codesign
Named by 2 kept items in this workspace.
Search every workspace for codesign. It matches the name as written, so it can find other things that share it.
The items that name it 2
Used to inspect entitlements of SSFileCopySender binary
Used by the malware to ad-hoc re-sign trojanised wallet app bundles and the capture-agent helper so they run and retain TCC grants under a consistent identity
All technologies in this workspace.