MORE LOGS ETC DIRT FBI MALWARE EXPOSURE THEY STOLE MY GIRLFRIEND 1/3/36 JORGE BUSTOS LETTER AT HOSPITAL

by snloa

61 WAS 16 IN MY ARTS CHANNEL JB HYBRIDED MUCH MORE COMING JORGES WIFES NAME HIGHLIGHTED VIA DARK LINE AT TOP

PEDOS EN CARGADO THE BEAUTIFUL FBI

day ashley stole 1:3:26 Download

day ashley stolen 1:3:26-2 Download

Terminal Saved Output 3:1:26 Download

Terminal Saved Output 1:3.26 they force ashley into life of SEXUAL SLAVERY Download

ONLY LOGS PRESENT 10 MINUTES FROM THE TIME SHE DUMPED ME SHE WAS FORCED TO THIS PROVES ALL AT THIS POINT I WAS SLEEPING

555 FOR 15 IE TAX SEASON WAS USED IN MY ART SERIES THESE CHILD MOLESTERS THE ONE WORKING RIGHT NOW RESPONSIBLE CHOSE TO SEXUALLY ENSLAVE HER WHY WONT SHE SELL ME HER PHO NE FEDDY SCARED OF FORENSICS ? DO DRUG TESTS? PEDOS EN CARGADO WESTERN DISTRICT OF ARKANSAS NOW I PAY THE HOSTING FOR 20 YEARS THE DROP BOX AND WRECK FEDERAL LIVES IN THE COURT ROOM AFTER I WILL SELF IMMOLATE MYSELF WITH THE GASALINE THEY SOLD ME AND HAVE KNOWN THEYRE COERCING THIS

Last login: Sun Mar 1 11:13:58 on ttys003

quattro@Quattros-MacBook-Pro ~ % open /Users/quattro/Desktop/MessagesBackup/0d/13/6FF7CA51-F2D5-4B45-B3B4-06F7F9015FDE/6FD7127B-01EA-4E39-A419-F2E4A9C81F57IMG_1217.heic

quattro@Quattros-MacBook-Pro ~ % codesign -dv –verbose=4 /usr/libexec/cameracaptured

Executable=/usr/libexec/cameracaptured

Identifier=com.apple.cameracaptured

Format=Mach-O universal (x86_64 arm64e)

CodeDirectory v=20400 size=753 flags=0x0(none) hashes=13+7 location=embedded

Platform identifier=26

VersionPlatform=1

VersionMin=1704448

VersionSDK=1704448

Hash type=sha256 size=32

CandidateCDHash sha256=0f941477c955ca8f679027324558c9c6a9f4eb20

CandidateCDHashFull sha256=0f941477c955ca8f679027324558c9c6a9f4eb2005830e2f7caf741426c1f4e3

Hash choices=sha256

CMSDigest=0f941477c955ca8f679027324558c9c6a9f4eb2005830e2f7caf741426c1f4e3

CMSDigestType=2

Executable Segment base=0

Executable Segment limit=16384

Executable Segment flags=0x1

Page size=4096

CDHash=0f941477c955ca8f679027324558c9c6a9f4eb20

Signature size=4442

Authority=Software Signing

Authority=Apple Code Signing Certification Authority

Authority=Apple Root CA

Signed Time=Nov 16, 2025 at 9:33:05 PM

Info.plist entries=22

TeamIdentifier=not set

Sealed Resources=none

Internal requirements count=1 size=72

quattro@Quattros-MacBook-Pro ~ % sudo launchctl print system | grep -A5 cameracaptured

Password:

536 – com.apple.cameracaptured

0 – com.apple.postfix.newaliases

0 – com.apple.xpc.roleaccountd

432 – com.apple.eligibilityd

0 0 com.apple.ionodecache

427 – com.apple.nsurlsessiond_privileged

—

0x25d13 M D com.apple.cameracaptured

0x12b03 M A com.apple.CoreServices.coreservicesd

0 M D com.apple.accessories.externalaccessory-server

0x2b80f M A com.apple.audioanalyticsd

0x26c6f M D com.apple.WirelessRadioManager

0x1de03 M A com.apple.mobileassetd.cache-delete

quattro@Quattros-MacBook-Pro ~ % csrutil status

System Integrity Protection status: enabled.

quattro@Quattros-MacBook-Pro ~ %

Last login: Sun Mar 1 12:18:47 on ttys005

quattro@Quattros-MacBook-Pro ~ % log stream –predicate ‘subsystem == “com.apple.TCC”‘ –info

Filtering the log data using “subsystem == “com.apple.TCC””

Timestamp Thread Type Activity PID TTL

2026-03-01 12:26:41.600292-0800 0x863f61 Info 0xfb531 36062 0 replayd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=36062.12, function=TCCAccessRequest, service=kTCCServiceScreenCapture,

2026-03-01 12:26:41.600456-0800 0xd90a9d Default 0xfb531 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=36062, sender_uid=501, sender_auid=501, function=TCCAccessRequest, msgID=36062.12

2026-03-01 12:26:41.602051-0800 0xd90a9d Info 0xfb531 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36062.12, msg={

service=”kTCCServiceScreenCapture”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:66928, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=2 (0x2)

TCCD_MSG_ID=”36062.12″

}

2026-03-01 12:26:41.602270-0800 0xd90a9d Info 0xfb531 36145 0 tccd: [com.apple.TCC:access] AttributionChain: responsible={TCCDProcess: identifier=com.apple.Terminal, pid=1795, auid=501, euid=501, responsible_path=/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal, binary_path=/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal}, accessing={TCCDProcess: identifier=com.apple.appkit.xpc.ThemeWidgetControlViewService, pid=66928, auid=501, euid=501, binary_path=/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/ThemeWidgetControlViewService.xpc/Contents/MacOS/ThemeWidgetControlViewService}, requesting={TCCDProcess: identifier=com.apple.replayd, pid=36062, auid=501, euid=501, binary_path=/usr/libexec/replayd},

2026-03-01 12:26:41.602295-0800 0xd90a9d Info 0xfb531 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.replayd, pid=36062> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceScreenCapture (composed to parent: (null))

2026-03-01 12:26:41.602364-0800 0x863f61 Info 0xfb531 36062 0 replayd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0x941090000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0x8eb3d4a832ea43d7>: 0

“auth_value” => <uint64: 0x8eb3d4a832ea43c7>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0x8eb3d4a832ea43df>: 1

“auth_reason” => <uint64: 0x8eb3d4a832ea438f>: 11

}

2026-03-01 12:26:41.602307-0800 0xd90a9d Info 0xfb531 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.appkit.xpc.ThemeWidgetControlViewService, pid=66928> has the com.apple.private.tcc.allow entitlement for service kTCCServiceScreenCapture (composed to parent: (null))

2026-03-01 12:26:41.602440-0800 0x863f61 Info 0xfb532 36062 0 replayd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=36062.13, function=TCCAccessRequest, service=kTCCServiceScreenCapture,

2026-03-01 12:26:41.602318-0800 0xd90a9d Info 0xfb531 36145 0 tccd: [com.apple.TCC:access] Auth:Allowed (Entitled) to kTCCServiceScreenCapture for TCCDProcess: identifier=com.apple.appkit.xpc.ThemeWidgetControlViewService, pid=66928, auid=501, euid=501, binary_path=/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/ThemeWidgetControlViewService.xpc/Contents/MacOS/ThemeWidgetControlViewService; checked by TCCDProcess: identifier=com.apple.replayd, pid=36062, auid=501, euid=501, binary_path=/usr/libexec/replayd because: IsTCCManager

2026-03-01 12:26:41.602338-0800 0xd90a9d Info 0xfb531 36145 0 tccd: [com.apple.TCC:access] system tccd handled entitlements check for: kTCCServiceScreenCapture

2026-03-01 12:26:41.602525-0800 0xdd0b1a Default 0xfb532 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=36062, sender_uid=501, sender_auid=501, function=TCCAccessRequest, msgID=36062.13

2026-03-01 12:26:41.602552-0800 0xdd0b1a Info 0xfb532 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36062.13, msg={

service=”kTCCServiceScreenCapture”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:66928, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=0 (0x0)

TCCD_MSG_ID=”36062.13″

}

2026-03-01 12:26:41.602688-0800 0xdd0b1a Info 0xfb532 36145 0 tccd: [com.apple.TCC:access] AttributionChain: responsible={TCCDProcess: identifier=com.apple.Terminal, pid=1795, auid=501, euid=501, responsible_path=/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal, binary_path=/System/Applications/Utilities/Terminal.app/Contents/MacOS/Terminal}, accessing={TCCDProcess: identifier=com.apple.appkit.xpc.ThemeWidgetControlViewService, pid=66928, auid=501, euid=501, binary_path=/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/ThemeWidgetControlViewService.xpc/Contents/MacOS/ThemeWidgetControlViewService}, requesting={TCCDProcess: identifier=com.apple.replayd, pid=36062, auid=501, euid=501, binary_path=/usr/libexec/replayd},

2026-03-01 12:26:41.602701-0800 0xdd0b1a Info 0xfb532 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.replayd, pid=36062> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceScreenCapture (composed to parent: (null))

2026-03-01 12:26:41.602731-0800 0xdd0b1a Info 0xfb532 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.appkit.xpc.ThemeWidgetControlViewService, pid=66928> has the com.apple.private.tcc.allow entitlement for service kTCCServiceScreenCapture (composed to parent: (null))

2026-03-01 12:26:41.602770-0800 0xdd0b1a Info 0xfb532 36145 0 tccd: [com.apple.TCC:access] Auth:Allowed (Entitled) to kTCCServiceScreenCapture for TCCDProcess: identifier=com.apple.appkit.xpc.ThemeWidgetControlViewService, pid=66928, auid=501, euid=501, binary_path=/System/Library/Frameworks/AppKit.framework/Versions/C/XPCServices/ThemeWidgetControlViewService.xpc/Contents/MacOS/ThemeWidgetControlViewService; checked by TCCDProcess: identifier=com.apple.replayd, pid=36062, auid=501, euid=501, binary_path=/usr/libexec/replayd because: IsTCCManager

2026-03-01 12:26:41.602788-0800 0xdd0b1a Info 0xfb532 36145 0 tccd: [com.apple.TCC:access] system tccd handled entitlements check for: kTCCServiceScreenCapture

2026-03-01 12:26:41.602811-0800 0x863f61 Info 0xfb532 36062 0 replayd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0x941090000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0x8eb3d4a832ea43d7>: 0

“auth_value” => <uint64: 0x8eb3d4a832ea43c7>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0x8eb3d4a832ea43df>: 1

“auth_reason” => <uint64: 0x8eb3d4a832ea438f>: 11

}

2026-03-01 12:27:01.246153-0800 0xde0e34 Info 0x1005e0 90833 0 screencapture: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=90833.1, function=TCCAccessRequest, service=kTCCServiceListenEvent,

2026-03-01 12:27:01.246626-0800 0xd90a9d Default 0x1005e0 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=90833, sender_uid=501, sender_auid=501, function=TCCAccessRequest, msgID=90833.1

2026-03-01 12:27:01.246689-0800 0xd90a9d Info 0x1005e0 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=90833.1, msg={

require_purpose=<xpc_null>

service=”kTCCServiceListenEvent”

function=”TCCAccessRequest”

preflight=true

target_token={NULL}

TCCD_MSG_ID=”90833.1″

background_session=false

}

2026-03-01 12:27:01.247137-0800 0xd90a9d Info 0x1005e0 36145 0 tccd: [com.apple.TCC:access] AttributionChain: responsible={TCCDProcess: identifier=com.apple.systemuiserver, pid=726, auid=501, euid=501, responsible_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer, binary_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer}, requesting={TCCDProcess: identifier=com.apple.screencapture, pid=90833, auid=501, euid=501, binary_path=/usr/sbin/screencapture},

2026-03-01 12:27:01.247169-0800 0xd90a9d Info 0x1005e0 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.screencapture, pid=90833> has the com.apple.private.tcc.allow entitlement for service kTCCServiceListenEvent (composed to parent: (null))

2026-03-01 12:27:01.247190-0800 0xd90a9d Info 0x1005e0 36145 0 tccd: [com.apple.TCC:access] Auth:Allowed (Entitled) to kTCCServiceListenEvent for TCCDProcess: identifier=com.apple.screencapture, pid=90833, auid=501, euid=501, binary_path=/usr/sbin/screencapture; checked by TCCDProcess: identifier=com.apple.screencapture, pid=90833, auid=501, euid=501, binary_path=/usr/sbin/screencapture because: IsRequestor

2026-03-01 12:27:01.247204-0800 0xd90a9d Info 0x1005e0 36145 0 tccd: [com.apple.TCC:access] system tccd handled entitlements check for: kTCCServiceListenEvent

2026-03-01 12:27:01.247244-0800 0xde0e34 Info 0x1005e0 90833 0 screencapture: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0x1011729b0> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0x942a54215823c1df>: 0

“auth_value” => <uint64: 0x942a54215823c1cf>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0x942a54215823c1d7>: 1

“auth_reason” => <uint64: 0x942a54215823c187>: 11

}

2026-03-01 12:27:01.247617-0800 0x10a6 Info 0xfed3b 407 0 WindowServer: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=407.282, function=TCCAccessRequest, service=kTCCServiceListenEvent, target_token={pid:90833, auid:501, euid:501},

2026-03-01 12:27:01.247733-0800 0xde0e64 Default 0xfed3b 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=407, sender_uid=88, sender_auid=-1, function=TCCAccessRequest, msgID=407.282

2026-03-01 12:27:01.247767-0800 0xde0e64 Info 0xfed3b 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=407.282, msg={

require_purpose=<xpc_null>

service=”kTCCServiceListenEvent”

function=”TCCAccessRequest”

preflight=true

target_token={pid:90833, auid:501, euid:501}

TCCD_MSG_ID=”407.282″

background_session=false

}

2026-03-01 12:27:01.248020-0800 0xde0e64 Info 0xfed3b 36145 0 tccd: [com.apple.TCC:access] AttributionChain: responsible={TCCDProcess: identifier=com.apple.systemuiserver, pid=726, auid=501, euid=501, responsible_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer, binary_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer}, accessing={TCCDProcess: identifier=com.apple.screencapture, pid=90833, auid=501, euid=501, binary_path=/usr/sbin/screencapture}, requesting={TCCDProcess: identifier=com.apple.WindowServer, pid=407, auid=88, euid=88, binary_path=/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer},

2026-03-01 12:27:01.248041-0800 0xde0e64 Info 0xfed3b 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.WindowServer, pid=407> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceListenEvent (composed to parent: (null))

2026-03-01 12:27:01.248051-0800 0xde0e64 Info 0xfed3b 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.screencapture, pid=90833> has the com.apple.private.tcc.allow entitlement for service kTCCServiceListenEvent (composed to parent: (null))

2026-03-01 12:27:01.248067-0800 0xde0e64 Info 0xfed3b 36145 0 tccd: [com.apple.TCC:access] Auth:Allowed (Entitled) to kTCCServiceListenEvent for TCCDProcess: identifier=com.apple.screencapture, pid=90833, auid=501, euid=501, binary_path=/usr/sbin/screencapture; checked by TCCDProcess: identifier=com.apple.WindowServer, pid=407, auid=88, euid=88, binary_path=/System/Library/PrivateFrameworks/SkyLight.framework/Versions/A/Resources/WindowServer because: IsTCCManager

2026-03-01 12:27:01.248077-0800 0xde0e64 Info 0xfed3b 36145 0 tccd: [com.apple.TCC:access] system tccd handled entitlements check for: kTCCServiceListenEvent

2026-03-01 12:27:01.248104-0800 0x10a6 Info 0xfed3b 407 0 WindowServer: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0x8d53fe000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0xba6a02f7bf3cc977>: 0

“auth_value” => <uint64: 0xba6a02f7bf3cc967>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0xba6a02f7bf3cc97f>: 1

“auth_reason” => <uint64: 0xba6a02f7bf3cc92f>: 11

}

2026-03-01 12:27:01.268724-0800 0x863f61 Info 0xfb533 36062 0 replayd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=36062.14, function=TCCAccessRequest, service=kTCCServiceScreenCapture,

2026-03-01 12:27:01.268777-0800 0xd90a9d Default 0xfb533 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=36062, sender_uid=501, sender_auid=501, function=TCCAccessRequest, msgID=36062.14

2026-03-01 12:27:01.268817-0800 0xd90a9d Info 0xfb533 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36062.14, msg={

service=”kTCCServiceScreenCapture”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:90833, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=2 (0x2)

TCCD_MSG_ID=”36062.14″

}

2026-03-01 12:27:01.268980-0800 0xd90a9d Info 0xfb533 36145 0 tccd: [com.apple.TCC:access] AttributionChain: responsible={TCCDProcess: identifier=com.apple.systemuiserver, pid=726, auid=501, euid=501, responsible_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer, binary_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer}, accessing={TCCDProcess: identifier=com.apple.screencapture, pid=90833, auid=501, euid=501, binary_path=/usr/sbin/screencapture}, requesting={TCCDProcess: identifier=com.apple.replayd, pid=36062, auid=501, euid=501, binary_path=/usr/libexec/replayd},

2026-03-01 12:27:01.268998-0800 0xd90a9d Info 0xfb533 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.replayd, pid=36062> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceScreenCapture (composed to parent: (null))

2026-03-01 12:27:01.269006-0800 0xd90a9d Info 0xfb533 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.systemuiserver, pid=726> has the com.apple.private.tcc.allow entitlement for service kTCCServiceScreenCapture (composed to parent: (null))

2026-03-01 12:27:01.269033-0800 0x863f61 Info 0xfb533 36062 0 replayd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0x941090000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0x8eb3d4a832ea43d7>: 0

“auth_value” => <uint64: 0x8eb3d4a832ea43c7>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0x8eb3d4a832ea43df>: 1

“auth_reason” => <uint64: 0x8eb3d4a832ea438f>: 11

}

2026-03-01 12:27:01.269014-0800 0xd90a9d Info 0xfb533 36145 0 tccd: [com.apple.TCC:access] Auth:Allowed (Entitled) to kTCCServiceScreenCapture because accessing process TCCDProcess: identifier=com.apple.screencapture, pid=90833, auid=501, euid=501, binary_path=/usr/sbin/screencapture has the check-allow-on-responsible-process entitlement and responsible process TCCDProcess: identifier=com.apple.systemuiserver, pid=726, auid=501, euid=501, responsible_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer, binary_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer has corresponding allow entitlement

2026-03-01 12:27:01.269019-0800 0xd90a9d Info 0xfb533 36145 0 tccd: [com.apple.TCC:access] system tccd handled entitlements check for: kTCCServiceScreenCapture

2026-03-01 12:27:01.269099-0800 0x863f61 Info 0xfb534 36062 0 replayd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=36062.15, function=TCCAccessRequest, service=kTCCServiceScreenCapture,

2026-03-01 12:27:01.269141-0800 0xd90a9d Default 0xfb534 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=36062, sender_uid=501, sender_auid=501, function=TCCAccessRequest, msgID=36062.15

2026-03-01 12:27:01.269167-0800 0xd90a9d Info 0xfb534 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36062.15, msg={

service=”kTCCServiceScreenCapture”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:90833, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=0 (0x0)

TCCD_MSG_ID=”36062.15″

}

2026-03-01 12:27:01.269303-0800 0xd90a9d Info 0xfb534 36145 0 tccd: [com.apple.TCC:access] AttributionChain: responsible={TCCDProcess: identifier=com.apple.systemuiserver, pid=726, auid=501, euid=501, responsible_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer, binary_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer}, accessing={TCCDProcess: identifier=com.apple.screencapture, pid=90833, auid=501, euid=501, binary_path=/usr/sbin/screencapture}, requesting={TCCDProcess: identifier=com.apple.replayd, pid=36062, auid=501, euid=501, binary_path=/usr/libexec/replayd},

2026-03-01 12:27:01.269315-0800 0xd90a9d Info 0xfb534 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.replayd, pid=36062> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceScreenCapture (composed to parent: (null))

2026-03-01 12:27:01.269322-0800 0xd90a9d Info 0xfb534 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.systemuiserver, pid=726> has the com.apple.private.tcc.allow entitlement for service kTCCServiceScreenCapture (composed to parent: (null))

2026-03-01 12:27:01.269352-0800 0x863f61 Info 0xfb534 36062 0 replayd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0x941090000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0x8eb3d4a832ea43d7>: 0

“auth_value” => <uint64: 0x8eb3d4a832ea43c7>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0x8eb3d4a832ea43df>: 1

“auth_reason” => <uint64: 0x8eb3d4a832ea438f>: 11

}

2026-03-01 12:27:01.269330-0800 0xd90a9d Info 0xfb534 36145 0 tccd: [com.apple.TCC:access] Auth:Allowed (Entitled) to kTCCServiceScreenCapture because accessing process TCCDProcess: identifier=com.apple.screencapture, pid=90833, auid=501, euid=501, binary_path=/usr/sbin/screencapture has the check-allow-on-responsible-process entitlement and responsible process TCCDProcess: identifier=com.apple.systemuiserver, pid=726, auid=501, euid=501, responsible_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer, binary_path=/System/Library/CoreServices/SystemUIServer.app/Contents/MacOS/SystemUIServer has corresponding allow entitlement

2026-03-01 12:27:01.269334-0800 0xd90a9d Info 0xfb534 36145 0 tccd: [com.apple.TCC:access] system tccd handled entitlements check for: kTCCServiceScreenCapture

2026-03-01 12:27:02.509788-0800 0xde100f Info 0xfe679 36214 0 sandboxd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=36214.114, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles,

2026-03-01 12:27:02.510300-0800 0xd90a9d Default 0xfe679 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=36214, sender_uid=0, sender_auid=-1, function=TCCAccessRequest, msgID=36214.114

2026-03-01 12:27:02.510385-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36214.114, msg={

service=”kTCCServiceSystemPolicyAllFiles”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_MESSAGE_OPTION_REQUEST_RECORD_UPGRADE_POLICY_POLICY_KEY=1 (0x1)

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_RIGHTS_MASK_KEY=5 (0x5)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:1018, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=2 (0x2)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=2 (0x2)

TCCD_MSG_ID=”36214.114″

}

2026-03-01 12:27:02.510694-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:27:02.510728-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.sandboxd, pid=36214> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceAll (composed to parent: (null))

2026-03-01 12:27:02.510905-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:27:02.510932-0800 0xd90a9d Default 0xfe679 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_CTX: msgID=36214.114, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles, preflight=yes, query=1, client_dict=(null), daemon_dict=<private>

2026-03-01 12:27:02.510951-0800 0xd90a9d Default 0xfe679 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: msgID=36214.114, attribution={accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}, },

2026-03-01 12:27:02.511959-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] IDENTITY_ATTRIBUTION: /Applications/Dropbox.app/Contents/MacOS/Dropbox[36214]: from cache: = com.getdropbox.dropbox, type 0 (97/162)

2026-03-01 12:27:02.512001-0800 0xd90a9d Default 0xfe679 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_SUBJECT: msgID=36214.114, subject=com.getdropbox.dropbox,

2026-03-01 12:27:02.512790-0800 0xd90a9d Default 0xfe679 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity staticCode]: static code for: identifier com.getdropbox.dropbox, type: 0: 0x7f4d30300 at /Applications/Dropbox.app

2026-03-01 12:27:02.530091-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.getdropbox.dropbox : identifier “com.getdropbox.dropbox” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = G7HH3F8CAK; status: 0

2026-03-01 12:27:02.530287-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.getdropbox.dropbox : anchor apple; status: -67050

2026-03-01 12:27:02.530321-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] For com.getdropbox.dropbox: matches platform requirements: No

2026-03-01 12:27:02.530339-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] -[TCCDPlatformMacOS promptingPolicyForIdentity:accessingService:withAttributionChain:]: promptPolicy = 0; isApplePlatformBinary = 0

2026-03-01 12:27:02.530393-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] Handling access request to kTCCServiceSystemPolicyAllFiles, from Sub:{com.getdropbox.dropbox}Resp:{TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, ReqResult(Auth Right: Denied (Service Policy), promptType: 1,DB Action:None)

2026-03-01 12:27:02.530420-0800 0xd90a9d Default 0xfe679 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_RESULT: msgID=36214.114, authValue=0, authReason=5, authVersion=1, desired_auth=0, error=(null),

2026-03-01 12:27:02.530594-0800 0xd90a9d Info 0xfe679 36145 0 tccd: [com.apple.TCC:access] REPLY_MSG: msg={

prompt_type=1 (0x1)

auth_value=0 (0x0)

result=false

auth_version=1 (0x1)

auth_reason=5 (0x5)

}

2026-03-01 12:27:02.530609-0800 0xd90a9d Default 0xfe679 36145 0 tccd: [com.apple.TCC:access] REPLY: (0) function=TCCAccessRequest, msgID=36214.114

2026-03-01 12:27:02.530658-0800 0xde100f Info 0xfe679 36214 0 sandboxd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0xbe1028000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0xbc79044dab330657>: 1

“auth_value” => <uint64: 0xbc79044dab33065f>: 0

“result” => <bool: 0x1feea7850>: false

“auth_version” => <uint64: 0xbc79044dab330657>: 1

“auth_reason” => <uint64: 0xbc79044dab330677>: 5

}

2026-03-01 12:27:02.530695-0800 0xde100f Info 0xfe679 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is not this process

2026-03-01 12:27:02.530704-0800 0xde100f Info 0xfe679 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is present: 0

2026-03-01 12:27:02.530709-0800 0xde100f Info 0xfe679 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Numbers of entries in cache: 5, max: 5

2026-03-01 12:27:02.530732-0800 0xde100f Info 0xfe679 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] REMOVE: (<private>, <private>)

2026-03-01 12:27:02.530779-0800 0xde100f Info 0xfe679 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] SET: (<private>, <private>) -> <private>

2026-03-01 12:27:02.530959-0800 0xde100f Info 0xfe67a 36214 0 sandboxd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd: request: msgID=36214.115, function=TCCAccessRequest, service=kTCCServiceSystemPolicyDocumentsFolder,

2026-03-01 12:27:02.531507-0800 0xd90a9c Default 0xfe67a 36307 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=501, sender_pid=36214, sender_uid=0, sender_auid=-1, function=TCCAccessRequest, msgID=36214.115

2026-03-01 12:27:02.531691-0800 0xd90a9c Info 0xfe67a 36307 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36214.115, msg={

service=”kTCCServiceSystemPolicyDocumentsFolder”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_MESSAGE_OPTION_REQUEST_RECORD_UPGRADE_POLICY_POLICY_KEY=1 (0x1)

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_RIGHTS_MASK_KEY=5 (0x5)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:1018, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=2 (0x2)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=0 (0x0)

TCCD_MSG_ID=”36214.115″

}

2026-03-01 12:27:02.532083-0800 0xd90a9c Info 0xfe67a 36307 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:27:02.532125-0800 0xd90a9c Default 0xfe67a 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_CTX: msgID=36214.115, function=TCCAccessRequest, service=kTCCServiceSystemPolicyDocumentsFolder, preflight=no, query=1, client_dict=(null), daemon_dict=<private>

2026-03-01 12:27:02.532147-0800 0xd90a9c Default 0xfe67a 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: msgID=36214.115, attribution={accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}, },

2026-03-01 12:27:02.533423-0800 0xd90a9c Info 0xfe67a 36307 0 tccd: [com.apple.TCC:access] IDENTITY_ATTRIBUTION: /Applications/Dropbox.app/Contents/MacOS/Dropbox[36214]: from cache: = com.getdropbox.dropbox, type 0 (55/77)

2026-03-01 12:27:02.533464-0800 0xd90a9c Default 0xfe67a 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_SUBJECT: msgID=36214.115, subject=com.getdropbox.dropbox,

2026-03-01 12:27:02.534687-0800 0xd90a9c Default 0xfe67a 36307 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity staticCode]: static code for: identifier com.getdropbox.dropbox, type: 0: 0xa42ccc600 at /Applications/Dropbox.app

2026-03-01 12:27:02.544428-0800 0xd90a9c Info 0xfe67a 36307 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0xa42ccc600) from com.getdropbox.dropbox : identifier “com.getdropbox.dropbox” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = G7HH3F8CAK; status: 0

2026-03-01 12:27:02.544502-0800 0xd90a9c Info 0xfe67a 36307 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0xa42ccc600) from com.getdropbox.dropbox : anchor apple; status: -67050

2026-03-01 12:27:02.544511-0800 0xd90a9c Info 0xfe67a 36307 0 tccd: [com.apple.TCC:access] For com.getdropbox.dropbox: matches platform requirements: No

2026-03-01 12:27:02.544522-0800 0xd90a9c Info 0xfe67a 36307 0 tccd: [com.apple.TCC:access] -[TCCDPlatformMacOS promptingPolicyForIdentity:accessingService:withAttributionChain:]: promptPolicy = 0; isApplePlatformBinary = 0

2026-03-01 12:27:02.544581-0800 0xd90a9c Info 0xfe67a 36307 0 tccd: [com.apple.TCC:access] Handling access request to kTCCServiceSystemPolicyDocumentsFolder, from Sub:{com.getdropbox.dropbox}Resp:{TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, ReqResult(Auth Right: Allowed (User Consent), promptType: 1,DB Action:None)

2026-03-01 12:27:02.544619-0800 0xd90a9c Default 0xfe67a 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_RESULT: msgID=36214.115, authValue=2, authReason=2, authVersion=1, desired_auth=0, error=(null),

2026-03-01 12:27:02.544827-0800 0xd90a9c Info 0xfe67a 36307 0 tccd: [com.apple.TCC:access] REPLY_MSG: msg={

prompt_type=1 (0x1)

auth_value=2 (0x2)

result=true

auth_version=1 (0x1)

auth_reason=2 (0x2)

}

2026-03-01 12:27:02.544844-0800 0xd90a9c Default 0xfe67a 36307 0 tccd: [com.apple.TCC:access] REPLY: (501) function=TCCAccessRequest, msgID=36214.115

2026-03-01 12:27:02.544895-0800 0xde100f Info 0xfe67a 36214 0 sandboxd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0xbe1028000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0xbc79044dab330657>: 1

“auth_value” => <uint64: 0xbc79044dab33064f>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0xbc79044dab330657>: 1

“auth_reason” => <uint64: 0xbc79044dab33064f>: 2

}

2026-03-01 12:27:05.083046-0800 0xde100f Info 0xfe67c 36214 0 sandboxd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=36214.116, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles,

2026-03-01 12:27:05.083160-0800 0xd90a9d Default 0xfe67c 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=36214, sender_uid=0, sender_auid=-1, function=TCCAccessRequest, msgID=36214.116

2026-03-01 12:27:05.083244-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36214.116, msg={

service=”kTCCServiceSystemPolicyAllFiles”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_MESSAGE_OPTION_REQUEST_RECORD_UPGRADE_POLICY_POLICY_KEY=1 (0x1)

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_RIGHTS_MASK_KEY=5 (0x5)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:1259, auid:-1, euid:0}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=2 (0x2)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=2 (0x2)

TCCD_MSG_ID=”36214.116″

}

2026-03-01 12:27:05.083600-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.avast.Antivirus.EndpointSecurity, pid=1259, auid=0, euid=0, binary_path=/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:27:05.083645-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.sandboxd, pid=36214> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceAll (composed to parent: (null))

2026-03-01 12:27:05.083840-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.avast.Antivirus.EndpointSecurity, pid=1259, auid=0, euid=0, binary_path=/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:27:05.083875-0800 0xd90a9d Default 0xfe67c 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_CTX: msgID=36214.116, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles, preflight=yes, query=1, client_dict=(null), daemon_dict=<private>

2026-03-01 12:27:05.083896-0800 0xd90a9d Default 0xfe67c 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: msgID=36214.116, attribution={accessing={TCCDProcess: identifier=com.avast.Antivirus.EndpointSecurity, pid=1259, auid=0, euid=0, binary_path=/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}, },

2026-03-01 12:27:05.084954-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] IDENTITY_ATTRIBUTION: /Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity[36214]: from cache: = com.avast.AAFM, type 0 (98/163)

2026-03-01 12:27:05.084979-0800 0xd90a9d Default 0xfe67c 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_SUBJECT: msgID=36214.116, subject=com.avast.AAFM,

2026-03-01 12:27:05.085680-0800 0xd90a9d Default 0xfe67c 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity staticCode]: static code for: identifier com.avast.AAFM, type: 0: 0x7f4d30300 at /Applications/Avast.app

2026-03-01 12:27:05.102981-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.avast.AAFM : identifier “com.avast.AAFM” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = “6H4HRTU5E3”; status: 0

2026-03-01 12:27:05.103294-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.avast.AAFM : anchor apple; status: -67050

2026-03-01 12:27:05.103308-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] For com.avast.AAFM: matches platform requirements: No

2026-03-01 12:27:05.103326-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] -[TCCDPlatformMacOS promptingPolicyForIdentity:accessingService:withAttributionChain:]: promptPolicy = 0; isApplePlatformBinary = 0

2026-03-01 12:27:05.103357-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] Handling access request to kTCCServiceSystemPolicyAllFiles, from Sub:{com.avast.AAFM}Resp:{TCCDProcess: identifier=com.avast.Antivirus.EndpointSecurity, pid=1259, auid=0, euid=0, binary_path=/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity}, ReqResult(Auth Right: Allowed (System Set), promptType: 1,DB Action:None)

2026-03-01 12:27:05.103375-0800 0xd90a9d Default 0xfe67c 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_RESULT: msgID=36214.116, authValue=2, authReason=4, authVersion=1, desired_auth=0, error=(null),

2026-03-01 12:27:05.103460-0800 0xd90a9d Info 0xfe67c 36145 0 tccd: [com.apple.TCC:access] REPLY_MSG: msg={

prompt_type=1 (0x1)

auth_value=2 (0x2)

result=true

auth_version=1 (0x1)

auth_reason=4 (0x4)

}

2026-03-01 12:27:05.103471-0800 0xd90a9d Default 0xfe67c 36145 0 tccd: [com.apple.TCC:access] REPLY: (0) function=TCCAccessRequest, msgID=36214.116

2026-03-01 12:27:05.103519-0800 0xde100f Info 0xfe67c 36214 0 sandboxd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0xbe1028000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0xbc79044dab330657>: 1

“auth_value” => <uint64: 0xbc79044dab33064f>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0xbc79044dab330657>: 1

“auth_reason” => <uint64: 0xbc79044dab33067f>: 4

}

2026-03-01 12:27:05.103551-0800 0xde100f Info 0xfe67c 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is not this process

2026-03-01 12:27:05.103561-0800 0xde100f Info 0xfe67c 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is present: 0

2026-03-01 12:27:05.103566-0800 0xde100f Info 0xfe67c 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Numbers of entries in cache: 5, max: 5

2026-03-01 12:27:05.103592-0800 0xde100f Info 0xfe67c 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] REMOVE: (<private>, <private>)

2026-03-01 12:27:05.103621-0800 0xde100f Info 0xfe67c 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] SET: (<private>, <private>) -> <private>

2026-03-01 12:28:44.853768-0800 0xe153f3 Info 0x1016f1 36214 0 sandboxd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=36214.117, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles,

2026-03-01 12:28:44.853900-0800 0xd90a9d Default 0x1016f1 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=36214, sender_uid=0, sender_auid=-1, function=TCCAccessRequest, msgID=36214.117

2026-03-01 12:28:44.853989-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36214.117, msg={

service=”kTCCServiceSystemPolicyAllFiles”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_MESSAGE_OPTION_REQUEST_RECORD_UPGRADE_POLICY_POLICY_KEY=1 (0x1)

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_RIGHTS_MASK_KEY=5 (0x5)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:1018, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=2 (0x2)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=2 (0x2)

TCCD_MSG_ID=”36214.117″

}

2026-03-01 12:28:44.854302-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:28:44.854339-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.sandboxd, pid=36214> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceAll (composed to parent: (null))

2026-03-01 12:28:44.854543-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:28:44.854587-0800 0xd90a9d Default 0x1016f1 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_CTX: msgID=36214.117, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles, preflight=yes, query=1, client_dict=(null), daemon_dict=<private>

2026-03-01 12:28:44.854622-0800 0xd90a9d Default 0x1016f1 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: msgID=36214.117, attribution={accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}, },

2026-03-01 12:28:44.856049-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] IDENTITY_ATTRIBUTION: /Applications/Dropbox.app/Contents/MacOS/Dropbox[36214]: from cache: = com.getdropbox.dropbox, type 0 (99/164)

2026-03-01 12:28:44.856088-0800 0xd90a9d Default 0x1016f1 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_SUBJECT: msgID=36214.117, subject=com.getdropbox.dropbox,

2026-03-01 12:28:44.857226-0800 0xd90a9d Default 0x1016f1 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity staticCode]: static code for: identifier com.getdropbox.dropbox, type: 0: 0x7f4d30300 at /Applications/Dropbox.app

2026-03-01 12:28:44.873538-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.getdropbox.dropbox : identifier “com.getdropbox.dropbox” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = G7HH3F8CAK; status: 0

2026-03-01 12:28:44.873677-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.getdropbox.dropbox : anchor apple; status: -67050

2026-03-01 12:28:44.873702-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] For com.getdropbox.dropbox: matches platform requirements: No

2026-03-01 12:28:44.873720-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] -[TCCDPlatformMacOS promptingPolicyForIdentity:accessingService:withAttributionChain:]: promptPolicy = 0; isApplePlatformBinary = 0

2026-03-01 12:28:44.873752-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] Handling access request to kTCCServiceSystemPolicyAllFiles, from Sub:{com.getdropbox.dropbox}Resp:{TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, ReqResult(Auth Right: Denied (Service Policy), promptType: 1,DB Action:None)

2026-03-01 12:28:44.873774-0800 0xd90a9d Default 0x1016f1 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_RESULT: msgID=36214.117, authValue=0, authReason=5, authVersion=1, desired_auth=0, error=(null),

2026-03-01 12:28:44.873948-0800 0xd90a9d Info 0x1016f1 36145 0 tccd: [com.apple.TCC:access] REPLY_MSG: msg={

prompt_type=1 (0x1)

auth_value=0 (0x0)

result=false

auth_version=1 (0x1)

auth_reason=5 (0x5)

}

2026-03-01 12:28:44.873965-0800 0xd90a9d Default 0x1016f1 36145 0 tccd: [com.apple.TCC:access] REPLY: (0) function=TCCAccessRequest, msgID=36214.117

2026-03-01 12:28:44.874039-0800 0xe153f3 Info 0x1016f1 36214 0 sandboxd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0xbe1028000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0xbc79044dab330657>: 1

“auth_value” => <uint64: 0xbc79044dab33065f>: 0

“result” => <bool: 0x1feea7850>: false

“auth_version” => <uint64: 0xbc79044dab330657>: 1

“auth_reason” => <uint64: 0xbc79044dab330677>: 5

}

2026-03-01 12:28:44.874075-0800 0xe153f3 Info 0x1016f1 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is not this process

2026-03-01 12:28:44.874091-0800 0xe153f3 Info 0x1016f1 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is present: 0

2026-03-01 12:28:44.874099-0800 0xe153f3 Info 0x1016f1 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Numbers of entries in cache: 5, max: 5

2026-03-01 12:28:44.874116-0800 0xe153f3 Info 0x1016f1 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] REMOVE: (<private>, <private>)

2026-03-01 12:28:44.874143-0800 0xe153f3 Info 0x1016f1 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] SET: (<private>, <private>) -> <private>

2026-03-01 12:28:44.874321-0800 0xe153f3 Info 0x1016f2 36214 0 sandboxd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd: request: msgID=36214.118, function=TCCAccessRequest, service=kTCCServiceSystemPolicyDocumentsFolder,

2026-03-01 12:28:44.874417-0800 0xde1f16 Default 0x1016f2 36307 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=501, sender_pid=36214, sender_uid=0, sender_auid=-1, function=TCCAccessRequest, msgID=36214.118

2026-03-01 12:28:44.874502-0800 0xde1f16 Info 0x1016f2 36307 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36214.118, msg={

service=”kTCCServiceSystemPolicyDocumentsFolder”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_MESSAGE_OPTION_REQUEST_RECORD_UPGRADE_POLICY_POLICY_KEY=1 (0x1)

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_RIGHTS_MASK_KEY=5 (0x5)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:1018, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=2 (0x2)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=0 (0x0)

TCCD_MSG_ID=”36214.118″

}

2026-03-01 12:28:44.874845-0800 0xde1f16 Info 0x1016f2 36307 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:28:44.874884-0800 0xde1f16 Default 0x1016f2 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_CTX: msgID=36214.118, function=TCCAccessRequest, service=kTCCServiceSystemPolicyDocumentsFolder, preflight=no, query=1, client_dict=(null), daemon_dict=<private>

2026-03-01 12:28:44.874906-0800 0xde1f16 Default 0x1016f2 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: msgID=36214.118, attribution={accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}, },

2026-03-01 12:28:44.876063-0800 0xde1f16 Info 0x1016f2 36307 0 tccd: [com.apple.TCC:access] IDENTITY_ATTRIBUTION: /Applications/Dropbox.app/Contents/MacOS/Dropbox[36214]: from cache: = com.getdropbox.dropbox, type 0 (56/78)

2026-03-01 12:28:44.876094-0800 0xde1f16 Default 0x1016f2 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_SUBJECT: msgID=36214.118, subject=com.getdropbox.dropbox,

2026-03-01 12:28:44.877097-0800 0xde1f16 Default 0x1016f2 36307 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity staticCode]: static code for: identifier com.getdropbox.dropbox, type: 0: 0xa42ccc600 at /Applications/Dropbox.app

2026-03-01 12:28:44.887245-0800 0xde1f16 Info 0x1016f2 36307 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0xa42ccc600) from com.getdropbox.dropbox : identifier “com.getdropbox.dropbox” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = G7HH3F8CAK; status: 0

2026-03-01 12:28:44.887329-0800 0xde1f16 Info 0x1016f2 36307 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0xa42ccc600) from com.getdropbox.dropbox : anchor apple; status: -67050

2026-03-01 12:28:44.887343-0800 0xde1f16 Info 0x1016f2 36307 0 tccd: [com.apple.TCC:access] For com.getdropbox.dropbox: matches platform requirements: No

2026-03-01 12:28:44.887354-0800 0xde1f16 Info 0x1016f2 36307 0 tccd: [com.apple.TCC:access] -[TCCDPlatformMacOS promptingPolicyForIdentity:accessingService:withAttributionChain:]: promptPolicy = 0; isApplePlatformBinary = 0

2026-03-01 12:28:44.887373-0800 0xde1f16 Info 0x1016f2 36307 0 tccd: [com.apple.TCC:access] Handling access request to kTCCServiceSystemPolicyDocumentsFolder, from Sub:{com.getdropbox.dropbox}Resp:{TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, ReqResult(Auth Right: Allowed (User Consent), promptType: 1,DB Action:None)

2026-03-01 12:28:44.887388-0800 0xde1f16 Default 0x1016f2 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_RESULT: msgID=36214.118, authValue=2, authReason=2, authVersion=1, desired_auth=0, error=(null),

2026-03-01 12:28:44.887487-0800 0xde1f16 Info 0x1016f2 36307 0 tccd: [com.apple.TCC:access] REPLY_MSG: msg={

prompt_type=1 (0x1)

auth_value=2 (0x2)

result=true

auth_version=1 (0x1)

auth_reason=2 (0x2)

}

2026-03-01 12:28:44.887494-0800 0xde1f16 Default 0x1016f2 36307 0 tccd: [com.apple.TCC:access] REPLY: (501) function=TCCAccessRequest, msgID=36214.118

2026-03-01 12:28:44.887551-0800 0xe153f3 Info 0x1016f2 36214 0 sandboxd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0xbe1028000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0xbc79044dab330657>: 1

“auth_value” => <uint64: 0xbc79044dab33064f>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0xbc79044dab330657>: 1

“auth_reason” => <uint64: 0xbc79044dab33064f>: 2

}

2026-03-01 12:28:50.767811-0800 0xe3a470 Info 0x1016f4 36214 0 sandboxd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=36214.119, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles,

2026-03-01 12:28:50.767919-0800 0xe3532f Default 0x1016f4 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=36214, sender_uid=0, sender_auid=-1, function=TCCAccessRequest, msgID=36214.119

2026-03-01 12:28:50.768000-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36214.119, msg={

service=”kTCCServiceSystemPolicyAllFiles”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_MESSAGE_OPTION_REQUEST_RECORD_UPGRADE_POLICY_POLICY_KEY=1 (0x1)

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_RIGHTS_MASK_KEY=5 (0x5)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:1259, auid:-1, euid:0}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=2 (0x2)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=0 (0x0)

TCCD_MSG_ID=”36214.119″

}

2026-03-01 12:28:50.768292-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.avast.Antivirus.EndpointSecurity, pid=1259, auid=0, euid=0, binary_path=/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:28:50.768321-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.sandboxd, pid=36214> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceAll (composed to parent: (null))

2026-03-01 12:28:50.768491-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.avast.Antivirus.EndpointSecurity, pid=1259, auid=0, euid=0, binary_path=/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:28:50.768517-0800 0xe3532f Default 0x1016f4 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_CTX: msgID=36214.119, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles, preflight=no, query=1, client_dict=(null), daemon_dict=<private>

2026-03-01 12:28:50.768535-0800 0xe3532f Default 0x1016f4 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: msgID=36214.119, attribution={accessing={TCCDProcess: identifier=com.avast.Antivirus.EndpointSecurity, pid=1259, auid=0, euid=0, binary_path=/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}, },

2026-03-01 12:28:50.769425-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] IDENTITY_ATTRIBUTION: /Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity[36214]: from cache: = com.avast.AAFM, type 0 (100/165)

2026-03-01 12:28:50.769444-0800 0xe3532f Default 0x1016f4 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_SUBJECT: msgID=36214.119, subject=com.avast.AAFM,

2026-03-01 12:28:50.770117-0800 0xe3532f Default 0x1016f4 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity staticCode]: static code for: identifier com.avast.AAFM, type: 0: 0x7f4d30300 at /Applications/Avast.app

2026-03-01 12:28:50.787448-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.avast.AAFM : identifier “com.avast.AAFM” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = “6H4HRTU5E3”; status: 0

2026-03-01 12:28:50.787805-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.avast.AAFM : anchor apple; status: -67050

2026-03-01 12:28:50.787822-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] For com.avast.AAFM: matches platform requirements: No

2026-03-01 12:28:50.787842-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] -[TCCDPlatformMacOS promptingPolicyForIdentity:accessingService:withAttributionChain:]: promptPolicy = 0; isApplePlatformBinary = 0

2026-03-01 12:28:50.787878-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] Handling access request to kTCCServiceSystemPolicyAllFiles, from Sub:{com.avast.AAFM}Resp:{TCCDProcess: identifier=com.avast.Antivirus.EndpointSecurity, pid=1259, auid=0, euid=0, binary_path=/Applications/Avast.app/Contents/Backend/utils/com.avast.Antivirus.EndpointSecurity.app/Contents/MacOS/com.avast.Antivirus.EndpointSecurity}, ReqResult(Auth Right: Allowed (System Set), promptType: 1,DB Action:None)

2026-03-01 12:28:50.787899-0800 0xe3532f Default 0x1016f4 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_RESULT: msgID=36214.119, authValue=2, authReason=4, authVersion=1, desired_auth=0, error=(null),

2026-03-01 12:28:50.787992-0800 0xe3532f Info 0x1016f4 36145 0 tccd: [com.apple.TCC:access] REPLY_MSG: msg={

prompt_type=1 (0x1)

auth_value=2 (0x2)

result=true

auth_version=1 (0x1)

auth_reason=4 (0x4)

}

2026-03-01 12:28:50.788005-0800 0xe3532f Default 0x1016f4 36145 0 tccd: [com.apple.TCC:access] REPLY: (0) function=TCCAccessRequest, msgID=36214.119

2026-03-01 12:28:50.788054-0800 0xe3a470 Info 0x1016f4 36214 0 sandboxd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0xbe1028000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0xbc79044dab330657>: 1

“auth_value” => <uint64: 0xbc79044dab33064f>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0xbc79044dab330657>: 1

“auth_reason” => <uint64: 0xbc79044dab33067f>: 4

}

2026-03-01 12:28:50.788087-0800 0xe3a470 Info 0x1016f4 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is not this process

2026-03-01 12:28:50.788100-0800 0xe3a470 Info 0x1016f4 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is present: 0

2026-03-01 12:28:50.788109-0800 0xe3a470 Info 0x1016f4 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Numbers of entries in cache: 5, max: 5

2026-03-01 12:28:50.788127-0800 0xe3a470 Info 0x1016f4 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] REMOVE: (<private>, <private>)

2026-03-01 12:28:50.788153-0800 0xe3a470 Info 0x1016f4 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] SET: (<private>, <private>) -> <private>

2026-03-01 12:29:06.931988-0800 0xe46a16 Info 0x1016f7 36214 0 sandboxd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd.system: request: msgID=36214.120, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles,

2026-03-01 12:29:06.932095-0800 0xe3a471 Default 0x1016f7 36145 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=0, sender_pid=36214, sender_uid=0, sender_auid=-1, function=TCCAccessRequest, msgID=36214.120

2026-03-01 12:29:06.932179-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36214.120, msg={

service=”kTCCServiceSystemPolicyAllFiles”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_MESSAGE_OPTION_REQUEST_RECORD_UPGRADE_POLICY_POLICY_KEY=1 (0x1)

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_RIGHTS_MASK_KEY=5 (0x5)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:1018, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=2 (0x2)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=2 (0x2)

TCCD_MSG_ID=”36214.120″

}

2026-03-01 12:29:06.932477-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:29:06.932510-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] <TCCDProcess: identifier=com.apple.sandboxd, pid=36214> has the com.apple.private.tcc.manager.check-by-audit-token entitlement for service kTCCServiceAll (composed to parent: (null))

2026-03-01 12:29:06.932688-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:29:06.932715-0800 0xe3a471 Default 0x1016f7 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_CTX: msgID=36214.120, function=TCCAccessRequest, service=kTCCServiceSystemPolicyAllFiles, preflight=yes, query=1, client_dict=(null), daemon_dict=<private>

2026-03-01 12:29:06.932734-0800 0xe3a471 Default 0x1016f7 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: msgID=36214.120, attribution={accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}, },

2026-03-01 12:29:06.933672-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] IDENTITY_ATTRIBUTION: /Applications/Dropbox.app/Contents/MacOS/Dropbox[36214]: from cache: = com.getdropbox.dropbox, type 0 (101/166)

2026-03-01 12:29:06.933694-0800 0xe3a471 Default 0x1016f7 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_SUBJECT: msgID=36214.120, subject=com.getdropbox.dropbox,

2026-03-01 12:29:06.934458-0800 0xe3a471 Default 0x1016f7 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity staticCode]: static code for: identifier com.getdropbox.dropbox, type: 0: 0x7f4d30300 at /Applications/Dropbox.app

2026-03-01 12:29:06.950146-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.getdropbox.dropbox : identifier “com.getdropbox.dropbox” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = G7HH3F8CAK; status: 0

2026-03-01 12:29:06.950324-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0x7f4d30300) from com.getdropbox.dropbox : anchor apple; status: -67050

2026-03-01 12:29:06.950344-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] For com.getdropbox.dropbox: matches platform requirements: No

2026-03-01 12:29:06.950368-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] -[TCCDPlatformMacOS promptingPolicyForIdentity:accessingService:withAttributionChain:]: promptPolicy = 0; isApplePlatformBinary = 0

2026-03-01 12:29:06.950405-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] Handling access request to kTCCServiceSystemPolicyAllFiles, from Sub:{com.getdropbox.dropbox}Resp:{TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, ReqResult(Auth Right: Denied (Service Policy), promptType: 1,DB Action:None)

2026-03-01 12:29:06.950432-0800 0xe3a471 Default 0x1016f7 36145 0 tccd: [com.apple.TCC:access] AUTHREQ_RESULT: msgID=36214.120, authValue=0, authReason=5, authVersion=1, desired_auth=0, error=(null),

2026-03-01 12:29:06.950630-0800 0xe3a471 Info 0x1016f7 36145 0 tccd: [com.apple.TCC:access] REPLY_MSG: msg={

prompt_type=1 (0x1)

auth_value=0 (0x0)

result=false

auth_version=1 (0x1)

auth_reason=5 (0x5)

}

2026-03-01 12:29:06.950645-0800 0xe3a471 Default 0x1016f7 36145 0 tccd: [com.apple.TCC:access] REPLY: (0) function=TCCAccessRequest, msgID=36214.120

2026-03-01 12:29:06.950714-0800 0xe46a16 Info 0x1016f7 36214 0 sandboxd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0xbe1028000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0xbc79044dab330657>: 1

“auth_value” => <uint64: 0xbc79044dab33065f>: 0

“result” => <bool: 0x1feea7850>: false

“auth_version” => <uint64: 0xbc79044dab330657>: 1

“auth_reason” => <uint64: 0xbc79044dab330677>: 5

}

2026-03-01 12:29:06.950749-0800 0xe46a16 Info 0x1016f7 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is not this process

2026-03-01 12:29:06.950762-0800 0xe46a16 Info 0x1016f7 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Credential is present: 0

2026-03-01 12:29:06.950770-0800 0xe46a16 Info 0x1016f7 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] Numbers of entries in cache: 5, max: 5

2026-03-01 12:29:06.950789-0800 0xe46a16 Info 0x1016f7 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] REMOVE: (<private>, <private>)

2026-03-01 12:29:06.950817-0800 0xe46a16 Info 0x1016f7 36214 0 sandboxd: (TCC) [com.apple.TCC:cache] SET: (<private>, <private>) -> <private>

2026-03-01 12:29:06.950980-0800 0xe46a16 Info 0x1016f8 36214 0 sandboxd: (TCC) [com.apple.TCC:access] SEND: 0/7 synchronous to com.apple.tccd: request: msgID=36214.121, function=TCCAccessRequest, service=kTCCServiceSystemPolicyDocumentsFolder,

2026-03-01 12:29:06.951091-0800 0xe3536b Default 0x1016f8 36307 0 tccd: [com.apple.TCC:access] REQUEST: tccd_uid=501, sender_pid=36214, sender_uid=0, sender_auid=-1, function=TCCAccessRequest, msgID=36214.121

2026-03-01 12:29:06.951171-0800 0xe3536b Info 0x1016f8 36307 0 tccd: [com.apple.TCC:access] REQUEST_MSG: msgID=36214.121, msg={

service=”kTCCServiceSystemPolicyDocumentsFolder”

TCCD_MSG_SPI_VERSION=2 (0x2)

function=”TCCAccessRequest”

TCCD_MSG_MESSAGE_OPTION_REQUEST_RECORD_UPGRADE_POLICY_POLICY_KEY=1 (0x1)

TCCD_MSG_REQUEST_TYPE_KEY=0 (0x0)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_RIGHTS_MASK_KEY=5 (0x5)

TCC_MSG_REQUEST_AUTHORIZATION_SUBJECT_CREDENTIAL_DICTIONARY_KEY={

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_TYPE_KEY=1 (0x1)

TCCD_MSG_CREDENTIAL_AUTHENTICATOR_AUDIT_TOKEN_KEY={pid:1018, auid:501, euid:501}

}

TCCD_MSG_MESSAGE_OPTION_REQUEST_USAGE_STRING_POLICY_KEY=2 (0x2)

TCCD_MSG_MESSAGE_OPTION_REQUEST_PROMPT_POLICY_KEY=0 (0x0)

TCCD_MSG_ID=”36214.121″

}

2026-03-01 12:29:06.951545-0800 0xe3536b Info 0x1016f8 36307 0 tccd: [com.apple.TCC:access] AttributionChain: accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd},

2026-03-01 12:29:06.951586-0800 0xe3536b Default 0x1016f8 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_CTX: msgID=36214.121, function=TCCAccessRequest, service=kTCCServiceSystemPolicyDocumentsFolder, preflight=no, query=1, client_dict=(null), daemon_dict=<private>

2026-03-01 12:29:06.951608-0800 0xe3536b Default 0x1016f8 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_ATTRIBUTION: msgID=36214.121, attribution={accessing={TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, requesting={TCCDProcess: identifier=com.apple.sandboxd, pid=36214, auid=0, euid=0, binary_path=/usr/libexec/sandboxd}, },

2026-03-01 12:29:06.952914-0800 0xe3536b Info 0x1016f8 36307 0 tccd: [com.apple.TCC:access] IDENTITY_ATTRIBUTION: /Applications/Dropbox.app/Contents/MacOS/Dropbox[36214]: from cache: = com.getdropbox.dropbox, type 0 (57/79)

2026-03-01 12:29:06.952948-0800 0xe3536b Default 0x1016f8 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_SUBJECT: msgID=36214.121, subject=com.getdropbox.dropbox,

2026-03-01 12:29:06.954035-0800 0xe3536b Default 0x1016f8 36307 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity staticCode]: static code for: identifier com.getdropbox.dropbox, type: 0: 0xa42ccc600 at /Applications/Dropbox.app

2026-03-01 12:29:06.964309-0800 0xe3536b Info 0x1016f8 36307 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0xa42ccc600) from com.getdropbox.dropbox : identifier “com.getdropbox.dropbox” and anchor apple generic and certificate 1[field.1.2.840.113635.100.6.2.6] /* exists */ and certificate leaf[field.1.2.840.113635.100.6.1.13] /* exists */ and certificate leaf[subject.OU] = G7HH3F8CAK; status: 0

2026-03-01 12:29:06.964378-0800 0xe3536b Info 0x1016f8 36307 0 tccd: [com.apple.TCC:access] -[TCCDAccessIdentity matchesCodeRequirement:]: SecStaticCodeCheckValidity() static code (0xa42ccc600) from com.getdropbox.dropbox : anchor apple; status: -67050

2026-03-01 12:29:06.964388-0800 0xe3536b Info 0x1016f8 36307 0 tccd: [com.apple.TCC:access] For com.getdropbox.dropbox: matches platform requirements: No

2026-03-01 12:29:06.964398-0800 0xe3536b Info 0x1016f8 36307 0 tccd: [com.apple.TCC:access] -[TCCDPlatformMacOS promptingPolicyForIdentity:accessingService:withAttributionChain:]: promptPolicy = 0; isApplePlatformBinary = 0

2026-03-01 12:29:06.964415-0800 0xe3536b Info 0x1016f8 36307 0 tccd: [com.apple.TCC:access] Handling access request to kTCCServiceSystemPolicyDocumentsFolder, from Sub:{com.getdropbox.dropbox}Resp:{TCCDProcess: identifier=com.getdropbox.dropbox, pid=1018, auid=501, euid=501, binary_path=/Applications/Dropbox.app/Contents/MacOS/Dropbox}, ReqResult(Auth Right: Allowed (User Consent), promptType: 1,DB Action:None)

2026-03-01 12:29:06.964430-0800 0xe3536b Default 0x1016f8 36307 0 tccd: [com.apple.TCC:access] AUTHREQ_RESULT: msgID=36214.121, authValue=2, authReason=2, authVersion=1, desired_auth=0, error=(null),

2026-03-01 12:29:06.964520-0800 0xe3536b Info 0x1016f8 36307 0 tccd: [com.apple.TCC:access] REPLY_MSG: msg={

prompt_type=1 (0x1)

auth_value=2 (0x2)

result=true

auth_version=1 (0x1)

auth_reason=2 (0x2)

}

2026-03-01 12:29:06.964529-0800 0xe3536b Default 0x1016f8 36307 0 tccd: [com.apple.TCC:access] REPLY: (501) function=TCCAccessRequest, msgID=36214.121

2026-03-01 12:29:06.964570-0800 0xe46a16 Info 0x1016f8 36214 0 sandboxd: (TCC) [com.apple.TCC:access] RECV: synchronous reply <dictionary: 0xbe1028000> { count = 5, transaction: 0, voucher = 0x0, contents =

“prompt_type” => <uint64: 0xbc79044dab330657>: 1

“auth_value” => <uint64: 0xbc79044dab33064f>: 2

“result” => <bool: 0x1feea7830>: true

“auth_version” => <uint64: 0xbc79044dab330657>: 1

“auth_reason” => <uint64: 0xbc79044dab33064f>: 2

}

Last login: Sun Mar 1 10:47:09 on ttys001

quattro@Quattros-MacBook-Pro ~ % last | head

quattro ttys001 Sun Mar 1 10:55 still logged in

quattro ttys001 Sun Mar 1 10:47 – 10:47 (00:00)

quattro ttys001 Sun Mar 1 10:45 – 10:45 (00:00)

quattro ttys001 Sun Mar 1 05:05 – 05:09 (00:03)

quattro ttys001 Sun Mar 1 04:19 – 04:19 (00:00)

quattro ttys001 Sun Mar 1 04:18 – 04:18 (00:00)

quattro ttys001 Sun Mar 1 04:16 – 04:16 (00:00)

quattro@Quattros-MacBook-Pro ~ % systemsetup -getremotelogin

You need administrator access to run this tool… exiting!

quattro@Quattros-MacBook-Pro ~ % sudo systemsetup -getremotelogin

Password:

Remote Login: Off

quattro@Quattros-MacBook-Pro ~ % last

quattro ttys004 Sun Mar 1 11:53 still logged in

quattro ttys003 Sun Mar 1 11:13 still logged in

quattro ttys002 Sun Mar 1 11:09 still logged in

quattro ttys002 Sun Mar 1 10:56 – 10:56 (00:00)

quattro ttys001 Sun Mar 1 10:55 still logged in

quattro ttys001 Sun Mar 1 10:47 – 10:47 (00:00)

quattro ttys001 Sun Mar 1 10:45 – 10:45 (00:00)

quattro ttys001 Sun Mar 1 05:05 – 05:09 (00:03)

quattro ttys001 Sun Mar 1 04:19 – 04:19 (00:00)

quattro ttys001 Sun Mar 1 04:18 – 04:18 (00:00)

quattro ttys001 Sun Mar 1 04:16 – 04:16 (00:00)

quattro ttys001 Sun Mar 1 04:15 – 04:15 (00:00)

quattro ttys001 Sun Mar 1 04:11 – 04:11 (00:00)

quattro ttys000 Sun Mar 1 03:39 still logged in

quattro console Sun Mar 1 03:32 still logged in

reboot time Sun Mar 1 03:29

shutdown time Sun Mar 1 03:28

quattro ttys000 Sat Feb 28 03:13 – 03:13 (00:00)

quattro ttys000 Sat Feb 28 01:58 – 01:58 (00:00)

quattro ttys000 Fri Feb 27 21:58 – 21:58 (00:00)

quattro ttys001 Fri Feb 27 12:01 – 12:01 (00:00)

quattro ttys000 Fri Feb 27 12:01 – 12:01 (00:00)

quattro console Fri Feb 27 12:01 – 03:28 (1+15:27)

reboot time Fri Feb 27 12:00

quattro ttys001 Fri Feb 27 11:58 – crash (00:01)

quattro ttys000 Fri Feb 27 11:58 – crash (00:01)

quattro console Fri Feb 27 11:58 – crash (00:01)

reboot time Fri Feb 27 11:57

quattro ttys001 Fri Feb 27 08:24 – 08:24 (00:00)

quattro ttys000 Fri Feb 27 07:14 – 07:14 (00:00)

quattro ttys001 Fri Feb 27 07:13 – 07:13 (00:00)

quattro ttys000 Fri Feb 27 07:08 – 07:08 (00:00)

quattro ttys001 Fri Feb 27 06:31 – 06:31 (00:00)

quattro ttys001 Fri Feb 27 06:29 – 06:29 (00:00)

quattro ttys001 Fri Feb 27 06:28 – 06:28 (00:00)

quattro ttys000 Thu Feb 26 17:53 – 17:53 (00:00)

quattro ttys000 Thu Feb 26 17:49 – 17:49 (00:00)

quattro console Thu Feb 26 15:39 – crash (20:17)

ASHLEY console Thu Feb 26 14:33 – 15:39 (01:05)

quattro ttys000 Thu Feb 26 12:45 – 12:45 (00:00)

quattro ttys001 Thu Feb 26 00:02 – 00:02 (00:00)

quattro ttys001 Wed Feb 25 23:52 – 23:52 (00:00)

quattro ttys001 Wed Feb 25 23:32 – 23:35 (00:03)

quattro ttys001 Wed Feb 25 23:32 – 23:32 (00:00)

quattro ttys001 Wed Feb 25 23:17 – 23:17 (00:00)

quattro ttys001 Wed Feb 25 23:04 – 23:04 (00:00)

quattro ttys000 Wed Feb 25 20:19 – 20:19 (00:00)

quattro console Wed Feb 25 03:36 – 14:33 (1+10:57)

reboot time Wed Feb 25 03:35

shutdown time Wed Feb 25 03:34

quattro ttys000 Tue Feb 24 18:16 – 18:16 (00:00)

quattro console Tue Feb 24 18:16 – 03:34 (09:18)

reboot time Tue Feb 24 18:16

shutdown time Tue Feb 24 18:14

quattro ttys000 Tue Feb 24 18:11 – 18:11 (00:00)

quattro ttys000 Tue Feb 24 15:20 – 15:20 (00:00)

quattro console Tue Feb 24 15:19 – 18:11 (02:51)

ASHLEY console Tue Feb 24 14:58 – 15:19 (00:21)

quattro ttys001 Tue Feb 24 06:20 – 06:20 (00:00)

quattro ttys000 Tue Feb 24 06:18 – 15:20 (09:01)

quattro ttys001 Tue Feb 24 06:07 – 06:07 (00:00)

quattro ttys000 Tue Feb 24 06:07 – 06:07 (00:00)

quattro ttys001 Tue Feb 24 06:01 – 06:01 (00:00)

quattro ttys000 Tue Feb 24 06:01 – 06:01 (00:00)

quattro ttys001 Tue Feb 24 05:53 – 05:54 (00:00)

quattro ttys000 Tue Feb 24 05:44 – 05:44 (00:00)

quattro ttys001 Tue Feb 24 05:19 – 05:22 (00:02)

quattro ttys000 Tue Feb 24 05:13 – 05:13 (00:00)

quattro console Tue Feb 24 05:13 – 14:58 (09:45)

reboot time Tue Feb 24 04:42

quattro ttys001 Tue Feb 24 03:05 – 03:05 (00:00)

quattro ttys001 Tue Feb 24 03:04 – 03:04 (00:00)

quattro ttys000 Tue Feb 24 02:57 – crash (01:45)

quattro ttys000 Tue Feb 24 00:07 – 00:07 (00:00)

quattro ttys000 Mon Feb 23 23:38 – 23:38 (00:00)

quattro console Mon Feb 23 23:38 – crash (05:04)

reboot time Mon Feb 23 23:38

shutdown time Mon Feb 23 17:29

quattro console Mon Feb 23 17:13 – 17:29 (00:16)

reboot time Mon Feb 23 17:12

quattro ttys000 Sun Feb 22 21:49 – 21:49 (00:00)

quattro ttys000 Sun Feb 22 20:46 – 20:46 (00:00)

quattro console Sun Feb 22 20:46 – crash (20:26)

quattro ttys000 Sun Feb 22 17:45 – 17:45 (00:00)

quattro console Sun Feb 22 17:45 – 18:12 (00:27)

ASHLEY console Sun Feb 22 13:17 – 17:45 (04:27)

quattro ttys000 Fri Feb 20 20:04 – 20:04 (00:00)

quattro console Fri Feb 20 20:04 – 13:17 (1+17:13)

reboot time Fri Feb 20 20:04

shutdown time Fri Feb 20 19:53

quattro ttys001 Fri Feb 20 19:51 – 19:51 (00:00)

quattro ttys001 Fri Feb 20 19:50 – 19:50 (00:00)

quattro ttys001 Fri Feb 20 19:49 – 19:49 (00:00)

quattro ttys001 Fri Feb 20 19:48 – 19:49 (00:00)

quattro ttys000 Fri Feb 20 19:47 – 19:47 (00:00)

quattro ttys000 Fri Feb 20 18:23 – 18:23 (00:00)

quattro ttys003 Fri Feb 20 17:58 – 17:58 (00:00)

quattro ttys002 Fri Feb 20 17:57 – 17:57 (00:00)

quattro ttys001 Fri Feb 20 17:56 – 18:00 (00:03)

quattro ttys000 Fri Feb 20 17:56 – 17:56 (00:00)

quattro console Fri Feb 20 17:20 – 19:53 (02:32)

reboot time Fri Feb 20 17:09

shutdown time Fri Feb 20 16:03

quattro console Fri Feb 20 15:16 – 16:03 (00:47)

quattro console Thu Feb 19 23:05 – 14:46 (15:41)

reboot time Thu Feb 19 23:04

quattro ttys000 Thu Feb 19 22:14 – 22:14 (00:00)

quattro console Thu Feb 19 22:14 – crash (00:50)

ASHLEY console Thu Feb 19 14:26 – 22:13 (07:47)

quattro ttys000 Thu Feb 19 10:51 – 10:51 (00:00)

quattro ttys000 Thu Feb 19 05:21 – 05:21 (00:00)

quattro ttys001 Wed Feb 18 21:54 – 21:54 (00:00)

quattro ttys000 Tue Feb 17 22:58 – 22:58 (00:00)

quattro ttys000 Tue Feb 17 20:52 – 20:52 (00:00)

quattro ttys000 Tue Feb 17 20:40 – 20:40 (00:00)

quattro console Tue Feb 17 17:02 – 14:26 (1+21:24)

reboot time Tue Feb 17 17:01

ASHLEY console Tue Feb 17 17:00 – crash (00:01)

quattro ttys000 Tue Feb 17 10:09 – 10:09 (00:00)

quattro ttys001 Mon Feb 16 17:50 – 17:52 (00:01)

quattro ttys000 Mon Feb 16 17:50 – 17:50 (00:00)

quattro ttys001 Mon Feb 16 17:49 – 17:50 (00:00)

quattro ttys000 Mon Feb 16 17:49 – 17:49 (00:00)

quattro ttys001 Mon Feb 16 17:47 – 17:47 (00:00)

quattro ttys000 Mon Feb 16 17:46 – 17:46 (00:00)

quattro console Mon Feb 16 17:33 – 16:59 (23:25)

reboot time Mon Feb 16 17:33

shutdown time Mon Feb 16 17:28

quattro ttys001 Sun Feb 15 19:43 – 19:55 (00:12)

quattro ttys001 Sun Feb 15 19:43 – 19:43 (00:00)

quattro ttys000 Sun Feb 15 19:38 – 19:38 (00:00)

quattro ttys001 Sun Feb 15 19:26 – 19:31 (00:04)

quattro ttys001 Sun Feb 15 19:26 – 19:26 (00:00)

quattro ttys001 Sun Feb 15 19:25 – 19:25 (00:00)

quattro ttys001 Sun Feb 15 19:15 – 19:19 (00:04)

quattro ttys000 Sun Feb 15 19:08 – 19:08 (00:00)

quattro ttys000 Sun Feb 15 07:02 – 07:02 (00:00)

quattro ttys000 Sun Feb 15 05:00 – 05:00 (00:00)

quattro ttys000 Sun Feb 15 04:58 – 04:58 (00:00)

quattro ttys000 Sun Feb 15 04:32 – 04:32 (00:00)

quattro ttys000 Sun Feb 15 04:27 – 04:27 (00:00)

quattro ttys000 Sun Feb 15 04:18 – 04:18 (00:00)

quattro ttys001 Sun Feb 15 03:24 – 03:24 (00:00)

quattro ttys000 Sun Feb 15 03:20 – 03:20 (00:00)

quattro ttys000 Fri Feb 13 14:24 – 14:24 (00:00)

quattro ttys000 Tue Feb 10 16:47 – 16:47 (00:00)

quattro ttys000 Mon Feb 9 23:17 – 23:17 (00:00)

quattro console Mon Feb 9 23:17 – 17:28 (6+18:11)

reboot time Mon Feb 9 23:16

shutdown time Mon Feb 9 23:12

quattro ttys000 Mon Feb 9 15:44 – 15:44 (00:00)

quattro ttys000 Sun Feb 8 16:17 – 16:17 (00:00)

quattro console Sun Feb 8 07:28 – 23:12 (1+15:43)

reboot time Sun Feb 8 07:28

quattro ttys000 Sun Feb 8 07:20 – 07:20 (00:00)

quattro ttys001 Sun Feb 8 05:51 – 05:51 (00:00)

quattro ttys001 Sun Feb 8 05:50 – 05:51 (00:00)

quattro ttys001 Sun Feb 8 05:50 – 05:50 (00:00)

quattro ttys001 Sun Feb 8 05:49 – 05:49 (00:00)

quattro ttys000 Sun Feb 8 05:47 – 05:47 (00:00)

quattro ttys000 Sat Feb 7 19:45 – 19:45 (00:00)

quattro ttys000 Sat Feb 7 06:03 – 06:03 (00:00)

quattro ttys000 Sat Feb 7 06:00 – 06:00 (00:00)

quattro console Fri Feb 6 15:52 – 07:27 (1+15:34)

reboot time Fri Feb 6 15:49

quattro ttys000 Fri Feb 6 15:40 – 15:40 (00:00)

quattro ttys000 Fri Feb 6 15:38 – 15:38 (00:00)

quattro console Fri Feb 6 09:09 – crash (06:40)

reboot time Fri Feb 6 09:06

shutdown time Fri Feb 6 09:04

quattro ttys000 Fri Feb 6 06:23 – 06:23 (00:00)

quattro console Fri Feb 6 06:04 – 09:04 (03:00)

reboot time Fri Feb 6 06:03

shutdown time Fri Feb 6 06:00

quattro ttys000 Thu Feb 5 21:29 – 21:29 (00:00)

quattro console Thu Feb 5 20:28 – 06:00 (09:32)

reboot time Thu Feb 5 20:27

shutdown time Thu Feb 5 20:19

quattro ttys002 Thu Feb 5 19:27 – 19:27 (00:00)

quattro ttys001 Thu Feb 5 19:27 – 19:27 (00:00)

quattro ttys000 Thu Feb 5 19:27 – 19:27 (00:00)

quattro console Thu Feb 5 19:27 – 20:19 (00:52)

reboot time Thu Feb 5 19:24

shutdown time Thu Feb 5 19:24

quattro ttys000 Thu Feb 5 18:50 – 18:50 (00:00)

quattro ttys000 Thu Feb 5 18:48 – 18:48 (00:00)

quattro ttys003 Thu Feb 5 18:47 – 18:47 (00:00)

quattro ttys002 Thu Feb 5 18:33 – 18:33 (00:00)

quattro ttys001 Thu Feb 5 18:22 – 18:22 (00:00)

quattro ttys001 Thu Feb 5 18:19 – 18:19 (00:00)

quattro ttys001 Thu Feb 5 18:17 – 18:17 (00:00)

quattro ttys000 Thu Feb 5 18:14 – 18:14 (00:00)

quattro ttys000 Thu Feb 5 17:22 – 17:22 (00:00)

quattro ttys002 Thu Feb 5 17:06 – 17:14 (00:08)

quattro ttys001 Thu Feb 5 17:05 – 17:05 (00:00)

quattro ttys000 Thu Feb 5 16:50 – 16:50 (00:00)

quattro ttys001 Thu Feb 5 16:49 – 16:49 (00:00)

quattro ttys000 Thu Feb 5 16:46 – 16:46 (00:00)

quattro console Thu Feb 5 04:08 – 19:24 (15:16)

reboot time Thu Feb 5 04:07

quattro ttys000 Wed Feb 4 18:27 – 18:27 (00:00)

quattro ttys001 Wed Feb 4 18:01 – 18:26 (00:25)

quattro ttys001 Wed Feb 4 18:00 – 18:00 (00:00)

quattro ttys000 Wed Feb 4 17:59 – 17:59 (00:00)

root ttys002 Wed Feb 4 17:58 – 17:58 (00:00)

quattro ttys000 Wed Feb 4 17:58 – 17:59 (00:01)

quattro ttys000 Wed Feb 4 17:57 – 17:57 (00:00)

quattro ttys001 Wed Feb 4 17:54 – 17:54 (00:00)

quattro ttys000 Wed Feb 4 17:54 – 17:54 (00:00)

quattro ttys005 Wed Feb 4 17:44 – 17:44 (00:00)

quattro ttys006 Wed Feb 4 17:24 – 17:24 (00:00)

quattro ttys006 Wed Feb 4 17:17 – 17:17 (00:00)

quattro ttys005 Wed Feb 4 17:16 – 17:16 (00:00)

quattro ttys005 Wed Feb 4 10:08 – 10:08 (00:00)

quattro ttys004 Wed Feb 4 10:08 – 10:08 (00:00)

quattro ttys003 Wed Feb 4 10:08 – 10:08 (00:00)

quattro ttys002 Wed Feb 4 10:08 – 10:08 (00:00)

quattro ttys001 Wed Feb 4 10:08 – 10:08 (00:00)

quattro ttys000 Wed Feb 4 10:08 – 10:08 (00:00)

quattro console Wed Feb 4 10:08 – crash (17:59)

reboot time Wed Feb 4 10:08

quattro ttys005 Wed Feb 4 08:15 – crash (01:52)

quattro ttys004 Wed Feb 4 07:50 – crash (02:17)

quattro ttys003 Wed Feb 4 07:29 – crash (02:39)

quattro ttys002 Wed Feb 4 07:13 – crash (02:55)

quattro ttys001 Wed Feb 4 04:40 – crash (05:27)

quattro ttys000 Wed Feb 4 04:40 – crash (05:27)

quattro ttys001 Wed Feb 4 04:39 – 04:39 (00:00)

quattro ttys000 Wed Feb 4 04:37 – 04:37 (00:00)

quattro ttys000 Wed Feb 4 02:43 – 02:43 (00:00)

quattro console Wed Feb 4 02:40 – crash (07:28)

reboot time Wed Feb 4 02:39

quattro ttys000 Wed Feb 4 02:36 – 02:36 (00:00)

quattro ttys001 Wed Feb 4 02:35 – 02:35 (00:00)

quattro ttys000 Wed Feb 4 02:33 – 02:33 (00:00)

quattro ttys000 Wed Feb 4 02:21 – 02:21 (00:00)

quattro ttys000 Wed Feb 4 02:20 – 02:20 (00:00)

quattro ttys001 Wed Feb 4 02:16 – 02:16 (00:00)

quattro ttys000 Wed Feb 4 02:16 – 02:16 (00:00)

quattro ttys000 Wed Feb 4 01:57 – 01:57 (00:00)

quattro console Wed Feb 4 01:57 – 02:39 (00:42)

reboot time Wed Feb 4 01:56

shutdown time Wed Feb 4 01:56

quattro ttys002 Tue Feb 3 21:24 – 21:24 (00:00)

quattro ttys001 Tue Feb 3 21:21 – 21:21 (00:00)

quattro ttys000 Tue Feb 3 21:19 – 21:19 (00:00)

quattro console Tue Feb 3 21:16 – 01:56 (04:40)

reboot time Tue Feb 3 21:15

quattro console Tue Feb 3 20:51 – crash (00:23)

reboot time Tue Feb 3 20:51

quattro console Tue Feb 3 05:12 – crash (15:38)

reboot time Tue Feb 3 05:12

quattro ttys000 Mon Feb 2 03:22 – 03:22 (00:00)

quattro console Thu Jan 29 17:25 – crash (4+11:47)

reboot time Thu Jan 29 17:24

shutdown time Thu Jan 29 16:51

quattro console Thu Jan 29 09:01 – 16:51 (07:50)

reboot time Thu Jan 29 08:31

shutdown time Thu Jan 29 07:57

quattro console Wed Jan 28 04:03 – 07:57 (1+03:53)

reboot time Wed Jan 28 04:02

wtmp begins Wed Jan 28 04:02:33 PST 2026

quattro@Quattros-MacBook-Pro ~ %

Leave a comment Cancel reply