macOS Analysis Report
EasyFind.app.zip

Overview

General Information

Sample name: EasyFind.app.zip
Analysis ID: 1541480
MD5: 91ce8e492999bfa0cf4a95e2aa505b73
SHA1: b9f8f97267def20bf488fee9b59fd6a3fbf158d0
SHA256: 1539a562539e3b3a243da864fddee0351a4c7d109aa9dcae436775ecbb288fc9
Infos:

Detection

Score: 4
Range: 0 - 100
Whitelisted: false

Signatures

Contains functionality related to login items (used for persistence)
Contains symbols with suspicious names likely related to networking
Reads hardware related sysctl values
Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)
Reads the systems OS release and/or type
Reads the systems hostname
Uses AppleScript framework/components containing Apple Script related functionalities
Uses AppleScript scripting additions containing additional functionalities for Apple Scripts

Classification

Source: unknown HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49350 version: TLS 1.2
Source: unknown HTTPS traffic detected: 17.253.97.203:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49406 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49407 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.8:443 -> 192.168.11.12:49409 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.8:443 -> 192.168.11.12:49410 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.8:443 -> 192.168.11.12:49411 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49413 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49414 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49418 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49426 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49427 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49428 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49429 version: TLS 1.2
Contains symbols with suspicious names likely related to networking
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _gethostbyname
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _kIOMasterPortDefault
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _kSMDomainUserLaunchd
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _OBJC_CLASS_$_NSHTTPURLResponse
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _AESendMessage
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _NSSearchPathForDirectoriesInDomains
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _IOMasterPort
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _inet_ntoa
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _inet_ntoa
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _gethostbyname
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _kIOMasterPortDefault
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _kSMDomainUserLaunchd
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _OBJC_CLASS_$_NSHTTPURLResponse
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _AESendMessage
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _NSSearchPathForDirectoriesInDomains
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _IOMasterPort
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.248.199.71
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 17.253.97.203
Source: unknown TCP traffic detected without corresponding DNS query: 23.48.144.29
Source: unknown TCP traffic detected without corresponding DNS query: 23.48.144.29
Source: unknown TCP traffic detected without corresponding DNS query: 172.64.149.23
Source: global traffic HTTP traffic detected: GET /2021/mobileassets/041-40471/B96AF6E1-5FF6-4786-9956-944A1AFE086A/com_apple_MobileAsset_KextDenyList/404087a7302927411b6ea0e05114d2c68355185e.zip HTTP/1.1Host: updates.cdn-apple.comAccept: */*Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic HTTP traffic detected: GET /2024/patches/052-54451/D609556E-69B1-482E-9C33-B2E3510A1311/com_apple_MobileAsset_TimeZoneUpdate/c5a4d0df08e8faecf4faebbbadc4d96a07d9d990.zip HTTP/1.1Host: updates.cdn-apple.comAccept: */*Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: global traffic HTTP traffic detected: GET /2024/patches/062-08173/234EE7F7-CC33-4CD3-85FC-60590A103560/com_apple_MobileAsset_CoreSuggestions/84f6102e2a09dd10dd694d795792a7771b6014fc.zip HTTP/1.1Host: updates.cdn-apple.comAccept: */*Accept-Language: en-usConnection: keep-aliveAccept-Encoding: br, gzip, deflateUser-Agent: mobileassetd (unknown version) CFNetwork/976 Darwin/18.2.0 (x86_64)
Source: EasyFind String found in binary or memory: //www.youtube.com equals www.youtube.com (Youtube)
Source: global traffic DNS traffic detected: DNS query: h3.apis.apple.map.fastly.net
Source: CodeResources String found in binary or memory: http://crl.apple.com/applerootcag3.crl0
Source: EasyFind String found in binary or memory: http://crl.apple.com/root.crl0
Source: EasyFind String found in binary or memory: http://crl.apple.com/timestamp.crl0
Source: EasyFind String found in binary or memory: http://ocsp.apple.com/ocsp-devid010
Source: CodeResources String found in binary or memory: http://ocsp.apple.com/ocsp03-applerootcag307
Source: CodeResources String found in binary or memory: http://ocsp.apple.com/ocsp03-asica4020
Source: EasyFind String found in binary or memory: http://tm.wc.ask.com/
Source: EasyFind String found in binary or memory: http://tmsyn.wc.ask.com/
Source: EasyFind String found in binary or memory: http://web.ask.com/redir?
Source: Info.plist, EasyFind, CodeResources String found in binary or memory: http://www.apple.com/DTDs/PropertyList-1.0.dtd
Source: EasyFind String found in binary or memory: http://www.apple.com/appleca0
Source: EasyFind String found in binary or memory: https://cdn.jsdelivr.net/npm/mathjax
Source: EasyFind String found in binary or memory: https://cdn.jsdelivr.net/npm/mermaid/dist/mermaid.min.js
Source: EasyFind String found in binary or memory: https://forum.devontechnologies.com/
Source: EasyFind String found in binary or memory: https://www.apple.com/appleca/0
Source: EasyFind String found in binary or memory: https://www.devontechnologies.com/
Source: EasyFind String found in binary or memory: https://www.devontechnologies.com/Updates.plist?product=%
Source: EasyFind String found in binary or memory: https://www.devontechnologies.com/download/
Source: EasyFind String found in binary or memory: https://www.devontechnologies.com/https://www.devontechnologies.com/support/https://forum.devontechn
Source: EasyFind String found in binary or memory: https://www.devontechnologies.com/support/
Source: unknown Network traffic detected: HTTP traffic on port 49410 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49403
Source: unknown Network traffic detected: HTTP traffic on port 49351 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49402
Source: unknown Network traffic detected: HTTP traffic on port 49406 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49414 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49427 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49429 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49426 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49403 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49418
Source: unknown Network traffic detected: HTTP traffic on port 49409 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49414
Source: unknown Network traffic detected: HTTP traffic on port 49411 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49413
Source: unknown Network traffic detected: HTTP traffic on port 49350 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49411
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49410
Source: unknown Network traffic detected: HTTP traffic on port 49413 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49407 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49351
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49350
Source: unknown Network traffic detected: HTTP traffic on port 49428 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49418 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49402 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49409
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49407
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49429
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49406
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49428
Source: unknown Network traffic detected: HTTP traffic on port 49349 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49427
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49349
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49426
Source: unknown HTTPS traffic detected: 151.101.3.6:443 -> 192.168.11.12:49350 version: TLS 1.2
Source: unknown HTTPS traffic detected: 17.253.97.203:443 -> 192.168.11.12:49351 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49402 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49403 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49406 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49407 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.8:443 -> 192.168.11.12:49409 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.8:443 -> 192.168.11.12:49410 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.8:443 -> 192.168.11.12:49411 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49413 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49414 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49418 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49426 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49427 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49428 version: TLS 1.2
Source: unknown HTTPS traffic detected: 151.101.195.6:443 -> 192.168.11.12:49429 version: TLS 1.2
Source: classification engine Classification label: clean4.macZIP@0/1@1/0
Contains functionality related to login items (used for persistence)
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _kLSSharedFileListItemLast
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _kLSSharedFileListSessionLoginItems
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _LSSharedFileListCopySnapshot
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _LSSharedFileListCreate
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _LSSharedFileListInsertItemURL
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _LSSharedFileListItemRemove
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _kLSSharedFileListItemLast
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _kLSSharedFileListSessionLoginItems
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _LSSharedFileListCopySnapshot
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _LSSharedFileListCreate
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _LSSharedFileListInsertItemURL
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O symbol: _LSSharedFileListItemRemove
Uses AppleScript framework/components containing Apple Script related functionalities
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist Jump to behavior
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist Jump to behavior
Uses AppleScript scripting additions containing additional functionalities for Apple Scripts
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist Jump to behavior
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist Jump to behavior
Source: extracted file from ZIP submission CodeResources XML file: EasyFind.app/Contents/_CodeSignature/CodeResources
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/AVFoundation.framework/Versions/A/AVFoundation
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/AppKit.framework/Versions/C/AppKit
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/ApplicationServices.framework/Versions/A/ApplicationServices
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/CoreVideo.framework/Versions/A/CoreVideo
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/Security.framework/Versions/A/Security
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/Security.framework/Versions/A/Security
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
Source: extracted file from submission: EasyFind.app/Contents/MacOS/EasyFind Mach-O header: load_dylib -> /System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) Random device file read: /dev/random Jump to behavior
Source: /usr/libexec/firmwarecheckers/eficheck/eficheck (PID: 653) Random device file read: /dev/random Jump to behavior
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist Jump to behavior
Source: submission CodeSign Info: Executable=/Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind
Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) Sysctl read request: kern.safeboot (1.66) Jump to behavior
Reads hardware related sysctl values
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) Sysctl read request: hw.availcpu (6.25) Jump to behavior
Reads the systems OS release and/or type
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) Sysctl requested: kern.ostype (1.1) Jump to behavior
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) Sysctl requested: kern.osrelease (1.2) Jump to behavior
Reads the systems hostname
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) Sysctl requested: kern.hostname (1.10) Jump to behavior
Source: /usr/bin/open (PID: 621) System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist Jump to behavior
Source: /usr/bin/open (PID: 624) System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist Jump to behavior
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist Jump to behavior
Source: /Users/bernard/Desktop/unpack/EasyFind.app/Contents/MacOS/EasyFind (PID: 625) System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist Jump to behavior
cam-macmac-stand
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
23.48.144.29
 unknown United States
20940 AKAMAI-ASN1EU false
151.101.3.6
 h3.apis.apple.map.fastly.net United States
54113 FASTLYUS false
151.101.195.8
 appledownload.map.fastly.net United States
54113 FASTLYUS false
151.101.195.6
 unknown United States
54113 FASTLYUS false
172.64.149.23
 unknown United States
13335 CLOUDFLARENETUS false

Contacted Domains

Name IP Active
appledownload.map.fastly.net 151.101.195.8 true
h3.apis.apple.map.fastly.net 151.101.3.6 true