Files
|
File Path
|
Type
|
Category
|
Malicious
|
|
|---|---|---|---|---|
|
TheUnarchiver.dmg
|
zlib compressed data
|
initial sample
|
||
|
/Users/bernard/Library/Caches/SentryCrash/The Unarchiver/Data/CrashState.json
|
JSON data
|
dropped
|
||
|
/dev/null
|
ASCII text
|
dropped
|
||
|
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/mds/mdsDirectory.db_
|
Mac OS X Keychain File
|
dropped
|
||
|
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/C/mds/mdsObject.db_
|
Mac OS X Keychain File
|
dropped
|
||
|
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/.dat.nosync028d.vUQ3ER
|
Apple binary property list
|
dropped
|
||
|
/private/var/folders/t9/r5v5jljx0rb04g1yc95c7hw40000gp/T/updates.xml.rss
|
XML 1.0 document, ASCII text
|
dropped
|
Processes
|
Path
|
Cmdline
|
Malicious
|
|
|---|---|---|---|
|
/usr/libexec/xpcproxy
|
-
|
||
|
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
|
/System/Library/PrivateFrameworks/PackageKit.framework/Resources/installd
|
||
|
/Library/Frameworks/Mono.framework/Versions/4.4.2/bin/mono-sgen32
|
-
|
||
|
/usr/bin/open
|
/usr/bin/open /Volumes/The Unarchiver/The Unarchiver.app
|
||
|
/usr/libexec/xpcproxy
|
-
|
||
|
/Volumes/The Unarchiver/The Unarchiver.app/Contents/MacOS/The Unarchiver
|
/Volumes/The Unarchiver/The Unarchiver.app/Contents/MacOS/The Unarchiver
|
||
|
/usr/bin/defaults
|
-
|
||
|
/usr/libexec/xpcproxy
|
-
|
||
|
/usr/libexec/firmwarecheckers/eficheck/eficheck
|
/usr/libexec/firmwarecheckers/eficheck/eficheck --integrity-check-daemon
|
URLs
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
https://updates.devmate.com/releasenotes/137/es-MX/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/no/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/120/no/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/128/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/121/zh-Hans/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/no/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/128/no/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/146/zh-Hans/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/137/ar/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/121/es/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/132/fr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/pt-BR/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/143/es/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/145/pl/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/128/es/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/es/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/132/nl/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/146/ja/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/132/pt-BR/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/120/sv/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/120/cs/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/ru/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/zh-Hans/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/137/pt/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/128/sv/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/129/es-MX/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/126/uk/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/129/1590582775/126.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/145/tr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/143/no/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/139/1652457131/131.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/hu-HU/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/129/tr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/131/1605625663/129.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/121/hu-HU/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/132/zh-Hans/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/128/cs/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/cs/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/137/de/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/126/de/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/145/1715684270/137.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/132/it/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/143/it/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/126/zh-Hans/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/121/tr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/128/1586456379/121.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/ar/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/131/1605625663/128.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/121/fr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/129/fr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/137/sv/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/120/es/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/128/ar/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/132/pl/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/145/fr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/145/ja/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://macpaw.com/news/know-the-truth-about-Ukraine?utm_source=un&utm_medium=app&utm_campaign=un_2
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/129/hu-HU/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/143/nl/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/139/1652457131/137.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/pt-BR/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/126/ru/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/146/pl/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/137/hu-HU/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/143/sv/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/fr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/121/cs/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/145/hu-HU/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/cs/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/uk/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/126/pt/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/145/1715684270/143.delta
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/146/1715865652/TheUnarchiver-146.zip
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/129/zh-Hans/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/128/1586456379/120.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/uk/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/137/zh-Hans/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/146/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/120/uk/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/tr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/120/hu-HU/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/it/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/120/it/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/137/no/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/126/no/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/137/pt-BR/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/129/1590582775/121.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/tr/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://dl.devmate.com/com.macpaw.site.theunarchiver/146/1715865652/145.delta
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/ar/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/126/es/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/126/sv/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://theunarchiver.comAbout
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/143/pl/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/129/ar/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/132/ar/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/131/pt/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/139/it/com.macpaw.site.theunarchiver.html
|
unknown
|
||
|
https://updates.devmate.com/releasenotes/129/pt/com.macpaw.site.theunarchiver.html
|
unknown
|
There are 90 hidden URLs, click here to show them.
Domains
|
Name
|
IP
|
Malicious
|
|
|---|---|---|---|
|
api-lytics.macpaw.com
|
172.64.147.102
|
||
|
appledownload.map.fastly.net
|
151.101.3.8
|
||
|
updates.devmate.com
|
104.18.38.206
|
||
|
s3-us-west-2.amazonaws.com
|
52.218.152.144
|
||
|
h3.apis.apple.map.fastly.net
|
151.101.131.6
|
IPs
|
IP
|
Domain
|
Country
|
Malicious
|
|
|---|---|---|---|---|
|
104.76.101.13
|
unknown
|
United States
|
||
|
172.64.147.102
|
api-lytics.macpaw.com
|
United States
|
||
|
52.218.152.144
|
s3-us-west-2.amazonaws.com
|
United States
|
||
|
104.18.38.206
|
updates.devmate.com
|
United States
|
||
|
151.101.3.8
|
appledownload.map.fastly.net
|
United States
|
||
|
151.101.3.6
|
unknown
|
United States
|
||
|
151.101.195.6
|
unknown
|
United States
|
Memdumps
|
Base Address
|
Regiontype
|
Protect
|
Malicious
|
|
|---|---|---|---|---|
|
11a125000
|
page execute read
|
|||
|
10b545000
|
page read and write
|
|||
|
10c45c000
|
page read and write
|
|||
|
10b8d8000
|
page read and write
|
|||
|
10c01b000
|
page read and write
|
|||
|
10b982000
|
page execute read
|
|||
|
10c0ff000
|
page execute read
|
|||
|
10bd82000
|
page readonly
|
|||
|
10b7af000
|
page read and write
|
|||
|
10c2e5000
|
page readonly
|
|||
|
10b539000
|
page readonly
|
|||
|
10c02b000
|
page read and write
|
|||
|
10c017000
|
page execute read
|
|||
|
10c0ef000
|
page read and write
|
|||
|
10c12a000
|
page execute read
|
|||
|
10c103000
|
page read and write
|
|||
|
10c037000
|
page execute read
|
|||
|
10b8fc000
|
page readonly
|
|||
|
10c040000
|
page readonly
|
|||
|
10c01c000
|
page readonly
|
|||
|
10c0d3000
|
page execute read
|
|||
|
10c0d8000
|
page read and write
|
|||
|
10e19a000
|
page execute read
|
|||
|
10b9a6000
|
page readonly
|
|||
|
10c06b000
|
page read and write
|
|||
|
10b81a000
|
page readonly
|
|||
|
10b854000
|
page execute read
|
|||
|
10bd32000
|
page read and write
|
|||
|
10c0c3000
|
page read and write
|
|||
|
10c0ae000
|
page readonly
|
|||
|
10c0d2000
|
page readonly
|
|||
|
10e945000
|
page readonly
|
|||
|
10b7f7000
|
page read and write
|
|||
|
10c0b9000
|
page execute read
|
|||
|
10e251000
|
page readonly
|
|||
|
10c072000
|
page readonly
|
|||
|
10c0d9000
|
page readonly
|
|||
|
10c45f000
|
page readonly
|
|||
|
10c0a9000
|
page execute read
|
|||
|
10c104000
|
page readonly
|
|||
|
10b51d000
|
page read and write
|
|||
|
10b4dd000
|
page execute read
|
|||
|
10c44c000
|
page execute read
|
|||
|
10ffd0000
|
page readonly
|
|||
|
10b817000
|
page readonly
|
|||
|
10c2c3000
|
page read and write
|
|||
|
10b54c000
|
page execute read
|
|||
|
10c025000
|
page execute read
|
|||
|
10c461000
|
page readonly
|
|||
|
11a1a4000
|
page read and write
|
|||
|
10e192000
|
page execute read
|
|||
|
10b9c0000
|
page execute read
|
|||
|
10c0ad000
|
page read and write
|
|||
|
10b6e7000
|
page readonly
|
|||
|
10e196000
|
page readonly
|
|||
|
10b568000
|
page readonly
|
|||
|
10efaf000
|
page readonly
|
|||
|
10c119000
|
page read and write
|
|||
|
10c445000
|
page readonly
|
|||
|
10b8ff000
|
page readonly
|
|||
|
10b55c000
|
page read and write
|
|||
|
10c11a000
|
page readonly
|
|||
|
10b6e9000
|
page readonly
|
|||
|
10c052000
|
page execute read
|
|||
|
10c2f0000
|
page readonly
|
|||
|
10df7d000
|
page readonly
|
|||
|
10c0c5000
|
page readonly
|
|||
|
10c03f000
|
page read and write
|
|||
|
10b663000
|
page read and write
|
|||
|
11a1a9000
|
page read and write
|
|||
|
10ed32000
|
page readonly
|
|||
|
10bd84000
|
page readonly
|
|||
|
10df7c000
|
page execute read
|
|||
|
10c0f0000
|
page readonly
|
|||
|
10b577000
|
page execute read
|
|||
|
10c070000
|
page readonly
|
|||
|
10b74b000
|
page execute read
|
|||
|
11a1dd000
|
page readonly
|
|||
|
10b99e000
|
page read and write
|
|||
|
10f5bd000
|
page read and write
|
|||
|
10c02c000
|
page readonly
|
|||
|
10df7e000
|
page readonly
|
|||
|
10c111000
|
page execute read
|
|||
|
10c0e8000
|
page execute read
|
There are 74 hidden memdumps, click here to show them.