<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic log entries re [ExecHandler.swift@335] ... &amp;quot;hash found in cache!&amp;quot; in Endpoint Security</title>
    <link>https://community.cisco.com/t5/endpoint-security/log-entries-re-exechandler-swift-335-quot-hash-found-in-cache/m-p/5330400#M8954</link>
    <description>&lt;P&gt;&lt;SPAN&gt;In trying to investigate the source of a Mac Book M4 Pro crash that made the trackpad unresponsive to clicks, and also killed the Dock and Application Switcher, I found multiple log entries on my Mac (running Sequoia 15.6.1) of the form “&lt;/SPAN&gt;com.cisco.endpoint.svc.securityextension [info][&lt;SPAN&gt;ExecHandler.swift@335] Executable file /usr/libexec/xpcproxy - hash found in cache!”, &lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;and&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;”endpointsecurity [info][ExecHandler.swift@335] Executable file /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared - hash found in cache!”&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Does “hash found in cache!” from com.cisco.endpoint.svc.securityextension refer to it finding the hash of a potentially malicious file? &amp;nbsp;I have scanned what I believe are the relevant cache files and binaries with several antivirus engines, and did not get any hits. I do have reason to suspect that I might have been hacked by some sophisticated and malign actors, and I cannot find any matches to "ExecHandler.swift@335" (or even "swift@335") on the web (although perhaps ExecHandler.swift is a&amp;nbsp;&lt;/SPAN&gt;component of the Endpoint Security Extension?). Thanks.&lt;/P&gt;</description>
    <pubDate>Tue, 16 Sep 2025 06:10:40 GMT</pubDate>
    <dc:creator>bobstowe</dc:creator>
    <dc:date>2025-09-16T06:10:40Z</dc:date>
    <item>
      <title>log entries re [ExecHandler.swift@335] ... "hash found in cache!"</title>
      <link>https://community.cisco.com/t5/endpoint-security/log-entries-re-exechandler-swift-335-quot-hash-found-in-cache/m-p/5330400#M8954</link>
      <description>&lt;P&gt;&lt;SPAN&gt;In trying to investigate the source of a Mac Book M4 Pro crash that made the trackpad unresponsive to clicks, and also killed the Dock and Application Switcher, I found multiple log entries on my Mac (running Sequoia 15.6.1) of the form “&lt;/SPAN&gt;com.cisco.endpoint.svc.securityextension [info][&lt;SPAN&gt;ExecHandler.swift@335] Executable file /usr/libexec/xpcproxy - hash found in cache!”, &lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;&amp;nbsp;and&lt;/SPAN&gt;&lt;BR /&gt;&lt;SPAN&gt;”endpointsecurity [info][ExecHandler.swift@335] Executable file /System/Library/Frameworks/CoreServices.framework/Versions/A/Frameworks/Metadata.framework/Versions/A/Support/mdworker_shared - hash found in cache!”&lt;/SPAN&gt;&lt;/P&gt;&lt;P&gt;&lt;SPAN&gt;Does “hash found in cache!” from com.cisco.endpoint.svc.securityextension refer to it finding the hash of a potentially malicious file? &amp;nbsp;I have scanned what I believe are the relevant cache files and binaries with several antivirus engines, and did not get any hits. I do have reason to suspect that I might have been hacked by some sophisticated and malign actors, and I cannot find any matches to "ExecHandler.swift@335" (or even "swift@335") on the web (although perhaps ExecHandler.swift is a&amp;nbsp;&lt;/SPAN&gt;component of the Endpoint Security Extension?). Thanks.&lt;/P&gt;</description>
      <pubDate>Tue, 16 Sep 2025 06:10:40 GMT</pubDate>
      <guid>https://community.cisco.com/t5/endpoint-security/log-entries-re-exechandler-swift-335-quot-hash-found-in-cache/m-p/5330400#M8954</guid>
      <dc:creator>bobstowe</dc:creator>
      <dc:date>2025-09-16T06:10:40Z</dc:date>
    </item>
  </channel>
</rss>

