Analysis Overview
SHA256
b22dd93184bd9447090a7fb85d7c2010ef30422622c65a1632518b86901091e0
Threat Level: Known bad
The file 2024-03-04_72a8bd836b4171fbfa3f1ee17e5bd4a2_adload_evilquest was found to be: Known bad.
Malicious Activity Summary
EvilQuest payload
Evilquest family
EvilQuest
Launch Daemon
Launch Agent
AppleScript
Launchctl
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2024-03-04 12:28
Signatures
EvilQuest payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Evilquest family
Analysis: behavioral1
Detonation Overview
Submitted
2024-03-04 12:28
Reported
2024-03-04 12:30
Platform
macos-20240214-en
Max time kernel
151s
Max time network
152s
Command Line
Signatures
EvilQuest
EvilQuest payload
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
| N/A | N/A | N/A | N/A |
Launch Agent
Launch Daemon
AppleScript
| Description | Indicator | Process | Target |
| N/A | osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
Launchctl
| Description | Indicator | Process | Target |
| N/A | launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | /bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" | N/A | N/A |
| N/A | osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" | N/A | N/A |
| N/A | /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
| N/A | /bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" | N/A | N/A |
Processes
/usr/libexec/xpcproxy
[xpcproxy com.apple.pluginkit.pkd]
/usr/libexec/pkd
[/usr/libexec/pkd]
/bin/sh
[sh -c sudo /bin/zsh -c "/Users/run/2024-03-04_72a8bd836b4171fbfa3f1ee17e5bd4a2_adload_evilquest"]
/bin/bash
[sh -c sudo /bin/zsh -c "/Users/run/2024-03-04_72a8bd836b4171fbfa3f1ee17e5bd4a2_adload_evilquest"]
/usr/bin/sudo
[sudo /bin/zsh -c /Users/run/2024-03-04_72a8bd836b4171fbfa3f1ee17e5bd4a2_adload_evilquest]
/bin/zsh
[/bin/zsh -c /Users/run/2024-03-04_72a8bd836b4171fbfa3f1ee17e5bd4a2_adload_evilquest]
/Users/run/2024-03-04_72a8bd836b4171fbfa3f1ee17e5bd4a2_adload_evilquest
[/Users/run/2024-03-04_72a8bd836b4171fbfa3f1ee17e5bd4a2_adload_evilquest]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" with administrator privileges]
/usr/libexec/xpcproxy
[xpcproxy com.apple.security.authtrampoline]
/System/Library/Frameworks/Security.framework/authtrampoline
[/System/Library/Frameworks/Security.framework/authtrampoline]
/bin/sh
[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/usr/libexec/xpcproxy
[xpcproxy com.apple.ReportCrash]
/System/Library/CoreServices/ReportCrash
[/System/Library/CoreServices/ReportCrash agent]
/usr/libexec/xpcproxy
[xpcproxy com.apple.sysmond]
/usr/libexec/sysmond
[/usr/libexec/sysmond]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/usr/bin/pluginkit
[/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync]
/usr/sbin/spctl
[/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterDA6CE80A/OneDrive.app]
/usr/libexec/xpcproxy
[xpcproxy com.apple.ReportCrash.Root]
/System/Library/CoreServices/ReportCrash
[/System/Library/CoreServices/ReportCrash daemon]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/usr/libexec/xpcproxy
[xpcproxy com.apple.geod]
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
[/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod]
/usr/libexec/xpcproxy
[xpcproxy com.apple.nehelper]
/usr/libexec/nehelper
[/usr/libexec/nehelper]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/usr/libexec/xpcproxy
[xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A]
/usr/libexec/neagent
[/usr/libexec/neagent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/libexec/xpcproxy
[xpcproxy com.apple.AddressBook.ContactsAccountsService]
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
[/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/usr/libexec/xpcproxy
[xpcproxy com.apple.tailspind]
/usr/libexec/tailspind
[/usr/libexec/tailspind]
/usr/libexec/xpcproxy
[xpcproxy com.apple.routined]
/usr/libexec/routined
[/usr/libexec/routined LAUNCHED_BY_LAUNCHD]
/usr/libexec/xpcproxy
[xpcproxy com.apple.Maps.mapspushd]
/System/Library/CoreServices/mapspushd
[/System/Library/CoreServices/mapspushd]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/usr/sbin/spctl
[/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app]
/usr/libexec/xpcproxy
[xpcproxy com.apple.assistantd]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
[/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd]
/bin/sh
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/usr/libexec/xpcproxy
[xpcproxy com.apple.pbs]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/System/Library/CoreServices/pbs
[/System/Library/CoreServices/pbs]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/usr/libexec/xpcproxy
[xpcproxy com.apple.newsyslog]
/usr/sbin/newsyslog
[/usr/sbin/newsyslog]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
/Library/osxmobiledata/com.apple.afsvcpd
[/Library/osxmobiledata/com.apple.afsvcpd --silent]
/bin/sh
[sh -c sysctl -n hw.ncpu]
/bin/bash
[sh -c sysctl -n hw.ncpu]
/usr/sbin/sysctl
[sysctl -n hw.ncpu]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/sh
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/bin/bash
[sh -c osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]
/usr/bin/osascript
[osascript -e do shell script "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]
/bin/sh
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/bash
[/bin/sh -c launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/bin/launchctl
[launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist]
/usr/libexec/xpcproxy
[xpcproxy afsvcpd]
/usr/bin/sudo
[sudo /Library/osxmobiledata/com.apple.afsvcpd --silent]
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | 2-courier.push.apple.com | udp |
| US | 8.8.8.8:53 | 34.courier-push-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | mobile.events.data.trafficmanager.net | udp |
| GB | 51.105.71.136:443 | tcp | |
| US | 8.8.8.8:53 | a68.dscw27.akamai.net | udp |
| US | 8.8.8.8:53 | 7-courier.push.apple.com | udp |
| US | 8.8.8.8:53 | a1366.dscapi6.akamai.net | udp |
| GB | 104.91.71.85:443 | a1366.dscapi6.akamai.net | tcp |
| US | 8.8.8.8:53 | 17.courier-push-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | gspe21-ssl.ls-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | gspe21-ssl.ls-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | gspe21-ssl.ls-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | gspe21-ssl.ls-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | 44-courier.push.apple.com | udp |
| US | 8.8.8.8:53 | gspe21-ssl.ls-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | 35-courier.push.apple.com | udp |
| US | 8.8.8.8:53 | 31.courier-push-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | a479.dscd.akamai.net | udp |
| US | 8.8.8.8:53 | a479.dscd.akamai.net | udp |
| US | 8.8.8.8:53 | e10499.dsce9.akamaiedge.net | udp |
| US | 8.8.8.8:53 | 26.courier-push-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | 18-courier.push.apple.com | udp |
| US | 8.8.8.8:53 | 1.courier-push-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | 4-courier.push.apple.com | udp |
| US | 8.8.8.8:53 | 13-courier.push.apple.com | udp |
| US | 8.8.8.8:53 | 38-courier.push.apple.com | udp |
| US | 8.8.8.8:53 | 23.courier-push-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | courier-ab-vs.push.apple.com | udp |
| N/A | 224.0.0.251:5353 | udp | |
| US | 8.8.8.8:53 | 24.courier-push-apple.com.akadns.net | udp |
| US | 8.8.8.8:53 | 29-courier.push.apple.com | udp |
| US | 8.8.8.8:53 | 50-courier.push.apple.com | udp |
Files
/Library/osxmobiledata/com.apple.afsvcpd
| MD5 | 4acb6851a91a94bbf93e1125160831b0 |
| SHA1 | bba5054460fe37e24b8bf0785153e008ad9c9a40 |
| SHA256 | 8061fde0e5e5a8ca50a2421975b0479d82b4bb2ec90e3f5cea2a3dbcfe65ec88 |
| SHA512 | f935f8331e82e0fd99ceaf26f139f945917565a69df3d36955131496ceaf569e6f69c062911fb7b7ec4b8b9ff37ca009ce9633a70bd52e114f6e4a1ebf9f3e32 |
/Users/run/2024-03-04_72a8bd836b4171fbfa3f1ee17e5bd4a2_adload_evilquest
| MD5 | c1f76e7417a8200f81e9841d2330e2ce |
| SHA1 | bf8589679b46da48dd5193e195e9f10c7e8e76f4 |
| SHA256 | a773091680c62b4a3828bfce3b37b0f6b80654fd0419acc6c6f50e7d510111ce |
| SHA512 | 40a11f9751091c270f90e5ea91ed8b77a91d38d2a995670d36d5a1bb39d3adcd5809ee8ffd8391afa008d92bb2e6f6e502219df5334b017eb500f57ecd160de2 |
/Library/osxmobiledata/com.apple.afsvcpd
| MD5 | 69c83bd42118285c23fda38b8588d5f0 |
| SHA1 | e13e1a7208b5858849c4bcd1929cce9f53cb91e1 |
| SHA256 | a233646cd1b926b55d7c387ecab3c6db0d9aba647db637ce398e6936335bea27 |
| SHA512 | 40b1b722f4b657fa4280504c190770c9d8cd53da0b1224b4bb6af52d81ea5b39bfacbb48898cae75d69f81da1b53353046ea5db3ad736528817c4512d529ad8b |
/Library/Preferences/com.apple.networkextension.uuidcache.plist
| MD5 | c92127f7ee48ad5e3c8b165ef0dcba1c |
| SHA1 | 7fabbe716497efc2de185429b40127cdd58f59b7 |
| SHA256 | 04fefbaa058a5c300a90a50be6894dde2138fa47239dd93e7b9265352a96e4eb |
| SHA512 | 29d6c275b4337e642dfc183316969acbc345c0cfae53f94a103192e56fbf73499cc05cbf8076788191434162ba75275adfbbe0bf31ade37be0c76954570b1ccc |
/Library/Preferences/com.apple.networkextension.uuidcache.plist
| MD5 | 180d9b3949b39ff1f5c85cecb6d6785c |
| SHA1 | c0d976708fd5a19728d7f0f275e93e19b7558eba |
| SHA256 | 87a9a1a2c137609da7808452aa71478cca04d1b0a778b1d1f559446bd8178d19 |
| SHA512 | 68ee36c2cf3ab0699358181e5027b9cc69adb9847de0206fe0dd46d3a06155b0f5557bd39863f6e1cfde3698f7abd873e57bd41398983fbbdf07a02e97b5ff43 |
/Library/osxmobiledata/com.apple.afsvcpd
| MD5 | b24ba5bd61f8d26b604ce53aa11815bd |
| SHA1 | eaad3ff718995dcd66edee1038a495640aac5661 |
| SHA256 | 5576075cc7518cceb6f10124d68afe5bf5337778fd1b99f5201c66ca0a94a240 |
| SHA512 | da30810a1f13f68005435e4a26680206af8c604faa5820cb61a6a2bc41afacd89117b99d6f4e2f5efc02f81b395a6106ca470f818e31ddd7d70dc2bbb7d3eaac |
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
| MD5 | a67018744d33b5ac2130f55c268ecb8b |
| SHA1 | a58b49950faec86f3a35803d47241cee73e62bed |
| SHA256 | 09aab1a1d2ebd2aad287e89f99429bb4ef44e7141a5bff6084fb1b97a9401c5d |
| SHA512 | c44474edf1b1c5c8272cb03db7ef5fbc6e130c4a0370376ca34a6525e7b20e4b79f4dfd947394855f19d2d3c9e268c6939a15af82706d9681a8bf4426be00216 |
/Users/run/Library/Caches/GeoServices/Resources/altitude-1188.xml
| MD5 | 3e6423b24f263da56088a101653606cd |
| SHA1 | 7c43adc6c23442858bf0dcdf84b5a08323fba317 |
| SHA256 | 95e4aa9570e1acd3de701ac19c395d80a710275d6e052c598c09cc1ed710c398 |
| SHA512 | 3f85d2f77102790e8ee82c1f8797c754167a79af91dfdd5377e7681370f01540234017eb24be89cc7a4da5e70005bf35b069d21f5bf70cc59efe1abd6dd8c255 |
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
| MD5 | a91c081a583ce5d97499b779d00b423e |
| SHA1 | c1dd6f2b15e1ef4e2746a0f5b6ea83cddca6f520 |
| SHA256 | ac5278415d929eb690c75a9e3bd04f5e307ba9235d1f5801c1e61b8cd9cfd1cf |
| SHA512 | ce153215425bc1247a3bd7a5d11fce83265b19a851271ffcb2825a52cd0614574b53d65d974ce479eaf5d83a1900a314b0f542ce089004e7b4b33f68c41795b1 |
/Library/Preferences/com.apple.networkextension.uuidcache.plist
| MD5 | ce7f5b3d4bfc7b4b0da6a06dccc515f2 |
| SHA1 | ce657a52a052a3aaf534ecfbf7cbdde4ee334c10 |
| SHA256 | 9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1 |
| SHA512 | db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb |
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsObject.db
| MD5 | d3a1859e6ec593505cc882e6def48fc8 |
| SHA1 | f8e6728e3e9de477a75706faa95cead9ce13cb32 |
| SHA256 | 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c |
| SHA512 | ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818 |
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C/assistantd//mds/mdsDirectory.db
| MD5 | 0e4a0d1ceb2af6f0f8d0167ce77be2d3 |
| SHA1 | 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c |
| SHA256 | cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030 |
| SHA512 | 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20 |
/Library/osxmobiledata/com.apple.afsvcpd
| MD5 | a20bac9530931c64f7b066d466b7f3ba |
| SHA1 | 8766ed15630c9499b9fe73abd0c0e4697800dfaf |
| SHA256 | 0437fdcb76ee067a3c52d5eb89e25d053ffadfd3be8d0330d0406ed58d15f6d5 |
| SHA512 | 947a23eca2baa96804313b8d72a7ec7753b3b9181c2a18e69eb650c060434c267d123abed2de903a524127b87b9e30ef5e391ba716cd2d150298c075eae7a98f |
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-04-122942_tests-iMac.crash
| MD5 | 7cef6694708ea75cb174c290eb6256a2 |
| SHA1 | dc2ea18f4aa8952efcf7b312e468d0146014e334 |
| SHA256 | 54bc12dbc8d96c4193086a51f32e7ddbfa42cd955538f683efed51287f6e2ab8 |
| SHA512 | 5308ab04723013b99c500dda966a7e9ee7b59d35c15bd2920f647f52508fbeadceda306e521928515adeff1a39ba43cdcd901195161c254c952638648d3d83b2 |
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
| MD5 | 058778f7ced64da59dafba347272f039 |
| SHA1 | e9688c68cddb8845b7b2930e8e710cc6ec7548fa |
| SHA256 | f3037562d2eca756f0dc3388fe297061049a0846ab457a39e63d33172947d455 |
| SHA512 | 472b56bdabe35d4d0b11ba927c38a3dc79d7fca087b2d402c9e36a20680c990de23fb07cc9e331c8ce9190b6fdabf40cc0c1482229dca5d4a21e15fa091aa4c5 |
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
| MD5 | 15a14ed24b47745a42b28bb025084bbb |
| SHA1 | f9f7a597c38bfedd27ec74e5246b076b2b109361 |
| SHA256 | 59cfb7f958e4fdaa1d3e21d1b19fb99a8adbab4358a9ff19d8ef463fab2add56 |
| SHA512 | ccaf7823834a2aebc557e40a3325d41d35e8a13e7efbb946ac5501e3c4c93a3ae6e4dc8ae8b056b8c2478ae486466d3a97491972c5bafe2ce29813abaee010f0 |
/Library/Logs/DiagnosticReports/sudo_2024-03-04-122942_tests-iMac.crash
| MD5 | 97e2adab12bfdc3026d3f22dedb2b50a |
| SHA1 | eace6c3f6ac06014749ab77e89bbe2bd18574fc0 |
| SHA256 | e7b9aac1196d868b37f2b51be0f22ffa680ea0462ba067ce4baf41caeec41bbf |
| SHA512 | f799cf05755dd14553a12f52837e69bb8d91ad808a1ada22c5ab66bb289206100deacbab98e768c14a0a6f0ad3c709fae1041e92be75ad53f10d34b496b21ba8 |
/Library/Logs/DiagnosticReports/sudo_2024-03-04-122942-1_tests-iMac.crash
| MD5 | 43e1920c54ca617d891870cd54e1f2c4 |
| SHA1 | 265b01ceea9e9046aa4edd523cdb88cc9760d8f4 |
| SHA256 | 8536f7d4f122d3b02f9cacc0ad229c0e800813977511e9c3f33cbf842b90f9f7 |
| SHA512 | a5ab1ecd5579d2596efc82056b1810dabcf3fd4143dc4de5c8baa95eabdbfba9f42e30039aeccb5e2b0d7b6a3ed29eb456a7516f54324efedb0ea2b74155c47d |
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
| MD5 | f34ccab83835fa3700b4a6f9f48a907b |
| SHA1 | 82a3240069746e372a446dbf98a0a4f667a31197 |
| SHA256 | 1e4ca6a51b090f5b34e868ead6b900232427856c07fdfbd8aa47027857075355 |
| SHA512 | c75305316c6d47f98916c1700846d50e2e7ca772505e427f8e90deefce1f15552f6eab1655e0108081214e111f308aebdf94d8b36ccf9edc73e3fb5ceceee268 |
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
| MD5 | 2b81320c32917287cae00e3ceddd73de |
| SHA1 | a277fdcf463c564751d721d3a4799a4a1bf39c72 |
| SHA256 | 892b58dd010c0e925ddc627038f1dbe28c377c2f93a5eacabf5b90245f979284 |
| SHA512 | ed6059b41659735a2aa4b6e7636df023cf87a03524c2b1253701a3f1a3b88667d3852f1c9fb02683d66d459a1be297e7121d105f0052d78425a19ebbbdefc6ae |
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
| MD5 | 70bba8903ed9549a2a4349a84505678e |
| SHA1 | 6c492a4d7514eb6355c7c98a7bf7d0531a2736f1 |
| SHA256 | 36934218dc47aebab9eddaedf91e96d13b1f91f1e3b57713b04d7f24d2149419 |
| SHA512 | 5932cac3442ab527da23d42080ce3d8b1a09745f13e974a36afb522549dc89ae9f9fcdcbd1bce5b598230f9bc5e9ac863fa07061fa96b34577aa065eeaed2385 |
/Library/osxmobiledata/com.apple.afsvcpd
| MD5 | b307c27cc2a76a77ac6e4122fdc75877 |
| SHA1 | 65c673cb1f3bf4cac20c4acb995d070471643f45 |
| SHA256 | 1c271bc9f93049909e4dca0d475f7926e3fec1b9a2f739c44f79b4c5077c71c9 |
| SHA512 | 34288ce463929ab51360672cd03cfee18a9eec8c0009567f58c48e69774bd6d1c46fc00a69e810515da9b01fee7fd4c3b26df433e29668385a15e53ba375a38a |
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
| MD5 | e5e9412c7f5980d7c6d06cc01d90a791 |
| SHA1 | 9dc01ca32da5315baeb0f8b42d79c7ee922e7593 |
| SHA256 | a6c0cc2221ee64d3bc8b86ec8039234950d0b7bec9c04bc1ac09a13b8f291853 |
| SHA512 | 0500ccce897097330b7d739a4426a2e755782a5fd24d0d785f78a28102236c52ca70509de268be63dbd4e5d0e12895a5cf0c57a0c5eb0eca3ae27a0ec9b0951a |
/Library/osxmobiledata/com.apple.afsvcpd
| MD5 | 5ab5b451281487453e8d6eaad6a837c0 |
| SHA1 | 4bedee2078f024c025bb962b54ea3dc64b8720d8 |
| SHA256 | a72770cef60b2d579a4a5434ac1581206bfb9bba50ac09ab64d95a5ae713f1db |
| SHA512 | 8a202ff3f828a8b15a3d7d9696308593b9a7dc867d8c0c7e6090c5b8fcca55d25108537283615990b26d25459b3526176f0f15970efeab0f5932458c9f44484e |
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
| MD5 | e98a4aa20311813732ab50305750d75e |
| SHA1 | ab524af85ebe538c7583e9229dd9edb7fe51bda9 |
| SHA256 | 4d447f372f6ebbe585305f7ad430ff26fdc060d0c10ed9cdcd11358783847409 |
| SHA512 | 4351ab355d62c6b4eed33924b5e979bb3ef9c916185fd55a6c034a628c4ba28f22f0302d83af8a34d6b40a39769bbf9a772c0ff18fc63b428bc543c612dffbfb |
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
| MD5 | e189c27a429b001cd05769e54dc1d5c4 |
| SHA1 | 7314477796805091a84735244cb1f973fc295639 |
| SHA256 | 508e0551f61f5ff2c530142bb3a56655eb3c4d02167065fabfaff98dee6153c5 |
| SHA512 | 8d631c5542cf38e5542c4f4285a8a5b71a4e05628d78c24b05c7ed293221f4686d753347f56fbaec7de466ff94b763d08fd1025c0f150f3722089618e728211e |