Malware Analysis Report

2024-11-30 16:04

Sample ID 240307-z85araec64
Target 2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest
SHA256 a07b95e8ec112a8c74a57cc54efb110b044b056d76deec09ee2c41e12d645657
Tags
evilquest backdoor execution persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

a07b95e8ec112a8c74a57cc54efb110b044b056d76deec09ee2c41e12d645657

Threat Level: Known bad

The file 2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest was found to be: Known bad.

Malicious Activity Summary

evilquest backdoor execution persistence

EvilQuest payload

Evilquest family

EvilQuest

Launch Agent

Launch Daemon

AppleScript

Launchctl

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-03-07 21:24

Signatures

EvilQuest payload

Description Indicator Process Target
N/A N/A N/A N/A

Evilquest family

evilquest

Analysis: behavioral1

Detonation Overview

Submitted

2024-03-07 21:24

Reported

2024-03-07 21:26

Platform

macos-20240214-en

Max time kernel

151s

Max time network

149s

Command Line

[sh -c sudo /bin/zsh -c "/Users/run/2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest"]

Signatures

EvilQuest

backdoor evilquest

EvilQuest payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Launch Agent

persistence

Launch Daemon

persistence

AppleScript

execution
Description Indicator Process Target
N/A sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" N/A N/A
N/A osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" N/A N/A
N/A sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" N/A N/A
N/A osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" N/A N/A
N/A sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" N/A N/A
N/A osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" N/A N/A
N/A sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" N/A N/A
N/A osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" N/A N/A

Launchctl

execution
Description Indicator Process Target
N/A launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist N/A N/A
N/A sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" N/A N/A
N/A launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist N/A N/A
N/A sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" N/A N/A
N/A /bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" N/A N/A
N/A osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" N/A N/A
N/A osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" N/A N/A
N/A sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\"" N/A N/A
N/A launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist N/A N/A
N/A /bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" N/A N/A
N/A sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\"" N/A N/A
N/A /bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" N/A N/A
N/A /bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" N/A N/A
N/A launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist N/A N/A
N/A osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges" N/A N/A
N/A osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges" N/A N/A

Processes

/bin/sh

[sh -c sudo /bin/zsh -c "/Users/run/2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest"]

/bin/bash

[sh -c sudo /bin/zsh -c "/Users/run/2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest"]

/usr/bin/sudo

[sudo /bin/zsh -c /Users/run/2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest]

/bin/zsh

[/bin/zsh -c /Users/run/2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest]

/Users/run/2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest

[/Users/run/2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.secd]

/usr/libexec/secd

[/usr/libexec/secd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.nehelper]

/usr/libexec/nehelper

[/usr/libexec/nehelper]

/bin/sh

[sh -c osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]

/bin/bash

[sh -c osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]

/usr/bin/osascript

[osascript -e do shell script "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]

/usr/libexec/xpcproxy

[xpcproxy com.apple.security.authtrampoline]

/System/Library/Frameworks/Security.framework/authtrampoline

[/System/Library/Frameworks/Security.framework/authtrampoline]

/bin/sh

[/bin/sh -c launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist]

/bin/bash

[/bin/sh -c launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist]

/bin/launchctl

[launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]

/bin/bash

[sh -c osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"]

/usr/bin/osascript

[osascript -e do shell script "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist" with administrator privileges]

/bin/sh

[/bin/sh -c launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist]

/bin/bash

[/bin/sh -c launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist]

/bin/launchctl

[launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist]

/bin/sh

[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]

/bin/bash

[sh -c osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]

/usr/bin/osascript

[osascript -e do shell script "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist" with administrator privileges]

/bin/sh

[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]

/bin/bash

[/bin/sh -c launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]

/bin/launchctl

[launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist]

/bin/sh

[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]

/bin/bash

[sh -c osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"]

/usr/bin/osascript

[osascript -e do shell script "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist" with administrator privileges]

/bin/sh

[/bin/sh -c launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]

/bin/bash

[/bin/sh -c launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]

/bin/launchctl

[launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist]

/usr/libexec/xpcproxy

[xpcproxy com.apple.ReportCrash]

/System/Library/CoreServices/ReportCrash

[/System/Library/CoreServices/ReportCrash agent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.sysmond]

/usr/libexec/sysmond

[/usr/libexec/sysmond]

/usr/libexec/xpcproxy

[xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A]

/usr/libexec/neagent

[/usr/libexec/neagent]

/usr/libexec/xpcproxy

[xpcproxy com.apple.ReportCrash.Root]

/System/Library/CoreServices/ReportCrash

[/System/Library/CoreServices/ReportCrash daemon]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.geod]

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

[/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod]

/usr/libexec/xpcproxy

[xpcproxy com.apple.geod]

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod

[/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod]

/usr/libexec/xpcproxy

[xpcproxy com.apple.secinitd]

/usr/libexec/secinitd

[/usr/libexec/secinitd]

/usr/libexec/xpcproxy

[xpcproxy com.apple.cfprefsd.xpc.agent]

/usr/sbin/cfprefsd

[/usr/sbin/cfprefsd agent]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.AddressBook.ContactsAccountsService]

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService

[/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService]

/usr/libexec/xpcproxy

[xpcproxy com.apple.routined]

/usr/libexec/routined

[/usr/libexec/routined LAUNCHED_BY_LAUNCHD]

/usr/libexec/xpcproxy

[xpcproxy com.apple.Maps.mapspushd]

/System/Library/CoreServices/mapspushd

[/System/Library/CoreServices/mapspushd]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E]

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService

[/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

/usr/libexec/xpcproxy

[xpcproxy afsvcpd]

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

[/Users/run/Library/osxmobiledata/com.apple.afsvcpd --silent]

/bin/sh

[sh -c sysctl -n hw.ncpu]

/bin/bash

[sh -c sysctl -n hw.ncpu]

/usr/sbin/sysctl

[sysctl -n hw.ncpu]

Network

Country Destination Domain Proto
US 20.42.73.24:443 tcp
US 8.8.8.8:53 gateway.fe2.apple-dns.net udp
US 8.8.8.8:53 onedscolprdfrc02.francecentral.cloudapp.azure.com udp
FR 40.79.150.120:443 onedscolprdfrc02.francecentral.cloudapp.azure.com tcp
US 8.8.8.8:53 bag.itunes.apple.com.edgesuite.net udp
US 17.137.170.36:443 tcp
US 17.171.98.2:443 tcp
US 8.8.8.8:53 29.courier-push-apple.com.akadns.net udp
US 8.8.8.8:53 a1366.dscapi6.akamai.net udp
GB 104.91.71.85:443 a1366.dscapi6.akamai.net tcp
GB 104.91.71.86:443 a1366.dscapi6.akamai.net tcp
US 8.8.8.8:53 e4686.dsce9.akamaiedge.net udp
US 8.8.8.8:53 gspe1-ssl.ls.apple.com.edgesuite.net udp
GB 104.91.71.85:443 gspe1-ssl.ls.apple.com.edgesuite.net tcp
US 8.8.8.8:53 20-courier.push.apple.com udp
US 8.8.8.8:53 18.courier-push-apple.com.akadns.net udp
GB 104.84.95.239:80 tcp
US 8.8.8.8:53 e4686.dsce9.akamaiedge.net udp
US 8.8.8.8:53 e4686.dsce9.akamaiedge.net udp
US 8.8.8.8:53 8.courier-push-apple.com.akadns.net udp
US 8.8.8.8:53 45.courier-push-apple.com.akadns.net udp
US 8.8.8.8:53 cds.apple.com udp
RO 82.78.25.240:443 cds.apple.com tcp
US 8.8.8.8:53 help.apple.com udp
US 8.8.8.8:53 44.courier-push-apple.com.akadns.net udp
GB 95.100.245.89:443 help.apple.com tcp
GB 95.100.245.89:443 help.apple.com tcp
US 8.8.8.8:53 41-courier.push.apple.com udp
US 8.8.8.8:53 28-courier.push.apple.com udp
US 8.8.8.8:53 40-courier.push.apple.com udp
US 8.8.8.8:53 23.courier-push-apple.com.akadns.net udp
N/A 224.0.0.251:5353 udp
US 8.8.8.8:53 50-courier.push.apple.com udp
US 8.8.8.8:53 23.courier-push-apple.com.akadns.net udp

Files

/Users/run/2024-03-07_072b85d39b048461f851c382b71eb217_adload_evilquest

MD5 6536997956c7f969bf9523f524436ef2
SHA1 3a0fe77927dfe88a83ee30299db8fcbcbf1c7c60
SHA256 23c4565c5fa030ff0294ac945ef09703c6b096b16dba5054b8fc87c84692203d
SHA512 ebc42f14c966b8cd3f0dc5e065ecaa189ac698e27f4d1d26646bbb9fc1c98423db4efddf805a7579b907cae4b8b1432d8e2eea2212136839f525c699712dbf2b

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 f5a8ff5c621294b6cf0a5002590f3a5f
SHA1 0a68c25b59b2838c073913a0e63d77c255795cb2
SHA256 f212f114dd10e0b8ced292f7a8184de7dc1d983bde0be008292a7c96eeef0eec
SHA512 a3b28fc3f55e2f476a143c66248fea9d903bbf6c8e12b270b849f151da89a47b2fbcb97c3c8e507aa77ab10c51c8caf230b4855f4fca9e04f4f554b724ad3ea2

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 50f1f02a77fc25c80bb8ebfdb93892db
SHA1 c7eafc476064ab46878faee91b2b11e74ae78311
SHA256 c8f669fc5fd6f8cabed1041d6c85182ed6abd39a3be5875ef79aece706b7a813
SHA512 2ba2d634b58ba91fcb3916831aa4545d69cba609e01b3f462cab2b10bca3f3404e7dd3850a772dbaa20ba53260daf24ea5e5f3d216c7e5aab23e4c84926f8c9b

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 198b28753673469c8fc499c7e1311729
SHA1 beba33f9861b405bb42541f2d07f10d42bef1cea
SHA256 7f1bab703dc4b5376f589465763cd51f6563a436080c2ea3a61be9cb1d9d8ce9
SHA512 0ae581e4bda612ea0a45e6266976c13b5873f2ba88e9a8e0a4d5eaa51ef96af7ee94fb3edf33b87a1a9daf8139015d1cee6f424e79fbc433fab5a4b6c506b1ac

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

MD5 d3a1859e6ec593505cc882e6def48fc8
SHA1 f8e6728e3e9de477a75706faa95cead9ce13cb32
SHA256 3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c
SHA512 ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

MD5 0e4a0d1ceb2af6f0f8d0167ce77be2d3
SHA1 414ba4c1dc5fc8bf53d550e296fd6f5ad669918c
SHA256 cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030
SHA512 1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 0980ae2696db5af9c7fc333e40da984e
SHA1 5357a36215260f0d0aebd24016bba2b29cda273f
SHA256 26c9a6896c1330377f6a74e94857fd7e7d2102eaec4bb67978851de724f42567
SHA512 254bb336f693805806dc5b33612c9aaf77e84c9fe65d2758e8210be5f043e0849a3d8ca3c64925ae0c544ab06564692d459acff95622ccb4e389eb43b754a9a7

/Library/Preferences/com.apple.networkextension.uuidcache.plist

MD5 c05b619361d2cac0288befbdef519546
SHA1 634e507971e2bd2697df0cdbbe8772e6fbec276e
SHA256 1b2c817978649cad70d67be41215a663790d97707b7512cfc156b488438cbec8
SHA512 86308ab30375670ff5eb886d50e3b5be5f3b7d60e0de53458e0372c0c67cbfd1c58450acb201c7d21a5f351c2b0e796d1777dbaa1e2b83ef7f69a83dac26ba20

/Library/Preferences/com.apple.networkextension.uuidcache.plist

MD5 e251c94fc14a772dbd695b0919d4f53a
SHA1 63c2eaa2aae3f097a6ad8952064d4764fe8295e0
SHA256 2e8a5e8288abdb773269792173899a3261c3a04c2a4d07c119988542d1978b49
SHA512 92222001d9e6f4bebf5abfc02f4a0b379b33c4f7dc4e9b27170e8b2d43f7c7e017632f893619d04f01eeaa48cfd79f77c7b910cc47d74d5b81f69ea83bd69a5d

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 5637caeb3bedb9919f5fd56f4ad38113
SHA1 81db253e97aef3882f016e4c5a4e9f898555c066
SHA256 0c3996c0a5eb004fa6eeb1789255e93ca1c683ce0d1f0686c22cfdcac3d1fa95
SHA512 69e34e6b9d86a3f96bac5554a01d013da30ef999bb7a46735fee000352cfcc845b35e6aeaea3e83b58811927c0d00121d1d0ee8a633a21d83cd3bd7b51571c4c

/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1202.xml

MD5 f627cf4820da06be8e6ff3fdec6ebfee
SHA1 993d8ec88721b9e76c3fe1f5987338a61b452bf8
SHA256 f1d2905b871b9b80172b7c9dc298c1a3dd355e6ae633f77562f4e06ed52a54e7
SHA512 bf698aa0eee296df872b91432670af719bda88be3b6d210a567b500da1cedc0e07055a805c2331ccacea0a8a17396e2e37b4bf70894b9052723049c96083001f

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 e17676d3b0238cc39c1689697ae11555
SHA1 7ce29652e0794b9f65a9905ad480dc80cbfedaf5
SHA256 46a2eaae2925c14b62bc3e710cc338a77bda877bce8c743d9e79c8d7ec3267e8
SHA512 4378ca5631c4f89cbaf04a336f9b91c2fdc05254e434ebe3c05537f19cdb71b2e58e702b86f9653ffa0d4050d9817f011ddea7caea5a889d8844c8a060d47ff9

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 be16b1573d548815c931af6b83e2b974
SHA1 2332e97387fd3d89f0d9dad981b8e85930357d7f
SHA256 021afa5b414fdafa5c0baa648705974c34e82eec070a69af466fc4374d5b6491
SHA512 5aff5189ce204c20e3f4f63edc29b9ce251ac698c49b13af5a7cde051d2488a51e8af3489e1ea0899873cb5bfa2c9959fb02877176db7a2171929ebe3f71021a

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 169e8ec710442e90c4c8bf45f63e321a
SHA1 824b57d22121b90b893c46524f001eef8b7b2e3f
SHA256 3df34df45f1f161141f78f31d8cc1c4c88e3ef378e17d751e92f52f54bbaae26
SHA512 5a40583d78d61b9f5b226fbf29c77c8a6b2e75101c6a7afd53840676680468d3db3c97a0a3f4cb56492081b225352dcbdbe105bdcd3943b763e7946ff4b6ecd7

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 25931d6c01e6d2a46d5b1dc7788c61f8
SHA1 632c0ec081eceddddd52f3bb65b0aad978374bf9
SHA256 ce305259569f2cc4450c68194e0c6407dd21137f2629a55906ce59431234b2b7
SHA512 c512459e9c21cd6ff15c4313fa71fd8b1a8092dd3fcda0e58d1dd484a75355aa3f2e25e01190f4c21671d281856428cd936f41eee8ba6360172e8281efd0129f

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 41006ddd1f1d812d767b36f125e5defd
SHA1 5d68e3a386ddee3f71008937a5a6292994405a11
SHA256 3e8b1d13cc6e78807f74735f70658327ca64c515063896e0ca5f34735c5e9783
SHA512 e4e61820909399926fece7bc54b2f64882b84ff36832b497cda455316b9fb390c7fec06c86d671f4731017bff948cbf81f84149e84aa3ff3e2a5ab369bba02e0

/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

MD5 2e3cd0f7ad37f572f8d620f08f16fe45
SHA1 df72381ab0fc52051492b08167c2e2afb6c5dabb
SHA256 7c2ea6adc06e1d26ce1bed799a97eeef58625a0c07a2129b0f4572d54d530763
SHA512 eefdafafa1a6d2ba8f0c42f36840818fa7744e6e470270b4b653c5a47926275c1c5ce05425f589770e21fb8df70c85333cf40d68f7153621c874d05f20da8178

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 c82e0d7274b5efd3f1cf0c275d4d0ff6
SHA1 8ee4ff0c31562c0fa898fd25dd1c040ff0ab3a7f
SHA256 0d379a4c8b88516b5874fcbff87997f45ef27d856bcfddda97a5d4228e33bcb9
SHA512 76d63de48e0a314b25957e85dd688275ffa2a363b1f5fb9d83e12d74e6d802687ab47274868f2c54db512bea47b50f7fe488c1eb39c4a693f28b03622f002337

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 a7e569157bf21df333b8fe446d9bb03b
SHA1 6026d1661ce29e13f6c873085ab8368d9fc2dd43
SHA256 40888e3853130af1d3853aa71a5cb60fc54d7eff4c89dedd6977b92b03a5f33c
SHA512 2aaf4faa7694de73487a07ad3fa99817087067d0e9673d84cb11a294d11eae52b0d9d38f27ec1aacbfb75f689fd8082b78f81dd62ec58d7430281bfbb29be067

/Library/Preferences/com.apple.networkextension.uuidcache.plist

MD5 7d3535f2750c80fb5549715a6eb18997
SHA1 e4c3448aa704f5a1c3e3dc8c6362ec9238e38ef9
SHA256 273fc7ecbe78aaf71d4692bc0c939735d1d6b02e48b9b7b503e9554bf54980b7
SHA512 a3344e01a57099e812e88cd83577f43e0dc756a06460ceb3177dae23a15a09a77a6175d99f7704eef66dc0edbf3539afa7982686703d7a0f2cd0a729be59fe83

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 8a480957bf4ef72c73810c9c18ad29d5
SHA1 ca7e5441eab302804ee3207fcb2b84e47cd0722f
SHA256 9e856ddfba8770f95e0c73e2de585bb7000de536b57620e3a51e99c3c840cda3
SHA512 5227e254297344fdadb7160f751a8d4f2283aa8427ba6a62fc2ae17b59f93b43ec4f81976a69a81686ff5bdfa1debc52494a96767b65faec540c67c4d9db852b

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 7d8054e7a121fd71c45b4da36c3a19ef
SHA1 825f6bd52eccd07823a51727201f7c8dc2c29e0c
SHA256 44694848335eeca6c4445273bbe024eef09aa338a134e7f42588edeb147b1747
SHA512 1c6a5055c93e314a32a15cdc51809b9f396785c0016bd7a0e121a46fdc1fb98d6caf13556fbfdddd8a0352c8d23d2d0f3e9217b9a3f867810709036dda71456d

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 adcdc763fb4aaa63d4089d11d5a2e5ae
SHA1 5adf1833627bf3741033958b390ff99617dc67e9
SHA256 a3772e8db8bdcbd396a68f46137cd5685dd39d99f4dcf53346429ec61e94688e
SHA512 6fb1dbe32a9f3c461d4d16a2ea36b75da10a887a069c08bd15363b17f6bdc9183ba29039b24ecd5aef40db96f2b5f35aa16150e83517018b78d57cd4d8a25003

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 987e934aedcf051b14f3602916887ae4
SHA1 477f9ed2cb9fd99769de98fa258da05981838188
SHA256 80ee5113bedcfd660a8fc0b0b54989f948970fc5d8377022d27fa6a2cfe89ca9
SHA512 f6350ef1727d39f83c8a68d48b8fd23b42256199aeaf8e831748c63a09a29d289e4379a8392d75b07e886812f87c38e7aa7a500a49c4933d4ef3b070817a3512

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 7436368cacfa2eace93a7e757f65d1b5
SHA1 dde9f8f28058fb6256724a7c03ca53f2dfeea231
SHA256 3f0c2792493861d92d67ef6998dcc9a31cab58b858f97f2ec52005eb9b177454
SHA512 aee8380ca958569ff4f542a886dfe292a7cbd842f08694341a58337814ad878aab6805f28d214f6417999ca0e592113be256a7c80beae91db2e40a337fb16c59

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 145fe587ef092f2ef929cbb290b1a032
SHA1 9bd72439ca42e8e7b42ff367f04aad40985c20c9
SHA256 391865e84a7d64d0a2b9ee4185bc3626a6a0b606039c3b00a4133d1698792502
SHA512 63efa4904a89dc2b0d4aebd6502b52f926ce8574497a45942edc49ccaf009a9ec5b133b6117d860277702742eb725cc34b6bdf4fd0b53a6a3709fe1332161e1a

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 565af3c8b1b97db01653a7dd83ce74e1
SHA1 2c01832500510ecd1c8242828f0b7613d8c7828e
SHA256 148b77d0407298fcd06211743e33b9364090e028959ef10af81d2115fce83345
SHA512 f926f7de125fa6504673238bc643ddc26f02f302982d5d1ad82dfd83c3006f10b74a668c4d01132a4ddf3de3d2565c8a61fd51258fbb8d1fcf291e6092bfc769

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 c5ce53f05ead02b877f1b9f23657aafa
SHA1 861b01a9d8e75d7758b0eae281ad97bf9b0d540c
SHA256 2541d4a8697fb1f934e1b67b9c7660516f62a9e6fffa3fbdfb9aac62063b56ad
SHA512 3b30a3c049c465152a98288c77575b408d5de133d176064f83eabdd9baff27c7c9fc5aff446f40ddc56ca0b4db76374d1b4fbf00e0a4465422b01bfeb16e07d5

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 b81b80a618dc06e04855526cdaa0fd78
SHA1 945996aa0f3838ecdd2c96cc837a7b8fb316705a
SHA256 b4eab44a61dd36a7012f0e8c139d50edbf5ab1e4cd41dbb795118e8bc32f0137
SHA512 2577a16bd0318b572ded0b8e16c6cdabb924bee934dfa46798a62503b5db4d3356d0a9710fdd9fa5dfd98495f3a14bc4e6c724eaa9f61084d2c1e8f1e1dc91fb

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 1fa55e1ff124ae508b8f9dc7e2d16650
SHA1 7287d9ab3e45c9f9acd1a3ca0baa9ff63e8b9a69
SHA256 c623b3876639ebef2ecddc930a5af52ee329285cad310b72a48835a47cc6abab
SHA512 cdf00aba1cbbfed7ddbe3fa38eb951f0046b83aa8047f01ad5307929370afa1c009879ba6217634066d4fb036adff6fb7c23c2fd7069b29071c5ef1a48fff4f9

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 1c1ccbec0abe9ab55f2bd7769d130f03
SHA1 be722f1ab6dce3e8e52c352d939dca751530db86
SHA256 7393e6a37401a17c5043de8b4d0a70f0118172b5b0009b12da6ba063c3808d88
SHA512 04a02a9b73eab88190bb63145b70eb6a3e5eaadbe84b3f3aa04e8ba0571e3b22500e14facb04d86fe185c6da27d834595dee8e20abae0d6b1957afc463014534

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 0bc384085112927531250913374beee7
SHA1 58e172a5ffd83bf686b8ccd35f764bface1e1377
SHA256 5fae4ca650d20afe8c4f4aa695d8c7a33653e7cab4d42e90dd5847e2df4a1166
SHA512 b23feab8f5b18d4c60f5758bd1229ff73fadbfaae94b471858d8bbffae811d755145161029f11acd1aac7be83e9fe6a2678fccc93b7bedbe63750d5a699f6a31

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 b930c355197a2039ca7914f16b672907
SHA1 bf0b16eb2b4ef8cd3a5501362ca4b66ddc4d6e99
SHA256 a46a57930b54424d5c74c56964b1cc320350836db1b5c70e57f5646ce3a37110
SHA512 7487957c2d5e6feb30076f010aada705ab9c0c8dbfc7c58dcadcfe84c06442afd956f49e32ca191397faae28652c1e05b7661a10f4018cc65d629e809adb618f

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 af7cb4a197effe717f197d1ab77515ff
SHA1 4c1b8d86d9c056cfcb6ec509f3e5cfcd84f38d5e
SHA256 34b2feff07da7b5f7a2e592b6dcb42548d563b7d2c0d8aa366eafc8689de8557
SHA512 5a3073097dffe2f3f0fd6d5fcee5fca910510e43527ef29ab578f1b4cc96d6b17cd4ad7dcfb0a13b023dc65f65ff55945521654de8b102f7c3ad390e9dc87224

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 8c7293ad51454d90095b99d7ce712dc9
SHA1 a76850c3b623b46f94dc07d072d49276a39031f0
SHA256 7a82e6fda0313fca0ad5989c1cd5ffc3214c1edce1ff561d8659196227abd109
SHA512 ddd8864dc0dea08f79816d83b5991a8c29f468414b70459aaeb3712f96f5814f3bed237f349e0dfd04ec159e3046db38b5508b2141d19d47c48cc521be1e4dc5

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5 4da36358a4ed406721ab766f7a066c68
SHA1 4f3280c3ed13805a7f8ddc2b405045cc698a38c8
SHA256 234ea9f2d781672e944503c8e12afaf23936f2f92bbdd3e04668748226b51fa6
SHA512 8e30fb25abbf7242721fcb30ca97462f7a697352f9f6133e3e846cd08654d6c5858f0d20d40a0f95f721dfae558bb1c5093ad36c1417d689c7322e78dcd898ee

/Users/run/Library/osxmobiledata/com.apple.afsvcpd

MD5 323af3d784be6c44c6b5b878ae6628cc
SHA1 dc923233080494e4e661beee3a09ba97df84556e
SHA256 e252ea021c6b37a1baea5c460363f91605bcc75fb985c93cd5bd89f15f2c4dd5
SHA512 514689b7088b4c198c9e264ef694322845fd93abfe0430d1882906665599f4b9330772a025db804a3f72bce3c2a17192efc1cd55c989531c79789dd1eaeff037