hxxps://guest-desk[.]rest/812815014

Analysis

max time kernel
149s
max time network
148s
platform
macos-10.15_amd64
resource
macos-20260915-de
resource tags

arch:amd64arch:i386image:macos-20260915-dekernel:19b77alocale:de-deos:macos-10.15-amd64system
submitted
10/11/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://guest-desk.rest/812815014
Sample261110-wsh6sshf58

Score

4^/10

defense_evasion

Malware Config

Signatures

Resource Forking 1 TTPs 10 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

defense_evasion

Resource Forking

T1564.009

ioc	Process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer	LWWeeklyMessageTracer
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"	ksinstall
/usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist	tar
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd	com.apple.speech.speechsynthesisd
/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd	tccd
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck	Java Updater
/Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded	GoogleSoftwareUpdateAgent
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd	hdiejectd
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 60836B62-E2E3-4645-9E9D-23EE1AC7D248	diskimages-helper
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 60836B62-E2E3-4645-9E9D-23EE1AC7D248 -post-exec 4	diskimages-helper

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
1⤵
PID:456

/usr/libexec/gkreport
/usr/libexec/gkreport
1⤵
PID:455

/bin/sh
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'https://guest-desk.rest/812815014'"
1⤵
PID:457

/bin/bash
sh -c "/Applications/Google\\ Chrome.app/Contents/MacOS/Google\\ Chrome --simulate-outdated-no-au='Tue, 31 Dec 2099' --new-window 'https://guest-desk.rest/812815014'"
1⤵
PID:457

/usr/libexec/xpcproxy
xpcproxy com.apple.systemstats.daily
1⤵
PID:459

/usr/libexec/xpcproxy
xpcproxy com.oracle.java.Java-Updater
1⤵
PID:461

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:449

/usr/libexec/pkreporter
/usr/libexec/pkreporter
1⤵
PID:453

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
- Resource Forking
PID:456

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:447

/Applications/Google Chrome.app/Contents/MacOS/Google Chrome
"/Applications/Google Chrome.app/Contents/MacOS/Google Chrome" "--simulate-outdated-no-au=Tue, 31 Dec 2099" --new-window https://guest-desk.rest/812815014
1⤵
PID:457
- /usr/bin/profiles
  /usr/bin/profiles status -type enrollment
  2⤵
  PID:490
- /usr/sbin/system_profiler
  /usr/sbin/system_profiler SPConfigurationProfileDataType -detailLevel mini -timeout 15 -xml
  2⤵
  PID:492
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Helpers/ksinstall" "--install=/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz"
  2⤵
  - Resource Forking
  PID:494
- - /usr/bin/tar
    /usr/bin/tar -Oxjf "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Frameworks/KeystoneRegistration.framework/Resources/Keystone.tbz" GoogleSoftwareUpdate.bundle/Contents/Info.plist
    3⤵
    - Resource Forking
    PID:496
- - /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent
    /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Resources/GoogleSoftwareUpdateAgent.app/Contents/MacOS/GoogleSoftwareUpdateAgent -runMode ifneeded
    3⤵
    - Resource Forking
    PID:499
  - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all --system
      4⤵
      PID:500
    - - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake --system
        5⤵
        
        PID:504
      - /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher
        
        "/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/Helpers/launcher" --internal
        6⤵
        
        PID:507
        
        /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
        
        GoogleUpdater --server "--service=update-internal" --system
        7⤵
        
        PID:0
  - - /Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
      "/Users/run/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --wake-all
      4⤵
      PID:501
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/developer_id_certificate_reauthorize" com.google.Chrome
  2⤵
  PID:495
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (GPU).app/Contents/MacOS/Google Chrome Helper (GPU)" "--type=gpu-process" "--gpu-preferences=UAAAAAAAAAAgAAAAAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAJgEAAAAAAAAmAQAAAAAAACIAQAAMAAAAIABAAAAAAAAiAEAAAAAAACQAQAAAAAAAJgBAAAAAAAAoAEAAAAAAACoAQAAAAAAALABAAAAAAAAuAEAAAAAAADAAQAAAAAAAMgBAAAAAAAA0AEAAAAAAADYAQAAAAAAAOABAAAAAAAA6AEAAAAAAADwAQAAAAAAAPgBAAAAAAAAAAIAAAAAAAAIAgAAAAAAABACAAAAAAAAGAIAAAAAAAAgAgAAAAAAACgCAAAAAAAAMAIAAAAAAAA4AgAAAAAAAEACAAAAAAAASAIAAAAAAABQAgAAAAAAAFgCAAAAAAAAYAIAAAAAAABoAgAAAAAAAHACAAAAAAAAeAIAAAAAAACAAgAAAAAAAIgCAAAAAAAAkAIAAAAAAACYAgAAAAAAAKACAAAAAAAAqAIAAAAAAACwAgAAAAAAALgCAAAAAAAAwAIAAAAAAADIAgAAAAAAANACAAAAAAAA2AIAAAAAAADgAgAAAAAAAOgCAAAAAAAA8AIAAAAAAAD4AgAAAAAAABAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAAAAAAAAHAAAAEAAAAAAAAAAAAAAACAAAABAAAAAAAAAAAAAAAAkAAAAQAAAAAAAAAAAAAAALAAAAEAAAAAAAAAAAAAAADAAAABAAAAAAAAAAAAAAAA4AAAAQAAAAAAAAAAAAAAAPAAAAEAAAAAAAAAABAAAAAAAAABAAAAAAAAAAAQAAAAcAAAAQAAAAAAAAAAEAAAAIAAAAEAAAAAAAAAABAAAACQAAABAAAAAAAAAAAQAAAAsAAAAQAAAAAAAAAAEAAAAMAAAAEAAAAAAAAAABAAAADgAAABAAAAAAAAAAAQAAAA8AAAAQAAAAAAAAAAQAAAAAAAAAEAAAAAAAAAAEAAAABwAAABAAAAAAAAAABAAAAAgAAAAQAAAAAAAAAAQAAAAJAAAAEAAAAAAAAAAEAAAACwAAABAAAAAAAAAABAAAAAwAAAAQAAAAAAAAAAQAAAAOAAAAEAAAAAAAAAAEAAAADwAAABAAAAAAAAAABwAAAAAAAAAQAAAAAAAAAAcAAAAHAAAAEAAAAAAAAAAHAAAACAAAABAAAAAAAAAABwAAAAkAAAAQAAAAAAAAAAcAAAALAAAAEAAAAAAAAAAHAAAADAAAABAAAAAAAAAABwAAAA4AAAAQAAAAAAAAAAcAAAAPAAAAEAAAAAAAAAAIAAAAAAAAABAAAAAAAAAACAAAAAcAAAAQAAAAAAAAAAgAAAAIAAAAEAAAAAAAAAAIAAAACQAAABAAAAAAAAAACAAAAAsAAAAQAAAAAAAAAAgAAAAMAAAAEAAAAAAAAAAIAAAADgAAABAAAAAAAAAACAAAAA8AAAAQAAAAAAAAAAoAAAAAAAAAEAAAAAAAAAAKAAAABwAAABAAAAAAAAAACgAAAAgAAAAQAAAAAAAAAAoAAAAJAAAAEAAAAAAAAAAKAAAACwAAABAAAAAAAAAACgAAAAwAAAAQAAAAAAAAAAoAAAAOAAAAEAAAAAAAAAAKAAAADwAAAAgAAAAAAAAACAAAAAAAAAA=" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=26"
  2⤵
  PID:518
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=network.mojom.NetworkService" "--lang=de" "--service-sandbox-type=network" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=26"
  2⤵
  PID:519
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=storage.mojom.StorageService" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=26"
  2⤵
  PID:520
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Alerts).app/Contents/MacOS/Google Chrome Helper (Alerts)" "--type=utility" "--utility-sub-type=mac_notifications.mojom.MacNotificationProvider" "--lang=de" "--service-sandbox-type=none" --message-loop-type-ui --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072"
  2⤵
  PID:521
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=7" "--launch-time-ticks=286764670" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=68"
  2⤵
  PID:522
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=6" "--launch-time-ticks=286832123" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=68"
  2⤵
  PID:523
- /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
  /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin --productid com.google.Chrome --print-tickets --store /Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
  2⤵
  PID:524
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=8" "--launch-time-ticks=288888165" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=80"
  2⤵
  PID:526
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=12" "--launch-time-ticks=289329334" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=84"
  2⤵
  PID:527
- /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin
  /Library/Google/GoogleSoftwareUpdate/GoogleSoftwareUpdate.bundle/Contents/Helpers/ksadmin -P com.google.Chrome --delete --store /Users/run/Library/Google/GoogleSoftwareUpdate/TicketStore/Keystone.ticketstore
  2⤵
  PID:528
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=10" "--launch-time-ticks=289765406" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=78"
  2⤵
  PID:529
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=11" "--launch-time-ticks=290281565" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=85"
  2⤵
  PID:530
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=de" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=93"
  2⤵
  PID:531
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=de" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=102"
  2⤵
  PID:532
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=107"
  2⤵
  PID:533
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=de" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=61"
  2⤵
  PID:534
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=107"
  2⤵
  PID:535
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=de" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=61"
  2⤵
  PID:536
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=19" "--launch-time-ticks=296136897" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=107"
  2⤵
  PID:539
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --extension-process --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=21" "--launch-time-ticks=296271133" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=118"
  2⤵
  PID:540
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=22" "--launch-time-ticks=299354723" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=78"
  2⤵
  PID:541
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper (Renderer).app/Contents/MacOS/Google Chrome Helper (Renderer)" "--type=renderer" --display-capture-permissions-policy-allowed "--lang=de" "--num-raster-threads=1" --enable-zero-copy --enable-gpu-memory-buffer-compositor-resources "--renderer-client-id=23" "--launch-time-ticks=299894216" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=124"
  2⤵
  PID:542
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=136"
  2⤵
  PID:545
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=data_decoder.mojom.DataDecoderService" "--lang=de" "--service-sandbox-type=service" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=137"
  2⤵
  PID:564
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=137"
  2⤵
  PID:565
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=137"
  2⤵
  PID:568
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=138"
  2⤵
  PID:570
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=138"
  2⤵
  PID:571
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=138"
  2⤵
  PID:572
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=138"
  2⤵
  PID:573
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=138"
  2⤵
  PID:574
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=139"
  2⤵
  PID:575
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=139"
  2⤵
  PID:576
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=139"
  2⤵
  PID:577
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=139"
  2⤵
  PID:578
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=102"
  2⤵
  PID:579
- /Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper
  "/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/Google Chrome Helper.app/Contents/MacOS/Google Chrome Helper" "--type=utility" "--utility-sub-type=unzip.mojom.Unzipper" "--lang=de" "--service-sandbox-type=utility" --shared-files "--field-trial-handle=1718379636,r,8838347142964439282,3346460863478524253,131072" "--seatbelt-client=102"
  2⤵
  PID:584

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
- Resource Forking
PID:461

/usr/libexec/xpcproxy
xpcproxy com.apple.GameController.gamecontrollerd
1⤵
PID:486

/usr/libexec/gamecontrollerd
/usr/libexec/gamecontrollerd
1⤵
PID:486

/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler
"/Applications/Google Chrome.app/Contents/Frameworks/Google Chrome Framework.framework/Versions/101.0.4951.54/Helpers/chrome_crashpad_handler" "--monitor-self-annotation=ptype=crashpad-handler" "--database=/Users/run/Library/Application Support/Google/Chrome/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=channel=" "--annotation=plat=OS X" "--annotation=prod=Chrome_Mac" "--annotation=ver=101.0.4951.54" "--handshake-fd=9"
1⤵
PID:488

/usr/libexec/xpcproxy
xpcproxy com.apple.sandboxd
1⤵
PID:498

/usr/libexec/sandboxd
/usr/libexec/sandboxd
1⤵
PID:498

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
1⤵
PID:0

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=4"
1⤵
PID:0

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
1⤵
PID:1.8446744073709552e+19

/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher
"/Library/Application Support/Google/GoogleUpdater/Current/GoogleUpdater.app/Contents/Helpers/launcher"
1⤵
PID:513
- /Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
  GoogleUpdater --server "--service=update" --system
  2⤵
  PID:0

/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater
"/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/GoogleUpdater.app/Contents/MacOS/GoogleUpdater" --crash-handler --system "--database=/Library/Application Support/Google/GoogleUpdater/128.0.6597.0/Crashpad" "--url=https://clients2.google.com/cr/report" "--annotation=prod=Update4" "--annotation=ver=128.0.6597.0" "--handshake-fd=5"
1⤵
PID:1.8446744073709552e+19

/usr/bin/profiles
/usr/bin/profiles status -type enrollment
1⤵
PID:517

/usr/libexec/xpcproxy
xpcproxy com.apple.SafariLaunchAgent
1⤵
PID:525

/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
/Library/Apple/System/Library/CoreServices/SafariSupport.bundle/Contents/MacOS/SafariLaunchAgent
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.speech.speechsynthesisd
1⤵
PID:543

/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd
/System/Library/Frameworks/ApplicationServices.framework/Frameworks/SpeechSynthesis.framework/Resources/com.apple.speech.speechsynthesisd
1⤵
- Resource Forking
PID:543

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:552

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged --privileged
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.mobile.keybagd
1⤵
PID:562

/usr/libexec/keybagd
/usr/libexec/keybagd -t 15
1⤵
PID:562

/usr/libexec/xpcproxy
xpcproxy com.apple.ViewBridgeAuxiliary
1⤵
PID:569

/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
/System/Library/PrivateFrameworks/ViewBridge.framework/Versions/A/XPCServices/ViewBridgeAuxiliary.xpc/Contents/MacOS/ViewBridgeAuxiliary
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.tccd
1⤵
PID:588

/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
/System/Library/PrivateFrameworks/TCC.framework/Resources/tccd
1⤵
- Resource Forking
PID:588

/usr/libexec/xpcproxy
xpcproxy com.apple.sandboxd
1⤵
PID:589

/usr/libexec/sandboxd
/usr/libexec/sandboxd
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.bird
1⤵
PID:590

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:591

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:592

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:593

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:595

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:596

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy com.apple.secd
1⤵
PID:599

/usr/libexec/secd
/usr/libexec/secd
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:600

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:601

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:601

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:602

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.coreduetd
1⤵
PID:603

/usr/libexec/coreduetd
/usr/libexec/coreduetd
1⤵
PID:603

/usr/bin/hdiutil
/usr/bin/hdiutil attach /var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/.com.google.Chrome.ABCM8t/GoogleChrome-128.0.6613.138.dmg -plist -nobrowse -readonly
1⤵
PID:605
- /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
  /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 60836B62-E2E3-4645-9E9D-23EE1AC7D248
  2⤵
  - Resource Forking
  PID:607
- - /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper
    /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper -uuid 60836B62-E2E3-4645-9E9D-23EE1AC7D248 -post-exec 4
    3⤵
    - Resource Forking
    PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.hdiejectd
1⤵
PID:606

/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
/System/Library/PrivateFrameworks/DiskImages.framework/Resources/hdiejectd
1⤵
- Resource Forking
PID:606

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

visual_model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/ClientSidePhishing/29.0/visual_model.tflite
Size 3.0MB
SHA256 d38a4cda8912f9598b8701dac7d5ee90eff324ed1fb9d277b9784fe45a4e6c72
MD5 a9803d560544e4d1fe551b2c113c5370
SHA1 a998fdb1e80dbca61267db112812a7ee34b82dce
SHA512 65b8b6ecfea2aeae95a39581c39476a54721e07ee7c296650ccddea29a09b29a11cab15fdc89f97295bd61423dc13a66666faca371200bcb459dc1f25b6c89fd
SSDEEP 98304:0FkQ8+nTgV11233hz/v/U2P6tObWAOz+O2la+Ao:T+nMV112lU6b9O2rAo
TLSH
T1CEE502A5B811F1C2CA19C6729B56FF6F48317C265F05D027320DBB4D48B22EB8F4A6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path /Users/run/Library/Application Support/Google/Chrome/Crashpad/settings.dat
Size 40B
SHA256 5cca682cfa80faa97838327d83ef5a2cc39e21b0cf16639aa7c4f095bf1be4e6
MD5 fcb4024c6dc53a5b72c492fd960762d7
SHA1 82c43024d9e274bf2b8a5d1e505d65cf3873fb92
SHA512 5373007f40ec378d18770218163ffc2870036bf8c0af1128194a60c6ed6d944f2e3833bf151fb5bf4aee9325c1fbab56bacf3f6437daaa59efb0afdc5c5eed8b
MD5 SHA1 SHA512

Submit Download

ed11c95b-484c-4875-8858-dda5921ef1db

Path /Users/run/Library/Application Support/Google/Chrome/Default/Download Service/Files/ed11c95b-484c-4875-8858-dda5921ef1db
Size 258KB
SHA256 8d21fe1bd251856bfaeaedd6a72ab78f153a047b6042e0fc614f57a32b56d340
MD5 5adf364735dcbe6bf26ebe3f705c9dbc
SHA1 a891521fea2f61a2fd16ea9f0a3fc3c2c5fb3a46
SHA512 5f77f8923ab3800ab754f4c60095077b529c5f5f230c6a0b6803dc28597f42ed682921267ed344e190d0f08e0a23eceace7bccbc9d22432029a3e6f4838420e0
SSDEEP 6144:771bE8xvMX08XghZNhvfhua/I4dMdYuw4/xCRxQkdE6oO:7p1xE3g3Nhvf39dMNxxyxGLO
TLSH
T12B4423A9480AFA919B0236F2BF61D07C234649142C9E2B9DDFE48F70E7FE715658F108
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extension Scripts/MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

craw_background.js

Path /Users/run/Library/Application Support/Google/Chrome/Default/Extensions/nmmhkkegccagdldgiimedpiccmgmieda/1.0.0.6_1/craw_background.js
Size 531KB
SHA256 04cd9494b0ed83924dad12202630b20d053d9e2819c8e826a386c814cc0a1697
MD5 6eebed29e6a6301e92a9b8b347807f5f
SHA1 65dfb69b650560551110b33dcba50b25e5b876de
SHA512 fede6db31f2ad242e7bc7b52a8859ba7f466a0b920a8dadcb32dcfb5b2a2742e98b767ff22e0c5bc5c11fec021240aa9e458486c9039eb4ebe5cf6af7be97bf2
SSDEEP 6144:abyfBNC2FRdjiRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOEzZQ+h72W3GB0n:Ft/g
TLSH
T1B5C4F74C34C2E8CD6A623DA5247B9085A2319266F4479ED9F0EDECF21AF44641937F3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Local Storage/leveldb/000003.ldb
Size 339B
SHA256 9cc80c0d1dfe7205c6530402c3240171966e72b6df8ef0e8571660fb18652cd5
MD5 61a867b6e4a24cfcfd32ddef25ac3229
SHA1 87cc4516fbce1700174d8ea27c9d2cb70a60a1fd
SHA512 3678cc5f913c7f6c179be8d8483240a1c9aabbe5b295d6aa2b8037c60a8f2aa473f1fb56a7ee7093aaa8c24b968d32fed99972f6f837868f86b53b45de13f4dc
TLSH
T115E0C2FB0A4984C1E9519BBB2524371D7B25CA2AD9448BE38E48E2528A284616609468
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Session Storage/000003.ldb
Size 569B
SHA256 b7600cfe0aa091e9ab8540869b7ea120a62b36240acc0370c3fd62655b58bf4e
MD5 b5db1f091948de93d7fc96e14aef6da3
SHA1 74745f991e3dfe45037366e55c2e6df47d8e6593
SHA512 d116ffaa01fa29545758fbe273c10d57879a91983d6b5a86ed410a0ac79cc8370fd2552284afa56f363a75ba6a89cc5c9a33f99071012dba2f2f8298ad0cac34
TLSH
T157F020631A2BD8A6C868A8325C94270C23A78F0D47B8865B6231CA301D668113A148AA
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Site Characteristics Database/000003.ldb
Size 269B
SHA256 241a349a63252a8026016a5ef0d713fc18f76735dd0c10963f9a693bfdb9b172
MD5 6487e04972ecffd0aabf7b61bdda8119
SHA1 26f0b11a2529a35f6970a914deadfcf2e2d23286
SHA512 44db500fa4549808a5ed1db5516fe4d412cc4e3898d102399fa6f467a2ed3fa79f133a0afcc5e1ab91f480267027ea11e48e37247d24513542286310ab2d47ae
TLSH
T150D0231426B7C48FE44951B165C35F64736CF459F5154783561865E44F3F0043D44174
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Storage/ext/gfdkimpbcpahaombhbimeihdjnejgicl/def/Session Storage/000003.ldb
Size 141B
SHA256 085c44dfa11e65ac3548c4d0fe1ae641570f90c7caaa2881c3990efcf555e6a8
MD5 38fc535a8f11d7e955ef58cc63158eff
SHA1 c45ad3ee106dbfb65dce7c09b53140f34454cd0e
SHA512 26e70000f77c1b6388dd470f9d7ec6bedc4fc3c43e48efcc853812eb076108bcdd9f50f7a89265e431d33df96e71755ca242dfd0aac16a51d99dea50a5a1e505
TLSH
T187C01210066B8863C417737106C417501310E8A40006471316C233600C740311F1045A
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/Sync Data/LevelDB/000003.ldb
Size 136B
SHA256 935d36c021d0e08a5648c622f3f6fde376e3310013680ae598c0e22dc943d132
MD5 fe382e791274914bee5950777e4f1fd3
SHA1 53b523b5fc87e66f2520a0b5f9ea080072668f4d
SHA512 a5f608fb4f0a1dbc4c5d1b739b1a5b6f50cac1d6a61312b19abf9f601882a291d73524ac55bbe183e4e64db8dcc203d4bf3cedc734fd04bd448cb825d98d1e67
TLSH
T156C012480B948CC3C9009736082443141301C920F72CDB434381B2A10D740CF5E00085
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/000003.ldb
Size 2KB
SHA256 18b5270537241fdd8a8de2f4435bb9a19acc82d565bf629678c07360e0fa89d8
MD5 e0f65ad85a40a32fa91e551005e193ce
SHA1 a145766d5df23ae5fcd23dbb6937606f280f3502
SHA512 bfcf2075ba3d99c6bf4840d6c7754668ac65e7b88aced5c727f99de68940783424b6e9755b4d90c28f489f87d88eda0f2b5194c292c7bcd0cebcb6a66adb2425
TLSH
T1F44164D3BDFD4BB2ED447E70D12ADB5C1015C6BE00564E0FAAE5A53C9274DA104F6076
MD5 SHA1 SHA512 TLSH

Submit Download

000003.ldb

Path /Users/run/Library/Application Support/Google/Chrome/Default/shared_proto_db/metadata/000003.ldb
Size 288B
SHA256 79b1150f1008ed3fbde59417e9727bce33a34ee2ac5b407eec1a82beabdd2c06
MD5 b47a44bdd1b765b6af56b347447fd1b7
SHA1 8599a1870656af91e432bb35e3497863e34ddfbb
SHA512 bfa1d967125878a40068e4d5ec4a4bed4f211373ef2ca839a51cb9a29d2da5afcc65755134af2ae732dc03391a636fbb222b4ae481315e4213ceb8d74797c9f0
TLSH
T129D09520FB93C021D7C0137D4D301F4C170555D1D5067759D43FF5642C74001784D430
MD5 SHA1 SHA512 TLSH

Submit Download

model.tflite

Path /Users/run/Library/Application Support/Google/Chrome/OptimizationGuidePredictionModels/f2e8a7cc-4628-49c6-96ce-353d068d93dd/model.tflite
Size 382KB
SHA256 a0956386dc64fd9f4883c8741f950cd60a56859616b159c9e4251c9eb0ac5534
MD5 6d7c2f9e94664539dec99b3233301b01
SHA1 85812b004742cc1c211c92911131ce270f8ba769
SHA512 4d06917f30651c3bf13c509aae79793b3f1ec93de12179464b18fd9fd16c7bf466884b1c70e425d7e937adde341cf24bd08f19a132bbb9683e804f29b4ed0c33
SSDEEP 6144:4i8mNiZGi+jiwubrNEOB37+rNiyykvXpqQC7SaPGNFzq/RnfAmn+qGk07U0z9zMl:WqEGi+GwGrNv9+r8bkvXpqQMLuNy5YmJ
TLSH
T10584C013460497BAD7FC237684C31D9E12A5F2625E73B86BF9363E464811B1BE62237C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.32.0/Ruleset Data
Size 138KB
SHA256 fed1557c8b4e40813114db3b546c043105892dd0895c4d7c02d45a8be351173a
MD5 132df2b999906be7b21cc21bc247b068
SHA1 0665be201a96e717410a4e61a263bb879b3f08d4
SHA512 6764c8a425cd010a67a4636f812d43e63bb0815943e9839cf9fa35f3e5f9ba52309ed842306dcffe32a72e7019cb0c28e1d402dfc22dca0603a0cd48d6a26451
SSDEEP 3072:nAwq4WU8BNptWsfvaWSzpjNSIy27mElP6vUGyA:nAw2fcFty27Js1
TLSH
T14FD373937718C4A2E391913A97CAC72145B2F7D9E487E6F779E2034F3C452B22F1468A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Ruleset Data

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Indexed Rules/35/9.73.1/Ruleset Data
Size 244KB
SHA256 0ce3a1482a32a3de6ced5f491df6a5f463536af6ffc8baa10b160426d98bd299
MD5 4265ef8da5232c0cf9bd783ff5fb2a45
SHA1 f10586d333514ad3d369cf435a6c9588010d82a8
SHA512 061d6c8adc20c8ba89427f46925dcf9a9c34f2c60b48fbe005f7aaf6cc258b3ef0215f4d2e173f014f47c391f325f7d1c6d534cbddeb73f6d1625f52ad1fa6a1
SSDEEP 3072:PiH5llLmWjITRo4Np/RivXcMGE5wIkEuCxi9y2HSbgblpgTnXyDNHVcQmjb9baQi:6H57jmD/RMK3y6e83TMXTPS
TLSH
T1F034C452631CD511FBE1023B04E6CB226720F7E26A82E6EE79A4534F3D4D6B72F1426D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Filtering Rules

Path /Users/run/Library/Application Support/Google/Chrome/Subresource Filter/Unindexed Rules/9.73.1/Filtering Rules
Size 154KB
SHA256 c0e0c30df5033d057165dc68ed0b87c334fd847da38b1591edc562bf68fbc7e5
MD5 e8f74a35cc4d127b88c322aebee04831
SHA1 cf38ebe7535b7036c3b97cc346636ad8db4d20ef
SHA512 d743ebfa8d3fa7cc8734be4f2414eb5dfe48ed0c65c64f628166385c48ec3934eac665b8453d0a1adf745169fa8d0ca7b9204d9d32efa756cc179e47fdaa1de9
SSDEEP 3072:Znb7WrcdZNVlVuq4nUjD7/LDjtQVu3/gpbfBORAnsD/gFYUsIAWPHL5P8h:pWxzCvmVIc3qh
TLSH
T14EF34E176219F0F10EB60A3E148AAD9556B032E543D7FDE18A19C34DB1F468FB2983F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 855434e52a48001caef8ebade4116d4987ee51ef9fbd45386c0f7d8b27460aa9
MD5 ad190d0ea75e9055a580ed36ebbe697e
SHA1 54dab64f4d842dfcede05a8a6b1db505787c1730
SHA512 c8f844a64e91c7c7a7fb246438951d7b2c2e28e4ea422d0fe8415a6af51f6de43bcb56fad86842e1004cf4b0032ce71a03e1789122e8aee379331df2707d0795
SSDEEP 3072:kZr6c0dcBHyr8UEFYVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXp:kop1ihJQk
TLSH
T168B383825BD5ED75C05105BEF9A3A308B335D6AB97A363873391A483AC122E40F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 cfc6083e0f69cdf28297a504d31dcc6a11511961afcf4c33b76f0470266fd8e7
MD5 62016acc0af614c1ba751643fc6ae8a7
SHA1 ac5d79f487c89115c764911d37ccb099fe9f30bc
SHA512 e6258460246b2a70b6f27f8163f7f1e189e70ef532bf8ce2b3fb40539d25ad8ed372946e002405b6d61ab6788bda6c209c0643d7384ae9874dce65ad2b170672
SSDEEP 3072:EZr6c0dcBHyr8UEFYVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXO:Eop1ihy
TLSH
T1E6B383825BD5ED75C05105BEF9A3A308B335D6AB97A363873391A483AD022E40F75BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 bb30c3cb14976280646103601ff246403010da73b9624f70fd0ad17057c49811
MD5 a23fc485d65ff62382f238cdb5ef459a
SHA1 8fb0711e57fc7da8cf3c4069a0e995b4c9b92f66
SHA512 55fb2f2760652550446192623f08915f9ee213792512d404bcc20a7a6fd6912108fb5a85ef8b95f082967067ec31841e136a759f90d6eb0901a4133604c926ee
SSDEEP 3072:hZr6c0dcBHyr8UEFZVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXK:hop1iUG
TLSH
T19BB393825BD5E975C05105BEF9F3A308B335D6AB979363872391A483AD022E40F79BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 6c6086b072e5a9135fd008fed87aaa4d2bd88985db076042c2a3d3986c6d40af
MD5 b8580f70673dbf256a2b8b9cab22332f
SHA1 b8003d348b6d130780accc7b41d5329987133473
SHA512 8011d8adb38ce8039ca98b5cd8b855308b15e68e07f1d0f89e03b201a8639e9d501dc3e42469fe8e63e2080134c326d1679ad8e3f96cc2bb66fceb20702b21ff
SSDEEP 3072:lZr6c0dcBHyr8UEFMVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXJ:lop1iVMQB
TLSH
T13CB383825BD5ED75C05105BEF9A3A308B335D6AB975363872391A483AD122E00F76BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 114KB
SHA256 b24c02efd618b757bbc9305b65bc66ffe548dd2a8d4b2fc3c84bd31615ba78ec
MD5 83e6ffcdd03a8ad2ebca268f01306191
SHA1 447962784089b892e85f27c908568ced6722ac66
SHA512 82ae1441a7156fec8a7c0e9ead95734b12cdf115fa03995c07ded620148f32bec2078257078eee55f0a111b0e89e9cf35b73b6f997944f351c9380b9f4575fc5
SSDEEP 3072:+Zr6c0dcBHyr8UEFMVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXj:+op1iVX
TLSH
T1D5B393825BD5ED75C05105BEF9E3A308B335D6AB979363872391A483AD122E00F76BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Path /Users/run/Library/Keychains/login.keychain-db
Size 112KB
SHA256 34e7f4ca3c1687b75e3294cce655448e627c4cf4b98e33bcf683c92b6142a06d
MD5 f8efed9ef3ec49e746caf57cdab49e8b
SHA1 3486d3fff806763254ba3e20442db1e27470a0b1
SHA512 b9bb7697ef819db2eaaeac43eb5328b40c3109563f869fe54e915ff89a180168b8768bfd88a453d0f46d7148a97207153e0d18ea38c5dcbcff5d0050dfcbffc4
SSDEEP 3072:ZZr6c0dcBHyr8UEFpVB46OZVhTLXS/iROPQrDQkbnoLEsnoXAKvkki1GtDPgijXD:Zop1ikH
TLSH
T139B383825BD5E975C05105BEF9F3A308B335D6AB979363872390A483AD122E40F79BDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

syncroots.db

Path /private/var/db/Sandbox/syncroots.db
Size 431B
SHA256 3c830812eb8dfacbc699dac1c177c1d1ef2f52c86a202bdc669514c8dbf2b1a8
MD5 e4946ad9e7a4fc02dfc2ef1ae0e17cf2
SHA1 add1ccc54e63d497c26a1a9956443c6a1bdf8b9f
SHA512 77f06e92dd2eaed59cc043dbd2b97bd82a06e360e284abc9a7499ecc736f65fb17e58c1897506ad2ec9605bf49f0de41ca49ce314a618e852006dfe2f0a9aab9
TLSH
T1F7E02B3E215090BFDDC4C0F0884A6D4AF350738150B0B4D661F0F2C04A1D6ED8CA06F3
MD5 SHA1 SHA512 TLSH

Submit Download

icon_128.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirPR8IwX/CRX_INSTALL/images/icon_128.png
Size 3KB
SHA256 4f17efbd974a41d88cb36567aab6bf4586579e78780f00b1826676819e14bff4
MD5 30899b6c4e4a757b8ec6dd2208acdfb4
SHA1 f2c5880a724c6d75cce1b5191e0d82c3bc7de768
SHA512 58539e3f0ad7fef30792efcdbbd955599e11e4261c9946e7c3dff6267e01747354ea3b901c46fc8329f81c68afbeb2d05fe3fcb266bc5948de8befa5b8d040ee
TLSH
T1B3617D3A733F1E1EA655403843096A51F0C1A62454A9C0C56BE3FCF90D02E086C29B28
MD5 SHA1 SHA512 TLSH

Submit Download

icon_16.png

Path /private/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/scoped_dirPR8IwX/CRX_INSTALL/images/icon_16.png
Size 531B
SHA256 0a4bd08db6422f8e7a8a218ef39c1b99a5a675f12697f26be88f9afc2e1f9378
MD5 344554d96e418120bd80ef5de5194697
SHA1 23e141c3a6ce368acc1c299f062ab85914bcb17e
SHA512 7ae38853e5acca479d7fd81d48bb88c671cf4dce63342209bcff045ac581a04b7b0ed48f6c58253db950935c0522caaa4fbc6cf5a25151a8960ba56fc804569e
TLSH
T171F075CE17705C76514D0763D5E535B278614AC642C76AA1500F1A54793BC1D8DC13B2
MD5 SHA1 SHA512 TLSH

Submit Download

mdsDirectory.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Size 47KB
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20
SSDEEP 384:xSMdGleGkIG7FF3theSMVXBD0tgcNrGB5pBfbouR6/chQOnGqwc2U+v+h/:8MdGleOhpBouRwchQOnGqwc2U+v+h/
TLSH
T19223BE475BA4DA72EA90357B903363BCDB69F667C346132F465CB0AB4C121802E6FD9C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

mdsObject.db

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Size 4KB
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818
SSDEEP 24:mFkXs98w/mBr53CEb9ujBbCYoVeA7uBEUMy733Ka2VCneWHrUZRJkWnJI4FNMOQS:m6Xsh+CLjL3Pe3T5FFEfEn8xiYuuSsS
TLSH
T1B6919F479BA86A23DD90357690B3677CAF29E693D347031B428CB0968C122843E6FDDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

hfnkpimlhhgieaddgfemjhofmfblmnib_10894_all_m622wpclxamerxc74qatuwwu6i.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.6bojBR/hfnkpimlhhgieaddgfemjhofmfblmnib_10894_all_m622wpclxamerxc74qatuwwu6i.crx3
Size 36KB
SHA256 6e01522be83c62dca09671fff781dc03f2cf94b443cd50c75fbfef6e7796d0c3
MD5 5345a86143b5a8bc4322551a2fb23120
SHA1 dbb947ba58cb569e24f0b38235cb06cbad6b0411
SHA512 2b24ce622aa541526876dbdf12050ad581aa21060a552b16a961b8623cb598b2e04c552bcceceb2f0b87e7e8618eebcbe347d7f6c6cabb0c4e8023fb2ffa6b90
SSDEEP 768:XnfputKcxa39koT20x80O5HMDQ6VDqmjTnEUiqhlJSphbjVLQb:Xnx6r69koqA8rsDnqmXEUpzJSplVsb
TLSH
T101F2F10A5DEC6306C036227E0536B758127BA24E375193535D95B36C39DB20EDA36C7F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.DEVvCt/ggkkehgbnfjpeggfpleeakpidbkibbmn_2022.10.19.1145_all_ac7cecrzrmfngskhgmtk6zmhfjoa.crx3
Size 10KB
SHA256 e3a7322843834a5270a01c56533a34a24b1a253e3bda6f14046e10d818446165
MD5 cb79d407a4d6d8526b42060b9210b5c2
SHA1 331e3d66e82e130042897faf86dcbd05d7b227f1
SHA512 0ea283f2077ff874e1f2518565497864b11fd8a65f03d65e2b2996048bdba19849fcab81d9a8220cd51d4a09741b9cf222b1393f6ea4fde6db76dfe0590efdf9
SSDEEP 192:Hkgz/5MwS0wqF1GCEomF17IchyrIqVGqKI4eHiTSj:EIS01komF1FmIqQg4eHES
TLSH
T1C4229EE3AD249894CF2B1F3D59E6930709602A9E86E484908077CCCA1570FBDEB94F27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.Dj38do/imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3
Size 1.7MB
SHA256 b18275f924740d790048c978d29ff0c726ccc2e5ac6f382cd016d30ba9e60bc0
MD5 d970a8fae9532d21b7d2fdd83e6678d6
SHA1 edd5d18784f04786466c191c6052844940bc847d
SHA512 667ab045d7fdb86f4aacf04f73712e7f632eee32aea65e23d9d2c44770e12664eb9ac59b73f9618f0d6272e4ed81740bda0f68eb0e3c1f15c439aa01191b270f
SSDEEP 24576:q4dGCxYrdQ5LT91NO/0Z7AeDq4M992f74j2a1hzl7cc4UxA9G1/PGO0K9C4GEcqf:7GGdTzNOf9v87G2whzy8x3ZOOK4G7t+
TLSH
T1408533C145FC6A4B4E49BCD5304C0ADF8A6AFB491DC59E1303BD2952BB2150FDAAADC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.Dj38do/imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3
Size 1.9MB
SHA256 d3fda248f4310788eafacd33aa80e29aa09cad0677e1f67a79831e940ee4595d
MD5 ae0533bc75dfb86ca0dd80b1e61bd786
SHA1 bea3854f0efb9cb812b9da0d737684d5eef3643b
SHA512 61d607c9745c3f793f7923f270e8b22eac09594e6a7ed6d417047f8e7c319da9253af6ecefff4edcabc18beb4646270289e12907731e6b199e4dbfe9185bca5e
SSDEEP 49152:7GGdTzNOf9v87G2whzy8x3ZOOK4G7tbbOWVd:qGVzGBolTA3ZOOK4Wtb6WX
TLSH
T1A39533C255FC754B4F89FC98304C599B8E2DFB495DC69D2203FE2542BB2150ACAA9EC3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.Dj38do/imefjhfbkmcmebodilednhmaccmincoa_29.0_mac_bfqwqczv2chgncq7qnwqjby3my.crx3
Size 2.3MB
SHA256 de5fbd79920b3310f975619248838da148dfc06f584123f9c244f598e62a89c2
MD5 ec66d3326e743f58310a530188feb4d8
SHA1 4eb361ac176eeb0f017c8b10a11c0fe26209f115
SHA512 454d1bcd00892944217d74c4364532421c1be9ca014ffc17934af54c16297f5c697569adc29eb32970bcfdf25e13488e87ea1fff8be31e50393cd9b16edb5130
SSDEEP 49152:7GGdTzNOf9v87G2whzy8x3ZOOK4G7tbbOWVc2JjrqnE1rmor:qGVzGBolTA3ZOOK4Wtb6WpYnE1tr
TLSH
T165B53381A4FC258A4F91BCD0740D19EB8E7DFB180DC6AD3207F925567F5124ACAB9EC2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.JDgH3u/ojhpjlocmbogdgmfpkhlaaeamibhnphh_3_all_gplutbkdljxxbjolk3siq7kive.crx3
Size 857KB
SHA256 545666a4efd056351597bb386aea1368105ededc976ed5650d8682daab9f37ff
MD5 a40c655b337e082c76b6ab04042b7ae0
SHA1 3cc2a2b7178a29fd2d246cbc532684d6ae45bea8
SHA512 fb4d54b573eb2275d8a3580fff138ecd7bded27ec58086b909b12c03c8005e35105c354a4a1ff76ada608ee8bbabeaafe208bb9e557661bb74e4ca39ee5eee56
SSDEEP 24576:tN1HYqiefjuhBCLF9t3c7y04bfB8w2aQnVBg1jAQpdnBXAt5:tN1HYqi2z9c7y04rKSpdtzw
TLSH
T1E7152367F7534E87A693C0F101B9EF5CDC2EC6B863DD6D5862DB6405CB8A8014EF1A28
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.MSi4rN/dhlpobdgcjafebgbbhjdnapejmpkgiie_20220505_all_adfdqqtvlhuhhtrt6irlkpynghca.crx3
Size 136KB
SHA256 0c24e9bd976adffa987e08fc54dc0950c84cf18f9cdb4c5caabc6acf24887c4f
MD5 667e9eec04509aa9e2b318f580addd8c
SHA1 346267ecad10c54de52a3aeb766ea72449500326
SHA512 a9d22d49290c164abf36dd7e887063ccdd2bf508eb2d16bbac6de749e5152805ecb38ca39352706150de29a76839fa6a56c084ea4f2757b61887b3a7912be917
SSDEEP 3072:SGYNExjxgL4glOAq2HgjlKr3dUqK9tXi606uuBTgilY09X:xYNExjxk48W2AMEt507uBUilY05
TLSH
T1F9D3125FDF1FB211ABE4E21CB68532C71284E58AC4BFA943884DF2E09FA89407865648
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_DE500000_acxbm5h6appcznv7yevrx2fge5ta.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.NChaiE/obedbbhbpmojnkanicioggnmelmoomoc_20251024.824731831.14_all_DE500000_acxbm5h6appcznv7yevrx2fge5ta.crx3
Size 7.4MB
SHA256 3c490cd0abb97f15040e4aaa68dc4f1eae73b73591c29ae082ea6c5b364abe94
MD5 6a600fdeff28b1595ebefdceb7efb299
SHA1 a924846aeb01a943dfe886ca44a7bc961067233f
SHA512 9d3f25e0974db6200a913ee674af57ece609e9abf3e62d4188be0cd85cec9e8c26fc15cd8712f24f89c6071f0e90416b4137affc2a98a640d17ec9d8fc1ecc96
SSDEEP 98304:rrMizWNsl+82gZmJOETmiFa9fzHbPdsnEkTZYPHeZPhgPfPm8D0osh:HtzWW+rc7ETcrbPds/WEG+Z
TLSH
T10D76F1A7F483013F5FAF8721F4824D66B79ED2C546012B0A86E9DFAB3087747C19D668
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.73.1_all_i7ccctigoxe5yv5u367vau4j5m.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.O5U4wc/gcmjkmgdlgnkkcocmoeiminaijmmjnii_9.73.1_all_i7ccctigoxe5yv5u367vau4j5m.crx3
Size 181KB
SHA256 37d183b933697a62791bf4d91eef0f197685818a1d70405561412344dad3e0a9
MD5 79ce69b3b3e512d92c338a89100eafac
SHA1 0ec7e98286e73e1dc67fc2855d0279c30e7561fc
SHA512 11f48b41661b0328f4d0ec4066379ab5f82d7a0cc5741eb7df661f78512ed6b133c3ca2ce9b7fb7bc3e23e49fabaece4fa4eb30172e75f0584da4feee114e7a0
SSDEEP 3072:AKBTQ6+nb7WrcdZNVlVuq4nUjD7/LDjtQVu3/gpbfBORAnsD/gFYUsIAWPHL5P8h:7W6AWxzCvmVIc3qh
TLSH
T1B50472176215F1F20EB2053E148A6C9592A472E503D7E9F0BA19C24CB7F469FB3983F9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

gonpemdgkjcecdgbnaabipppbmgfggbe_2025.07.24.00_all_hou4jz7zmeg5zedchpigdjxhve.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.OXFmf4/gonpemdgkjcecdgbnaabipppbmgfggbe_2025.07.24.00_all_hou4jz7zmeg5zedchpigdjxhve.crx3
Size 16KB
SHA256 56c21927faa028be6ce18c931660eec37e41da4bfbfd47cafa48350f828c0dbd
MD5 479078f9927c39f3ae015938f9a8b304
SHA1 31a6f9dbac78faad676ad3c1d9ee1cb85d87241f
SHA512 b1c098abc3f797dc2b498806a5181d4eea7f8b2e06b20e0ddf94a720fafe2a0677ae38049230d9830f918631ca1b10e4439698b11bb8994ae286b3c14cd3b2c2
SSDEEP 384:cTcwCd5CuqlL+kIVxRtRTGXvcxtsVjrs4rs9IJbjXaKYHuA:YOCuqlL+kIVxRtRTGXvcxt6phbjX/YOA
TLSH
T1A2724FFF46556504D7AA43F894AD3D4CD06B495E8FECE9E7DB22D82E4AB0AF410002DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

.com.google.Chrome.VlSVOj

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.VlSVOj
Size 242KB
SHA256 81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82
MD5 541f52e24fe1ef9f8e12377a6ccae0c0
SHA1 189898bb2dcae7d5a6057bc2d98b8b450afaebb6
SHA512 d779d78a15c5efca51ebd6b96a7ccb6d718741bdf7d9a37f53b2eb4b98aa1a78bc4cfa57d6e763aab97276c8f9088940ac0476690d4d46023ff4bf52f3326c88
SSDEEP 3072:r+nmRykNgoldZ8GjJCiUXZSk+QSVh85PxEalRVHmcld9R6yYfEp4ABUGDcaKklrv:k3oF4Z4h45P99Fld9RBQYBVcaxlnfL
TLSH
T1F63402BD7D8AE686D006A17676C0B48BE1199F4E41CB7C0F668A89010D70F8C57B9DEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

laoigpblnllgcgjnjnllmfolckpjlhki_1.1.0.3_all_adwgvw4jdcarox4vlsm7t4gq257a.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.asvDec/laoigpblnllgcgjnjnllmfolckpjlhki_1.1.0.3_all_adwgvw4jdcarox4vlsm7t4gq257a.crx3
Size 12KB
SHA256 7b05c14dba04ed522210b733f004cb0e74d7679a653b19bd029f9bc0e6b19903
MD5 752fb191723f2ac933f27a4cf7b0e381
SHA1 143a9a509ebb85b228eb5e3721c0f4a3274e4f62
SHA512 bc04fcf4486206228df389b27e910bb38e926b0a2b625591f03d3c4f616befd96498b0c8355e83c36400969d2600aafe0f8d06c8ddf2e83636419de21cc68750
SSDEEP 384:KouyxMA8bnsa46GN1eRv/RR7J8jmmOsRJpJyV:dxMzsyGNUZj+jmmrpo
TLSH
T12842AE069D4E3A8FD90AD23D454A3E07377B326711D25449FB8B982980E97B1B0E89CE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lmelglejhemejginpboagddgdfbepgmp_776_all_ZZ_dv7iw7cjraguho6tj3mhi2tzda.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.iYSHYd/lmelglejhemejginpboagddgdfbepgmp_776_all_ZZ_dv7iw7cjraguho6tj3mhi2tzda.crx3
Size 557KB
SHA256 3bd5860bf7afc9fa31c69edafa43ac4bd390329e590782c8e6820decd5832128
MD5 9d53e715145abff0216d8a4a4baae8f9
SHA1 882a22411b561e06cc4da4f0a8ffd77e278d3d08
SHA512 d2c85f5261b0b0bddc99cc49b5259fab0879d826d0a88eae658167519f9e637529ef22b743a40b9197b3fc7a3d6aa7ea91c0414433fd5149752715436f1d0c5a
SSDEEP 12288:pMcG3OkkksGORY5AZfbZnNnl9vumc5igDUnqZMlC:ZG3n5Ifh9Mi2GqZMlC
TLSH
T182C423FFB6188071CF9785B0783F3F5EC22B319CE5844CCA8A494B586785AF477AA251
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

efniojlnjndmcbiieegkicadnoecjjef_1830_all_acha4qitlh3cli23znkwm4xxzpwa.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.meseO2/efniojlnjndmcbiieegkicadnoecjjef_1830_all_acha4qitlh3cli23znkwm4xxzpwa.crx3
Size 424KB
SHA256 b0ad5e1107445b759043965c3c6ef957b685c7771245ffbc6676988ad727f80a
MD5 fb5309baf811c0bc41f9025273b4a2e0
SHA1 43805c512debc35d7def0782ad1e746a9d645424
SHA512 1fcc6ff18db44698668d7328ae100de434853d8fac22848eb10ceb5401daa391f98e4ed42b85301e6c7e1d9e23f7cecf69effc24c2a964799256286a9a928fb3
SSDEEP 6144:R/yOJ2VZUvVc2oc66oXpFTy3ZXtw6xrWtefZBSy7EwNZbgWy56kGFUT+SZp1vH4/:H2VCpApQZXt9BX7EmKNDm
TLSH
T1BF949EAB2F247C43AFD3DD6470C8E92BBDB173D179EA54969155C0B1A9823D13E8802F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eeigpngbgcognadeebkilcpcaedhellh_2025.06.13.084507_all_acip2yapafsolnpcvaohkisaowaq.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.sMs2uN/eeigpngbgcognadeebkilcpcaedhellh_2025.06.13.084507_all_acip2yapafsolnpcvaohkisaowaq.crx3
Size 257KB
SHA256 4497d8060d0e53c12b4403aa9ebe7e827d4880bae3f4139a26a4feb7ed64c4a2
MD5 5a6371818d0598fc615c76004f226666
SHA1 9225ea4a8418a37f8d6d393040ba78f20c93366f
SHA512 69d50587a46ad60c535ba0dfba8f0816f6474205e63a8ae2a8fe0c5f002b3e14dd8739a4dc0d9c60106398fb8566c27bfba9ba5ead347898842606aeba0bbf4a
SSDEEP 6144:FHKYcaVcxaGDSdsAm16knUFEUrlaTiHzeQM+XuWU:BKYUxakSd21TUFEClamHzeQ7up
TLSH
T1FF442A3A59B00465C44D43797A8A3717F3FC8F38AAB16FC514F9195838EB9028B7E61E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jflookgnkcckhobaglndicnbbgbonegd_3092_all_ahxh6jruqhhwu3ei5bavmdcw44.crx3

Path /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/.com.google.Chrome.wKakyx/jflookgnkcckhobaglndicnbbgbonegd_3092_all_ahxh6jruqhhwu3ei5bavmdcw44.crx3
Size 178KB
SHA256 3b1293b1cd2b0b9ebc8c64bf5c6a0407ffad78a0364bbac71c5fe7d3e1bd7657
MD5 4a373c18ce6f385bb60ac1d0c1b693f8
SHA1 01867b49466650133f543340a06fbd04d4abd7a8
SHA512 12c55e5718e52f02d51568202dc253d3faa0b24d4889d8465e155cafc6aa823f4b91af2d4f5010fa08a0471b448d515294749ec96273ea1d01c9296e33db93bc
SSDEEP 3072:zhmxm6uVFA/79bVcmxgyOarbOn9n01m9XDHjVjVYYa8u9xXG2O:1Is479umxenFDQEu9xXG2O
TLSH
T164046D45FC8B02A06F4780C99FAC66D72105B2F473B5CADFB77FB2A56D4089720894B9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads