Malware Analysis Report

2024-11-30 16:06

Sample ID 240128-d97xdaaeg3
Target 2024-01-28_680444307a0322d408e51dd45d30b4ae_adload_evilquest
SHA256 1c73212799e94362b63f05392ba408c32eca4cc80946bf6fb42b5b915f8a425b
Tags
evilquest backdoor execution persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

1c73212799e94362b63f05392ba408c32eca4cc80946bf6fb42b5b915f8a425b

Threat Level: Known bad

The file 2024-01-28_680444307a0322d408e51dd45d30b4ae_adload_evilquest was found to be: Known bad.

Malicious Activity Summary

evilquest backdoor execution persistence

EvilQuest payload

Evilquest family

EvilQuest

Launch Agent

Launchctl

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-01-28 03:43

Signatures

EvilQuest payload

Description Indicator Process Target
N/A N/A N/A N/A

Evilquest family

evilquest

Analysis: behavioral1

Detonation Overview

Submitted

2024-01-28 03:43

Reported

2024-01-28 03:46

Platform

macos-20231201-en

Max time kernel

150s

Max time network

136s

Command Line

[sh -c sudo /bin/zsh -c "/Users/run/2024-01-28_680444307a0322d408e51dd45d30b4ae_adload_evilquest"]

Signatures

EvilQuest

backdoor evilquest

EvilQuest payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Launch Agent

persistence

Launchctl

execution
Description Indicator Process Target
N/A sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" N/A N/A
N/A osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" N/A N/A
N/A /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" N/A N/A
N/A launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist N/A N/A

Processes

/bin/sh

[sh -c sudo /bin/zsh -c "/Users/run/2024-01-28_680444307a0322d408e51dd45d30b4ae_adload_evilquest"]

/bin/bash

[sh -c sudo /bin/zsh -c "/Users/run/2024-01-28_680444307a0322d408e51dd45d30b4ae_adload_evilquest"]

/usr/bin/sudo

[sudo /bin/zsh -c /Users/run/2024-01-28_680444307a0322d408e51dd45d30b4ae_adload_evilquest]

/bin/zsh

[/bin/zsh -c /Users/run/2024-01-28_680444307a0322d408e51dd45d30b4ae_adload_evilquest]

/Users/run/2024-01-28_680444307a0322d408e51dd45d30b4ae_adload_evilquest

[/Users/run/2024-01-28_680444307a0322d408e51dd45d30b4ae_adload_evilquest]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/dmd

[/usr/libexec/dmd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.sysmond]

/usr/libexec/sysmond

[/usr/libexec/sysmond]

/bin/sh

[sh -c osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]

/bin/bash

[sh -c osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]

/usr/bin/osascript

[osascript -e do shell script "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]

/usr/libexec/xpcproxy

[xpcproxy com.apple.security.authtrampoline]

/System/Library/Frameworks/Security.framework/authtrampoline

[/System/Library/Frameworks/Security.framework/authtrampoline]

/bin/sh

[/bin/sh -c launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist]

/bin/bash

[/bin/sh -c launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist]

/bin/launchctl

[launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.ReportCrash.Root]

/System/Library/CoreServices/ReportCrash

[/System/Library/CoreServices/ReportCrash daemon]

/usr/libexec/xpcproxy

[xpcproxy com.apple.geod]

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

[/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod]

/usr/libexec/xpcproxy

[xpcproxy com.apple.suggestd]

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd

[/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.geod]

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

[/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod]

/usr/libexec/xpcproxy

[xpcproxy com.apple.secinitd]

/usr/libexec/secinitd

[/usr/libexec/secinitd]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.cfprefsd.xpc.agent]

/usr/sbin/cfprefsd

[/usr/sbin/cfprefsd agent]

/usr/libexec/xpcproxy

[xpcproxy com.apple.knowledge-agent]

/usr/libexec/knowledge-agent

[/usr/libexec/knowledge-agent]

/usr/libexec/xpcproxy

[xpcproxy com.apple.icloud.findmydeviced]

/usr/libexec/findmydeviced

[/usr/libexec/findmydeviced]

/usr/libexec/xpcproxy

[xpcproxy com.apple.AddressBook.ContactsAccountsService]

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService

[/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService]

/usr/libexec/xpcproxy

[xpcproxy com.apple.PerfPowerServices]

/usr/libexec/PerfPowerServices

[/usr/libexec/PerfPowerServices]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.routined]

/usr/libexec/routined

[/usr/libexec/routined LAUNCHED_BY_LAUNCHD]

/usr/libexec/xpcproxy

[xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A]

/usr/libexec/neagent

[/usr/libexec/neagent]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.Maps.mapspushd]

/System/Library/CoreServices/mapspushd

[/System/Library/CoreServices/mapspushd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.siri.context.service]

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService

[/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.tailspind]

/usr/libexec/tailspind

[/usr/libexec/tailspind]

/usr/libexec/xpcproxy

[xpcproxy com.apple.PerfPowerServices]

/usr/libexec/PerfPowerServices

[/usr/libexec/PerfPowerServices]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.assistantd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.bird]

/usr/sbin/spctl

[/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app]

/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird

[/System/Library/PrivateFrameworks/CloudDocsDaemon.framework/Versions/A/Support/bird]

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd

[/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.pbs]

/System/Library/CoreServices/pbs

[/System/Library/CoreServices/pbs]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/bin/launchctl

[/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon]

/bin/launchctl

[/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

Network

Country Destination Domain Proto
US 20.189.173.16:443 tcp
US 8.8.8.8:53 gspe1-ssl.ls.apple.com.edgesuite.net udp
US 8.8.8.8:53 e673.dsce9.akamaiedge.net udp
GB 104.91.71.85:443 gspe1-ssl.ls.apple.com.edgesuite.net tcp
US 8.8.8.8:53 certs.apple.com udp
GB 17.253.77.202:80 certs.apple.com tcp
US 8.8.8.8:53 fp2e7a.wpc.2be4.phicdn.net udp
SE 192.229.221.95:80 fp2e7a.wpc.2be4.phicdn.net tcp
US 8.8.8.8:53 fp2e7a.wpc.2be4.phicdn.net udp
SE 192.229.221.95:80 fp2e7a.wpc.2be4.phicdn.net tcp
NL 17.248.236.65:443 tcp
GB 104.91.71.86:443 gspe1-ssl.ls.apple.com.edgesuite.net tcp
US 8.8.8.8:53 fp2e7a.wpc.2be4.phicdn.net udp
SE 192.229.221.95:80 fp2e7a.wpc.2be4.phicdn.net tcp
US 8.8.8.8:53 fp2e7a.wpc.2be4.phicdn.net udp
SE 192.229.221.95:80 fp2e7a.wpc.2be4.phicdn.net tcp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 mobile.events.data.trafficmanager.net udp
US 20.42.65.90:443 tcp

Files

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 0c211f0f9605fcb9e269275ad6f678f2
SHA1 57cd5332aacbfbb3f1567ba45f9c104b331d350b
SHA256 80a16e3960334ef2aa5ad26970f200bf3a8c09a0344024d527201a0cd5c21279
SHA512 78943e25b635c1f4757bb0f8a23eabcc3799b5cf3f16d352b7ade119b5025d16d850be5941738c8dd97b2af5c751b32b29cb1a7304ae9ffadd7146e8e91e58df

/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

/Users/run/Library/Caches/GeoServices/Resources/altitude-1168.xml

MD5 76ebb0196d42a294b69ef118cbb301d5
SHA1 61e5ab752d351af1661716bc48c0520f66cd1d1b
SHA256 aaa9febe98e3a75220b4933d1f00f2bef276183491e7d171fa54d03259812759
SHA512 8dde09d72944e8925c5bd64dc3799a44d7c30191d5038939a24f8a45ccf4d66b84990e8be3e0f2ee1d42d1dd6e5ed3673c39f803874fb0840a3232cc1e533663

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 5a56b5696fea1f0248055a25907dc47a
SHA1 dc23136e67df19e9f12374d8d605f7adb2c548ba
SHA256 560f9cadd674a5389878506c222fa8be0e602ae15beafe5492bf28d1e76b9cdb
SHA512 a19fac7cac387c07a40b286b0c58efc54d9c24477b757ad1af68c9f0afd44f6d6db8bd1ff3421e9c0e402b19778baa089b18f2731219794a03f036f46b11e059

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

MD5 70d902ee2d325cc47fa738bf4205c1f1
SHA1 d1c7b8839eb0e613c242ea0bfbf12ad62e4c29e1
SHA256 769e579748dfd62d48039482d771c50b7418e3fdcbcc1fe45acebf1f6f83a85c
SHA512 3f7b06e0b667b4e3cc3021bf87359cd7a9fc8ae43552c8ab8262e5458ef2c7fc33f5af7a5df1a3e153f91483db0d065c1201fc25c962c064deefb1129b2fd71a

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 1b2a3315eb343ba28ef019cb8399467e
SHA1 96409394461c02c17fde93b8261fb2ff7174096a
SHA256 34bcf920386615c766d27d8340b207a5499cfb4d9eed884065bec00b0729f446
SHA512 a96b8180737c63e98818c5b0bf1f4f0db747b7c40f0fb52e8712fb49aeb2b82b84009dc6a91e4fa3925a8b4d70a9714e6d390bbab94fe5f0b0b42942713ece1c

/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-01-28-034347_tests-iMac.crash

MD5 5cb2d64e468aaa2ecbb4e94f43b0831d
SHA1 d076444dcaca6f68cc09abb033e3e4b34f7f8407
SHA256 f5dd8e5c3fb5c1fdbc656be25cc998d5524c84636cc18431d6df837599d015fd
SHA512 cc0686bc8f61f4811f753f60456923465c825b5ffc42fed9072f228824ec88618fa1001f8699c60169d51ca433feeb71056acafd6d41a8ce36a46a64958b7837

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 2be269db4c9e086e366550ffaea67faa
SHA1 a20d8ff6a34d0b8efec7df4b500b9260c2770358
SHA256 b36c92a5009bdfe8b3ce406eab595cdafa07f899904a2aa41f67071a8ab5e9cf
SHA512 84ca38f717fe06abf7013bd16cb987455bea5f525616e4fe871f166e34e5adbea64a21b2ffa76fa7fdedc9f70e218d5b0fd295e5623dadfa0b5565220ba235c2

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 2c00c8b97ffe16fbb38ec1a606ad461e
SHA1 313c84d0e21b8080ee337769fe3dba3c631e3079
SHA256 1630f0a990154d5cbd634e2795d624b3319e0335217a0c06c95e28124a0319dc
SHA512 6cc75c46d1a805b0275301cc3678f07fcfa89d39562dbfc0a505555018e964999a93afb6a720efbcb45d2bf032b63fa5e32246a3c1b8f6faec675cdd41fc8094

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 084933a36b60c8d0b5511945f08cf358
SHA1 0ba0f7eae3741825b990f82a09902120bebb00fb
SHA256 48614961dfa20d796d8a43fa3e5fe7082742f9cb1f4305a944344835f150b094
SHA512 e2f46b43da01cc036e4d87f4924ae8c5e8561262fa95e0de05d1ac6435f1ace68ae054e6e33335c3d1e872a45d2ec03a64e3ce108ebe1caf93f3fe71c5828a3c

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 a59d3d6e4f10aae0dccf1bbcdf0ac30c
SHA1 318c0b855feaa5bd793c16c505de58e264bdfcb5
SHA256 553e4aa18ef24fc523ccb1ac10b6a46e9446290cf8c652f9ff63790e45602d40
SHA512 2d46e2ccaed26c0becf9e5c6e710d6575f6e5bf350dae92a92d90e106547cebc0169f154a51d628b78fd3d5e510ff3bdad4f560971845181e0ccff63c32bf26d

/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-01-28-034358_tests-iMac.crash

MD5 1d5693b3b8c82a61ff6fb546e7352f03
SHA1 150d170078ee4f2d9b8bcba156cbbe6ef38a6564
SHA256 c8bd5cf32dabfea988f0fda7db0d61119d504984a2c7f090e08cc0e19281ce22
SHA512 06cebbfcfdd32aacb67c8dca3a4c3446ce8afa90393716a21b8d62b3210a3eedc5f0fd5675d8985ce1a5671ca3bb2d2e66f1f28c425da6e38f7523f2aeea39be

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 368c72a27a89a8c68486c212d83569c5
SHA1 44c4e318aafac80e6baed646439e1ca18c47e745
SHA256 a30536509d305ed8f0b80e26f7c759ee8bedf5260491694b1ddc97f504c3938e
SHA512 bcb28041627dd86256c56bddb3c3db8c8fb9ad4f876208747692c15dc0bb7a2e5cf38426c478faca0741c8b175366b04bc9ed3c85f4f6863c48ab73cde9982d0

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 a01bf0aa8eb35bcafd21efa3effd4e4f
SHA1 981b232ffe986bfd24458ce0a62f5eb9cdeeaca5
SHA256 166100ceb787ac3995ee75903cf9d7971f3d929282e1a0cf5d3e644f665bd6c5
SHA512 26457af711f22921b4542d565270f9e3cbf139bd60738e8204551023b1ae0878628c41620e6e287086b43ee68f8be348d98feb0e1f68a7d0e2422f0e7fc2b9e2

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 8f86d82fb73eab216532880749d56c27
SHA1 6b2357e7235ef2955ea8fa072e1f9008fc1b1679
SHA256 9b94d671449ae6cf2fd2fdabbfe2627315c9e8f202beda179f7e0bc91c67c5d0
SHA512 2fe44f983a50de51835bdc3cd100db4a42fca91009b15de2c27b49ebecf813430ae423f43bacafa9bb1f59cba3b01019cba600e4f76ee277b309752f616721eb

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 62728e25fdd01c0dca7b7742dd3156a5
SHA1 a066642e267da82c4281f4648eb0e0ab4f546ba4
SHA256 a455432f76195f48d7f6cbbac82d892e28a3d6900bd358e3c57b834878cab4d4
SHA512 64166efa8bae46df910f530d444fd7beff19db9b39cee73f2888da2adfbe971b05f8fd0533809dc6ef252e5639d8338981370cf8e4d4b71f0ce624648905a12b

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 5d79d4a3eb4692919730387023263404
SHA1 97d5fc2b6ec33ea4abee6cfe1ba5ad095ffbbada
SHA256 e748f3514994f1c68e78f08396ba67baaa3bfdbfcd01fbe54ee15a468d753625
SHA512 c837a3c2699f3bad9ca6db76cc62d4ced884f6dfcdc28df49b13a3c2388216b94e340ab0b280e09504d2f4db33d5e5665f4ea4a0a9c92da99337cd396a0419e4

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 58505f65a7902f7465360dd3e57ed8c6
SHA1 f539c6e85365970470c919d14298e6128da311d0
SHA256 6747019f860af6ebc210bc410269c5833d890cb05ea55cca1285ec3bee8a9653
SHA512 1fe2229c7ec5facf3339e69f2188cfd84fde9bfbbd686f2ed4e878798ca3b872fad3da503715dce9749ef0a1d254d450961329b59a3b76bb2fadb79fdb902726

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 3dc8f158a39f95d86aa298abe6e54b96
SHA1 cf527837961eef0ed3f7b60855217a7c02b40459
SHA256 3befac93422ca2c8a33dd4c203778694584994233cf3a663d9785cd55245bb6c
SHA512 315d1519b49547015552438bfa4a8829f7418b4240939f3987aa2ba08f75d0400c00b0c62508b9745d8eecf1bbf03e9bc90e91e06c9953af9fa74f0f329877f0

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 2a7924ee3a2b4b79a2c899ca11e9aa45
SHA1 4beff1f7e7533328ce3ae963799c378968b3f4ca
SHA256 28b7629cf7d6ab54948a90d4ecd8229f434df86eb92d3b65466cec306961e9f0
SHA512 e0340489719cc51903e2e031ce8ce675e429127423168d1b914d5602ea5689de930a55dd7b9a4e96f023b59052e04f43a39927188b2f3d3e48cf73ca31b6e121

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 22128289ad800db44bfd3151a9e5fc31
SHA1 da9be9a175969b2e896b74c3953e83749b9126d3
SHA256 52c183619b2df2dbcb1be5329a218b0fdc699702d202f87acf179bbc0ae89757
SHA512 7b9f1b5b8403fdadc9fd2d3974ca1ba950b370da2c948341e7162ab8051884b7302975b9d0a016986c89407bc3f3a2d71de6c8a73d562957f5d03d365c70ab98

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 32ab999c3e531e13af9a6577ec03f3ad
SHA1 7d21c475264dd831a24fa98748bf3cee89fe4cd7
SHA256 079571dba9f6b8ec10d1c7ac90fb75db24b538ee3f6164898760b886ab730dd0
SHA512 e5592d283924e2f6ca06ea6d3565608782493113c558dfd6229ee89a1a965b385cd952dc25c9617fb58db09dcf73a9dcabccf38366655ea9ffc3535b7ae84fcb

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 9ddad78124588802fb07c54594eeeea0
SHA1 dd72a044ea23a559a3368d9879ab17cd60d7ba92
SHA256 7d8d4ac4f25a262f4d4206484f02cd5deff2e6990478ff286a3bd46bf5418ff1
SHA512 199cdd110c093a5611aa31db07b48922a809e5d62aee935f88c0c6a9f77472ed96194a3015e421051eb098ff4bb17129129d3b3e484b8d9dca3773fb8879d2bf

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 c25224faecced7a56eade1205e1ef57c
SHA1 1cfcabebd1b2a1eca72dc89ba1b6140ae8a8f10a
SHA256 a55af7881b063e7ad2ba5168f2fa328dca1237a7e27e537356a393941bfe642d
SHA512 d70616f2a1c610c486fe268e63070dd3b81d12b8be446e3210a944db01ccabc14be77e709f01e14a0bb8fd4073b3a1ad1180222d40f13a029be033aaeccf94ef

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 cbdea2e38f8290527087c1b336c1a3b6
SHA1 1423c58b7c45e6bbf9f149d29521239d4544ba58
SHA256 eb23d0b51951c5ee24fb9f02def6e8205eba7ebde45d104e095371ae01504341
SHA512 760774700f2ee947a083f39c0d0bd3453695b27771063625c8d32cf6d0305a88187d5f3c7f8dafe77e4fa65af436d5cf108c3e53200ad2160219d7badb9d4b9b

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 af4e6c0a731228f596f9ad092034147e
SHA1 38aa4f4c28a487190835683e6850bc6d7a7b6c14
SHA256 e83ccf539a451681d260f83167d983517011d56fc996563ff1f561ab5f51429a
SHA512 deccf5c085478a34b7c1f1d9008ab6a8041118488717934df4116bdac0e21717d395f4603265910e8b82e6d2e5d0863570f0fb453aee86827860dd1728e2ec54

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 2fde1054a942001fe68065078d5c2e9b
SHA1 754b1ca2a44d44099a4d8b33f7355bb6f277c7d6
SHA256 37b46b5dcb53b00b8be1dfe43d9f4c17eeb2e81d1444769b85490681a57ac967
SHA512 12d928dd2545f5c9f035aac9f23ad7bf806cb5621a6d2db15bb203f36ec52e805edb41f3138601c2a20948e6ccc807b532361cf111f79267c4849328da6d7365

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 6492f34726cff75163487ea1cce2a6ac
SHA1 8de0fc5f8044336050b68f6b433b60387184b5d4
SHA256 fd14b78b70bda9deaa362215cd066511d92613b3d2e69a59626e6aaa33d05708
SHA512 bc79faa575eac50737af19ecb7efdb0ab72d78ac7bff3c9f631e4763f4ec7aa0d94735d06defc3283df6016de525390ef0bb181b6a49177bedaa616400e22ed4

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 5a7716dcb7a7f984e1d56c9b75835d4e
SHA1 8ef35c82750dfe989aa551b8e64cf0952759a968
SHA256 90c83c2d19d90eb359030f9c92297bdc94959651aae83d1893f9c1cf710b7624
SHA512 ebac9de7e49c62c140086e2de599abc7fe581fbd9ad024c0aabfd21a10887c2c72a028bf8279444b44d1f37e6bb0945d19e54e2aac6b9f637c59e214215ba4aa