Is it a sign of malware to find a s a folder titled "Crypto" and a file titled "crypto.conf" located in Relocated Items folder following update to MacOS 15?

Last month I updated to MacOS 15.5. Today I noticed a folder called "Relocated items" in the Shared folder. This folder often appears after an update. But, I was surprised to find the following folders and files with "crypto" in their name.


'/Users/Shared/Relocated Items/Configuration/private/etc/ssh.system_default/crypto'

'/Users/Shared/Relocated Items/Configuration/private/etc/ssh.system_default/crypto.conf'

'/Users/Shared/Relocated Items/Configuration/private/etc/ssh.system_default/moduli'

'/Users/Shared/Relocated Items/Configuration/private/etc/ssh.system_default/ssh_config'

'/Users/Shared/Relocated Items/Configuration/private/etc/ssh.system_default'


Does anyone know if these folders and files are normal for MacOS, or if this is indicative of malware?

I have not tried to read any of these files.

Thank you,

Eric


Mac mini (M2, 2023)

Posted on Jul 17, 2025 10:15 PM

Reply
2 replies

This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Is it a sign of malware to find a s a folder titled "Crypto" and a file titled "crypto.conf" located in Relocated Items folder following update to MacOS 15?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.