evilquest | 1274a869286e56c786c4ac3cf32a0269547b68be7ffe7ed0178edd88972b55f0

Analysis

max time kernel
150s
max time network
154s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
04-03-2024 12:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-04_a0b771899c51e67223527142ab299a25_adload_evilquest
Size

182KB
MD5

a0b771899c51e67223527142ab299a25
SHA1

bbcb5c11f8d5da5cf40aed29411adef4ebbf8671
SHA256

1274a869286e56c786c4ac3cf32a0269547b68be7ffe7ed0178edd88972b55f0
SHA512

e5138512bb115d1eb04b6ce027336d41369951d0c6801a92919c37a365e7f09a85fb99383e884c2ac592dea1bb447bdf799a2458774804c99a4433287f2b2693
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9py0wl9:5SeOQdaZNxtk8cqhSxvHY9A7

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 16 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008af25-0.dat	family_evilquest
behavioral1/files/0x000000030008aed4-1.dat	family_evilquest
behavioral1/files/0x000000030008af25-10.dat	family_evilquest
behavioral1/files/0x000000030008af25-19.dat	family_evilquest
behavioral1/files/0x000000030008af25-28.dat	family_evilquest
behavioral1/files/0x000000030008af25-29.dat	family_evilquest
behavioral1/files/0x000000030008af43-37.dat	family_evilquest
behavioral1/files/0x000000030008af25-70.dat	family_evilquest
behavioral1/files/0x000000030008af25-77.dat	family_evilquest
behavioral1/files/0x000000030008af25-84.dat	family_evilquest
behavioral1/files/0x000000030008af25-91.dat	family_evilquest
behavioral1/files/0x000000030008af25-92.dat	family_evilquest
behavioral1/files/0x000000030008af25-98.dat	family_evilquest
behavioral1/files/0x000000030008af25-105.dat	family_evilquest
behavioral1/files/0x000000030008af25-112.dat	family_evilquest
behavioral1/files/0x000000030008af25-119.dat	family_evilquest

Launch Agent 1 TTPs
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 46 IoCs

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"

Launchctl 1 TTPs 64 IoCs

execution

Launchctl

T1569.001

Processes:

ioc	Process
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start afsvcpd
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "launchctl start afsvcpd"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-04_a0b771899c51e67223527142ab299a25_adload_evilquest\""
1⤵
PID:518

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-04_a0b771899c51e67223527142ab299a25_adload_evilquest\""
1⤵
PID:518

/usr/libexec/xpcproxy
xpcproxy com.apple.nsurlstoraged
1⤵
PID:520

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-03-04_a0b771899c51e67223527142ab299a25_adload_evilquest
1⤵
PID:518
- /bin/zsh
  /bin/zsh -c /Users/run/2024-03-04_a0b771899c51e67223527142ab299a25_adload_evilquest
  2⤵
  PID:523
- /Users/run/2024-03-04_a0b771899c51e67223527142ab299a25_adload_evilquest
  /Users/run/2024-03-04_a0b771899c51e67223527142ab299a25_adload_evilquest
  2⤵
  PID:523

/usr/libexec/nsurlstoraged
/usr/libexec/nsurlstoraged
1⤵
PID:520

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:521

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:521

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:524

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:524

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:524

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:527

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:527

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:529

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:529

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:530

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:530

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:531

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:531
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:533

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:534

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:534

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:534

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:535

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:535

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:535

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:536

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:536

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:538

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:539

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:539

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:539

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:540

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:540

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:540

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:538

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:543

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:543

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:547

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:547

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:550

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdaterDA6CE80A/OneDrive.app
1⤵
PID:551

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:573

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:573
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:574

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:577

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:579

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:584

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:585

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:585
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:586

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:587

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:588

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:588

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:592

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:594

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:595

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:596

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:598

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:598
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:599

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:600

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:600

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:602

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:602

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:602

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:603

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:603

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:603

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:604

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:604

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:604

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:605

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:605

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:605

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:606

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:606

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:606

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:607

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:607

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:607

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:608

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:608

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:608

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:609

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:609

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:609

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:610

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:610
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:611

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:612

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:616

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:616
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:617

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:618

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:618

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:619

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:619

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:619

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:620

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:620

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:620

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:621

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:621

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:621

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:622

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:622

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:622

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:623

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:623

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:623

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:624

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:624

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:624

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:625

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:625

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:625

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:626

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:626

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:626

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:628

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:628
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:629

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:630

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:630

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:630

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:632

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:632
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:633

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:634

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:634

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:635

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:635

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:635

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:636

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:636

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:636

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:637

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:637

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:637

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:638

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:638

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:639

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:639
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:640

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:641

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:643

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:644

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:645

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:646

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:646
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:647

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:648

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:648

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:649

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:649

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:649

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:650

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:650

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:650

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:651

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:651

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:651

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:652

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:652

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:653

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:653
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:654

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:656

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:657

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:658

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:658
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:659

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:660

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:660

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:661

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:662

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:663

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:663

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:663

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:664

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:664

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:664

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:665

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:665

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:665

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:666

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:666

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:666

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:667

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:667

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:668

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:668
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:669

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:670

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:670

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:671

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:671

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:671

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:672

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:672

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:672

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:673

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:673

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:673

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:674

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:674

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:675

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:675
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:676

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:677

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:677

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
8e277f716490979b9b508d030f481c97

SHA1
4109997b0b5923d071bdac1b695f32848036d61e

SHA256
83883906607d95d9d768e2019e6cd98552021c90b773da8e88a1cfdf5921f318

SHA512
15a374577b2acb42adc4863c8a08832fa3c59164e6f77c016709da4d16b7a214b446c8b9aae461c6f350ccbf10a4d45de4346952e03766aa5fdb9c1c1921f5b6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
0fa493d053301118fe0d2611ffd5d0db

SHA1
9e53289b1ca4cb82aa9d962ba4bf92f14d56b23a

SHA256
81be35da7e4a9c2a69f2aa0368c818bc593c74f956996467705b606e81dac130

SHA512
42721bf6c3af400f5c6d46c3a701dd215ee43c71332a7ed09c97eda90eb99f88719908469238b545333f978d48e08be32369386305bdbfb3b2ab17a5e760845e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
8eb961520f5e0defe1def6713b7af723

SHA1
96fe6c50b486ff4544be92741e827cedea535e64

SHA256
890f08b87d24cecd5ff987e352cfc29fe5d4e4613af48b019aeb95535a41038f

SHA512
c5c422bc9503f76cdcd166666ec25001526e1f174a8357009e14e51e0b1b5dd50c97b11e0fb8d54147f10e79c0d5d37c6e6e280a74c222303b1e0865b76ef901

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
9f23ce30d684c94481d849441529ba04

SHA1
a9f84e250c14642ec01d12f0b38eb83945c9a886

SHA256
f60c5233840a56a7d9f0764b29824430453515069e9c11e3e9477b9df573f4c5

SHA512
13916ea743db152614d967d214715579aa5175019afc351841962d816ecac3e9983bbad44a9a24be5599f647a610878ca357727e3a381bb35a1a4c93c7784b34

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
ae193f0be02569ae0755fe339aa2f5d2

SHA1
9bfb959a33f9aa07c55ecfd8a40cc7f770f5ed55

SHA256
e498025179ab62d0ebe45ca54a41a6693fabeaf069883067f657dd7ba2908e67

SHA512
a1b1dc91c5286c605b1e4df2e04e94d7709367644d4a969838b6d36edc7fddb9d149361aad521916375f6734b8ff2e617797281270292d250ca11c984833bf29

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
ecc4f4d1bd65ca4cf5a9eb639243824c

SHA1
962a2541be9ea3b52eb188a2e0afe46e73767c1d

SHA256
29d88b22be8ef3e06f82239ff5ecece53b8bce3deab7b1cc9002d16a601b82ea

SHA512
4e3ab1aeb05259cc85a4ae0082f118ee5fe17eda621999ab7d9f9ec7d4711417302806937269fa3bcc5c3c9b0dd029cff993b723e37641e644050730117464eb

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
a90dec395b52284b8b2493749b8cdc66

SHA1
f20117ae8f3f562cb60fd81a95388e0c69e2afa3

SHA256
76f1b6143d6172d1fed1f21962fb7d39b3cefd0c05c6b0f03e85eeadeedd1119

SHA512
60197a87a2e97a6d53afba7832cb716e919dd46d8ac090343c7422b6d7f25b37833feb7c952354950a1df24bc44a3110054641b37ef041001a99bb31e6ac7eea

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
f5ff57b17e1fa21bb61620345fd55bd4

SHA1
fc75dce93bdda8076ae4ea1b1fa5bef3c7e6ea0a

SHA256
64f2e7c9c21e67d98341b5d73742a149843fdbcda4023b0747f01a9d446489bb

SHA512
c49e3116154f13466cde147aafcf7d94197acb4867a7d033111beb51ff8998bf687f5c931c268b3bf6b519c5d2dacc18fcf732ff6d77290b601ad045352f61ab

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
6e4d4f55a11656a6ca8689e8e3e6cc6b

SHA1
963593592f9a4df7b329ee22551d8595b3be416f

SHA256
38f30f3055e892c0edfa314313418d3d071696aaec3e80a028a6d94449f014dd

SHA512
97d6c4d4d6c78aef05b7869e51cd155357fb214b4cc6497bfd4386fda588018caf7a7ba946b72f87acd5e152fb3fbe2235cae5fe4832c450efad1ff34cc3236c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
a22eec8005dc25f03f4f0cafc8f85fac

SHA1
3c76d85188ca45ad8f4649129e4fe59073e09df3

SHA256
cbaec564a1665833a10f3bf455d5b922a1607fca51e005a521f6207468ff18c3

SHA512
296907deb1a97d960a981581438aa246a77864d167cca8c6ddd98f4371491659cb0b2d73585044b9020363f8ac109055b17bd66054d70f1a093862f267b40065

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
d71402694b441f4e44c4ca929a94d9a3

SHA1
324a6c468606c04a6fdc36d043a55f870347c0ca

SHA256
68ed81f7d3c5dbecbbbaeeaf29072eced3b64f2019877d434acee0cc5e61e4a1

SHA512
c03834d38155b5918f4452d71f4e24328ac8144f70629b9db29e92a12df8304fd04ef743d72b9732e26203b86da3cdfd150135d1758b1da3a958bbda14f38a1b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
8a98c564cf8c03b0c47c482aea324700

SHA1
20ba9ee2e2f55f8b329e406aa3cc373a2db5d0d8

SHA256
74ad19cbc4c1cbd8fe9be0f3b3eec7f842073ca899bbc97d81f3368a088b66b8

SHA512
916fbd6797b77a7b9ac75108f8fed124f39b6e700b3dd8c14376fa4bf93de0610d7973ffaf17942775963ed350b85707308815462db0db3e03d4ff2393e20638

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
69b7c548a9fdea3f86c41d15373bfe90

SHA1
da0f9d284d4e4860eacce0af13f3ec6b1400ffb5

SHA256
8ceb71e3e498264f88f183fe0ef4d5102d4042ef96f8b3402d643bf9bfab84bb

SHA512
d1b14711c7eac2f5e024598070e75e46b34a6ac5f7425609399f2afbcd08eb069ec2b90aee21cda577b6dcd55265d7ed86945de0e798d5aa970bb478eae681b2

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
2d1efd82e3eb4607b26adc6d9a47bb00

SHA1
1d943f1218ade29b43bcc8ee3edf23696846817c

SHA256
b806a4d4e72b85b76bf830bb60bd4826ef67837dd3c7f0e34d052496348f9c48

SHA512
0b5a51b58128d42a77f378ba5634cab96a931ac51e9f8f5d3e1eef82916427fb8872af7c72bf9860c5e89d6267ea9d85a902a14dfd4a6d16030142ee9ef486a9

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
2407af3afef4377ef1147e509ac8543e

SHA1
078872f771660a34335bd9588b89c09a83dca466

SHA256
09b2f546e307ffa68b44a6e53e9aea13ecd113a0865f7851082b9f099b731795

SHA512
f9e783565c4da871547c82bb41124d0aed01d32b979b2c3ca779ed37750fffafa46a4d40726b1b8bcf3aaeeab8cfb3b551e6959721e5c34515f61519fae49ae7

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
e2d90031b24040681d354007224f2fbb

SHA1
9ec0e56d88f9ce97c8e0f0ce5f1538c4fb9ac4c9

SHA256
6f4a9c50b3f59df2986425051f33fb93d589b446ddaa0c3c2f49ed5298126704

SHA512
5c4839368d48cb723ef018ab4e0a256286d26212b09e6d8130796c318ad63a66c2b511ce4f0af9b844eeecfd6aa74fa1318dcd26d90d4764eb451f99c4082d01

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
0e4005a4a5d58b6c6136cc6d6bc3d5ae

SHA1
3b8364ba2b1baabed74a063ed60c7090c4e64f3b

SHA256
12b84c44c8a74e6b40ed552fb8284ab5940920a3c67ee7438e85575f92359219

SHA512
e631b809cec947cc7f59da6926c4c148d16dad3577292b9c4196fc825b02d1b42d44d4d97d89bfd4faa89651e7c643fe711a2d8aa245c796afed785cd287e2b3

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
b73f6983f6217e959bacb4049c9fd4cd

SHA1
e2b56129899e79c2cfdbbab8496bc1feedd317de

SHA256
51210d7d1298eb6e153f1c5b838022c2655e7f1ab34cd415f0655bd7f9bf3d15

SHA512
17f5214bad4a50547f2037a603efdc02e0c916b0a12bc41fad7b28375c194d8985cdb0127c56fc431ac05679fd644f7a4a7780952d125d3c5a2c1103011a0c70

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
2574d7c03e406913307b73f26201761e

SHA1
3a90768d63abdec580552b25e32ab7e9d67ec1b1

SHA256
ae85bfd3bda300a319fdc3a8fb12b8dd770b13cfe1d8514a4cc9cc5c70fda170

SHA512
0f44288186b74d2d4d5a8d70106e9e63f4fc4bd1f3d109f388740a62a3847abee67ce50b31cc763438221e3c04a918fdf1caa160d4a596c0a4b73d8ceedaab5e

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
c81dbe197059500c7df33af33c7a975a

SHA1
2b210193559c7c32b1c90dcd6fddf48e97c902c9

SHA256
f2247b23c51388bdafd381cd3b4da1fd730ee6e1a91c47ec690489ad3fe26fa8

SHA512
8901495deb91906a33578ecf3d409c269993363ae7d3758ae58d4a61400996f94064a496355fb9a8c52003f85d8aaa4ef85249ef10d08861bc00d8853399a093

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
bc8ad7766e5d8c37672c16ed5fd2a1cb

SHA1
bc8d22ce7ae101023329028253c721fd0f97501a

SHA256
dcd569f8354c8cd7d6664c61a628ba04011923fca6fb9a2621d25991f3d85cf8

SHA512
a821556954362fdb4276776ce07f5b4a60ed286fc32b366a7e37e004506e6c99d7c35ae0d8ebc0a1b5012b522ef71e9eacc76df6c70d281ba611109929b2ebe5

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
8f0d11e7eece232e5d4be894d4c2a5ed

SHA1
00bec3f385bdbdcc209b14855d8cc281bdac6a63

SHA256
390a8d99acafbfc701b5a375aa8625d879ad207acb1d5d48c63c99626d4a694d

SHA512
cbd7f27e6094f57c69f8ef68ee2155bd681626ce4542ec44dd4cc352c5d66c0ccb71adec91b77ff818e22de658eddc0d6b566bf5a63bda42b1f9c09aeb0262b7

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
43f5dc0155fbd45f1fb3d286b0b1b78a

SHA1
f74ee7e58b4670be9e17a0232c5d29cb8c5d4af7

SHA256
5ab715d78fdf8df8767fd28a6780680b82b73da36a7d96a311a36dae621e2b56

SHA512
dcda5763e1be1ca1029b27e754f8f7edabcc238b88da9c7ea8a417f2857951b062804984109fa51a14ece361210413f008a4bec1920e39eea512314533e4f23a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
c42dea4572eb806014d6de4a791787ae

SHA1
85c4d03ff5297d67ef4c28406898865359782da6

SHA256
9107c42aa6bbfec3bd3eb3e93f65e25a2abb61fa71ef25b292515ff2b4a22c61

SHA512
905e75c86a85e3b4155d8a7bd67c82d2d628ca9f041e3788cd91dec6eb0a6abfc3f42c1fbb5011874cab2d92887f21eed3fd4a5bd38914f304a6227cf4943ad4

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
288B

MD5
c92127f7ee48ad5e3c8b165ef0dcba1c

SHA1
7fabbe716497efc2de185429b40127cdd58f59b7

SHA256
04fefbaa058a5c300a90a50be6894dde2138fa47239dd93e7b9265352a96e4eb

SHA512
29d6c275b4337e642dfc183316969acbc345c0cfae53f94a103192e56fbf73499cc05cbf8076788191434162ba75275adfbbe0bf31ade37be0c76954570b1ccc

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
288B

MD5
180d9b3949b39ff1f5c85cecb6d6785c

SHA1
c0d976708fd5a19728d7f0f275e93e19b7558eba

SHA256
87a9a1a2c137609da7808452aa71478cca04d1b0a778b1d1f559446bd8178d19

SHA512
68ee36c2cf3ab0699358181e5027b9cc69adb9847de0206fe0dd46d3a06155b0f5557bd39863f6e1cfde3698f7abd873e57bd41398983fbbdf07a02e97b5ff43

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
96c02100783934cbdacfc249b5536ee8

SHA1
c812b87e75127e72a01a8d00f3dd89cb64cbe1de

SHA256
c21abbd509f667e7023ae90016bd489ab2e52067572deb370431cbbe7d6d1b5d

SHA512
905d0a9aee14aff1c913599a12571ee5afb607764cadbbc4966a06cf216433ba010e5753753cadae37ee11c5ad93302abebd0a6e9fa9e6ffaf83f45a1ebad5e8

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a7ad6019e39fd1a5bec2a05f70307289

SHA1
83c0102e8490754a6245a80923ef035a01544ed1

SHA256
e0d18cfc1e4400f56b4e5377b17bf82b7117722b0d6ab631b028f7dce58ab0da

SHA512
fa7819236b9a14d5428fa23d7de4bcb94e4b02da10e207e77c2bbc19b0950b14b118f2d8f760d59815ac7217e86a4651551e05e2efd2d6edf1eaf8e9e3c0b868

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c620378605b4005e1e9a37360ac01410

SHA1
33178152a2a41b845cb0d9babbb76ddc756a431e

SHA256
a3990783a35cc24da2f0d4272f0d729aed149819a87153ec02b3c4337adf514a

SHA512
93e9bfe2a4b4adcd28c7e28df854d738692dd775485c7c36726de374a5e02dc660e728ad815779037d62cfe3ff4914f433855da61065c57f9ee831206886a999

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
17f4c22dc0ebca867ab2e5b443943bb5

SHA1
260f66b7a39eee0771336aefccb25162b2578ba2

SHA256
13804c830f9ae659d5a3d72740f744c51f0788abad960ffd7afd4d9e92b8b39c

SHA512
c786d5484a69855bcc5d650bd50a002df72869bc74b6ca918ef68b0df4f3f32e9fb41451ac2f60168420cf108368769069dd9160a2897cddf3b89adce26e61dc

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3d25fa86473d5f460f7c48dd5f5187fd

SHA1
c2e41aa0a3538c7aed1e5d3a4a986ef7a523e0c5

SHA256
cc28aab6769776fbf9b2197093348040192037c813bfe12b3d2fa1335e81ba73

SHA512
d8f88f437e93fddc398d3c53b4606500b196dc0d484a58f50d14f3fb095e80026913e40807d2537bb5d859b7e4b33739b7e864a8822abc9a292ff52134764422

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
268c5ce911cfef53f5fcc9eb6656aa6a

SHA1
80e80d0b5d7dd7e8604392c57a6f5078757a98ac

SHA256
68373e538736304b0f4e7ec4e8095a57949954581bf40261836eea14a05e66ac

SHA512
f6fc906c55cbd185c1487760f30063ffedbc60d5b615d8b6fa5a25363af7578c51dd7c9db15575e03732644807ff7d71eba7d1ecf1fa6379fe7fe019a37244fb

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9ce1ca681349ffc8867fd3cfc3460f0b

SHA1
7cd0eaabaf48fda83434007f061043ba0cad470f

SHA256
b4eb758c2ec3d6b7723df366b6c75b4b982e8e7ecdbf93a4c7d28d59a83692d4

SHA512
a1ab964b4c6017cf866717e59f3f5561717310cded9f95c3cbe0c9701c28675b170682811f6d107059e97078c685e5e66560e6b7c3bfc058e7de9e9e1231dd24

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
19KB

MD5
9970fca40fe9143055be795e84b6a73f

SHA1
df1bfda089a5db2423cbae9adc9baf0c45257f83

SHA256
a1395bf087ce27dd314a1871fb240a655227ebd04eda1ddb35d55a66a58fdb6c

SHA512
161a5e68590474a4eefcb9cb0d6164d61ebf8e1efed1e2d660244604ca50a7868288d0df562d4712d5b99d96e902698837242b14b92db6d03b13abfb31d44865

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d5202b9439432eca04b0448a0617e176

SHA1
63295a6cfa1c4c2e788d7ed560a5dd897b42aa4c

SHA256
2dc4704d4a943f3ca7ebad13fd8fd00a6c323262f7bbe98cf406e335194e1268

SHA512
a735cde1e3a026df4639c05c0ed3fb8a5ff634403c3c1da7b749a810d4b5419ef6750d2264dde8a97bf2f52c358ff304d3cc53d406e034301876cb4fccdb347c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
720fc0b2a0050a722a73a00a4f355b92

SHA1
87364a7c5573c094b506a05ca7d55326805ad26f

SHA256
a9cf38d4cfd998589a3ecbede3aafe5d713941caf309ddd74d569e57ad8fc9f8

SHA512
6f5be624949f9c8d5419620bdc21ccde75a131c2b11cca1d8eafce45666068fe6c0ad894e23f8980fd913f4297056beb51fdf223a65a07bc684baea38568ea98

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fde328ef7c8d28366de41feb559676e3

SHA1
8a0b27ca215ff5965142a5b7d045689c77f5db89

SHA256
a6863dc37becdd44c6b1584c47b357cd3bd955dfd98f3dca06ef22a99d72e3fa

SHA512
1315e303c8ee8dc15ad6560f902daad2d23fa805fde1c5bf817d8c5a7479266056fe5b6c1959b7292d5ef90e7f790874900d46b09a5e5aa4a603eeb08b3665aa

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
90KB

MD5
5e2377dfbf01cc8ba7ae1cbc8067f2aa

SHA1
bdce34e123ca09618aa10bd75fd44a4616d7da2f

SHA256
407f1e69dfe3ed96ff11ab06f2c29cc95febd846d46b82ed430cd66adff72dea

SHA512
54c1850dd53cfd43234ec15ad3561b22fa50c2438cd1fa7d556e574f06d78102429cb2d226f93d653ea5e09ec2f04a873032bd70179884387fc40914d13b0e8c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
abc713eaede5e59ec78d993c8eb442bc

SHA1
9508221d4c4af1c1bd1cb57db05fc9c2a344355d

SHA256
d682c39ce032be1ab2d6762f09b34ca2fa602539faf9d1532038e63ff16a3612

SHA512
c492094ac8fa53b9d7372858d23cc877bc85139afe09d83008acda1d7015cf45c405da6dc50a4d4f67127df94b95c7c808736a60560a64fbecc2f783e19d6332

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
bde17d6b7d44f6b80bc20585eee858cf

SHA1
769b7fd23706b4af70c9888c49be7130e9598450

SHA256
009068b26b5c1525090b4e69c08d16ab7f30d535dd16a189cecad3e46101810d

SHA512
88deae6ecd293db32edbd77b1ef7e3814b738688683f7773f7a502521df09e222b3350072b31fae09b209422872ef1c7f212fffe8e157e5bf562b3b3cbbb6fa8

Download Submit
/Users/run/2024-03-04_a0b771899c51e67223527142ab299a25_adload_evilquest

Filesize
182KB

MD5
4b936c82464c17b616a5ffce030f59f1

SHA1
d703486bb5019076ee247351ed8058e6a2687c88

SHA256
7ad324777126c903003f1d6646e5a792f42ebd7b5caa15069ddf593030d5644c

SHA512
86a4050a6263b0ec96cae983c38db71ca9514634dfde260508318e2f3d82413dde0d56254dd1f5d85d4ba4d66467de331d67d44d4791bbcb1a3bb0b175a71c7a

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
d32b5371460e13daa369286ba1197ece

SHA1
0aef3bb41fd2709e65fb7b962052ec8e28c8cc61

SHA256
504f67099d8d0484e87e5ca69141a34735bfe7ab8b2ddc031b2ed697b0f294d8

SHA512
de2786fd15329d9ad0027ce174261119c80e2eb7b590c8f4373323019b74c98b423ef04008970be407adabc3c14601161f87affdaa2c5d82bdd139a9254d39e8

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1188.xml

Filesize
157KB

MD5
3e6423b24f263da56088a101653606cd

SHA1
7c43adc6c23442858bf0dcdf84b5a08323fba317

SHA256
95e4aa9570e1acd3de701ac19c395d80a710275d6e052c598c09cc1ed710c398

SHA512
3f85d2f77102790e8ee82c1f8797c754167a79af91dfdd5377e7681370f01540234017eb24be89cc7a4da5e70005bf35b069d21f5bf70cc59efe1abd6dd8c255

Download Submit
/Users/run/Library/Logs/DiagnosticReports/2024-03-04_a0b771899c51e67223527142ab299a25_adload_evilquest_2024-03-04-123127_tests-iMac.crash

Filesize
24KB

MD5
433d355f6316a98aba741b96c7497838

SHA1
3498a92a57f2daf2e956cced66a009264cc87a05

SHA256
3084cf6a9797d126299c84b5cc843451b4c977a8c9811ca3b7d459972c6716b8

SHA512
db921ad691243fc31ae3eb2ca38e9d674b2e02c9de8d93b8d7ae6589599c790a452955f4e11ffb28bf7b68d90f1e715ebdf92a25049db4a04fab9378d8d01c9f

Download Submit
/var/root/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
429B

MD5
b29145cf94cd1ef0d81552c333c3603a

SHA1
4095a7b7b982b8875a6256919b7d80c50b0a2799

SHA256
2cac13ffabc18f7010fffce9f31aaacc06e0c5ae898c3faa79d747567ce1e2fc

SHA512
fd0ccb56cb0c5084950ad4d04363ae9919a0bfa76c45554df8a7fe0eb0f8a7ed2525af3b4f64982eedac0f9aaec28b7985b4ce5ec80434fc3cf426cb96b1def0

Download Submit
/var/root/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
57d2bdb1011100ba72abeea684b71f4b

SHA1
ec30894a6ff30ea086758092c0ef8248078d5172

SHA256
07c1e23f08a21d3146c75b27bcc946f6b5de344bc418ba11753506cb6b00dff0

SHA512
e46626f6384804fd7b2a8296de1ab6318b9f5ddc3cbf6a17226c0409beae247b8807f1aea7d2e026c85c99308fe7ac2dda5318cc771a440e75bcdee46e70acde

Download Submit