
        /usr/libexec/mobileassetd
        5⤵
        
        PID:669
    - - /System/Library/CoreServices/ReportCrash
        
        /System/Library/CoreServices/ReportCrash daemon
        5⤵
        
        PID:673
    - - /usr/bin/hdiutil
        
        /usr/bin/hdiutil detach "/Volumes/Google Chrome" -force
        5⤵
        
        PID:679
    - - /System/Library/CoreServices/pbs
        
        /System/Library/CoreServices/pbs
        5⤵
        
        PID:668
    - - /usr/libexec/nehelper
        
        /usr/libexec/nehelper
        5⤵
        
        PID:639
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secd
        5⤵
        
        PID:680
    - - /usr/libexec/secd
        
        /usr/libexec/secd
        5⤵
        
        PID:680
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.cloudkeychainproxy3
        5⤵
        
        PID:681
    - - /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
        
        /System/Library/Frameworks/Security.framework/Versions/A/Resources/CloudKeychainProxy.bundle/Contents/MacOS/CloudKeychainProxy
        5⤵
        
        PID:681
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.cdpd
        5⤵
        
        PID:684
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.keychain-circle-notification
        5⤵
        
        PID:686
    - - /System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Keychain Circle Notification
        
        "/System/Library/CoreServices/Keychain Circle Notification.app/Contents/MacOS/Keychain Circle Notification"
        5⤵
        
        PID:686
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.tccd
        5⤵
        
        PID:687
    - - /System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
        
        /System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
        5⤵
        
        PID:687
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.sandboxd
        5⤵
        
        PID:688
    - - /usr/libexec/sandboxd
        
        /usr/libexec/sandboxd
        5⤵
        
        PID:688
    - - /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
        
        /System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
        5⤵
        
        PID:665
    - - /usr/libexec/dmd
        
        /usr/libexec/dmd
        5⤵
        
        PID:667
    - - /sbin/umount
        
        /sbin/umount -f "/Volumes/Google Chrome"
        5⤵
        
        PID:690
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.security.DiskUnmountWatcher
        5⤵
        
        PID:692
    - - /System/Library/PrivateFrameworks/CoreCDP.framework/Versions/A/Resources/cdpd
        
        /System/Library/PrivateFrameworks/CoreCDP.framework/Versions/A/Resources/cdpd
        5⤵
        
        PID:684
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.sysmond
        5⤵
        
        PID:694
    - - /usr/libexec/sysmond
        
        /usr/libexec/sysmond
        5⤵
        
        PID:694
    - - /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        
        /System/Library/PrivateFrameworks/KerberosHelper/Helpers/DiskUnmountWatcher
        5⤵
        
        PID:692
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportCrash
        5⤵
        
        PID:695
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.ReportMemoryException
        5⤵
        
        PID:696
    - - /usr/libexec/ReportMemoryException
        
        /usr/libexec/ReportMemoryException
        5⤵
        
        PID:696
    - - /System/Library/CoreServices/ReportCrash
        
        /System/Library/CoreServices/ReportCrash agent
        5⤵
        
        PID:695
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.spindump_agent
        5⤵
        
        PID:697
    - - /usr/libexec/spindump_agent
        
        /usr/libexec/spindump_agent
        5⤵
        
        PID:697
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
        5⤵
        
        PID:698
    - - /usr/libexec/neagent
        
        /usr/libexec/neagent
        5⤵
        
        PID:698
    - - /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
        
        "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=en-GB" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,7461179137638075262,14126719359004949633,131072" "--seatbelt-client=127"
        5⤵
        
        PID:713
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.suggestd
        5⤵
        
        PID:716
    - - /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
        
        /System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
        5⤵
        
        PID:716
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.knowledge-agent
        5⤵
        
        PID:718
    - - /usr/libexec/knowledge-agent
        
        /usr/libexec/knowledge-agent
        5⤵
        
        PID:718
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.AddressBook.ContactsAccountsService
        5⤵
        
        PID:719
    - - /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
        
        /System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
        5⤵
        
        PID:719
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.secinitd
        5⤵
        
        PID:720
    - - /usr/libexec/secinitd
        
        /usr/libexec/secinitd
        5⤵
        
        PID:720
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.coreduetd
        5⤵
        
        PID:722
    - - /usr/libexec/coreduetd
        
        /usr/libexec/coreduetd
        5⤵
        
        PID:722
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.nsurlstoraged
        5⤵
        
        PID:723
    - - /usr/libexec/nsurlstoraged
        
        /usr/libexec/nsurlstoraged
        5⤵
        
        PID:723
    - - /usr/libexec/xpcproxy
        
        xpcproxy com.apple.siri.context.service
        5⤵
        
        PID:724
    - - /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
        
        /System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
        5⤵
        
        PID:724
    - - /bin/sh
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:725
    - - /bin/bash
        
        sh -c /usr/sbin/kextstat
        5⤵
        
        PID:725
    - - /usr/sbin/kextstat
        
        /usr/sbin/kextstat
        5⤵
        
        PID:725

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:606

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:608

/usr/bin/defaults
defaults read "/Volumes/Google Chrome/Google Chrome.app/Contents/Info" KSProductID
1⤵
PID:610

/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
ksadmin --ksadmin-version
1⤵
PID:613

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:616

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSBrandID
1⤵
PID:618

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CFBundleShortVersionString
1⤵
PID:629

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSVersion
1⤵
PID:631

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSUpdateURL
1⤵
PID:633

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" KSChannelID
1⤵
PID:635

/usr/bin/defaults
defaults read "/Applications/Google Chrome.app/Contents/Info" CrProductDirName
1⤵
PID:637

/usr/bin/defaults
defaults read "/Library/Google/Google Chrome Brand" KSBrandID
1⤵
PID:641

/bin/ps
ps -ewwo "comm="
1⤵
PID:653

/usr/bin/grep
grep -Fqx "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/"
1⤵
PID:655

/usr/bin/cut
cut -c 1-108
1⤵
PID:654

/usr/sbin/lsof
lsof "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/95.0.4638.69/Google Chrome Framework"
1⤵
PID:657

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Indicator Removal

T1070

File Deletion

T1070.004

Subvert Trust Controls

T1553

Gatekeeper Bypass

T1553.001

Credential Access

Discovery

File and Directory Discovery

T1083

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

com.apple.networkextension.uuidcache.plist

Path /Library/Preferences/com.apple.networkextension.uuidcache.plist
Size 42B
SHA256 9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1
MD5 ce7f5b3d4bfc7b4b0da6a06dccc515f2
SHA1 ce657a52a052a3aaf534ecfbf7cbdde4ee334c10
SHA512 db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb
MD5 SHA1 SHA512

Submit Download

settings.dat

Path /Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat
Size 40B
SHA256 5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6
MD5 fcb4024c6dc53a5b72c492fd960762d7
SHA1 82c43024d9e274bf2b8a5d1e505d65cf3873fb92
SHA512 5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b
MD5 SHA1 SHA512

Submit Download

934149fa-970a-4032-836a-1b8f11b6a413

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/934149fa-970a-4032-836a-1b8f11b6a413
Size 258KB
SHA256 8d21fe1bd251856bfaeaedd6a72ab78f153a047b6042e0fc614f57a32b56d340
MD5 5adf364735dcbe6bf26ebe3f705c9dbc
SHA1 a891521fea2f61a2fd16ea9f0a3fc3c2c5fb3a46
SHA512 5f77f8923ab3800ab754f4c60095077b529c5f5f230c6a0b6803dc28597f42ed682921267ed344e190d0f08e0a23eceace7bccbc9d22432029a3e6f4838420e0
SSDEEP 6144:771bE8xvMX08XghZNhvfhua/I4dMdYuw4/xCRxQkdE6oO:7p1xE3g3Nhvf39dMNxxyxGLO
TLSH
T12B4423A9480AFA919B0236F2BF61D07C234649142C9E2B9DDFE48F70E7FE715658F108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Unconfirmed 686563.crdownload

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/Unconfirmed 686563.crdownload
Size 201KB
SHA256 5ba5f2e7fb8b8bf5d0b38427ec33c277ac588c4e9fc60020f59949c381f6a93a
MD5 cf09b72e69443449ec8beec4a2817c6b
SHA1 0e5bcc3cfefea39b2e37e7e98ba65a1cbd0a2932
SHA512 7ce9639a7e9d561f974791891a0c26e85f7a0fca00e060a64cf2cbc4d29c54ec63ac6b6026b9a891a667583555cd5a3b60aad1f15d9367a29b2634f5313c90f9
SSDEEP 3072:7Kalx+YKNI4gF4mXx7FVMgduV7Y8NTJMJhyROMiROelt2WhzP63SfNnXXuaKuI4i:771bE8xvMX08XghZNhvfhua/I4dMdYA
TLSH
T1EF1423AC945EF9B19B0332F33F21C07C53465A242CDE96989BE4CF20E6ACB655A4F448
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

craw_background.js

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_1/craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb
Size 339B
SHA256 9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5
MD5 61a867b6e4a24cfcfd32ddef25ac3229
SHA1 87cc4516fbce1700174d8ea27c9d2cb70a60a1fd
SHA512 3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc
TLSH
T115E0C2FB0A4984C1E9519BBB2524371D7B25CA2AD9448BE38E48E2528A284616609468
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb
Size 569B
SHA256 b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e
MD5 b5db1f091948de93d7fc96e14aef6da3
SHA1 74745f991e3dfe45037366e55c2e6df47d8e6593
SHA512 d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34
TLSH
T157F020631A2BD8A6C868A8325C94270C23A78F0D47B8865B6231CA301D668113A148AA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
Size 269B
SHA256 241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172
MD5 6487e04972ecffd0aabf7b61bdda8119
SHA1 26f0b11a2529a35f6970a914deadfcf2e2d23286
SHA512 44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae
TLSH
T150D0231426B7C48FE44951B165C35F64736CF459F5154783561865E44F3F0043D44174
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Storage/ext/gfdkimpbcpahaombhbimeihdjnejgicl/def/Session Storage/000003.ldb
Size 141B
SHA256 085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8
MD5 38fc535a8f11d7e955ef58cc63158eff
SHA1 c45ad3ee106dbfb65dce7c09b53140f34454cd0e
SHA512 26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505
TLSH
T187C01210066B8863C417737106C417501310E8A40006471316C233600C740311F1045A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb
Size 136B
SHA256 935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132
MD5 fe382e791274914bee5950777e4f1fd3
SHA1 53b523b5fc87e66f2520a0b5f9ea080072668f4d
SHA512 a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67
TLSH
T156C012480B948CC3C9009736082443141301C920F72CDB434381B2A10D740CF5E00085
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb
Size 2KB
SHA256 18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8
MD5 e0f65ad85a40a32fa91e551005e193ce
SHA1 a145766d5df23ae5fcd23dbb6937606f280f3502
SHA512 bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425
TLSH
T1F44164D3BDFD4BB2ED447E70D12ADB5C1015C6BE00564E0FAAE5A53C9274DA104F6076
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb
Size 288B
SHA256 79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06
MD5 b47a44bdd1b765b6af56b347447fd1b7
SHA1 8599a1870656af91e432bb35e3497863e34ddfbb
SHA512 bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0
TLSH
T129D09520FB93C021D7C0137D4D301F4C170555D1D5067759D43FF5642C74001784D430
MD5 SHA1 SHA512 TLSH

Submit Download

model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/OptimizationGuidePredictionModels/ae53b0fa-91ca-4b54-ab19-ac66e0e273b8/model.tflite
Size 382KB
SHA256 a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534
MD5 6d7c2f9e94664539dec99b3233301b01
SHA1 85812b004742cc1c211c92911131ce270f8ba769
SHA512 4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33
SSDEEP 6144:4i8mNiZGi+jiwubrNEOB37+rNiyykvXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMl:WqEGi+GwGrNv9+r8bkvXpqQMLuNy5YmJ
TLSH
T10584C013460497BAD7FC237684C31D9E12A5F2625E73B86BF9363E464811B1BE62237C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.32.0/Ruleset Data
Size 138KB
SHA256 fed1557c8b4e40813114db3b546c043105892dd0895c4d7c02d45a8be351173a
MD5 132df2b999906be7b21cc21bc247b068
SHA1 0665be201a96e717410a4e61a263bb879b3f08d4
SHA512 6764c8a425cd010a67a4636f812d43e63bb0815943e9839cf9fa35f3e5f9ba52309ed842306dcffe32a72e7019cb0c28e1d402dfc22dca0603a0cd48d6a26451
SSDEEP 3072:nAwq4WU8BNptWsfvaWSzpjNSIy27mElP6vUGyA:nAw2fcFty27Js1
TLSH
T14FD373937718C4A2E391913A97CAC72145B2F7D9E487E6F779E2034F3C452B22F1468A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 e1cff0bbb1c36ee6e80b3a1b712f6ee1afaa8b8bfdd4f41393bda1ec767e67aa
MD5 8ae017650d234ed2869e7ad757d8d57a
SHA1 e5340e1bd14eda4799d8ac91d4db77aadffb5338
SHA512 8b8d22f333b6ebbd7fe745a0d3d6ab488b6153c9e0556e21f0ec6df64bc9c1c1656a295c7942157a11394b580316b92515f6db9ce8378d9802ecb14b7582dc79
SSDEEP 3072:kZr6c0dcwOyr8n7YVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmo:koplu/Qk
TLSH
T15FB372825BD5E975C05105BEF9B3A308B735D6AB97A363873391A483AD022E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 6f211ceee3db2a92ff93ecce7a7a6fde75997bb5cd2c99a9bcdb88b6e84536ef
MD5 cfe085d43279cd5d9375182132bb21d7
SHA1 e755cb05bd31898fd027ec6902694520ad9c4836
SHA512 f2a3391d268cf66d03e8c077b886af23c5c8f38251afafaf69fc262b18369d153d87949ebe201c4454be798d8f2989216c3abdff714c4a5217ba038b6618f61a
SSDEEP 3072:EZr6c0dcwOyr8n7YVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmn:Eoplu8
TLSH
T1A7B372825BD5E975C05105BEF9B3A308B335D6AB97A363873391A483AD122E00F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 e6d4c1cc04122aa38c119209ce1f2b65b1da8c31e116b572c27cd1ef05de1b81
MD5 9a9f80462497091bc8476c0a9fd117f3
SHA1 1f8d16299e375ef72730cc7a9d0e59d3b94a3ac3
SHA512 3f40e523ab8f172891ac420b565e68331bf45da38b973cbecb7d5a1f8b369cc946e7c54de617720692b71e208fb218a2976e94e1f18ff134f0b79a7faf545944
SSDEEP 3072:hZr6c0dcwOyr8n7ZVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmj:hoplf8
TLSH
T1DBB384825BD5E971C05205BEF9F3A308B335D6AB97A363872391A483AD122E40F757DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 f8f283dfba520273315d636359a23051cd8e1270076e8d44455c0b8156d32cfb
MD5 dbf1bf08dd610dc83591b7a9703b13a4
SHA1 8893ce3559419d57830a923c138c201f8a437157
SHA512 cb2a48d682ad4997f54d494fb6cd0d7b308eac22d72e798b8141fab6b3926f105fc81f88d2835a464dd9c4d38538e959ab12f2287476377a11351c1dd55af8f8
SSDEEP 3072:lZr6c0dcwOyr8n7MVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmd:loplCnQB
TLSH
T1EDB383825BD5ED71C05105BEF9B3A308B335D6AB976363876391A483AD122E00F79BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 b38eb08075dbf16b52f48faa35fe2c3c62aed327c457496797e61a7462657ed5
MD5 83b88d1b85442197365a29f0a7f9e652
SHA1 e16e69f1610616ae78de6473cfc59a72b354b7d1
SHA512 13b5cb742c8a2c50e765044f5018254c06568f08bdc7093469dab05550777a88cefece68baf3c61171ce1022dcf1ac320b52c72f7088e3f4b28097bd9f2d1596
SSDEEP 3072:+Zr6c0dcwOyr8n7MVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmE:+oplCL
TLSH
T1C7B382825BD5ED71C05105BEF9B3A308B335D6AB976363876391A483AD122E00F79BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 140a48cd6a7ede7fa586bc2c416a70a0764f0c631b6591ee6d563b070647aa6d
MD5 ffcebcc4bab98db5efd9528c2ced17d6
SHA1 028471271d4368693a057ca3f2a563f1d62716c7
SHA512 81fae7e27dd35a31818b73d59a844500cd7ea5970c725707ff6d88f880492ffc10818726b8859d5f057bf01634755a2567bf65cf0ddf62b4df44eff6e990ecd0
SSDEEP 3072:ZZr6c0dcwOyr8n7pVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXmV:Zopl/m
TLSH
T1CBB384865BD5E971C05105BEF9F3A308B335D6AB979363872390A483AD122E40F79BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

persona.kb

Path /private/var/db//keybags/persona.kb
Size 3KB
SHA256 7bf79ea45235626c1ea7fc4a818506f1f91f4b88a88e5d8793bbfcf356f8de1a
MD5 91c946bac1a8e19c1d326b32a54c7a5f
SHA1 74984c3f381f8038b787dd106cb59fdabfa6e6fb
SHA512 6366436ff51ed7ffb4b02195145468b7ce4f8fe6a1cd2b73726fff87090001e6b37c135953970bc6094fe80b6cbe8ca94c01fe8647e4e2acbe17095436f8ecad
TLSH
T1EC71BA442F83881BE54E0FF79AB9DE1896C508CBD0A4511582B28D47AF05EAC67A63FC
MD5 SHA1 SHA512 TLSH

Submit Download

persona.kb

Path /private/var/db//keybags/persona.kb
Size 3KB
SHA256 300d3a4d25e1af9fab5fe0f89f14ecaf4671d4786accaf5d5a564a2b98f2ed2c
MD5 49665526c75515b700958e46d4c7daa9
SHA1 945fe38df32596b474cfcdbc1b27ea580db8654a
SHA512 1a7f54a6ab5cf054116e04f006af62fa1d64119c5693f3c8482ea479da072ce54e7c83be80a7563b9141367bfae80298c51d70111edbbcf64272db34be3b35de
TLSH
T1F971CB042F838807E80E0FF75BB9DE1896C404CB80A8521586B28D87DB45EAC67B63EC
MD5 SHA1 SHA512 TLSH

Submit Download

persona.kb

Path /private/var/db//keybags/persona.kb
Size 3KB
SHA256 33b64fc31b7e6b10f0eb207002068e2b62a2c43761e8afe6d8216c8536a7f9fb
MD5 d21c0d3083c05739ba5e69d020c34970
SHA1 885ced133248d69e7a97859c551390103e355fd0
SHA512 98d5dddb028f5c685a232e962c9bb8fe9deb4cd6494488b5ddae285970b51c4e6b2ac1836c1ceae46021eed925ba01681e62d9d8d36006e1613c33deb1eb0cb5
TLSH
T11171DC442F83890BD54E0FFB9A79DE1896C508CBD0A4511582B28D87AF05EAC67A63FC
MD5 SHA1 SHA512 TLSH

Submit Download

tailspin-trace.2026-10-14_20-00-05.tailspin

Path /private/var/db/spindump/tailspin-trace.2026-10-14_20-00-05.tailspin
Size 15.0MB
SHA256 78fd7224e4058642cac96c71d9291501092fb9431c0588fe811cea2c094d7606
MD5 c3e5912f3e2303dcac200c49d4804ab1
SHA1 68c9badf4ce81e8224226c10263138a51293b8e4
SHA512 e93391862f3367dabef654a66bd3a2534c9955839464fd80cfcbc77d7bea1fe17599642b6d66fdf2dca2791fe6a1a5f45de0f9d1c9915b0f46e84f8797d373e4
SSDEEP 98304:82UlvuhSLEBjXx63Nu4kfobtUYRu5VlWO03dHFGD80VWumZbZQSUHr1QtZI/LJJ5:1kLERYVqlYRu5VlWfGdWtcuwVJEocV2
TLSH
T1FBF69DF26D0478D4ECD0CDB7899298010FA236F4CC6251FFAB9A69C5526AF074F3A395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

icon_128.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirkVsqLK/CRX_INSTALL/images/icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efniojlnjndmcbiieegkicadnoecjjef_1803_all_kls57d3etypk3vcvbarzzo7zpq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.9nkGme/efniojlnjndmcbiieegkicadnoecjjef_1803_all_kls57d3etypk3vcvbarzzo7zpq.crx3
Size 427KB
SHA256 f1b02742fbcbd7f0b5be8a96058f17067ada885b04325b60fa225d4508d679e3
MD5 e195be7f71dcba58aa1e6b4eca696215
SHA1 0732d8b2c0ca365ef5efde742c94accb309669b4
SHA512 ec801fdc9242d768ff871999e1044f30f81fd6d56a4606536928d93391dde78d7f045abfe1ca4a9de2b3c12101d3333f61ed8ee51a1bbc7047c2cab68cb7288f
SSDEEP 6144:d/dxJ26uUvVc2cc66oXpFTy3CXtw6xrWtefZBSy7EwNZbgWy56kGFUT+Ssp1vH3J:P26TdApQCXt9BX7EmRbD0w
TLSH
T1D9949FAB2F247843AFC3DD7471C8E53BBDB172D179EA54969149C0B1A9823D13E8902F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_ENGB500000_lof45en2yrc2tvvdfc42hhgnkq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.ELu9i7/obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_ENGB500000_lof45en2yrc2tvvdfc42hhgnkq.crx3
Size 7.6MB
SHA256 95ff39d8ef1186d8b10dd3a57c6a4a426732b5fca36bdea4670fc4eb0f0b04b5
MD5 f33b5f649851bfaa5e3a9f813b586b1e
SHA1 d6b346fc53489779f07ce1a220e38d62a89b89dd
SHA512 940cf34538cf387663ecd8124e370dc5c95504bea41247ac0766088288c68ce53489a20ee7182a03dc99e5559e034f3a005b73c35f6dde6f3a9e5151112ab1ca
SSDEEP 98304:WBMCyPEP6vKwEHDrIq34e0zBNMv4XCq1Mbrp9hsvwxId1C+c:WpyPxCTIFNy4SV8YxG1S
TLSH
T18E86DF2DB774101B0DB61319D4471753A76A80D9C3844B5C91E8EEAA36926CF82FFAFC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.com.google.Chrome.LK0VgP

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.LK0VgP
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmelglejhemejginpboagddgdfbepgmp_759_all_ZZ_jhhaup62kw2yzwlrotzljwjwmi.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.SsvyTb/lmelglejhemejginpboagddgdfbepgmp_759_all_ZZ_jhhaup62kw2yzwlrotzljwjwmi.crx3
Size 562KB
SHA256 3f1dd991776c11845f769ee321269cb7b3ec6b582afdee14ab703f2a3f36a89c
MD5 4631535aaa8bc2ec29178498f5d08bf4
SHA1 b853d1f547bb78357dccdfef97d208fef4481f5a
SHA512 4b613aff55d85696f2d6779c83e5954ebfa349bb8516f955cb10164f8ff36aa6892d453667faa7c14c9448881cd530727a64739f5aace9a9c64f4c1c0da85140
SSDEEP 12288:lM5JoJPJfFi2uNvGWAqQhw+Ynl9vumc5igDUnqZMl9:6CJVFi2FRhwt9Mi2GqZMl9
TLSH
T14FC422FF560C40F39FA99B70B9FB7B2D942B359CE4818CC5D9C5030AA6464FA231B265
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

khaoiebndkojlmppeemjhbpbandiljpe_145.0.7584.0_mac_adijmuudraws5pmse4bp2wpjlfpq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.TDXtq8/khaoiebndkojlmppeemjhbpbandiljpe_145.0.7584.0_mac_adijmuudraws5pmse4bp2wpjlfpq.crx3
Size 11KB
SHA256 9f157bd09a986baa46110a0acb7e3d7407208e58d02250c637902962e5ed2c5e
MD5 c2425a80ea4d5f90463e346b50f9d7d3
SHA1 64831f252de87d662b290493e98ec9d917449e91
SHA512 b934b3071adb98db083ff5ef06b239465f075c43a1b33467cc97ea09d7138cbee016fa44d9e8b4ecb89eced44b91a14faf07bf2ef3754b926f014dc03678b510
SSDEEP 192:YM6V27mUXs0aEW8SsWk/pvtHB3Nf5Y10k6QKEa4pmi1XP44PZexJFV3faUUGOuX:kVf0aEW8SsWk/pvtHB3Nf5YKk6QKEa4q
TLSH
T149320E95883A16E9AC3183A5F1B9C2218D21EE2B941F548E1BF353CB7BC1D868F37157
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fsck_hfs.log

Path /var/log/fsck_hfs.log
Size 15KB
SHA256 a87fa73217caae80b82efa6fe452625de3648cfe4107a4ddea519f5f73ab0d58
MD5 6cebf6f128cda767e9c010b55f79778b
SHA1 7e1157fc6e063ec4c13244d2d995707724d9951d
SHA512 dbde9e6e9cd54bd6daad636c54663166639c8aaac79b3aa3564f63fc52669d7f621badb4c913e829f942ecfbc69ea59bb41cada16811a50b21a0569109a2ac83
SSDEEP 96:iAgQ8J+kny9DFE/4lrmwFmDWnUu4fp1f4flXAnAiPcv+cr9XsdOktYZgIvUnoH0o:5gBnZ3R1SpidI7
TLSH
T1D57235849101E71DBA8F11DCD373AA8971CFAD8AC373D76B38A934D8720C82A57769C0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Resubmissions

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads