RANSOMWHERE? CHANGELOG VERSION 1.2.5 (06/11/2018) on upgrade, list of pre-installed apps is retained improved code signing checks (mahalo @midnite_runr!) VERSION 1.2.4 (5/26/2018) expanded whitelist fixed file handle leak reduced false positives by ignoring gzipped files VERSION 1.2.3 (9/30/2017) improved memory usage VERSION 1.2.2 (9/28/2017) improved error checking VERSION 1.2.1 (9/26/2017) improved High Sierra compatibility improved process path resolution VERSION 1.2.0 (4/20/2017) added process monitoring to: a) reduce time to detect untrusted processes b) track children that are creating encrypted files c) identify trusted processes creating encrypted files on behalf of an untrusted ancestor added processes signing info to alert window added ability to persistently approve unsigned binaries (via hash) white listed (via code-signing auth) more AV products, and other false-positives bug fixes, code optimizations, etc. VERSION 1.1.0 (5/23/2016) expanded monitoring to entire file-systems (not just /Users/*) extended support to older OS X versions (back to OS X 10.8) added command-line interface ('-install' and '-uninstall' for easier (non-UI) deployment) alerts and user's response now logged to system log now trusts signed/verified apps from Mac App Store white listed (via code signing auth) various AV products, and other false-positives gray listed Apple-signed apps such as Python, etc (to not explicitly trust) explicitly set launch daemon plist to r/x improved enumeration for installed/baselined apps improved UI (alert, install window, etc) added drop down menu for installer created .dmg and .pkg builds for easier deployment bug fixes, code optimizations, etc. VERSION 1.0.0 (4/20/2016) initial release