Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.

THG29

macrumors newbie
Original poster
Apr 12, 2025
1
0
I need some help.

I have been investigating unusual behavior that seems to be a shell-like environment. Id appreciate input from anyone with DFIR, Apple admin or system internals experience

I was opened up to another environment in my calendat with meetings and facetimes, A free form. I had co-pilot installed randmly along with capcut, freeform, you name it. I have dozens of files on my computer like sirimembers.sqlite3 Swift GRDB. Evidence of Jet UI Framework being triggerted by onboarding Siri Interface

Strange Folers/Files
AlgorythmConfig.json
Ruby
Sandbox
Scripting Additions
Staged DriverExtensuions
Staged Extensions
Mobile Apple Buleroot.db-shm
Mobile Apple Blueroot.Plist
Linux - Bridge Storage
Files Extension Manager
Remote Locall Files Model
Cloud store-Wal
Client_ab_version
MMKV_WebinfoID
MMKV_Webinfo.CRC
Projectinfo.plist
Callendar.sqlitedb-wal
KTConfig.plist
mmkvdefault

The list goes on The list goes on and i dont want to sound crazy i just would like someone to take a look please or give me some advice.

Thank you.
 
Register on MacRumors! This sidebar will go away, and you'll see fewer ads.