evilquest | 2e6b00f3d65f8480a213d53a0a287206615b3cb0a96cf64b9ee7317c02bf6a7e

Analysis

max time kernel
147s
max time network
136s
platform
macos-10.15_amd64
resource
macos-20231201-en
resource tags

arch:amd64arch:i386image:macos-20231201-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
05-02-2024 12:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-02-05_3df57a0931087e4e6c63278d3388029f_adload_evilquest
Size

305KB
MD5

3df57a0931087e4e6c63278d3388029f
SHA1

3b2e29e13e603a844d1db4a68c699d6349f4a506
SHA256

2e6b00f3d65f8480a213d53a0a287206615b3cb0a96cf64b9ee7317c02bf6a7e
SHA512

6b66dce59b6fc045488eeefa85c9f9ab5bec718fd64f1c83631f30327af1ed2c5cddb37104bdcd549c792930c2a5d1eb8d32a089dd6c50f2e37c2298b5b1b175
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY9T755Sx8GpdlXmVkO:5LOQdaDxq8cqavHYJ75kxkj

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

resource	yara_rule
behavioral1/files/0x000000030008b269-0.dat	family_evilquest
behavioral1/files/0x000000030008b269-8.dat	family_evilquest
behavioral1/files/0x000000030008b269-15.dat	family_evilquest
behavioral1/files/0x000000030008b269-25.dat	family_evilquest
behavioral1/files/0x000000030008b269-30.dat	family_evilquest
behavioral1/files/0x000000030008b269-45.dat	family_evilquest
behavioral1/files/0x000000030008b269-53.dat	family_evilquest
behavioral1/files/0x000000030008b269-61.dat	family_evilquest
behavioral1/files/0x000000030008b269-67.dat	family_evilquest
behavioral1/files/0x000000030008b269-74.dat	family_evilquest
behavioral1/files/0x000000030008b269-81.dat	family_evilquest
behavioral1/files/0x000000030008b269-88.dat	family_evilquest
behavioral1/files/0x000000030008b269-95.dat	family_evilquest
behavioral1/files/0x000000030008b269-102.dat	family_evilquest

Launch Agent 1 TTPs
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 52 IoCs

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

Launchctl 1 TTPs 64 IoCs

execution

Launchctl

T1569.001

ioc	Process
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "launchctl start afsvcpd"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-02-05_3df57a0931087e4e6c63278d3388029f_adload_evilquest\""
1⤵
PID:523

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-02-05_3df57a0931087e4e6c63278d3388029f_adload_evilquest\""
1⤵
PID:523

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-02-05_3df57a0931087e4e6c63278d3388029f_adload_evilquest
1⤵
PID:523
- /bin/zsh
  /bin/zsh -c /Users/run/2024-02-05_3df57a0931087e4e6c63278d3388029f_adload_evilquest
  2⤵
  PID:525
- /Users/run/2024-02-05_3df57a0931087e4e6c63278d3388029f_adload_evilquest
  /Users/run/2024-02-05_3df57a0931087e4e6c63278d3388029f_adload_evilquest
  2⤵
  PID:525
- - /Users/run/.2024-02-05_3df57a0931087e4e6c63278d3388029f_adload_evilquest1
    /Users/run/.2024-02-05_3df57a0931087e4e6c63278d3388029f_adload_evilquest1
    3⤵
    PID:577

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:527

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:527

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:530

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:530

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:532

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:532

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:532

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:533

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:533

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:534

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:535

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:535

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:536

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:536

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:537

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:537

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:537

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:538

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:538
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:547

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:539

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:539

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:539

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:540

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:540

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:540

/bin/sh
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:542

/bin/bash
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:542

/usr/bin/osascript
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
1⤵
PID:542

/bin/sh
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:543

/bin/bash
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:543

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd
1⤵
PID:543
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd
  2⤵
  PID:544

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:546

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:546

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:546

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:548

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:548

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:548

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:568

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:568

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:568

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:569

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:569

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:569

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:570

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:570

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:572

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:572

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:572

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:573

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:573

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:573

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:574

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:574

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:574

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:575

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:575

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:575

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:576

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:576

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:579

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:579
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:580

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:581

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:581

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:582

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:582

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:582

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:583

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:583

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:583

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:584

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:584

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:584

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:585

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:585

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:585

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:586

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:586

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:586

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:588

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:588

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:588

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:589

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:589

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:590

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:590

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:591

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:591
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:592

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:593

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:593

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:593

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:599

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:604

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:606

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:606

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:607

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:607

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:608

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:608

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:610

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:612

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:612
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:614

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:615

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:622

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:623

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:624

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:625

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:627

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:628

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:628

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:631

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:631

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:631

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:632

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:632

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:632

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:633

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:633

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:633

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:634

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:634

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:639

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:639
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:640

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:641

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:643

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:643

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:643

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:644

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:644

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:644

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:645

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:645

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:645

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:646

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:646

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:651

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:652

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:652
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:653

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:654

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:656

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:656
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:657

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:658

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:660

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:662

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:663

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:664

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:664

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:664

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:665

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:665

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:665

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:666

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:666

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:666

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:667

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:667

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:667

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:668

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:668

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:668

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:669

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:669

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:669

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:670

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:670

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:670

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:671

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:671

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:671

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:672

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:672
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:673

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:675

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:675
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:676

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:677

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:678

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:679

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:680

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:681

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:681

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:681

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:682

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:682
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:683

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:684

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:684

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:684

/usr/libexec/xpcproxy
xpcproxy com.apple.newsyslog
1⤵
PID:685

/usr/sbin/newsyslog
/usr/sbin/newsyslog
1⤵
PID:685

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:687

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:687
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:688

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:689

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:689

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:689

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:690

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:690

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:690

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:691

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:691

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:691

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:692

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:692

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:692

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:693

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:693

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:693

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:694

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:694
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:695

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:696

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:696

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:696

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:697

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:697

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:697

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:698

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:698

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:698

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:699

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:699

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:699

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:700

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:700

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
fabd763b192a8f424cac921bb730dfc9

SHA1
3601b0d9f8c34274c505bd743845fe76e2b5d99f

SHA256
730e20ed5df9e62e1fd3de9576dfe2dfaecc75a4b5cee368180bb2a4ac1f4277

SHA512
27d4f19ef39ebc05eb7c1e3fd0ecd2ce6c6c2c18d9863718cd65f741cc082098b365de9cc5d01e556800c292e816048c8d70d4361550954767bc09a41307688f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
158B

MD5
196b51ad502eb228ac8aba36d365313e

SHA1
2416f852d5267c6595b1f6621df41b6237474db4

SHA256
64b084890ea0305537735c2ac3fe38d9dc9ed98f541521b5e8042fa821c02056

SHA512
48a0329f08d6a8e177771921d507a56ca9390fccce863cd1a1e9ff941610fc2e220ce3dda8c77b982bf1c9fe18f076a21568030236dd763c48fb69d1726f1ad4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
b22fad5b1b08a634aced63deda9630ff

SHA1
40c02a6fef0b51216640d4f088bbb82f28c68101

SHA256
5b9130989d41bf9e75d0199e357fd7acdd3282d263c0ecc836009d7584f14c37

SHA512
f42f494a33983684d3030d0fd8c7a7e4757b7f716222822d9864cb469c8190605c181824d3d7563cd307d7e6540b4a3673c747cfe1f68ad9ffe0da6cd28279d4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
4ea526dd013a4979db79dcc03eca0a96

SHA1
659bed16bfea3bcec290b0969d8058e4586f6abe

SHA256
94327b7be63f11743cf524770df8b7baa6b6e50e4e51f5991bc2b78fdf29868d

SHA512
0fe1071a20c9c5fef16df55f82c970613ea7dcb7b84c708e9161550872a685bad72fa9418e12c1574e461f8e4fce7189c105f803b6ddecb2a110ac10b4f21b6e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
40e18226269c668a87c35bbcd9b38d52

SHA1
b78bee784761b313d4460cad7fb98297e86f9e3a

SHA256
b75a863a2828ff5d7310a4d7a2ed4354765a22a1fa6ba0b6556377d053c6fb77

SHA512
8097e4ff1821d9bc76767a478e56ad8f7136b46acdad3579d0d96b4257e440784c12b91244a1df6208d91e69e9faf8bf565d0a4f241466c64007b90dec908c67

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
15b3ec6af4d303b8eba052bb234af6cb

SHA1
0da798cecaddf87a204f9fa91e2bc6e3f3db9b15

SHA256
457f8738c4e3784391be752c5b9581d26dcdbb1b54f348bc6fc726511f4aa3e1

SHA512
8f84d36cef9713e2709a76e223a911bbc12c1a08ef82dd69907715ba2954fd365fb60bc3d956ae91e5d62285c214711df0dcd360a722245c62a22c43feb58c52

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
c6b0cc06a2b3d8a46d3f0df1960288b3

SHA1
335ae0197d4d7629dab1accfc39db3327e858f3c

SHA256
bbdead94b2c738a2629a8fbce8d2f8b008dea1cf8613d09f0c1b1182a08b2a44

SHA512
4e3ed4c0ff23dfb57dda82aa0591d51317f8092bc8f301c7cfcafe483fc83e618ce118bf0652212fd7969f4e24872a8d7799b5ca3526f0065b259d9a4f8ee908

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
13a297eb33cf2d28b3728e5c7cfc9901

SHA1
c87b4297d1833700267166493988515084a4d0cb

SHA256
a75a60888fe27b376f068e2d1311e51618d8453deca249daab05555fc45f4482

SHA512
0e6c830b66edabcb0dc5d8fb7a743d2778c8528a84494e224027a4e95f7b01385fc05772ae2ff362ec5d6d95e9ff1b57f3d00e8a0afdc0588faab9d0f20f1b03

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
3133eddb55227467618263daa476c732

SHA1
b2109f9981c65371dc780b4708d65985b5cccdf4

SHA256
de21645f065b4476f6298b633721ed5b54f2f9ee0a222bd6267c5846e89e45f8

SHA512
1924bb7eb383967235206ffabff550093874f3a66da52974a05b146a1c4deae844bcdf60d68e1a2161779469e68d5f94408218fe34f0ca08c3df7280f51b1c26

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
2a099f703360dabc9706ada23a2fa9b5

SHA1
b2af33836cdb6b905f5c7b2d159006c0b2444479

SHA256
6dae9a9cfa16053aff1f6fa0d1d631896054e6b864bef53d0d6a5b4faa085b51

SHA512
c05880e44c7df5f98a2150f46ef3612d6389654a1c8c6fdced1be1a5ebf002dd767e3ba511aa50d5cab5c87bd8f422f19a1ac13f884c8ee46f3147c8598b6753

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
24ea67b493a1c8c35ae01119f3ee3ca0

SHA1
b92062242c432617e156f7f10babc0867d5b4857

SHA256
1dd0b69d94e310b1011b4476ab021fa17180bb7297dff00902a339bfe893b30a

SHA512
6d53a1e3c6b4fd2986b97413d9128a5654d3b22f36a39e2c57ecb0156adf7ae3f0436344800b9b3c8a9f0de2e22c072f8c9a48bbb04c7ee5de7a0914f814bda9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
7d195e09a025301e42694d0be43f944c

SHA1
7c8233768b98a7473098f6ce844a12c248ff43e2

SHA256
931c7b74ab1682f4aa7efd203e58852eec194147b29e5364a1deb966b89534ec

SHA512
154144dcf441a8feb5a19ac2aa1a8675c456ccaa33f0dfa99457933462f5b35d913be6ab316a27486dd8057db094955bc0c85926b444143eb3e90130d896e5cc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
0ca791e06edb7e8814595fa4e678ad45

SHA1
97559972323455634a341158c0f65ffd03d89716

SHA256
a212feb92687d7f48c4286cafd73ac3394f4b79dd922ddd5291251d81fc820fd

SHA512
4daef4cef05f4dc7a300411fec4cc43c93062ef364e0ed39d9233923b41d92a718c43dd51412ebfbb2aa0fbf26196564e3a240724abec5bafd0bbf709fe26ba7

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
be50e18c13e75e964ce95629b95fc54a

SHA1
49fe3cc4ad153e4f6a902f987cbd66efae345b99

SHA256
6b338753e4e0a4b0760bf58fe44e28dedd2646aa5e33a5d6ba9c1abf56fd401e

SHA512
43a2970de53cf8a09141a370b8f1878b5196c3b7c9de0df24fa4b4f6e44f51f2c04db398f7186d0a0d8d90b6a83d18758066e34da3925ae0524077ddd7ad867a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
d9e0eb4a11b36f183cedb7222cdbd079

SHA1
77eb9d4cdff74ff9b352347b9c2ee383987aabc6

SHA256
838b191a961fc0bb3b193d14e92ad53ffc2b310ca6a653c554587e9c7434158f

SHA512
5ee8dbc3538602b8119f16ffb3fa6ab6ac0862ff53d05709bb87d6e600bf323fc051ddc7cfbf279de37338fed7650b499a2ce850f4e709b611a134fbd16acf30

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
8f94aadbce685e7ce01f709a124feba8

SHA1
a838bb087d1492516dea54e717ba32a926408387

SHA256
8907b2af6225b7d9d93b620ddd9962cacaeb0a096a41a86c3344bfdd117e715d

SHA512
56a8e0d84f009aaf2f3fdb45f92ce1fd229b38e8d4154cfc0af5394104638c3d72b3f9998d50cb9f83f9bd522c94278fd691b2f811827d4d2d4fd5d3d96be2cb

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
06c1a4c03f45d345a788a3a4084e90cd

SHA1
9d6774c5ad11a9d3c8522ea7bd7d9e8b02fb4bd9

SHA256
85f2b4975c5eace486720f12fac7adb89126aa4366bceef33c80080f76111772

SHA512
967c4960dbf02506df590d67c8c8880f379baac208d48b05c8d1e898c3048ec4a0df193b019a48f680f888f6317a31f29f741425c41ddc8a89f1b4dd9c3462e3

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
00fb49e586f73d03bafbb8341605f31c

SHA1
adc53642e65a84500e6a07eb4efabf33569248bb

SHA256
939349d5729480adcd5622d5cbe32799434eb74130a7f483841bcc97e885cf7e

SHA512
663166c89f51fd4b91c6411f28f48ebe8205e2035d10bbe80210695dea69085146b91934a8a0511409492edb2e59ef03ddb4ede7cc9c03d809ea33a77f01a284

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
d7dd4b3b68e85781358485009d48770c

SHA1
ec696735ccba5c0230622a4692565fe0e676d411

SHA256
e53fb09389bb0ca97a349cf938df9e27cfde36bc404fa07e6d166ffde84a006a

SHA512
7fd0369c15fc4fec8ab65777875cb76f2fb53d8c73777303101c1ae1c989c0e9fc869d5f8725b7deca183da2327d58d7de4ecad79121848c0023e09bbe61e103

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
fa84a4c52202b2a6088e0f8753df3096

SHA1
a1be82a34414d78633dbede8f88dae90f42ce020

SHA256
7b11e8c8e98844e855eb125826d82a74a2d1e2e31473e8853c828032ac6c798e

SHA512
9078ec507d55f2ed04d5fd4e6af677122eb0a6b8d73c5d5235c3422d6fb1f3490c9915cfeb06cc19cd847b2cfeaa997fcce4ce76a37bad7172247d64ea5e19c3

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
b338f7f3dab07732d6813bc6c73ee21e

SHA1
9116012b272e4d86c2d05eead303ecc1390dfabd

SHA256
69695d8ac0b9b39da8b3fd7c825387151689ebec95932d8b22bb33591f8aa89a

SHA512
4c29dd56977aa12beb1bd755127f43e400619baba1681dbf5aeaf8a0b41129b1954f022bfbd5cda5e62b24b7a52b2f57fa1f2c9877a1c622c574b79cb551fee7

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
03758a3b34897921c73e96c022b06782

SHA1
96e534ca30a8a59e60e7b0745a48adc01a8815e8

SHA256
cc62cf2c209f8406f1e2cc4d38ae9722fea40a8571ec801f7e19e248abff2339

SHA512
db1826bc54d6943b749d169baece758d8a3fe3267b4777475084364f51ffd3eb6a946015d1dbfc9367fd3375b50609e26debd7574ce0167a31c7f2fccce503f7

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
a1853a21f87066cf33b77e40d462ead7

SHA1
1fe093e7d5b4a7054dab56891987dd8c40590685

SHA256
85812c99cc64d700ba916aba5432c704f453683e711dc514d7e9bd7d30865a87

SHA512
a4c2a1ed6ffd72cc98828e73db46adf7b6ad3d382dec9e1338d829af24bac8b33f604aa3579cddf6856b145c4e853463f73fbb0df3bda63ddc3ad0c77d524838

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
883b2ce96e677cc97238450b5ce73841

SHA1
b1696c1545bf29f8aa3e73aa775851e0e1d2935d

SHA256
a91680e9a6f9b66da46e4707bee8c3cd829b1ef2bc0d40663d6d4e9410da684f

SHA512
0d78ac5920412282137a47a1f22e849d10694e123b95cd70fc338fc1014bca5f708e10026f7bce2dae18a6ae38516daa106fe61e817469cbf9bda64d3a67a520

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
def680d16ffe53dc2bbd887b96b91d88

SHA1
cde752e27cdeb7611632bd536640e4aa62241809

SHA256
c5e58c19eba48d9e229a81c91f1aa54cde36093b356605a546876efe97381700

SHA512
31e9702282b16f0f125ca4f7832f6691d0a25717de9ca9d2817dd96758eda270b7adc097b8973bcb3aaac8085f44b09ac9aa195359c44d1711e4d9fd126eae68

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
6670ae2bcdbbb6a57e967ea5d916fdaf

SHA1
eb7eee99ca24f2c2697097a88abdde07b21151f6

SHA256
91270440bf37d2bc7ae080cdbd6f8f091e5cdaa5a178afac32ec4d740cd6647a

SHA512
42f78d386746f3ba3c14660fc3966812b3f2326db321f9fb77325532910387d837fee3f305161c9a2552f980fb0791a474c2f2f5be77c61ba32d888ff27dff80

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-02-05-122814_tests-iMac.crash

Filesize
40KB

MD5
0571413210c194210db95ede44937ced

SHA1
e43228a1f62c334045e5962f70050bf77c5de481

SHA256
683478fe57eaf1499b63b44e39e247ede20f277e78a7be36c307b294be6ba7a8

SHA512
2da0280d453ee568fd3f14513eb5bc70a72fed75165f9b0e6805e47f0d7b0b4562b281d3e4acd5e6fc93a8f31237af6468499adc0e3b1e70747b3781d8eabccf

Download Submit
/Library/Logs/DiagnosticReports/sudo_2024-02-05-122814_tests-iMac.crash

Filesize
47KB

MD5
870444610118842ba2d64c1aa020a846

SHA1
3d5851bcb15be443e5624c8616f3a9376a90059d

SHA256
785ecae2cb939ad6d4288ccc6c0425b0a5015f0e43fb764c71a3d532396946d7

SHA512
304cfe21c8f7a0ac7f83283a3f8ec2f6e1950ce01b38879a69efd0ddb407c623bf8be3272f7d6b27a71bba71fd80734eac0f04ed3a400b0f028e5dbc024a5b77

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
355B

MD5
a6ef4856e99c9d8e1d9bb762c5a8503a

SHA1
25d5405ad91791b716ae5a56b37aa2b393854967

SHA256
232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa

SHA512
582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
355B

MD5
2f01f7a00c85e424f82b00b2bf794a7c

SHA1
c75cb52aa31012888dd7c65373d5faba6048c425

SHA256
23d6746cb1c1906c9cfb5c69f7377f7cb68965ac0708ed1d600bfd3d3c34ce32

SHA512
75131e0145182653cef2edbb968853c9cb3c26c37c5821f3cd69c3ecdde7979ae37e74ecea8ad333090a473177c6dad43bc34f94a8fd104cd4c9b16c8f7b54f8

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
de19201536431a2a679aeb0e9f0c8b9c

SHA1
a07d3faddd04cb30396adc1497c83db9d05f28c5

SHA256
1049c872b2f1ad25699fcf13ffc0119c267d643ac668116f30a4f0e3fb5b1592

SHA512
aea19156ce3ec98f737ca84826043cc003c02783357b309434220a5b0b3133cc0309cf7d53fac6286f5dca37fd58b88e9d41264342288e222d50b1ee16c61938

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6e9f95fe4e18e9b7cc8dbe5c93f4f493

SHA1
4e4abf0049498f754bfd81a08833f320dd5ce9a8

SHA256
0545e6e865f2ab793beb1db0cc67be831f8fa5798849a560bc2e555f06f1c8e8

SHA512
e6cc8fe8d24e06f0b8e5664fdd22fc2d406016361dcd45ad17d0f0de52f660042e6c2be5e9f3197ad57d0141635129a6c468698fc3bf520a8e4d542f9bbf21d0

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9ff24efe1bfb08cc5278374a26289fa9

SHA1
8800bb6de29e4bdb6c51eb50aa1f8687d7978bd7

SHA256
19d6d4088a1342aa8f0a59a7229b45cffa500b41635f397891f094f598b6ca34

SHA512
9dec66865fa1089465a1e2660cf5b049a7632d0831372d0673ddc9f2dcbe8de17c5e77c27cfc5e8ec9fd63b389ea245952aa1c24da5cf09ff3f2f28a34563b83

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a7dceaaa0f8e9f4e3f466ff106839657

SHA1
d27c45a494a42e064cf7afd945497e25948bd9bb

SHA256
99a104dc68a3fa4ff2122eeb38f56239d907af2f4f63bdda325cc44562819514

SHA512
b18c811b60c5b124f92ab8a46240c444f4ce2cf779df0809797b97005feaa8ea8b5d20386755f2bfba10b853de23640a0f784f2bb86008447b3c78903a0c8205

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
94d339d41a7b8ed63dce847201f7a634

SHA1
bd555ec51d1f2fb09447ede839d2b918f9ce03e5

SHA256
2f7ab5b2af87588dee3430a0ee086949f6037048fe2f5ce19bcd980770113292

SHA512
d8fa6ba32720216eeb8bf5a9d0bc062b7e6fae5c58945967dac2acb0f0786a4efb63d5ac3f0eaa9af0d75be6a7b55da070f212c3c885b9b7371ccbb99aa8ec3c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8070aa6de44813705276ce8ca0399429

SHA1
c6ce0a8a9c332af3817a59256f8c797176ff4f20

SHA256
a91e10a30ebbe835d28b2868a81f1f26e09ed66c1483aae2c4a6c4e9d54cc0c8

SHA512
87dd85a0145ce3505584e9badfdb681166a47b928ec5297417ff2d765ee80a9fc3e17ad8da863f521a4d0dbd7caba12a94b2ce31e3667a6c361a5f77bc370eb5

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9171a05d657ac779f1a31d027276bfe2

SHA1
2e8a1352d119c3b98d43396a3f419475441749b2

SHA256
c1c0364e9749482d97b4c78bdb912866cc078b0f7f3481650a6a41b9e6b42b2b

SHA512
bd12d33aacd593792c0264fcfabd630163e24004459509b042de598a21502bab0ff68ec8123c731e60342a2f87b051961515a945b222b7c9875ac848939277b4

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9eb9da86587575173737784ad3b0e91f

SHA1
4d65f28e035ef284055e62c449358e38c3fbd8d5

SHA256
25eba55822eafe5015d9e603546d90a8fff39075285a1f8cd28c3babc2fd1c65

SHA512
9b1f3cd257d54333c67d7594480b15e6e28b2ca5e8c4c7310f3af36a73b310381ecc947e729e943592738017a06762a3770ba3e692b8296b2820dc025edd342d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
707304c2a07992db3e3ec01fb36ae29c

SHA1
356b1201480f0ceb0004db1fe2c31a5f68529d0c

SHA256
507f721a53107d2fac82e4d3ad7049661f109dfcfc9008a2bf2e5c05f1284c83

SHA512
03b01f67f0a5f0dcbc126e24aae87fd30810fb24485d5293cfb7c781c85b1a5ad9ee89880940b177caed24bee9d78be43dae7e92ffeff3d538ddc9a1a408008d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
80615c4a77b4c0363507f19684bcdd8f

SHA1
5beb56efaf2c571ebfa7e5b6c271325a96200114

SHA256
79db56b98bc8bd0b4b93e33d8b2b9160871ff95e7ec8a6952f961d7c1621acb8

SHA512
7639b845bdd50ee36090fa6d567431dfe0d2bba13fdfb3e4a3cb81ba3fa69bf5118a4cb48fcf40c63d2cfc787ef8bc9c5d6220491c88782f5380875fcff8474b

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1879c8d3829ab2cfd7e1231487b9e8e6

SHA1
ffd17fb0b436e31cebe136412b1b6d415af0ddb7

SHA256
b8dc768e61e6ee185326eeb3743fb8b7e04f1d87c5395f46f7edb51fde1dc104

SHA512
7a33fc434c77df6730fa285ef97a60ebbc9c137bbe7824698f8cbb650f56809a87b1bd2a015f733e619634ba16f8ce1a389e3c6ec9d502247c009907c7e4a685

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
69c0910ee733948611efe0273a90748d

SHA1
66caf371bd356b1adc6b29b816696f430818a160

SHA256
f498b7c1c087747cb44a1a92ee685ccb1b35fd889a705fb85c25804c1b23a7a3

SHA512
c2b88e034c1937d2056310effb7e19f3e5383332b008025af6ce34f78eba5dbb31c5926a93ea6f861690cbb399146334a0dcc8e0060537ff14a8d0f9cb296723

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fc0cf05ec09dd4024ab5e9197eba3334

SHA1
014a7db4a6f5c43abbe55f342ae17dedd874a24f

SHA256
dcb8efa3fec9209b00c0cf9dcdc60c15ae9485fa2d68f41d8f77b43a18501a38

SHA512
5e063869d58f504509480ba804b299eabae8bac725932a455fa351912d819b2432186ff32dd9af52cddf19712e90464441b63ce361eb9b3264cfaf1d88015183

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
178cfea6f6678be72d5418e8c5a99e6e

SHA1
a58de98183e294428bf3c79e28a195f8cc08045d

SHA256
ad1767ad89f509a8e42f1f5b9c6cece55e47c91741f21919995d469d3867c6e7

SHA512
f02ff4306b38059b35f58008479f0f57c0697e8514f159c115fdebf87e49e6a26988c5269f3885992b9d8e802af2061d623628150cd5975bcb50eba0633f27d8

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
a648ac00d46c10d3bed897268abe9562

SHA1
bc078e57a7fe6c94ce561ca6aed8f956d4e28e0b

SHA256
8ca7a0b5267ace922add05b968259da49d0a2cbc63eefbed141481b29cd580ba

SHA512
ca6caeda3e9f6b9c457d54bbf8b6a7cd8d2a892428ad3608441be68cc648148fd156510bdec9be7156b3856162e56118d2eed9fc3b48b43e3f74fad822f03106

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1168.xml

Filesize
150KB

MD5
76ebb0196d42a294b69ef118cbb301d5

SHA1
61e5ab752d351af1661716bc48c0520f66cd1d1b

SHA256
aaa9febe98e3a75220b4933d1f00f2bef276183491e7d171fa54d03259812759

SHA512
8dde09d72944e8925c5bd64dc3799a44d7c30191d5038939a24f8a45ccf4d66b84990e8be3e0f2ee1d42d1dd6e5ed3673c39f803874fb0840a3232cc1e533663

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit