evilquest | 21d670a2f386061a2eb655ce110775bcbe0d24cc67dc501a7b1d34a7581dd4af

Analysis

max time kernel
149s
max time network
153s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
08-03-2024 12:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-08_e0bedaba350a07c610f735d45232ead9_adload_evilquest
Size

177KB
MD5

e0bedaba350a07c610f735d45232ead9
SHA1

ee9beef90fc246902ca6753392762ea6e2036ef8
SHA256

21d670a2f386061a2eb655ce110775bcbe0d24cc67dc501a7b1d34a7581dd4af
SHA512

25a8a6bb1ce313f7863aa2165e73d26f2886384afbf79db8915d667a1dcc10b5d345aca62f14529f680c48eda2a00bb4e9e99ce47f421e7428f7c15a46405665
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq96KVcZfL0t:5SeOQdaZNxtk8cqhSxvHY9ZuZfc

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008af83-0.dat	family_evilquest
behavioral1/files/0x000000030008af83-9.dat	family_evilquest
behavioral1/files/0x000000030008af83-25.dat	family_evilquest
behavioral1/files/0x000000030008af83-32.dat	family_evilquest
behavioral1/files/0x000000030008af83-41.dat	family_evilquest
behavioral1/files/0x000000030008af83-49.dat	family_evilquest
behavioral1/files/0x000000030008af83-56.dat	family_evilquest
behavioral1/files/0x000000030008af83-63.dat	family_evilquest
behavioral1/files/0x000000030008af83-70.dat	family_evilquest
behavioral1/files/0x000000030008af83-77.dat	family_evilquest
behavioral1/files/0x000000030008af83-84.dat	family_evilquest
behavioral1/files/0x000000030008af83-85.dat	family_evilquest
behavioral1/files/0x000000030008af83-91.dat	family_evilquest
behavioral1/files/0x000000030008af83-98.dat	family_evilquest

Launch Agent 1 TTPs
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 49 IoCs

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"

Launchctl 1 TTPs 64 IoCs

execution

Launchctl

T1569.001

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:533

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:533

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-08_e0bedaba350a07c610f735d45232ead9_adload_evilquest\""
1⤵
PID:536

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-08_e0bedaba350a07c610f735d45232ead9_adload_evilquest\""
1⤵
PID:536

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-03-08_e0bedaba350a07c610f735d45232ead9_adload_evilquest
1⤵
PID:536
- /bin/zsh
  /bin/zsh -c /Users/run/2024-03-08_e0bedaba350a07c610f735d45232ead9_adload_evilquest
  2⤵
  PID:537
- /Users/run/2024-03-08_e0bedaba350a07c610f735d45232ead9_adload_evilquest
  /Users/run/2024-03-08_e0bedaba350a07c610f735d45232ead9_adload_evilquest
  2⤵
  PID:537
- - /Users/run/.2024-03-08_e0bedaba350a07c610f735d45232ead9_adload_e��x�
    "/Users/run/.2024-03-08_e0bedaba350a07c610f735d45232ead9_adload_e��x�"
    3⤵
    PID:587

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:538

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:538

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:538

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:542

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:542

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:542

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:543

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:543

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:544

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:544

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:544

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:545

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:545
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:546

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:547

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:547

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:547

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:548

/bin/sh
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:550

/bin/bash
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:550

/usr/bin/osascript
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
1⤵
PID:550

/bin/sh
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:551

/bin/bash
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:551

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd
1⤵
PID:551
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd
  2⤵
  PID:552

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:553

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:553

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:553

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:554

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:554

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:555

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:555

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:556

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater4B941C11/OneDrive.app
1⤵
PID:557

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:559

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:558

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:558

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:559

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:560

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:561

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:561

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:561

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:562

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:562

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:562

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:563

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:563

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:565

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:566

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:566

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:567

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:567

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:592

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:592
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:593

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:594

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:594

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:598

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:602

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:603

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:604

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:605

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:605

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:610

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:610
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:611

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:612

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:612

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:613

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:615

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:615

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:619

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:619

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:623

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:624

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:624

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:627

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:627
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:628

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:629

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:629

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:630

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:630

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:630

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:631

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:631

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:631

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:632

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:632

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:632

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:633

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:633

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:633

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:634

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:634

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:634

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:635

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:635

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:635

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:637

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:637

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:638

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:638
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:639

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:640

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:640

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:644

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:644
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:645

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:646

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:648

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:649

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:651

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:651

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:651

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:652

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:652

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:652

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:653

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:653

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:653

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:654

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:654

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:655

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:655
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:656

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:657

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:657

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:658

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:658

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:658

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:659

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:659

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:659

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:660

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:660

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:660

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:661

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:661

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:661

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:662

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:662

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:662

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:663

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:663

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:663

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:664

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:664

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:664

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:665

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:665

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:666

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:666
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:667

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:668

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:668

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:669

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:670

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:670
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:671

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:672

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:674

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:675

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:675

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:676

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:676
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:677

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:678

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:678

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:678

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:679

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:679

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:679

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:680

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:680

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:680

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:681

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:681

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:681

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:682

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:682

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:682

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:683

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:683
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:684

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:685

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:685

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:685

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:686

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:686

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:687

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:687

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:688

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:688

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:688

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:689

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:689

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:689

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:690

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:690
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:691

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:692

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:692

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:692

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:693

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:693

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:693

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:694

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:694

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:694

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:695

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:695

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:695

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:696

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:696

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:696

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:704

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:704
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:705

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:706

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:706

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:706

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:707

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:707

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:707

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:708

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:708

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:708

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:709

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:709

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:709

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:710

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:710

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:710

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:711

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:711
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:712

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:713

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:713

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:713

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
c3e5d5dabb625f3b1b953981e5f5413b

SHA1
3e2e3ad0dacaf4ccc2187c8e704cef0602eecd1e

SHA256
0b862fa16e5db933c2621e358e915d302828a3b57033cf10c60214444f21c0d8

SHA512
af480a8654a84bdd4006e18762b6cafb8ecc5626ab7d4c1f6269263f0e0d86ac9cdf24c16cb0699f1da75abd0a63cf71b8c29bd3056f7fa78eb664cad9810cc5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
f5c26b0da7d9a2679b65da6eefc88077

SHA1
511a37df072aacee38e12b5cda71e7066883aa30

SHA256
45be203ede510249989f4e394cf9654feb2c76d2d54e6fb8cfeed74eae1ab6d6

SHA512
56c61d2424e0a66eb93ef33397061ccfc50f9fbe704c59afb06e02c8854d8bc12fa2721b7e10f94913494780537511ad1b2b3e12a13f87183472dabf60745540

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
158B

MD5
cfbcfa51edc5eda0e7021ff9867cfa4d

SHA1
678bb5d3735a4b3e7fc12d72758135a7fa987090

SHA256
26c16eea3c71d8c2d874c936472c03f52f197419cbe5c8e0b4ff292cf6719991

SHA512
7a3933b9ac19d88d34bbf5e68f93a5dfac48d0faa3bcfb01d650736d5e338dbed50c1a437c253e1b3603891f56c9349d8c6d513d3076c30f27c6b9a379354733

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
26af46cf1c0b1feacda745117404ba6e

SHA1
94a9c671f4da2534057dac6df755b1e9929709d0

SHA256
09f0b674c2e86bdeb687536abe45c59b28dc44ca3ebf78c28253fa47f97a5a04

SHA512
3ee4d45c95b76a148d7f8269fcc5cdb519e491f3ce6c2f5ae30e6ecae5a465d8d08e84334245f0f331c6319610c888fc05be15f60dd2412bfceaed6f5b9e0d80

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
c8a3f0fd94d5a727fa2f89dac46fc674

SHA1
e6e509ef7f00b00d228fe7f47023466a29889a3a

SHA256
b20bd27dccdb909a2a6781a82c6c9d98cd36b800d55683c117872532f4934fdc

SHA512
968894381b6b9c4b536adca22d6a3dd8c420f912955f8dbedd85d437619f1c48db7168ff2147ffe99e2ec471d4b1f555f0e08ba75fcd6761d410b812eb23de48

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
a6893ade15d19ddf74b8e72ab72504e2

SHA1
4f1441e7b160b5aa99457294246635f1b1ffe284

SHA256
e20f5b8ba59cd925e9fa2fad89241e3d5d52e858ea658834e7d7e13738b8e038

SHA512
e30752ec1033b12b8ebbcd8cb8fd66e619695ea5842f7a2b152175ff4deda50213618de0bae9042165a63910b41de0ecd43454bfa3c09bae5bd4a093e943a2a3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
5ec567ead4efde420314762273a9ac81

SHA1
56d5355270e289f00166a9a919e5535611355a7e

SHA256
06c89a026bfb288485feccb0e27f0e2a3b0b5b7be68ed07cb012be8f3c831c9d

SHA512
7acf2f6bbb060c4adda5b7e6336a762e59404828ccbd3698a97ee2d91eb4c7dcbc6c6e836233e5f4a85380fed95ca0cd4580f97c1fa85d98f0e810294a3c63b7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
fa037e877cd1899a90bd49a2fd127a74

SHA1
15f101857dce3f54ebea8aec1e4c219d4b255f87

SHA256
b5b9f756d6f937f5d8f6ced1f2594639b7fe8f33ea7570efc200c36278317334

SHA512
531ad542aae92b663ce81124d01c315598d46502accc9a0f2c78bdfd6afdd2cbaacaf688b31c87d2e762781dd5222108654c1618165dd340a01da032b14c34a0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
3a27c94d87fb6ad2b71a2e06cb634fea

SHA1
3067576f0638126bc1b430df668298efa176a34e

SHA256
fa6680952922a5814bb9e7d4951e196579f2249966bb116b7b04d5719ac537aa

SHA512
3e0508c9765c6dcc3753c5be98fd56091c1f19c56bf4e986767ad36e87254687dbe00d462ebb9301b277766c0a968df62c98456f167aef7830b71960196d3527

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
4bc60173c6275c6cfecba2acc8b58b2f

SHA1
f38573f5016bbd301df307eda5d31dda089547f8

SHA256
560751d708232223a7ea975a6505984e9352a90ab2cb6598593feb6d3e331203

SHA512
e87e48289e0ac7ff17107e1a64aa0439e802ec3b583e4f937c403fdb126f889e886879bc616953dd543f7b0ff1634308a3a8ee57cd35d91a9514fad02b7b3d77

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
62c4100c9c3c15f018531cea6683febe

SHA1
67527c28664ba804b5def5e0715d611d2d06fb40

SHA256
851f011a0c2b803b566db229053b27f636153e620bcbda6a0d975f92830b5bc9

SHA512
6278f3a26a6eb7495f0c3094887e87ec2bd2425b27308c27647d80983ee0b4a99048a7cc90ff5e4b1030720db78b3e76a9aaf5eb1794cb2017cab3ea0ce9e01a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
f8310f7939b5737f653a432ac531a5c5

SHA1
ee985861fdfabf8932c7af8e1c22124533ea05f9

SHA256
208086e86a805894950d27ee5f0be5e700eeaf5b2b08945f355380449b2d2620

SHA512
1349091dc56b9f5db174d9e60d0ba4bbfb9d69dfe9cbd0a19ffbb212a51d0dbe1cb20b8c30c8183307d08fabc0f6feca286eca3bdf604381986cee26e58c7665

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
ea980a660d53f021706131f2ad1e34c6

SHA1
765f68eb267b6092673590481598a28cb37484e6

SHA256
425a27625f2112cfac0495374bf7c6c23f9df406dfdce0b78cf0656b1f7c7293

SHA512
098d5231dc23d8fda918a7504d06c3a2ea67fcdb49339780bbb09a97a1636e0d5b99960607b20660faddffb4d6e6aac246700b1f207da2618b90eb227f56ea75

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
6ddc1a0cbcd3b3bd0b7d3c90dd4cd219

SHA1
26cd948d13031a7de7c9263c7c933dc89848ef22

SHA256
37786e6a27b61686287f8064a55d8038a312787d34e7baa7979580d4a565d0d4

SHA512
4c5b6365530c9467b02458e7af322de023bd21302ebff68c786fed989b9e300140e2b34f88437d741b24c335efbdbf7b4ffdf6675981eee423efe010c0fc1a1f

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
dff2f8518b0ef6169b349ca6874488e7

SHA1
aa5b186282e46a987c4c70aec5ba14a14c5fc4d6

SHA256
ff7b9ae9b01e6956230d4b91d32dd426a933fd98cc767dcaa3c3b9c08051085f

SHA512
65e5c00d1b38fe33ddd2a234e154b945139986308d7ae6cd421e2d305fa65f902a9fe7351ef0af593bce6fe20b251c7c404b99b4a5cd80f41945a76b07800f92

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
145B

MD5
5bc31920b404807b3bcc075866062e83

SHA1
966e6dddcec5ead35a0c02fc1530ad450daf8593

SHA256
b8bd3edc28979cefa3005d3f5fe01f60d6f73e5fcb9006ef7fe0bb099e864050

SHA512
861452f9d6f31ced108da052ff3c507c49db5b404824692c0c5eb3168cccecb15d98b4b456f365d580c51123fc486a545de6f773f37ce0e5feaa586df22bcc29

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
84e3755f63390bc6639f7df1342605c0

SHA1
1e2ba50b9409e753d4a41e165a9d7fce7ef70303

SHA256
858cb41084354134f1ad9dd2a92fb6059e16d079fdbe9cdf5d22ed0972cb3cfe

SHA512
7bdfe28c3475ef563055ec32e2b48eb630a4a0541dbd350a6db140414ea86d49854b2564878c8e02afdac4506778a710c4ec74976217c6da3ee91092e36c7c7e

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
97eeeea5da47eb670dd90e53f1956293

SHA1
58899ea75a312be37702d97a24f0db792be89d49

SHA256
180d8935afc9debc92ec2932620ea46e3e8eca5a57ed9fde59e796022d3c5d4a

SHA512
d7f84c66864c8aea8445b060d6b96e4b1cd8887516e36bd41f82dc4f69143e1c9bd87a3be1e6b93937b91bb01d6444ff390901f0a92229e27fb32f7c4bd8685e

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
f7813330a77c9d4fb344d3e7c5581f8e

SHA1
8554af609846a8dde65e31456ac32ee56b0a4ec8

SHA256
70c6ad52d99cec8c72c169e11b66a14d01112d73fe9f2ba9b3d3461855ff3af1

SHA512
5c4f9e4d0fcca2fcebede31db9e05bd2aec2010a5d53b03be637ceb9b081163433a2806fc7f9373111f6d2d621e75f6e2eae9b48cfb832ab86271bd1587622c9

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
75c16ce9c46b7484db9f1dd3e03e3568

SHA1
989c8ffbeed150a8daa9fe02699a7b8d248f730e

SHA256
764bb48ce7bea082f7591c5c0b885bc5451b96c25fa28929d9827ace57164f6d

SHA512
05336b99b9fac79a4bacd074d06ca40ec31e9fa0f67e6ee58bb8a37f4cf5c295abab3830880ef44fd2308c146d9b5304dd38fd0e3b4c0cfe1afa9046971701e1

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
810f786a6fe24a4252f7b1b306bf91ca

SHA1
f0279136962bc41b317b03de68dd122e3fce7fca

SHA256
215216b128138d04906e7506a4494aac882e0574d96fa34232cdbc2a25e9156d

SHA512
7cb25bbd51ceb57df5ca6597b0874a4926a3412a0f7877f0b509395ba775938443f05ba647514d8f2fd81fffda1debcfd0eadc812f169dfb949204e64b13aa16

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
d2261e318da31f204f98cc2291d2cded

SHA1
597971198e04199e3fa13055fca4eefefd644b7e

SHA256
296eaff79a549e34987e629120dee93d7e14d53615f47856f2da51a276dabd41

SHA512
c5a55ada73ee4fc39546b5112193dbb3b6ec022f15cc77176e31d8b6524c4a2b3cf7806ba232d2e0052c7f036f561d4e29e196160bf0d9bbb2f5c5814ea43693

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
782074a031a5415a9df26ca2457bb057

SHA1
94861a32a756188647e2a890b0a67421bf14633c

SHA256
92586f32b2031ce4e1189ca3d747965732cb80f9aa09ae5572ada31c29756893

SHA512
99f990ef9c6224ef02495a9d803d98b3dc45cd27e2d2a72bd32ffa708fdf090f8586637b7882c745cea723dbdc556a1387399b3c9ad874d07f0e54b4f0e54433

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
cb9763aa55030cf2a8767dd512a18cac

SHA1
7f07eb5a9e4bf4611ab4bb3683d686749a7d1c05

SHA256
0b30d92fee400e869a82d9e980f4f535b870dc39fd0b73081014ccebfb7ef1b3

SHA512
9e9fc3b6b56ececbda54ce94954be18e4207e97f2e50efbc128613272307860fa5dfe98521aeadd613e4c9c9b18c5e0564c1219af06604101d0fc96e69c0d22b

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
6691b5b33890f47918ec753309e84eee

SHA1
7ad0665755f074dd033aa39549ea64dd101518c1

SHA256
674275288852413681bd00b7706de7d77981fac4363ffff043782da8564bc2a8

SHA512
cf3ae7d4c36dae29e5e69b99ccff74cfc470adc3fbf807d84a08b3b193e554bc6ed4d69d166772ed3c8c5b0ec0e4b7d62c9fa33cd511a70295fd7288151470f7

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
e9ddf80a5d25772233c9729fd594683f

SHA1
c70e716ef1c88dfb409ebcc38468ce51a40c71ec

SHA256
49982e292afcc029d9456d71130217ca9eba818979c669747d8abace78ed19ef

SHA512
61403895e395e2d2f07690e49092c6ce99e2bd4ba2aa0fa56b0403a6f8f3edee049df2216816ca621c5f28fbeb6f31778c3ecbb73c8f158bbed1fd4218d4e3a9

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-08-125233_tests-iMac.crash

Filesize
40KB

MD5
adb07f8c518c2003a84f99be0e7cef39

SHA1
d6437902338bda0afa1a11808d866d1b2c441c39

SHA256
e41675d4936ba32130336332133f9d5191f9a6c3f281df6b4997e927729c7c34

SHA512
36aada16113f42e0e50e3ce1785f293efc8208e51e73bfc2c242eaa82f18132adbd84fc2abc89cc51f6cb2a71f6ecd32e03dabede5e2099139e2e0267352b866

Download Submit
/Library/Logs/DiagnosticReports/sudo_2024-03-08-125233_tests-iMac.crash

Filesize
47KB

MD5
37ac290d6064ed374db683a475c0e2f6

SHA1
928e3ce80f6ed6dcaacdf12843308804e67aa5db

SHA256
e1d55c3061ba1af0fd9a8c487eaff7686dfe4da32b0d1a65ca07832385e71912

SHA512
4b16c6e07e798553b21ca66933b0297e2685ab7b5114da452e36e0ed93182f44ef30f7b30eb945f21076cdbcb1f4f8ee8e58bd37f5a370aa1645de7c074cf477

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
355B

MD5
a6ef4856e99c9d8e1d9bb762c5a8503a

SHA1
25d5405ad91791b716ae5a56b37aa2b393854967

SHA256
232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa

SHA512
582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
355B

MD5
2f01f7a00c85e424f82b00b2bf794a7c

SHA1
c75cb52aa31012888dd7c65373d5faba6048c425

SHA256
23d6746cb1c1906c9cfb5c69f7377f7cb68965ac0708ed1d600bfd3d3c34ce32

SHA512
75131e0145182653cef2edbb968853c9cb3c26c37c5821f3cd69c3ecdde7979ae37e74ecea8ad333090a473177c6dad43bc34f94a8fd104cd4c9b16c8f7b54f8

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
6f6319c18e608fae76e87ea49c4de49a

SHA1
f8794c1691718d6306454e25871d382719fa576e

SHA256
19734fe7521c0739f9c3a0b587d1d313b4f859ccfecce2855fca4e51df162db6

SHA512
1a31842bea141ff201228f589f7fb17dc4ada43f384124bfd069baeb9050c4c5c4890871d8d4268be16dff7088220f13fcb511a266ecbdae014e8d9b86bf9f18

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
4d4101c941a94e7583790bbf9a4c92b6

SHA1
568ea6149661e2d9973b04a878fc51571856e7b3

SHA256
0618c57cddc781f7917e08f681a7dc60dfd1cf8eb5cdabb25923ec6e14db42fd

SHA512
479e1d048bf6c008f1031bdaa8872e08acb2c7d50bda12d7756b545ae2e019558464fe6a79fc32123dc3b1ab770be5d8a93ea07baa97061826c5afa15ce40030

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
52ac36dba037cc1fe24da317caf6065c

SHA1
ce06276754c13016cead886606a30014ebf193a1

SHA256
9507f0164e9d0fa50520af87257391d059b67eb2972c83cdfb61e7fd5a90c75a

SHA512
88451ace9dcfa426cec02f2c5e04d553a1d1e529662ff4f0a5f14b97464e29fa80340563c1c39db8804704e3746fd6380fbaa8598662cfb2de87faa62c025467

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a5ee2d5f56e4849a386d9d5947900e5b

SHA1
379dadac24cd9c964bfbb10f1eb4cc9ce984c002

SHA256
699f8ae7050ca2dc7880a2950d4873e473f27f271d46e5bd79853a111b221ad9

SHA512
f484b308c6e60f4523e401437893d925ec49af337c6622c264d55f29b7ffa47f7830c28157c826e2e3fb3dc4df314f9feabe0258c3bd3c92eb0ed47b3b250958

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
44589f2cf760f9ab348cac32e1f0d5ce

SHA1
e7a5513cb7c0755e4f73f6c6b0ef5d536e89c48b

SHA256
211bc867543b8fa0d5a0903a7adca9c9cf3656409843b97260bbcffaccc03ef6

SHA512
8a0a466ca0ccc5c874812031a4f49d6fed5bff1c8602278d1965cbee189728ac26985463da7b0da8bef9cee24cd42b8010c76393d549ce3bf85cbc127ef405c6

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
59cb14154e11ad946b068da5f0692c32

SHA1
c2ea5fa1a967ec2ec70036e3a3929f21096ef620

SHA256
4f82d0d107360de154737e4cd3ea48d9d0081c2ce6c4f5dffad8d72412180b88

SHA512
8967fa850d740bb234cabf0aec172fa4d8dc6a0a93ef5435da737000340baab8f8e1355893eb9d0373976b4dc6aef68900f2b53fd8355008793bb2acf70a7675

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2713775cbcc5bb03bbc233496aa01954

SHA1
3234bd3214413595976d944bc639029337cbebd9

SHA256
ac4b9e5a971465989275bbfe9799549844956743fd948cd3105559eb9beffbd1

SHA512
521362563ed655c2378eb0162edb0cba824afbe9c3198c6e5247a1672f9524331adef7933cbd42f7241c91834faf235fc697d3aa7e9cc9ca022e0103a859c938

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1e475a14f007add180d01df0f5aa785d

SHA1
e90865b250885a50fdccaa6455fa145bc650ba08

SHA256
2e2f997daf0b03c6e92044886eb2f3a4f89f1a5df92348aa3772c6ee481e3362

SHA512
886a504418be254a6ae7f913a4e2218e8588fe7d670929ac13cf6eea8f5d358304eaafea30b276e93e6f555c63362bb183629ca8c104899deed7ddc352ce4ffe

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
31eed73dd9f1b67d8f74119a59a75170

SHA1
5a54861b813d6718cb1f4b6fb604ccb6d7484931

SHA256
e01a6af6f7baa5e3d05f7b925b1503ab73ba17430bb87590afd2764c0ff64c41

SHA512
8c13e1cdc2d1fe8466d0ea8876f6a29826ac5690a8e9357d804b996d8b04ea10ea12356e5976ff91b282dd1cd9f94bb46d95427d02053e54e6462ec31db1a545

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
66e0bf79306077de8fbc68502765c600

SHA1
66a57cd5fba92c5dcb30efaae8930cedd102584d

SHA256
d2ddfaac447ec1b94bc4bb25a0311dd2053fd339633ed7f916fd7ea7d3b7eac0

SHA512
bf50c459c67404fc43dfb71a0459833d414f8f9901864f6bc6681a6fbaca2da1603283ef3926b5de228c4e98672070af486337dc525441539aa1d1e0215b7e14

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
77KB

MD5
5c63c767e8b528f0dd3f5c382c69528e

SHA1
9c877f08d2f67b31acb69a65e5bd08ad5064f4c1

SHA256
7a37c3d864588bf75fd801585bdaaaa1430107925efa685fce2f124c144b9f94

SHA512
296d5eb68e3984d0a99be4753acd2ba712818d23b2bb49e26f3d26167cf346ba7318298e7af84d28207d739773ba30922dfbab1dfbb2436dac0c436305e1a541

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ae24708545e2fdbb0242893197e4c341

SHA1
5d7c846a2470eeba72b553762891ac303fa27ff8

SHA256
6fc08e6137ba00c81b8d16d213cb734f82e1b41b02a6581d5dcb798bebe57a7a

SHA512
6f3e94256b56a4bc80e3d7a36521859e0a7af5bf72a51fdf219136e5b48672b18032c5275ea89da07752e87c658ca054c6405b24f8309e5c2620fe9037041856

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1c216758f17c18c31a05ffe05f7eddef

SHA1
7b6300196df67f020a8960f7fb72dab022d6b149

SHA256
d1b0f9cffdf39ef701c42885b4e689720710bc06eafc6c14b9539b3701c19edb

SHA512
d23e112fd97e4c295d36dd871f7488e7337bd87f03ece04bb8f3745c1d0f8783a35d3b51c9ed0fe8740d32261ecc999637d39c396e7be756c403fd88ebdea2dd

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ae1a01cbc2d4b82591bac776313a9c92

SHA1
1b77edc409c6a185cc98a8fdd2dcd2f067f8c6f4

SHA256
8d67e7374dcf030c9b9698d7ba6aa360bc2cba5c286ce18e9296e8d3ae7e6af2

SHA512
55c5bf545caaebec8dba98aa36e9ec06eb3f393640eeab2eee9fa80067a891b8fc47966812ffa220b0abbfd7e3d9ad8508fda09e02681fb63399dc304e381823

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
66be66bbbfad0148dba0d99d087bce83

SHA1
035685c2a386c1fa2437b401697c8cda5d11c2f2

SHA256
32f711d418185549e2fa614feb6c1554c0a60644105af8e523426551665f5822

SHA512
d87312109a4aec41d27b3758374dad0e4b4d8ef012e36343fa7aed3e31747a7518dd0da83130a0b7e7669cb2f6ab00b07a742010c86a516282f98b6d0a623b5c

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1202.xml

Filesize
157KB

MD5
f627cf4820da06be8e6ff3fdec6ebfee

SHA1
993d8ec88721b9e76c3fe1f5987338a61b452bf8

SHA256
f1d2905b871b9b80172b7c9dc298c1a3dd355e6ae633f77562f4e06ed52a54e7

SHA512
bf698aa0eee296df872b91432670af719bda88be3b6d210a567b500da1cedc0e07055a805c2331ccacea0a8a17396e2e37b4bf70894b9052723049c96083001f

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit