Analysis Report

Overview

General Information

Joe Sandbox Version:	19.0.0
Analysis ID:	35263
Start time:	14:01:16
Joe Sandbox Product:	Cloud
Start date:	21.03.2017
Overall analysis duration:	0h 21m 21s
Report type:	full
Sample file name:	MacInstaller.dmg
Cookbook file name:	default.jbs
Analysis system description:	Mac Mini, El Capitan 10.11.6 (Java 1.8.0_25)
Detection:	MAL
Classification:	mal100.evad.adwa.spyw.troj.macDMG@0/183@30/0
Warnings:	Show All Report creation exceeded maximum number of non-whitelisted processes and may have missing process information. Report size exceeded maximum capacity and may have missing behavior information.

Detection

Strategy	Score	Range	Reporting	Detection
Threshold	100	0 - 100	Report FP / FN

Classification

Signature Overview

Click to jump to signature section

Spam, unwanted Advertisements and Ransom Demands:

Writes HTML files containing JavaScript to disk

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	HTML file containing JavaScript created: /Users/vreni/Desktop/Ziggy Marley(Beach In Hawaii).mp3
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	HTML file containing JavaScript created: /Users/vreni/Library/Application Support/osxDownloader/item-511797823.355455.dmg

Writes HTML files containing suspicious ad-related keywords to disk

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)

HTML file created with suspicious ad-related keywords: /Users/vreni/Desktop/Ziggy Marley(Beach In Hawaii).mp3 (keywords found: track, ads)

Networking:

Downloads compressed data via HTTP

Show sources

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OK x-amz-id-2: gi9WAMvCGwHOLPMF/t6083G4altrG/WDeiWhqAFq61EyvLqWYEmCcelaa19zft/PTRWms8410Qs= x-amz-request-id: 12F5D7EF2861BC92 Date: Tue, 21 Mar 2017 13:04:37 GMT Last-Modified: Sun, 05 Mar 2017 12:12:44 GMT Accept-Ranges: bytes Content-Type: application/zip Content-Length: 8775 Server: nginx Data Raw: 50 4b 03 04 14 00 08 00 08 00 fb 43 47 47 00 00 00 00 00 00 00 00 00 00 00 00 0d 00 10 00 65 78 74 65 6e 73 69 6f 6e 2e 74 78 74 55 58 0c 00 4a ae 14 56 4a ae 14 56 f5 01 14 00 75 90 4d 4e 1b 41 10 85 ab c0 80 49 08 34 c8 18 02 76 68 29 6b 2c 36 08 21 d8 f8 0f 6c c9 58 08 19 46 4a 22 4d da 9e 32 34 ee 99 b6 7a 1a f3 73 05 d8 46 d9 3a 27 60 89 72 8c 24 9b 1c 21 4b 8e 40 1b 2c a1 44 a4 36 25 d5 7b f5 55 e9 35 bb 4a c6 76 6d ed 17 8e 8c 26 c6 16 bc 23 32 b1 d4 91 cf 52 d5 28 b6 42 29 0a 78 f9 c2 52 34 98 c6 3e 9b cd f7 84 54 a2 a9 88 1f 76 03 61 29 66 f8 6d fc f7 44 72 f2 d5 eb a9 37 d3 33 8c cd b1 d4 7c 7a 60 34 ad 13 d9 23 be 23 9d b7 2e 42 fa 58 91 41 40 11 2f 08 e3 40 d9 03 0a 75 cf d1 4b d4 16 67
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OK Server: Apache X-Frame-Options: SAMEORIGIN X-Xss-Protection: 1; mode=block Accept-Ranges: bytes X-Content-Type-Options: nosniff Content-Type: text/html; charset=UTF-8 Vary: Accept-Encoding Content-Encoding: gzip Cache-Control: max-age=342 Expires: Tue, 21 Mar 2017 13:10:27 GMT Date: Tue, 21 Mar 2017 13:04:45 GMT Content-Length: 5958 Connection: keep-alive Data Raw: 1f 8b 08 00 00 00 00 00 00 00 ed 3d 6b 77 db 36 b2 9f e3 5f c1 55 cf 6e 3f d4 94 92 b8 dd 3c 6a ab d7 71 5e 6e e3 47 63 a7 6d 76 4f 8f 0f 44 42 12 62 92 60 48 50 8e 92 9b 1f 74 ff c6 fd 65 77 06 00 49 80 14 65 19 76 a3 ec 3d ee 71 23 12 18 0c 66 06 83 99 c1 93 1b db 7f 7b 7a b4 77 fa f6 f8 99 37 15 71 34 dc d8 c6 1f ef 43 1c 25 f9 4e 6f 2a 44 fa 78 30 b8 b8 b8 e8 5f 6c f5 79 36 19 dc 7b f4 e8 d1 e0 03 c2 f4 10 e8 71 44 92 c9 4e 8f 26 fe 9b 93 9e 67 bd a4 19 1d b3 0f 3b 3d 3e 79 ec 69 3c 7c 92 f6 63 3a 48 f2 6f 7a 5e 10 91 1c 6a e8 0d 37 a0 4a 4a c2 e1 c6 9d ed 98 0a 22 61 7d fa be 60 b3 9d de 1f fe 9b 5d 7f 8f c7 29 11 6c 14 51 28 c5
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OK Server: Apache Content-Type: text/css Content-Encoding: gzip Content-Length: 806 Cache-Control: max-age=61 Expires: Tue, 21 Mar 2017 13:05:46 GMT Date: Tue, 21 Mar 2017 13:04:45 GMT Connection: keep-alive Vary: Accept-Encoding Data Raw: 1f 8b 08 00 00 00 00 00 00 03 cd 59 cb 8e da 30 14 5d 17 69 fe c1 62 03 8c 0a 81 69 a7 0f ba 99 51 2b a4 d9 55 9a ee ab 34 38 43 54 43 90 6d a0 a8 ea 2f 74 dd 4f a9 fa 39 fd 81 fe 42 9d f0 18 66 64 07 f7 e6 52 df a5 83 38 b9 f7 1c 1f 3b 3a f7 2a cd 67 ba 9b c6 09 67 5f cf 1a 4f b6 ab 69 26 d6 c3 d6 ed 88 bd 97 39 7b 97 a9 b9 88 d7 ad 37 bb df 95 5e 0b 3e 9c e5 72 1a 8b fd c3 15 cf ee 26 7a 38 e8 f7 8b 47 4a 26 43 91 27 b1 68 b7 7e ff f8 f5 e7 e7 f7 56 e7 29 5b 48 d1 6e 46 2b a5 a2 e2 1f 2a ba 1d 75 0d 7e 77 8b 1f 2d 07 91 4a bb 73 f3 64 bc 79 f2 71 21 b4 8c 45 81 db 5b e5 69 da ec b0 b4 78 a9 6e 37 37 cb 7a 90 5a 1f 22 6a b9 e0 7a 3d e7 cd 4e 51 7f 74 ce da 6f 3b ec a2 3f b8 64 d7 f3 b9 e0 ec 66 96 f4 d8 b5 10 4c 16 7f 56 4c 72 c5 e5 92 8f 7b e7 d1 59 e3 5b a3 7
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OK Server: Apache Last-Modified: Thu, 16 Feb 2017 01:32:04 GMT Accept-Ranges: bytes Content-Type: application/x-javascript Vary: Accept-Encoding Content-Encoding: gzip Cache-Control: max-age=78 Expires: Tue, 21 Mar 2017 13:06:03 GMT Date: Tue, 21 Mar 2017 13:04:45 GMT Content-Length: 6767 Connection: keep-alive Data Raw: 1f 8b 08 00 00 00 00 00 00 00 e5 3c 6b 73 db 46 92 9f c9 5f 31 e2 6d 99 e0 0a 02 25 3b 8e 37 62 b8 89 2c cb bb da b3 2d 97 24 27 9b 52 b4 0a 44 0e 49 c4 20 c0 05 40 4b 5a 85 55 f7 37 ee ef dd 2f b9 7e cc 0c 66 00 50 8f 54 1e 7b 75 da 87 49 60 a6 a7 a7 df dd d3 43 6f b2 4c 46 45 94 26 42 7a 85 9f f8 59 ef d6 3c c9 bd d4 5f f6 6e a3 89 b7 91 9c a5 e7 fc a9 a0 4f 9f c2 4c 84 c3 e2 66 21 d3 89 c8 e4 3f 97 51 26 87 c3 8e 9e da 79 f2 44 3d 1c e0 9c e5 93 27 61 2f 93 c5 32 4b 44 08 40 37 b6 7b f8 3c d2 cf 22 f5 0c a1 4e 86 89 bc 12 07 59 96 66 5e 67 3f 4c 92 b4 10 93 28 19 8b 79 3a 5e c6 52 74 3b 9b e9 66 a7 db e9 0d 8a 59 96 5e 89 49 30 4a c7 72 d8 79 7b f4 ea c3 9b 83 8b 77 47 a7 17 af

Downloads files from webservers via HTTP

Show sources

Source: global traffic	HTTP traffic detected: GET /download/4pSYaW9moGNmr6yq3JeWtGpkm2dkZnBwmpbfhKKj3Jeih6iR1djXrZuV/Ziggy%20Marley(Beach%20In%20Hawaii).mp3 HTTP/1.1 Host: srv43.listentoyoutube.com User-Agent: Downloader 1.0 rv:1 (Macintosh; Mac OS X 10.11.6; en_CH) Connection: keep-alive Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /download/4pSYaW9moGNmr6yq3JeWtGpkm2dkZnBwmpbfhKKj3Jeih6iR1djXrZuV/Ziggy%20Marley(Beach%20In%20Hawaii).mp3 HTTP/1.1 Host: srv43.listentoyoutube.com User-Agent: Downloader 1.0 rv:1 (Macintosh; Mac OS X 10.11.6; en_CH) Connection: keep-alive Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /addons/mac/macUpdInstaller.dmg HTTP/1.1 Host: i1.settlings.xyz User-Agent: Downloader 1.0 rv:1 (Macintosh; Mac OS X 10.11.6; en_CH) Connection: keep-alive Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Host: www.listentoyoutube.com User-Agent: Downloader 1.0 rv:1 (Macintosh; Mac OS X 10.11.6; en_CH) Connection: keep-alive Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Host: www.listentoyoutube.com User-Agent: Downloader 1.0 rv:1 (Macintosh; Mac OS X 10.11.6; en_CH) Connection: keep-alive Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /market/domain/settlings.xyz HTTP/1.1 Host: uniregistry.com User-Agent: Downloader 1.0 rv:1 (Macintosh; Mac OS X 10.11.6; en_CH) Connection: keep-alive Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFEn0vYoYv3YGmMXeQC1oO3Fq5OaGBBQ901Cl1qCt7vNKYApl0yHU%2BPjWDwIQD397ua1b2sNq6DLB%2FHmZZQ%3D%3D HTTP/1.1 Host: ocsp.digicert.com Accept-Encoding: gzip, deflate Accept: / User-Agent: ocspd/1.0.3 Accept-Language: en-us Cache-Control: max-age=300 Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /MFYwVKADAgEAME0wSzBJMAkGBSsOAwIaBQAEFN%2BqEuMosQlBk%2BKfQoLOR0BClVijBBSxPsNpA%2Fi%2FRwHUmCYaCALvY2QrwwIQDHmpRLCMEZUgkmFf4msdgw%3D%3D HTTP/1.1 Host: ocsp.digicert.com Accept-Encoding: gzip, deflate Accept: / User-Agent: ocspd/1.0.3 Accept-Language: en-us Cache-Control: max-age=300 Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /api/download/1432806369192751/wpsilent.dmg HTTP/1.1 Host: ds2.installmac.com User-Agent: Downloader 1.0 rv:1 (Macintosh; Mac OS X 10.11.6; en_CH) Connection: keep-alive Accept-Encoding: gzip
Source: global traffic	HTTP traffic detected: GET /health?emid=df433081ec0f5a770362a867d15e78dc HTTP/1.1 Host: install.royalbgood.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: AppYS/2 CFNetwork/760.6.3 Darwin/15.6.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /install/first_time?session_id=83A3D2C7-F673-4F71-8754-6FB975CC0202&emid=df433081ec0f5a770362a867d15e78dc&app_id=1432806369192751&offer_id=000000000&os_version=10.11.6&install_version=422&r=241233615&disable_dynamic_update=0&keyboard_lang=en,de&os_lang=en&internal_download_url=http%253A%252F%252Fds2.polebeary.com%252Fapi%252Fdownload%252F1432806369192751%252Fwpsilent.dmg&identity=Royalbgood&agent_update=0&sig=YARONSHUR_SIGNATURE&silent=true HTTP/1.1 Host: install.royalbgood.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko)
Source: global traffic	HTTP traffic detected: GET /install?session_id=83A3D2C7-F673-4F71-8754-6FB975CC0202&app_id=1432806369192751&offer_id=000000000&os_version=10.11.6&install_version=422&r=241300843&disable_dynamic_update=0&emid=df433081ec0f5a770362a867d15e78dc&download_browser=&silence=true&hp=true&sp=true&keyboard_lang=en,de&os_lang=en&internal_download_url=http%253A%252F%252Fds2.polebeary.com%252Fapi%252Fdownload%252F1432806369192751%252Fwpsilent.dmg&identity=Royalbgood&download_browser=&default_browser=safari&active_browser=unknown&info_b=GkwSBEdWQ1dPU0teQxM%253D HTTP/1.1 Host: install.royalbgood.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Cookie: JSESSIONID=4BB3EDF67BD9F82138E8A18940154DF0 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /40/394021/856793/Minecraft.zip HTTP/1.1 Host: download.itnt.netdna-cdn.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: AppYS/2 CFNetwork/760.6.3 Darwin/15.6.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /report?session_id=83A3D2C7-F673-4F71-8754-6FB975CC0202&emid=df433081ec0f5a770362a867d15e78dc&os_version=10.11.6&is_set_hp_approved=true HTTP/1.1 Host: report.royalbgood.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: AppYS/2 CFNetwork/760.6.3 Darwin/15.6.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /report?session_id=83A3D2C7-F673-4F71-8754-6FB975CC0202&emid=df433081ec0f5a770362a867d15e78dc&os_version=10.11.6&is_set_hp_approved=true&is_set_sp_approved=true&is_install_accepted=true&install_id=1432806369192751&chrome_hp_set=false&firefox_hp_set=false HTTP/1.1 Host: report.royalbgood.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: AppYS/2 CFNetwork/760.6.3 Darwin/15.6.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /report?session_id=83A3D2C7-F673-4F71-8754-6FB975CC0202&emid=df433081ec0f5a770362a867d15e78dc&os_version=10.11.6&is_set_hp_approved=true&is_set_sp_approved=true&is_install_accepted=true&install_id=1432806369192751&chrome_hp_set=false&firefox_hp_set=false&is_hp_set=true&safari_hp_set=true HTTP/1.1 Host: report.royalbgood.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: AppYS/2 CFNetwork/760.6.3 Darwin/15.6.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /report?session_id=83A3D2C7-F673-4F71-8754-6FB975CC0202&emid=df433081ec0f5a770362a867d15e78dc&os_version=10.11.6&is_set_hp_approved=true&is_set_sp_approved=true&is_install_accepted=true&install_id=1432806369192751&chrome_hp_set=false&firefox_hp_set=false&is_hp_set=true&safari_hp_set=true&chrome_sp_set=false&firefox_sp_set=false HTTP/1.1 Host: report.royalbgood.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: AppYS/2 CFNetwork/760.6.3 Darwin/15.6.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /extensions/2c3520930158d3c15879d50bf67f837a.zip HTTP/1.1 Host: storage.royalbgood.com Accept: / Accept-Language: en-us Connection: keep-alive Accept-Encoding: gzip, deflate User-Agent: AppYS/2 CFNetwork/760.6.3 Darwin/15.6.0 (x86_64)
Source: global traffic	HTTP traffic detected: GET /startpage/ HTTP/1.1 Host: www.apple.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /startpage/ HTTP/1.1 Host: www.apple.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1 Host: www.apple.com Accept: text/html,application/xhtml+xml,application/xml;q=0.9,/;q=0.8 Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Accept-Encoding: gzip, deflate Connection: keep-alive
Source: global traffic	HTTP traffic detected: GET /ac/globalnav/3/en_US/styles/ac-globalnav.built.css HTTP/1.1 Host: www.apple.com Accept: text/css,/;q=0.1 Connection: keep-alive Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Referer: http://www.apple.com/ Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ac/globalfooter/3/en_US/styles/ac-globalfooter.built.css HTTP/1.1 Host: www.apple.com Accept: text/css,/;q=0.1 Connection: keep-alive Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Referer: http://www.apple.com/ Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ac/localnav/3.0/styles/ac-localnav.built.css HTTP/1.1 Host: www.apple.com Accept: text/css,/;q=0.1 Connection: keep-alive Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Referer: http://www.apple.com/ Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /wss/fonts?families=SF+Pro,v1\|SF+Pro+Icons,v1 HTTP/1.1 Host: www.apple.com Accept: text/css,/;q=0.1 Connection: keep-alive Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Referer: http://www.apple.com/ Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /ac/globalnav/3/en_US/scripts/ac-globalnav.built.js HTTP/1.1 Host: www.apple.com Accept: / Connection: keep-alive Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Referer: http://www.apple.com/ Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /metrics/ac-analytics/1.1/scripts/ac-analytics.js HTTP/1.1 Host: www.apple.com Accept: / Connection: keep-alive Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Referer: http://www.apple.com/ Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: GET /metrics/ac-analytics/1.1/scripts/auto-init.js HTTP/1.1 Host: www.apple.com Accept: / Connection: keep-alive Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Referer: http://www.apple.com/ Accept-Encoding: gzip, deflate
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OK Server: Apache Last-Modified: Fri, 12 Feb 2016 19:36:34 GMT Accept-Ranges: bytes Content-Length: 412 Content-Type: application/x-javascript Cache-Control: max-age=66 Expires: Tue, 21 Mar 2017 13:05:51 GMT Date: Tue, 21 Mar 2017 13:04:45 GMT Connection: keep-alive Data Raw: 28 66 75 6e 63 74 69 6f 6e 28 29 7b 76 61 72 20 69 3d 22 61 6e 61 6c 79 74 69 63 73 2d 70 61 67 65 2d 76 69 65 77 2d 64 61 74 61 22 3b 76 61 72 20 6c 3d 72 65 71 75 69 72 65 28 22 61 63 2d 61 6e 61 6c 79 74 69 63 73 22 29 3b 76 61 72 20 68 3d 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 22 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 22 3a 22 61 74 74 61 63 68 45 76 65 6e 74 22 3b 0a 76 61 72 20 6a 3d 64 6f 63 75 6d 65 6e 74 2e 61 64 64 45 76 65 6e 74 4c 69 73 74 65 6e 65 72 3f 22 22 3a 22 6f 6e 22 3b 76 61 72 20 67 3d 7b 7d 3b 76 61 72 20 6b 3b 64 6f 63 75 6d 65 6e 74 5b 68 5d 28 6a 2b 22 72 65 61 64 79 73 74 61 74 65 63 68 61 6e 67 65 22 2c 66 75 6e 63 74 69 6f 6e 28 29 7b 69 66 28 64 6f
Source: global traffic	HTTP traffic detected: GET /ac/globalfooter/3/en_US/scripts/ac-globalfooter.built.js HTTP/1.1 Host: www.apple.com Accept: / Connection: keep-alive Cookie: s_fid=5F94603991263979-399A94B2623A4A36; s_vi=[CS]v1\|2BE4139305013CEC-40000130A0006326[CE]; s_vnum_n2_us=4\|1 User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/601.7.7 (KHTML, like Gecko) Version/9.1.2 Safari/601.7.7 Accept-Language: en-us Referer: http://www.apple.com/ Accept-Encoding: gzip, deflate

Performs DNS lookups

Show sources

Source: unknown

DNS traffic detected: queries for: www.google.com

Reads from file descriptors related to (network) sockets

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Reads from socket in process:
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Reads from socket in process:
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Reads from socket in process:
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Reads from socket in process:
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Reads from socket in process:

Urls found in memory or binary data

Show sources

Source: MacInstaller.dmg

String found in binary or memory: http://www.apple.com/dtds/propertylist-1.0.dtd

Uses HTTPS

Show sources

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49241
Source: unknown	Network traffic detected: HTTP traffic on port 49294 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49281 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49269
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49264
Source: unknown	Network traffic detected: HTTP traffic on port 49254 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49293
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49258
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49256
Source: unknown	Network traffic detected: HTTP traffic on port 49293 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49273
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49248
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49249
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49257
Source: unknown	Network traffic detected: HTTP traffic on port 49289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49291 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49261 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49249 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49283
Source: unknown	Network traffic detected: HTTP traffic on port 49252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49257 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49269 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49277
Source: unknown	Network traffic detected: HTTP traffic on port 49273 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49283 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49265
Source: unknown	Network traffic detected: HTTP traffic on port 49282 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49270 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49276
Source: unknown	Network traffic detected: HTTP traffic on port 49265 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49247 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49277 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49248 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49281
Source: unknown	Network traffic detected: HTTP traffic on port 49253 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49241 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49264 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49259
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49270
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49263
Source: unknown	Network traffic detected: HTTP traffic on port 49260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49254
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49253
Source: unknown	Network traffic detected: HTTP traffic on port 49263 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49266
Source: unknown	Network traffic detected: HTTP traffic on port 49262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49294
Source: unknown	Network traffic detected: HTTP traffic on port 49258 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49260
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49291
Source: unknown	Network traffic detected: HTTP traffic on port 49274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49259 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49266 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49280
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49247
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49282

Writes from file descriptors related to (network) sockets

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Writes from socket in process:
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Writes from socket in process:
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Writes from socket in process:
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Writes from socket in process:
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Writes from socket in process:

Detected TCP or UDP traffic on non-standard ports

Show sources

Source: global traffic

TCP traffic: 192.168.0.50:5353 -> 224.0.0.251:5353

Boot Survival:

Creates memory-persistent launch services

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)

Launch agent/daemon created with KeepAlive and/or RunAtLoad, file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.aBQ78C -> /Users/vreni/Library/LaunchAgents/Royalbgood.uadpte.plist

Creates user-wide 'launchd' managed services aka launch agents

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent created file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.tAy8tC -> /Users/vreni/Library/LaunchAgents/Royalbgood.dolnwoad.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent created file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.rMJ0NR -> /Users/vreni/Library/LaunchAgents/Royalbgood.btvlit.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent created file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.GmpGQh -> /Users/vreni/Library/LaunchAgents/Royalbgood.AppVemoral.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent created file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.aBQ78C -> /Users/vreni/Library/LaunchAgents/Royalbgood.uadpte.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent created file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.EwEv40 -> /Users/vreni/Library/LaunchAgents/Royalbgood.disable.plist

Persistence and Installation Behavior:

Creates application bundles containing icon files

Show sources

Source: /bin/cp (PID: 491)	Icon file created: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/Resources/Icon.icns
Source: /bin/cp (PID: 491)	Icon file created: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/Resources/Logo.icns
Source: /bin/cp (PID: 492)	Icon file created: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/Resources/Icon.icns
Source: /bin/cp (PID: 492)	Icon file created: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/Resources/Logo.icns

Reads data from the local random generator

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	Random device file read: /dev/random
Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	Random device file read: /dev/random
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Random device file read: /dev/random
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Random device file read: /dev/random
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Random device file read: /dev/random
Source: /usr/bin/hdiutil (PID: 472)	Random device file read: /dev/random
Source: /usr/bin/hdiutil (PID: 475)	Random device file read: /dev/random
Source: /System/Library/PrivateFrameworks/DiskImages.framework/Resources/diskimages-helper (PID: 477)	Random device file read: /dev/random
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Random device file read: /dev/random
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 488)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 488)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 490)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 490)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 500)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 500)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 506)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 506)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 520)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 520)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 532)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 532)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 547)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 547)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 551)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 551)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 552)	Random device file read: /dev/random
Source: /usr/bin/osascript (PID: 552)	Random device file read: /dev/random
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	Random device file read: /dev/random
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Random device file read: /dev/random
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Random device file read: /dev/random
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Random device file read: /dev/random
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Random device file read: /dev/random
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Random device file read: /dev/random
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Random device file read: /dev/random
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Random device file read: /dev/random
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Random device file read: /dev/random
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Random device file read: /dev/random
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Random device file read: /dev/random
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Random device file read: /dev/random
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Random device file read: /dev/random
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Random device file read: /dev/random
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Random device file read: /dev/random
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Random device file read: /dev/random
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Random device file read: /dev/urandom
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Random device file read: /dev/random
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Random device file read: /dev/random
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Random device file read: /dev/random

Uses AppleKeyboardLayouts bundle containing keyboard layouts

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /usr/bin/osascript (PID: 488)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /usr/bin/osascript (PID: 490)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /usr/bin/osascript (PID: 500)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /usr/bin/osascript (PID: 506)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /usr/bin/osascript (PID: 520)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /usr/bin/osascript (PID: 532)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /usr/bin/osascript (PID: 547)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /usr/bin/osascript (PID: 551)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /usr/bin/osascript (PID: 552)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	AppleKeyboardLayouts info plist opened: /System/Library/Keyboard Layouts/AppleKeyboardLayouts.bundle/Contents/Info.plist

Uses the Python framework

Show sources

Source: /usr/bin/xattr (PID: 493)

Python framework application: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python

Writes property list (.plist) files to disk

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.7lNPVo
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.wEuAMu
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.cG392y
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.kJsop6
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.sov0H5
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.xE5HHs
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.GVtLG9
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.Lxk3dh
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.tlwJNt
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.KHE5NK
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.UgZz9E
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.SDkxxy
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.yafVJR
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.VnxRQp
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.MlxdCx
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.cM9vVi
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.tAy8tC
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.rMJ0NR
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.GmpGQh
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.aBQ78C
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.EwEv40
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.xEbu95
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.FB0nOJ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Binary plist file created: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.zvPiuV
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.fJkCzf
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.1gUiEj
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Safari/Extensions/.dat.nosync01e7.UHelM4
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.PGUE0s
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Binary plist file created: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.04rM1i
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Binary plist file created: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.BCvTMg
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.niAQDW
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.YB6LiN
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.aO0uTx
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.ctG12F
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.oMakCY
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.X5i0Px
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.QUqYFw
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.VSzBnP
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.0k5znF
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.X8XNkk
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.EMT3wM
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.fdcfHa
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dZuATb
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.El5kIS
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.qC2tds
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.1zRwOn
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.5F19hw
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.5hqPmI
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dHCzx4
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.HRUUxZ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.5PkSIY
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.nbfwNb
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.zEbNNQ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.Laq6zJ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.a1bpmA
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.hbI2NI
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.RbJmST
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dbrTcG
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.z4pLhP
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.2zzPLP
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.aWM8OU
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.ZmLdrd
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dxWVRC
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.46Tk98
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.hLjLf7
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.Lir9ZO
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.8UoxWm
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.EctCqe
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.UZBwcw
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.VJRUAp
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.0ef569
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.rnmhZA
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.9CvXe8
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.3pkCMQ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dqiMCV
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.5ZhY5y
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.VUqc2x
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.wB8wxu
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.AgIn7f
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.rjv1iy
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.gDP3bS
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.ke1a35
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.Nle0Q3
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.svOJf3
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.BmpCxV
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.gSvhFG
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.URzpn6
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.yahwbh
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.oXh7wA
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.7IjQJm
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.arq8Di
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.TMAsos
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.cpND2f
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.mOPdnb
Source: /bin/cp (PID: 491)	XML plist file created: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/_CodeSignature/CodeResources
Source: /bin/cp (PID: 491)	XML plist file created: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/Info.plist
Source: /bin/cp (PID: 491)	Binary plist file created: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/Resources/CompleterWindow.nib
Source: /bin/cp (PID: 491)	Binary plist file created: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/Resources/English.lproj/MainMenu.nib
Source: /bin/cp (PID: 491)	Binary plist file created: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/Resources/UtilWindowController.nib
Source: /bin/cp (PID: 492)	XML plist file created: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/_CodeSignature/CodeResources
Source: /bin/cp (PID: 492)	XML plist file created: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/Info.plist
Source: /bin/cp (PID: 492)	Binary plist file created: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/Resources/CompleterWindow.nib
Source: /bin/cp (PID: 492)	Binary plist file created: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/Resources/English.lproj/MainMenu.nib
Source: /bin/cp (PID: 492)	Binary plist file created: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/Resources/UtilWindowController.nib
Source: /usr/bin/unzip (PID: 528)	Binary plist file created: /private/var/folders/rz/z4lzdb9n2yg9fdd643nf823w0000gn/T/5D8C775D-6525-4E56-A99A-DD048A3BF0D0/extension.txt
Source: /usr/bin/unzip (PID: 528)	XML plist file created: /private/var/folders/rz/z4lzdb9n2yg9fdd643nf823w0000gn/T/5D8C775D-6525-4E56-A99A-DD048A3BF0D0/Extensions.plist
Source: /usr/bin/unzip (PID: 528)	XML plist file created: /private/var/folders/rz/z4lzdb9n2yg9fdd643nf823w0000gn/T/5D8C775D-6525-4E56-A99A-DD048A3BF0D0/Info.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync01f9.pI0tRR
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Binary plist file created: /Users/vreni/Library/Safari/lock/.dat.nosync01fb.MPHGta
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Binary plist file created: /Users/vreni/Library/Safari/.dat.nosync01fb.bUuBFy
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync0209.HPnB9u
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Binary plist file created: /Users/vreni/Library/Safari/lock/.dat.nosync0216.83yHAq
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Binary plist file created: /Users/vreni/Library/Safari/.dat.nosync0216.CzQYLs
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Binary plist file created: /Users/vreni/Library/Safari/lock/.dat.nosync0224.b6afY6
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Binary plist file created: /Users/vreni/Library/Caches/Metadata/Safari/History/http:%2F%2Fwww.apple.com%2Fstartpage%2F.webhistory
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Binary plist file created: /Users/vreni/Library/Caches/Metadata/Safari/History/http:%2F%2Fwww.apple.com%2F.webhistory
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Binary plist file created: /Users/vreni/Library/Safari/.dat.nosync0224.NZjHOh
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Binary plist file created: /Users/vreni/Library/Safari/Extensions/.dat.nosync0224.rwrzcG
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	XML plist file created: /Users/vreni/Library/Preferences/.dat.nosync0229.AQkmzx

Changes permissions of written Mach-O files

Show sources

Source: /bin/cp (PID: 491)	Permissions modifiied for written 64-bit Mach-O /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS: bits: - usr: rx grp: rx all: rwx
Source: /bin/cp (PID: 492)	Permissions modifiied for written 64-bit Mach-O /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/MacOS/AppYS: bits: - usr: rx grp: rx all: rwx

Creates application bundles

Show sources

Source: /bin/cp (PID: 491)	Bundle Info.plist file created: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/Info.plist
Source: /bin/cp (PID: 492)	Bundle Info.plist file created: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/Info.plist

Creates code signed application bundles

Show sources

Source: /bin/cp (PID: 491)	Bundle code signature resource file created: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/_CodeSignature/CodeResources
Source: /bin/cp (PID: 492)	Bundle code signature resource file created: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/_CodeSignature/CodeResources

Creates hidden files, links and/or directories

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Hidden file created: /Users/vreni/Desktop/.dat.nosync01c9.Sg7Uz9
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Hidden file created: /Users/vreni/Desktop/.dat.nosync01c9.TMnowj
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Hidden file created: /Users/vreni/Library/Application Support/osxDownloader/.dat.nosync01c9.1L866T
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.7lNPVo
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.wEuAMu
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.cG392y
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.kJsop6
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.sov0H5
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.xE5HHs
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.GVtLG9
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.Lxk3dh
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.tlwJNt
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.KHE5NK
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.UgZz9E
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.SDkxxy
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.yafVJR
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.VnxRQp
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.MlxdCx
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.cM9vVi
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Applications/Royalbgood/.dat.nosync01e7.iUNcYq
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Applications/Royalbgood/.dat.nosync01e7.1CfKdG
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.tAy8tC
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.rMJ0NR
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.GmpGQh
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.aBQ78C
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.EwEv40
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.xEbu95
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.FB0nOJ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.pZTvyh
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.zvPiuV
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Logs/.dat.nosync01e7.mGUGLu
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.fJkCzf
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /var/folders/rz/z4lzdb9n2yg9fdd643nf823w0000gn/T/5D8C775D-6525-4E56-A99A-DD048A3BF0D0/.dat.nosync01e7.Fs1LhF
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.1gUiEj
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Safari/Extensions/.dat.nosync01e7.UHelM4
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.PGUE0s
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.M9JNDK
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.04rM1i
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Logs/.dat.nosync01e7.GC6ybs
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.xKA3Zf
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.BCvTMg
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.niAQDW
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Logs/.dat.nosync01e7.MMkZor
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.YB6LiN
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.aO0uTx
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.ctG12F
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.oMakCY
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.X5i0Px
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.QUqYFw
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.VSzBnP
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.0k5znF
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.X8XNkk
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.EMT3wM
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.fdcfHa
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dZuATb
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.El5kIS
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.qC2tds
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.1zRwOn
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.5F19hw
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.5hqPmI
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dHCzx4
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.HRUUxZ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.5PkSIY
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.nbfwNb
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.zEbNNQ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.Laq6zJ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.a1bpmA
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.hbI2NI
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.RbJmST
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dbrTcG
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.z4pLhP
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.2zzPLP
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.aWM8OU
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.ZmLdrd
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dxWVRC
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.46Tk98
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.hLjLf7
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.Lir9ZO
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.8UoxWm
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.EctCqe
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.UZBwcw
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.VJRUAp
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.0ef569
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.rnmhZA
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.9CvXe8
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.3pkCMQ
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.dqiMCV
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.5ZhY5y
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.VUqc2x
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.wB8wxu
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.AgIn7f
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.rjv1iy
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.gDP3bS
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.ke1a35
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.Nle0Q3
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.svOJf3
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.BmpCxV
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.gSvhFG
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.URzpn6
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.yahwbh
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.oXh7wA
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.7IjQJm
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.arq8Di
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.TMAsos
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.cpND2f
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01e7.mOPdnb
Source: /usr/bin/unzip (PID: 528)	Hidden file created: /var/folders/rz/z4lzdb9n2yg9fdd643nf823w0000gn/T/5D8C775D-6525-4E56-A99A-DD048A3BF0D0/__MACOSX/._Royalbgood.safariextz
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync01f9.pI0tRR
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Hidden file created: /Users/vreni/Library/Safari/lock/.dat.nosync01fb.MPHGta
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Hidden file created: /Users/vreni/Library/Safari/.dat.nosync01fb.bUuBFy
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync0209.HPnB9u
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Hidden file created: /Users/vreni/Library/Safari/lock/.dat.nosync0216.83yHAq
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Hidden file created: /Users/vreni/Library/Safari/.dat.nosync0216.CzQYLs
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Hidden file created: /Users/vreni/Library/Safari/lock/.dat.nosync0224.b6afY6
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Hidden file created: /Users/vreni/Library/Safari/.dat.nosync0224.NZjHOh
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Hidden file created: /Users/vreni/Library/Safari/Extensions/.dat.nosync0224.rwrzcG
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Hidden file created: /Users/vreni/Library/Preferences/.dat.nosync0229.AQkmzx

Creates launch services that monitor directory changes

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon created with WatchPaths, file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.EwEv40 -> /Users/vreni/Library/LaunchAgents/Royalbgood.disable.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon created with WatchPaths, file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.tAy8tC -> /Users/vreni/Library/LaunchAgents/Royalbgood.dolnwoad.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon created with WatchPaths, file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.GmpGQh -> /Users/vreni/Library/LaunchAgents/Royalbgood.AppVemoral.plist

Creates launch services that start periodically

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon created with StartInterval and/or StartCalendarInterval, file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.aBQ78C -> /Users/vreni/Library/LaunchAgents/Royalbgood.uadpte.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon created with StartInterval and/or StartCalendarInterval, file moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.rMJ0NR -> /Users/vreni/Library/LaunchAgents/Royalbgood.btvlit.plist

Executes Apple scripts and/or other OSA language scripts with shell command 'osascript'

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'System Events' to key code 63 tell application 'System Events' to key code 59 tell application 'System Events' to key code 98 using {control down}
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Finder' set windowCount to number of windows repeat with x from 1 to windowCount set winName to (name of front window) if (winName is equal to 'Installer') then close window x end if end repeat end tell
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'System Preferences' set the current pane to pane id 'com.apple.preference.dock' end tell
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of window 'General' to {0.00, 0.00, 1.00, 1.00}
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' close (every window ) end tell
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of window 'Search' to {400.00, 53.00, 401.00, 54.00}
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to launch
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of the front window to {0, 0, 0, 0}
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of window 'Extensions' to {400.00, 23.00, 401.00, 24.00}
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of window 'Extensions' to {399.00, -115.00, 400.00, -114.00}

Executes commands using a shell command-line interpreter

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 457)	Shell command executed: sh -c '/Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader'
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 472)	Shell command executed: sh -c hdiutil attach '/Users/vreni/Library/Application Support/osxDownloader/item-511797823.355455.dmg'
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 475)	Shell command executed: sh -c hdiutil attach '/Users/vreni/Library/Application Support/osxDownloader/item-511797831.419019.dmg'
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Shell command executed: sh -c xar --dump-toc=/var/folders/rz/z4lzdb9n2yg9fdd643nf823w0000gn/T/bbb.xml -f /Users/vreni/Library/Safari/Extensions/Royalbgood.safariextz
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Shell command executed: sh -c xar --dump-toc=/var/folders/rz/z4lzdb9n2yg9fdd643nf823w0000gn/T/bbb.xml -f /Users/vreni/Library/Safari/Extensions/Royalbgood.safariextz

Explicitly loads/starts launch services

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon loaded: /bin/launchctl load -F -w /Users/vreni/Library/LaunchAgents/Royalbgood.dolnwoad.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon loaded: /bin/launchctl load -F -w /Users/vreni/Library/LaunchAgents/Royalbgood.btvlit.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon loaded: /bin/launchctl load -F -w /Users/vreni/Library/LaunchAgents/Royalbgood.AppVemoral.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon loaded: /bin/launchctl load -F -w /Users/vreni/Library/LaunchAgents/Royalbgood.uadpte.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launch agent/daemon loaded: /bin/launchctl load -F -w /Users/vreni/Library/LaunchAgents/Royalbgood.disable.plist

Opens the Safari browser app

Show sources

Source: /usr/libexec/xpcproxy (PID: 507)	Safari app opened: /Applications/Safari.app/Contents/MacOS/Safari
Source: /usr/libexec/xpcproxy (PID: 534)	Safari app opened: /Applications/Safari.app/Contents/MacOS/Safari
Source: /usr/libexec/xpcproxy (PID: 548)	Safari app opened: /Applications/Safari.app/Contents/MacOS/Safari

Reads launchservices plist files

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /usr/bin/osascript (PID: 500)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /usr/bin/osascript (PID: 500)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Reads the Safari version file

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)

Safari PLIST file read: /Applications/Safari.app/Contents/version.plist

Reads user launchservices plist file containing default apps for corresponding filetypes

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /usr/bin/osascript (PID: 500)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Preferences launchservices plist file read: /Users/vreni/Library/Preferences/com.apple.LaunchServices/com.apple.launchservices.secure.plist

Uses AppleScript framework/components containing Apple Script related functionalities

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /usr/bin/osascript (PID: 488)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /usr/bin/osascript (PID: 488)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /usr/bin/osascript (PID: 490)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /usr/bin/osascript (PID: 490)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /usr/bin/osascript (PID: 500)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /usr/bin/osascript (PID: 500)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /usr/bin/osascript (PID: 506)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /usr/bin/osascript (PID: 506)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /usr/bin/osascript (PID: 520)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /usr/bin/osascript (PID: 520)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /usr/bin/osascript (PID: 532)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /usr/bin/osascript (PID: 532)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /usr/bin/osascript (PID: 547)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /usr/bin/osascript (PID: 547)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /usr/bin/osascript (PID: 551)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /usr/bin/osascript (PID: 551)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist
Source: /usr/bin/osascript (PID: 552)	AppleScript framework/component info plist opened: /System/Library/Components/AppleScript.component/Contents/Info.plist
Source: /usr/bin/osascript (PID: 552)	AppleScript framework/component info plist opened: /System/Library/PrivateFrameworks/AppleScript.framework/Resources/Info.plist

Uses AppleScript scripting additions containing additional functionalities for Apple Scripts

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 488)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 488)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 490)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 490)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 500)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 500)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 506)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 506)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 520)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 520)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 532)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 532)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 547)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 547)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 551)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 551)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 552)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/Digital Hub Scripting.osax/Contents/Info.plist
Source: /usr/bin/osascript (PID: 552)	AppleScript scripting addition info plist opened: /System/Library/ScriptingAdditions/StandardAdditions.osax/Contents/Info.plist

Uses CFNetwork bundle containing interfaces for network communication (HTTP, sockets, and Bonjour)

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	CFNetwork info plist opened: /System/Library/Frameworks/CFNetwork.framework/Resources/Info.plist

Writes 64-bit Mach-O files to disk

Show sources

Source: /bin/cp (PID: 491)	File written: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS
Source: /bin/cp (PID: 492)	File written: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/MacOS/AppYS

Writes Safari extension files to disk

Show sources

Source: /usr/bin/unzip (PID: 528)	Safari extension file created: /private/var/folders/rz/z4lzdb9n2yg9fdd643nf823w0000gn/T/5D8C775D-6525-4E56-A99A-DD048A3BF0D0/Royalbgood.safariextz
Source: /bin/cp (PID: 529)	Safari extension file created: /Users/vreni/Library/Safari/Extensions/Royalbgood.safariextz
Source: /bin/cp (PID: 530)	Safari extension file created: /Users/vreni/Library/Safari/Extensions/Royalbgood.safariextz

Writes ZIP files to disk

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)

ZIP file created: /private/var/folders/rz/z4lzdb9n2yg9fdd643nf823w0000gn/T/5D8C775D-6525-4E56-A99A-DD048A3BF0D0/.dat.nosync01e7.Fs1LhF

Writes icon files to disk

Show sources

Source: /bin/cp (PID: 491)	File written: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/Resources/Icon.icns
Source: /bin/cp (PID: 491)	File written: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/Resources/Logo.icns
Source: /bin/cp (PID: 492)	File written: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/Resources/Icon.icns
Source: /bin/cp (PID: 492)	File written: /Applications/Royalbgood/Uninstall Royalbgood.app/Contents/Resources/Logo.icns

Attaches disk images with shell command 'hdiutil'

Show sources

Source: /bin/sh (PID: 472)	Hdiutil command executed: hdiutil attach /Users/vreni/Library/Application Support/osxDownloader/item-511797823.355455.dmg
Source: /bin/sh (PID: 475)	Hdiutil command executed: hdiutil attach /Users/vreni/Library/Application Support/osxDownloader/item-511797831.419019.dmg

Installs Safari extensions

Show sources

Source: /bin/cp (PID: 529)

Safari extension file created: /Users/vreni/Library/Safari/Extensions/Royalbgood.safariextz

Queries for attached disk images with shell command 'hdiutil'

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Hdiutil command executed: /usr/bin/hdiutil info -plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Hdiutil command executed: /usr/bin/hdiutil info -plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Hdiutil command executed: /usr/bin/hdiutil info -plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Hdiutil command executed: /usr/bin/hdiutil info -plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Hdiutil command executed: /usr/bin/hdiutil info -plist

Terminates several processes with shell command 'killall'

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)

Killall command executed: /usr/bin/killall -9 Safari

Uses Apple scripts to automate UI tasks of Safari

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of window 'General' to {0.00, 0.00, 1.00, 1.00}
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' close (every window ) end tell
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of window 'Search' to {400.00, 53.00, 401.00, 54.00}
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to launch
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of the front window to {0, 0, 0, 0}
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of window 'Extensions' to {400.00, 23.00, 401.00, 24.00}
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Osascript command executed: /usr/bin/osascript -e tell application 'Safari' to set the bounds of window 'Extensions' to {399.00, -115.00, 400.00, -114.00}

Uses Apple scripts to automate UI tasks of system preferences

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)

Osascript command executed: /usr/bin/osascript -e tell application 'System Preferences' set the current pane to pane id 'com.apple.preference.dock' end tell

Uses Apple scripts to close windows

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)

Osascript command executed: /usr/bin/osascript -e tell application 'Finder' set windowCount to number of windows repeat with x from 1 to windowCount set winName to (name of front window) if (winName is equal to 'Installer') then close window x end if end repeat end tell

Uses Apple scripts to enumerate windows

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)

Uses Apple scripts to simulate keyboard events

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)

Osascript command executed: /usr/bin/osascript -e tell application 'System Events' to key code 63 tell application 'System Events' to key code 59 tell application 'System Events' to key code 98 using {control down}

Writes Mach-O files to unusual directories

Show sources

Source: /bin/cp (PID: 491)

64-bit Mach-O written to unusual path: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS

Data Obfuscation:

Imports the IOKit library (often used to register services)

Show sources

Source: initial sample	Static MACH information: dylib_command -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit
Source: initial sample	Static MACH information: dylib_command -> /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

Imports the Security library (often used for certificate, key, keychain, or secure transport handling)

Show sources

Source: initial sample	Static MACH information: dylib_command -> /System/Library/Frameworks/Security.framework/Versions/A/Security
Source: initial sample	Static MACH information: dylib_command -> /System/Library/Frameworks/Security.framework/Versions/A/Security

System Summary:

Classification label

Show sources

Source: classification engine

Classification label: mal100.evad.adwa.spyw.troj.macDMG@0/183@30/0

HIPS / PFW / Operating System Protection Evasion:

Reads the sysctl safe boot value (probably to check if the system is in safe boot mode)

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Sysctl read request: kern.safeboot (1.66)
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Sysctl read request: kern.safeboot (1.66)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	Sysctl read request: kern.safeboot (1.66)
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Sysctl read request: kern.safeboot (1.66)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Sysctl read request: kern.safeboot (1.66)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Sysctl read request: kern.safeboot (1.66)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Sysctl read request: kern.safeboot (1.66)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Sysctl read request: kern.safeboot (1.66)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Sysctl read request: kern.safeboot (1.66)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Sysctl read request: kern.safeboot (1.66)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Sysctl read request: kern.safeboot (1.66)

Removes the quarantine attribute from files that is used to protect users from malware

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)

Xattr command executed: /usr/bin/xattr -d -r com.apple.quarantine /Applications/Royalbgood/Uninstall Royalbgood.app

Hooking and other Techniques for Hiding and Protection:

Moves itself during installation or deletes itself after installation

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	File deleted: /Users/vreni/Desktop/Ziggy Marley(Beach In Hawaii).mp3.part
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	File deleted: /Users/vreni/Library/Application Support/osxDownloader/item-511797823.355455.dmg.part
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	File moved: /Users/vreni/Desktop/.dat.nosync01c9.Sg7Uz9 -> /Users/vreni/Desktop/Ziggy Marley(Beach In Hawaii).mp3
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	File moved: /Users/vreni/Desktop/.dat.nosync01c9.TMnowj -> /Users/vreni/Desktop/Ziggy Marley(Beach In Hawaii).mp3
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	File moved: /Users/vreni/Library/Application Support/osxDownloader/.dat.nosync01c9.1L866T -> /Users/vreni/Library/Application Support/osxDownloader/item-511797823.355455.dmg
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	File moved: /Users/vreni/Library/Application Support/osxDownloader/item-511797831.419019.dmg.part -> /Users/vreni/Library/Application Support/osxDownloader/item-511797831.419019.dmg
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File deleted: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/data.data
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File deleted: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/window_1.data
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File deleted: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/windows.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.7lNPVo -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.wEuAMu -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.cG392y -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.kJsop6 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.sov0H5 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.xE5HHs -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.GVtLG9 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.Lxk3dh -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.tlwJNt -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.KHE5NK -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.UgZz9E -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.SDkxxy -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.yafVJR -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.VnxRQp -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.MlxdCx -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.cM9vVi -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.tAy8tC -> /Users/vreni/Library/LaunchAgents/Royalbgood.dolnwoad.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.rMJ0NR -> /Users/vreni/Library/LaunchAgents/Royalbgood.btvlit.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.GmpGQh -> /Users/vreni/Library/LaunchAgents/Royalbgood.AppVemoral.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.aBQ78C -> /Users/vreni/Library/LaunchAgents/Royalbgood.uadpte.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/LaunchAgents/.dat.nosync01e7.EwEv40 -> /Users/vreni/Library/LaunchAgents/Royalbgood.disable.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.xEbu95 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.FB0nOJ -> /Users/vreni/Library/Preferences/com.apple.dock.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.pZTvyh -> /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/data.data
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.zvPiuV -> /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/windows.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Logs/.dat.nosync01e7.mGUGLu -> /Users/vreni/Library/Logs/ExecErrors.txt
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.fJkCzf -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.1gUiEj -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Safari/Extensions/.dat.nosync01e7.UHelM4 -> /Users/vreni/Library/Safari/Extensions/Extensions.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.PGUE0s -> /Users/vreni/Library/Preferences/com.apple.Safari.Extensions.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.M9JNDK -> /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/data.data
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.04rM1i -> /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/windows.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Logs/.dat.nosync01e7.GC6ybs -> /Users/vreni/Library/Logs/ExecErrors.txt
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.xKA3Zf -> /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/data.data
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/.dat.nosync01e7.BCvTMg -> /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState/windows.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.niAQDW -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Logs/.dat.nosync01e7.MMkZor -> /Users/vreni/Library/Logs/ExecErrors.txt
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.YB6LiN -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.aO0uTx -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.ctG12F -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.oMakCY -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.X5i0Px -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.QUqYFw -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.VSzBnP -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.0k5znF -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.X8XNkk -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.EMT3wM -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.fdcfHa -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.dZuATb -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.El5kIS -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.qC2tds -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.1zRwOn -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.5F19hw -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.5hqPmI -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.dHCzx4 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.HRUUxZ -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.5PkSIY -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.nbfwNb -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.zEbNNQ -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.Laq6zJ -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.a1bpmA -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.hbI2NI -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.RbJmST -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.dbrTcG -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.z4pLhP -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.2zzPLP -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.aWM8OU -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.ZmLdrd -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.dxWVRC -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.46Tk98 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.hLjLf7 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.Lir9ZO -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.8UoxWm -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.EctCqe -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.UZBwcw -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.VJRUAp -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.0ef569 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.rnmhZA -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.9CvXe8 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.3pkCMQ -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.dqiMCV -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.5ZhY5y -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.VUqc2x -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.wB8wxu -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.AgIn7f -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.rjv1iy -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.gDP3bS -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.ke1a35 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.Nle0Q3 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.svOJf3 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.BmpCxV -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.gSvhFG -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.URzpn6 -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.yahwbh -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.oXh7wA -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.7IjQJm -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.arq8Di -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.TMAsos -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.cpND2f -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01e7.mOPdnb -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Directory deleted: /Users/vreni/Library/Saved Application State/com.apple.Safari.savedState
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	File moved: /Users/vreni/Library/Preferences/.dat.nosync01f9.pI0tRR -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	File deleted: /Users/vreni/Library/Safari/lock/details.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	File moved: /Users/vreni/Library/Safari/lock/.dat.nosync01fb.MPHGta -> /Users/vreni/Library/Safari/lock/details.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	File moved: /Users/vreni/Library/Safari/.dat.nosync01fb.bUuBFy -> /Users/vreni/Library/Safari/LastSession.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Directory deleted: /Users/vreni/Library/Safari/lock
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	File moved: /Users/vreni/Library/Preferences/.dat.nosync0209.HPnB9u -> /Users/vreni/Library/Preferences/com.Royalbgood.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	File deleted: /Users/vreni/Library/Safari/lock/details.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	File moved: /Users/vreni/Library/Safari/lock/.dat.nosync0216.83yHAq -> /Users/vreni/Library/Safari/lock/details.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	File moved: /Users/vreni/Library/Safari/.dat.nosync0216.CzQYLs -> /Users/vreni/Library/Safari/LastSession.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Directory deleted: /Users/vreni/Library/Safari/lock
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	File deleted: /Users/vreni/Library/Safari/lock/details.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	File moved: /Users/vreni/Library/Safari/lock/.dat.nosync0224.b6afY6 -> /Users/vreni/Library/Safari/lock/details.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	File moved: /Users/vreni/Library/Safari/.dat.nosync0224.NZjHOh -> /Users/vreni/Library/Safari/LastSession.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	File moved: /Users/vreni/Library/Safari/Extensions/.dat.nosync0224.rwrzcG -> /Users/vreni/Library/Safari/Extensions/Extensions.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Directory deleted: /Users/vreni/Library/Safari/lock
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	File moved: /Users/vreni/Library/Preferences/.dat.nosync0229.AQkmzx -> /Users/vreni/Library/Preferences/com.Royalbgood.plist

Writes HTML files with suspicious file extensions used to disguise malicious content

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)

HTML file created with suspicious file extension: /Users/vreni/Desktop/Ziggy Marley(Beach In Hawaii).mp3

Language, Device and Operating System Detection:

Reads the system or server version plist file

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/Ziggy MarleyBeach In Hawaii_mp3.app/Contents/MacOS/macLauncher (PID: 455)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /usr/bin/osascript (PID: 488)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /usr/bin/osascript (PID: 490)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 493)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 493)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /usr/bin/osascript (PID: 500)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /usr/bin/osascript (PID: 506)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /usr/bin/osascript (PID: 520)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /usr/bin/osascript (PID: 532)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /usr/bin/osascript (PID: 547)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /usr/bin/osascript (PID: 551)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /usr/bin/osascript (PID: 552)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	System or server version plist file read: /System/Library/CoreServices/SystemVersion.plist

Reads hardware related sysctl values

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Sysctl read request: hw.availcpu (6.25)
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Sysctl read request: hw.ncpu (6.3)
Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Sysctl read request: hw.availcpu (6.25)
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Sysctl read request: hw.ncpu (6.3)
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	Sysctl read request: hw.availcpu (6.25)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	Sysctl read request: hw.ncpu (6.3)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Sysctl read request: hw.ncpu (6.3)
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Sysctl read request: hw.availcpu (6.25)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Sysctl read request: hw.availcpu (6.25)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Sysctl read request: hw.ncpu (6.3)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Sysctl read request: hw.availcpu (6.25)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Sysctl read request: hw.ncpu (6.3)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Sysctl read request: hw.availcpu (6.25)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Sysctl read request: hw.ncpu (6.3)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Sysctl read request: hw.availcpu (6.25)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Sysctl read request: hw.ncpu (6.3)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Sysctl read request: hw.availcpu (6.25)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Sysctl read request: hw.ncpu (6.3)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Sysctl read request: hw.availcpu (6.25)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Sysctl read request: hw.ncpu (6.3)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Sysctl read request: hw.cpu_freq (6.15)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Sysctl read request: hw.availcpu (6.25)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Sysctl read request: hw.ncpu (6.3)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Sysctl read request: hw.cpu_freq (6.15)

Reads the kernel OS version value

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)	Sysctl read request: kern.osversion (1.65)
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Sysctl read request: kern.osversion (1.65)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 498)	Sysctl read request: kern.osversion (1.65)
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Sysctl read request: kern.osversion (1.65)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 505)	Sysctl read request: kern.osversion (1.65)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Sysctl read request: kern.osversion (1.65)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 521)	Sysctl read request: kern.osversion (1.65)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Sysctl read request: kern.osversion (1.65)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 538)	Sysctl read request: kern.osversion (1.65)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Sysctl read request: kern.osversion (1.65)
Source: /Users/vreni/Library/Application Support/Royalbgood/Royalbgood.app/Contents/MacOS/AppYS (PID: 553)	Sysctl read request: kern.osversion (1.65)

Reads the systems OS release and/or type

Show sources

Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Sysctl requested: kern.ostype (1.1)
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Sysctl requested: kern.osrelease (1.2)
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 493)	Sysctl requested: kern.ostype (1.1)
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 493)	Sysctl requested: kern.osrelease (1.2)
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Sysctl requested: kern.ostype (1.1)
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Sysctl requested: kern.osrelease (1.2)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Sysctl requested: kern.ostype (1.1)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Sysctl requested: kern.osrelease (1.2)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Sysctl requested: kern.ostype (1.1)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Sysctl requested: kern.osrelease (1.2)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Sysctl requested: kern.ostype (1.1)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Sysctl requested: kern.osrelease (1.2)

Reads the systems hostname

Show sources

Source: /bin/sh (PID: 457)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 472)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 475)	Sysctl requested: kern.hostname (1.10)
Source: /Volumes/Installer/Installer.app/Contents/MacOS/AppYS (PID: 487)	Sysctl requested: kern.hostname (1.10)
Source: /System/Library/Frameworks/Python.framework/Versions/2.7/Resources/Python.app/Contents/MacOS/Python (PID: 493)	Sysctl requested: kern.hostname (1.10)
Source: /Applications/System Preferences.app/Contents/MacOS/System Preferences (PID: 501)	Sysctl requested: kern.hostname (1.10)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 507)	Sysctl requested: kern.hostname (1.10)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 534)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 540)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 546)	Sysctl requested: kern.hostname (1.10)
Source: /Applications/Safari.app/Contents/MacOS/Safari (PID: 548)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 555)	Sysctl requested: kern.hostname (1.10)
Source: /bin/sh (PID: 561)	Sysctl requested: kern.hostname (1.10)

Executes the "ioreg" command used to gather hardware information (I/O kit registry)

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)

IOreg executable: /usr/sbin/ioreg -> /usr/sbin/ioreg -l

Queries the unique Apple serial number of the machine

Show sources

Source: /Users/vreni/Desktop/unpack/Downloader/.app/Downloader.app/Contents/MacOS/Downloader (PID: 457)

IOPlatformSerialNumber keyword found in command: /usr/bin/awk /usr/bin/awk /IOPlatformSerialNumber/ { print $4 }

Runtime Messages

Command:	open
Exitcode:	0
Killed:	False
Standard Output:
Standard Error:

Yara Overview

No Yara matches

Screenshot

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Error!

Analysis Report

Overview

General Information

Detection

Classification

Signature Overview

Spam, unwanted Advertisements and Ransom Demands:

Networking:

Boot Survival:

Persistence and Installation Behavior:

Data Obfuscation:

System Summary:

HIPS / PFW / Operating System Protection Evasion:

Hooking and other Techniques for Hiding and Protection:

Language, Device and Operating System Detection:

Runtime Messages

Yara Overview

Screenshot