evilquest | 3026b9a7ddf24cde270b2124aac84ac998c7da6ba8e55d7de99f740f4341ab49

Analysis

max time kernel
150s
max time network
152s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-03-2024 21:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_33fb5923bcb5cad49a52b2ed6d91f8cc_adload_evilquest
Size

177KB
MD5

33fb5923bcb5cad49a52b2ed6d91f8cc
SHA1

a424032f7c16d6b74d1e54d2644505392d16cd5e
SHA256

3026b9a7ddf24cde270b2124aac84ac998c7da6ba8e55d7de99f740f4341ab49
SHA512

3d16527e8e8c4a407c9757087d6eea9b1a0109b0ae9b8eb24cc08847498154a87ef11f0449d8c3cd43b0ea61130f3d4eb0558498f7017de10d41a9d00d72b65c
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Zd207:5SeOQdaZNxtk8cqhSxvHY9x

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 13 IoCs

Processes:

resource	yara_rule
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 53 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	process
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start afsvcpd
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:549

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:549

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-29_33fb5923bcb5cad49a52b2ed6d91f8cc_adload_evilquest\""
1⤵
PID:550

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-29_33fb5923bcb5cad49a52b2ed6d91f8cc_adload_evilquest\""
1⤵
PID:550

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-03-29_33fb5923bcb5cad49a52b2ed6d91f8cc_adload_evilquest
1⤵
PID:550

/bin/zsh
/bin/zsh -c /Users/run/2024-03-29_33fb5923bcb5cad49a52b2ed6d91f8cc_adload_evilquest
2⤵
PID:551

/Users/run/2024-03-29_33fb5923bcb5cad49a52b2ed6d91f8cc_adload_evilquest
/Users/run/2024-03-29_33fb5923bcb5cad49a52b2ed6d91f8cc_adload_evilquest
2⤵
PID:551

/Users/run/.2024-03-29_33fb5923bcb5cad49a52b2ed6d91f8cc_adload_evilquest1
/Users/run/.2024-03-29_33fb5923bcb5cad49a52b2ed6d91f8cc_adload_evilquest1
3⤵
PID:586

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:552

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:552

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:552

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:556

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:556

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:557

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:557

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:558

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:558

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:558

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:559

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:559

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:560

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:560

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:561

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:561

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:570

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:562

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:562

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:562

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:563

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:563

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:563

/bin/sh
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:565

/bin/bash
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:565

/usr/bin/osascript
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
1⤵
PID:565

/bin/sh
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:566

/bin/bash
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:566

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd
1⤵
PID:566

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd
2⤵
PID:567

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:568

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:568

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:568

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:571

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:571

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.systemsoundserverd
1⤵
PID:572

/usr/sbin/systemsoundserverd
/usr/sbin/systemsoundserverd
1⤵
PID:572

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:573

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.audio.AudioComponentRegistrar
1⤵
PID:574

/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar
/System/Library/Frameworks/AudioToolbox.framework/AudioComponentRegistrar -daemon
1⤵
PID:574

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:575

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:575

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:575

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:577

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:577

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:577

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:578

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:578

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:578

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:579

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:579

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:579

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:580

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:580

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:580

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:581

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:581

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:581

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:582

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:582

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:583

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:584

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:585

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:585

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:585

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:587

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:587

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:587

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:583

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:588

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:588

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:591

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:592

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:612

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater6BDB2703/OneDrive.app
1⤵
PID:613

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:616

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:618

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:625

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:625

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:626

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:627

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:627

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:642

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:642

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:643

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:644

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:644

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:647

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:648

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:648

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:649

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:650

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:650

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:651

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:651

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:651

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:652

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:652

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:652

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:653

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:653

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:653

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:654

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:654

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:657

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:657

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:658

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:659

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:660

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:660

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:660

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:661

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:661

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:661

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:662

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:662

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:662

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:663

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:663

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:664

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:664

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:665

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:666

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:666

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:667

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:667

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:667

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:668

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:668

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:668

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:669

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:670

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:670

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:671

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:672

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:672

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:673

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:674

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:674

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:677

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:677

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:678

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:679

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:679

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:679

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:682

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:682

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:683

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:684

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:684

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:684

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:685

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:685

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:685

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:686

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:686

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:686

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:687

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:687

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:687

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:688

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:688

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:688

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:689

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:689

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:689

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:690

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:690

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:690

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:692

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:692

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:693

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:694

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:694

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:694

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:695

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:695

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:695

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:696

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:696

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:696

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:697

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:697

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:697

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:698

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:698

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:698

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:700

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:700

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:701

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:702

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:702

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:702

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:703

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:710

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:710

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:711

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:712

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:712

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:712

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:714

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:714

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:714

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:715

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:715

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:715

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:716

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:716

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:716

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:717

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:717

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:717

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:718

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:718

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:718

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:719

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:719

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:719

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:720

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:721

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:721

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:722

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:723

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:723

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:723

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:724

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:724

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:724

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:725

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:725

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:725

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:726

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:726

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:726

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:727

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:727

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:727

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
5515d32c521fdfde65814d469eabeeb4

SHA1
92b7482937297278c814abe7c2edd52583a80ab4

SHA256
748d72596b8e60b6eb8980f95c7d91189f96f231c18821de6f3640db769c041b

SHA512
03e408bc01903383592cb051a1f495f526b9a1a3442a621726c72fdcf0235571f3d6e84969f1bf042b809466dfdf1cce2d6d88bd117bb2836507598b7a1da5b1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
99ee1175bfff7788a1665005db8a6e85

SHA1
678ea14d679d80a9d6df4a5fe1896b393feaf459

SHA256
e7144b2310a93c00ac217a436de58e38924944dab88b06c46397e9bc8b66ce69

SHA512
224e4ca56ec6d873ef25021ef187a9d49a035b9fbde995c5e95c4622bf546e5ee74541391e69ad881c74a529d39e87b5704b155794b588c7b2e099b0dc8167cc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
158B

MD5
59fcfd281707b0005227dd283f62dea2

SHA1
4220df1953c6b15a87d71a7e86f78cf8f7ad21b1

SHA256
0324ca533e92a8427e97504fe3337f3190ab97f5828ee9bc1108e81dbb4a32f3

SHA512
d0df564ce5dcddf853742396bd543f75fbe7cfd86593575885b336fde11eb78651fd1b5ac196359a4b758ad5b4a1c63eada0cbfaa057eb0d9f793667290f75c4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
d6d683de19d6d0a75ea8df2dad49840a

SHA1
295db558670e83cb90ba7dc9ff12fc1a22449a09

SHA256
1636ef369185b1b179df2db8f33ef9bc206c80cd876da2d6347fbc176894e7c9

SHA512
719a6dfd0a5faf6e0b4ec67a46721f627b49659e10386a831d5ff3fdf02eb6defb6ce4f430516755e7d50a2dbc8d38711b6803a61d18fe93a28fea43469b8774

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
e9f6fdec43887c6e2321971daac3ecf7

SHA1
a8798e1b88a3e29e6ab25e4e11acc87d6ed1c5a6

SHA256
6af177221a3d4f0ca9a6a5d5af2add6ee134095b26715699b5f21dbeab559c8b

SHA512
a2fe3d24a3f147d6a493c351bd75bbaada5521bc4ece064997a20950773b66ebe6d1f237697c5edef1b983adba0491463af0a5e677cfd3ea07d35b5085f1000e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
344aae0b6e42169682a54dcf8f39cbea

SHA1
b54c1ad17d37b455efb065db9890c2b2a4304efa

SHA256
125cfb29d95b2768aa95a9a45d98a70a819bbdbbba1f423b20fa431ab95e5370

SHA512
69ca4f76917377456ec0c49dfa6503caf266c62be06af1ee3b65c926eaf8dd1ce6115ed17f5abc4e98c8bcb2615a037ea892fb92ac9b35ec13ec2d78fc516a1b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
fad9e9abcd3c3c0c966f6b320a7b2875

SHA1
4333853c105c0390ed70156ae57100f59a7d6bf7

SHA256
821f1dd4e5896d6ee579f9da986ed4abc682fd31524dc5db106430664034a788

SHA512
72bd5654ec32d79bdf5a43cc43dc40afe223d9cbae9807b8e4f588f47194465b64bf890a51a71f173f95b3c0727d6cbde403207e2a59b6650e8dc155e087f51e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
f557a9b70f8d6db80f45895fc0ed0bba

SHA1
97d998a8211b22cbaa59b1ac13dd80e3d925c379

SHA256
c8183c8a83f122dad916405f982aeb2cd7d709e8f8fd8f407423e05e0885b7be

SHA512
c6b2ea3d9da22bc9dd84a01848c25d28a934debd09cdc21aeabfb74bdc1e08de106c7f56643388dc722576d25844907a4c22d86928baf486794479338a0bf915

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
167d2028da2be9482c47d70a760ed365

SHA1
6bc0bb64e9576fc738c85e1555f56df7fc56f446

SHA256
f7e9b6d776208adaba041ff95c78619743901b96f117b1203389965372485ec7

SHA512
344185623d81db3edc343040e3e83c706bca574f1d93e1193eb836952b6855b1cfa253d7e26efcf9bffd6f2dab7164f163773715833c5433c93e23d26d21a7ba

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
3b85dfc943f199139ca5033728364a7f

SHA1
04a7d1570c1bf55544163c9b4d68e24a42516b8e

SHA256
afb34e03d8813c77c3ce358ea463018994529ab9f65a02c89e1fb230866057d6

SHA512
bda25245f14c8310c8e874fee213f1b649700d96803a3590e51e2881d7312bc293d21e867877604076f62d6c8e4ff59767e07baf159f0ff22234b2cd47778c44

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
c63920f0a1ee25a4cd5cd1735df60e34

SHA1
3a7bab6342d41da8ddbea48aeb3ca6cb44b82827

SHA256
061a4ad25d83600420d0638b838a7f0aeba0b09921148508a3f39b82c702be1d

SHA512
e7f84fcf97c56dbd0eabada42fed99f4c1db0fae30bb928afddd23ca0642c5330750ca5e7ac77ee02a0741b7c88a3ff9a7f6e4db9b5f768282d0f61b6fea5bbe

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
2a763f709ffd365c614d56f97472722a

SHA1
448c2dbbe5ff85351c21f78dcd91cf0908992916

SHA256
fd6618f081cbf0c2ca9e47221cc6d0b5299bceccfffb0012ac40529b703be42c

SHA512
5ae99de97fe1ca2363b398b7dc180c2d95043f8ee56ec1a355296465abdb222706abbba7f2b887a40b94dd596ccff1e5db35275b92cebd567bbdc897d5ea99ba

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
c62c1aadb9b6718d8088a6db870b38ca

SHA1
fb19d3bf5e3d253129ee3f69d4d3f80b46661ad8

SHA256
b6e9a4409700ec0d01ce19e8a8fb453e053250d472758ce1bcb401296c9375c0

SHA512
95a9ff7ae71625269cac096d0b55152998334b93ef64f50288b2bfdb8035d2a1975a966c32c1e57f1c3e1788299d546db90139cd416991b93d8640c5c0ab70b4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
1f38781e31c085320f8b63851226b999

SHA1
a5026c64066906f0d4ae4d6e9b15552d5b41c191

SHA256
0b55930a94fcadfc42437231fe1098857875cb803bc07b6a4b2c2c5c151d5607

SHA512
3101efdb299a82327e59b26ee23859f1d109709c38ff2195c2c57856fb8c71e8f2c4d1f745886ce5369557ffa9bb45ae3da96766a6f52cdeb47e6cfac1a2f900

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
c7bb36c039985c7826adb1ae02d04580

SHA1
087de3d9ce123f06fe786f736acbe1d32b57c2fb

SHA256
4cd3c87c0b02e8dfe2d0c6d625a3bff6bd4024f2beb684d4808818125f697817

SHA512
f9fe71f2724ba0c2954deb91ea625dba2623253acdd4fe9701dfe3f930c42af2f7159b38a45d8e4b5bfc1e0b19659d746bae2eb6a9f75b5ce59bb790d223b9a4

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
145B

MD5
702a2c0d588b428c00ddbd5b209994ce

SHA1
4a95884b67c104854df4970c1efb312e0114f94d

SHA256
8be1359fe9ad11385f5c4274220f86c6f5e9d86345df1ccf8d3f61d8eee79a96

SHA512
97d7e4dbfd0686446f316fc1922a7aa232e6ebc3bb8cf5c0179efc2f28fc913bb6831b7c6410d4ea02386b4a5499adc89353e6910677ccb41b170f5d410c2375

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
ef8957e4d7fdee809f47090d2dead51b

SHA1
f7fc2133e5a2a6eface4af98fbe2eb3c83338548

SHA256
e0f6951aef2998a43f8603f0eb3810e718e1d98a736ab57f1608064b4ad4e4c9

SHA512
5a5331e189fa99b456930d967c431024c3caf2d836db6b763dbb900fc3aaa096ea0c22cc096a03f312427de7f4e2628419d8a2869d326930d715e5ed2b2b1e6f

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
ee812a020b166aee7ffb16bbf56fa418

SHA1
61c65ccb7e58646826fcf34f14840fb83b294b51

SHA256
11fd37f2be2c1a4f0c21af1cf40c0d4131a853a6f727b2b7106bb90ac8706c2d

SHA512
65389bca32484cf0b4b8d809482037657920807838b11391f71445a43a6b2fb63f719d374d59d26cf2917ddffad00e30c9e29cd03682a32d4d967d5f875442bf

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
4404cdc7f5a308bea42e020da8163b82

SHA1
3ab65cf26cf816caedd3a122539b92e08f17bbac

SHA256
1c8d6460f39bb8913572a9045b04dff24db2ac73ad7ae8679dda4be61bd4a65f

SHA512
17f493bcce94aafa998066429711b4aedd64d6a6b1c0a2a96b7717b1a2bee43efb44ed4688f4a28b9e477f311d09e851fa7ca53d9c62526871bb124c381dc8a4

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
4c5d1b778093e90d139b53336a519e65

SHA1
43c32b0e5fec958b2647958680c4a19f66c2d6b5

SHA256
80248708632eda8c0562b5d03722e27b924e341c2e39774e6858be3f4dee5edb

SHA512
411c6864aba2edd1cf5e0efa4ce1730de39bf8b5fbee5088859b1380cfa9dc8fd857de88438c80b1be2424f66fca01b7a36d47d1bb4763a4b0bed663d07c63a9

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
6594fe4db9bef9ce90879e2d41cfa89c

SHA1
b3adff97072b1f2e6120dc4179fcbe6efcd62b62

SHA256
a9d80dd3731146cbe806084ccb0fc46fdcb9ac21332acb932dd35c1fd73c4850

SHA512
9c4dd54e26d8b772e599cb9ec9b48cc6bb1a31856080611daa2b28240eb8109ef0997d5c51f2f668e7c95940b7123aa106691708ca970a0c85e2052d416dedcf

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
2287010935756a272a8279f79adf55c4

SHA1
bf8a3fdf07fe0fcee77aace1378ba0c974564ab5

SHA256
4d06d49936f43be42c3494cc0579703aa6e42fe304a3823a48072b14119f4235

SHA512
3ad201845f23e0c90f320a38186f4ffd256d4b100cf854aae98530cb44b06feb1d94befaa6a3cff1b2ea0fa3339f4169a7b928a2f4521d5b883fd5764095da11

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
9237a32a666fa5a8acffeed62ddeff0d

SHA1
7fca86911f43f752c487bdd171289520ace5399f

SHA256
fe3eb17869323c7357811b4b89e0928a1e812f26d74b8d9cafbed3a14d84aa23

SHA512
d791b31c12a2fcaa9a5004a8a2b13990c6711659ab425f9d20db9d413d75f835f262be3686c3f4fe3c327a9793e72a2aafc652d904512f655cf8d6d633a7acee

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
d3a8d7e403909bfc893a5d1ffc88ed17

SHA1
f3067451023c4d3b7ff860ec7655aa65c174dcb6

SHA256
c2b313dd00c86829d63f1af160809b726f46fd3e83cdecbc43ff2f5d596a5877

SHA512
b6ae862a1e34eb84d26a8e912f906a19393267355a8512ca94f606c931b47c61d78d545b40ed7fc7b8a485970596c6bbc440c20601c52741dbadc163d8a0ff6a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
050f788e3aa865993276bdedd5af9d97

SHA1
640dbcc9240e89e1c5265a2121630aecba512b0a

SHA256
d98032031fa15c6080c8d7667a85e11b18014345d87207ae3b5beab16e51ccbf

SHA512
6a18748abd117130f9f2a0ad2216e97a94d13281592f7ff2e64343d47409980a4515a6c19fd19570ba334e2c57e2763542b57b639e66ede028e58698b53736bd

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
303488a8fcbd0f602d25841849747472

SHA1
0b8f18de4c60b3404f12fee22303c9b4c7adeaa1

SHA256
440c53fd7c82c13e534c918da8a32ea1cb6915f24993a00fbf0063926c44fe34

SHA512
ff1174f196ab40f4b9242643e14b9e306788b8a255f0e27bfd4eb505705fe49b8e5cc22167cebe369fac7311af682f13ea237682a442a4b0b652348d15af779b

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-29-213135_tests-iMac.crash
Filesize
40KB

MD5
0f05c7131b92709ae0ed4b799d9ff93f

SHA1
38a21ca86bb68fe801b1654d2705dab2ef743f54

SHA256
d0c16a5df5bddc830d6b8a02c6015b55d4bc388ea5edc99256d4c377d290b67e

SHA512
f8f2865b324aa1237eaff69bc03c8ce10a8c89708d7ec23fc8ea1f09892297ca925acbd1bdd315f82f7dc869101547b4bd6e8fec0e756d84d53ec08f70420135

Download Submit
/Library/Logs/DiagnosticReports/sudo_2024-03-29-213135_tests-iMac.crash
Filesize
47KB

MD5
8fab9b6b1f8263ac48e1ab40da205b10

SHA1
17e3ea63b822ea1cbf3f20e2e6c9c33ed5cc4db6

SHA256
0133e2cc2041fdcbc9cafa68b5f08387e34dbd52bbb02abb937aa423d11a753a

SHA512
4688e40d992317ef264b820816217f4bb4cf778619bee8408a46a258fd4f3acfad94e0ae2327c2ff52e7dd3b464b1350cc41f9bef565a9f80d4dc5ce541c1e9c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
1214ecd29f4859355a8786b216118ddc

SHA1
e9fefc66767e0f86fe0f2abcc018610b8e2f45ef

SHA256
47473aab50692bf689cb969f34620f970594f04e2f59d8d0c4486eb925f340a0

SHA512
fec3fc643459fc7f8b8a3b900b3a39500e9182d2d4ece907c75d0b26dbff6c7ebc60ce29bb49889eb68fd2e994c5a0c0fa2152ec43970be35676e54f5bf2a89b

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
57fc714d55f3f005765ed3af7286e4fd

SHA1
86e0c9746479efe3d44658439b8777a9a5f10c1b

SHA256
e532d9a51a3919e187cea9e9589beedb496c7e3d5f80b0b903dcc607d64d41b4

SHA512
18832d5e193f769dfb47cd84132829dae939154739fa8badd38636b9557325153e91b18a705fe16f9dbe31ac6fb292eacafd19dc903805f17b5ef65a4b5e3d4c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
0530681ba691adf83567b7d3b3f44343

SHA1
f6db7e94757b00da8f7e3b9d44c8fd23e7eb8c65

SHA256
a88242e87695ab0f7b2b20ca0d75394c04fcaf49f02024ef27021f5679423fcf

SHA512
90a2b47d3ce6f594df640551f178060a360cee1d8e2e2da9dca551b1995bda50a03863d9e85859718ce7422eda027666e341c4cf31c50bba8be0741ee643baa8

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
4b86278ae21b8c420441334051d50c4d

SHA1
d244ad1fb551252bd04844504af909f321363bcd

SHA256
4b97d3ab2d9d748f91176044c2b0f46ea4318cff26e007c56f57c1e52df71841

SHA512
0bb8e57f3e5613d97564892cd94c67c53255d982d6324f33b7ca24a2b3346dc2ac878e17c1db3221a91be95e294427ff0486312a85192bcbbcff5e40ba510295

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
706046ed54c06ba6b01cf1f991ba8978

SHA1
3a0743aaf856dea2902b0cb30ea23b890e5456da

SHA256
72e15462f3f7a8f71fc3852c36d2ccc7d19107dd51f079cc378bea35f18027be

SHA512
ee427c71ccca6fea289126fdd57d2853d16b9dbdac95b00da9dcc29a1270ae4d8b40d47e72f12ad4b4467e5cf9b35890735ce54d8b91caefc0005b7b6b086992

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
d71cbb1debdad2a10d4525773e2c7590

SHA1
f2ad9a5adb7a63be079b11d167d241af88604fb6

SHA256
a2614de323fd0116d1ab0031e11f78469f44305781165c5b34f54b4f25ad8d55

SHA512
e4fed7b1f487fb0a32481e99e1b7134c45c752472accefe27bd34e3353fa0149805fea2bd584bf1dbd5f7717ced093754631e8648edb77bb8e7c486dbb492b66

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
fa496857b83d5a922ff555b42e3769ab

SHA1
b19273b59543702e27f22b48c5ad0918c8246e35

SHA256
0e863248f40f3767082dbd62f506b090037662ff633b75d25678ac3c04cf4aa6

SHA512
33b7c816424e0081197e1aff84c4a3e4a9ee95e1a0005bb1748c47516376b1ba42afa3e92ad664b81d240cbff1e6ce7c11e823b911acffaa0a35c8697d30a12f

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
9863d43d35627c96017dd53f33c72346

SHA1
b0767c4f5a036d7f24b38da5140f401984fa69c5

SHA256
88e517ecb163f78f8c4e41e0a55ae50ee6ef782dd0fef6bf3b1ea959e15290b6

SHA512
3df46396a5d9dcd76f5e5ac5a17cf7ed4fdb9d513e0198c1295999e54612e16939e5019f2d18188333939629fecdd69722fbd32d6c6b6edc55c09ef4063d5d45

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
d5f39a361df2183636c89be32f56918b

SHA1
2788d71c55b80211257b4d2950b827890bdce916

SHA256
879428129d448bf146f134a5df636917cd0a5bde66d6a03f6d4c673fce8753eb

SHA512
e076bac739c1d61f163c2d322c186242a9c8b9fb6898e048c14e7740d968e413e362d19a6e30a62827a3ee99abe27db655a418224b0a576197f86e93dfea3a82

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
70cf198a74e48f7ae079896310bb61b7

SHA1
639e29691412f67c048d56da2834a2d4dc4cbc87

SHA256
1d25b52bf49d222bea259d0fb55861e559044e2504e7ab0abb92107e4081db83

SHA512
344d288bea25e5a3cce7a6b3a1fc15775b8558346d663e0393591f45fc285c0248c115c4e2d23f1bccc3728ae84656681d9761eef49defcf30d06b4bc4c31928

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
3e0565caa06228dd4abd67297ed1184f

SHA1
65844d0df36cbea25483721b067707305677cf8e

SHA256
5f5ad1da33b8f2c41817cca48049e03673369b90f5654d6f6fafd86828044064

SHA512
50a8b0989dd9b3a079f976f4f5b5ab305946f24d97df3f2e2cd6674a3f62abecd998d65d20bde8e103465c8e1d45ef96470c406a55f145e49ad385a7e3a0108d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
7023fe98a09f1534d534a136e6a5d290

SHA1
bbfa37c715d4602efdb93f6524c4a305d0a98a3e

SHA256
33e3d326f0c2c4b2451f2a8ee63f6b3458f8d119cc8efd900c07964011d09f49

SHA512
090e9bc9cc225e3d23809c50be2d944b5e6693f474daf3fa42a81711f87fab14abc408dddc294730be8b3e90dd0e5bea6656a3cee0189c2bd676e4b2a26d3348

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
d8a8b30df5cebd5da9c98ddc1e4abbad

SHA1
579096e68bbb466a29a9f73daa1759f5adbae70a

SHA256
5a1dfe4daba27fc9675c50e1e82861454d31d11732dfb2ef3f76d7ae3dce497c

SHA512
de2a36aed1133640ea99095591ec68140bcb95599028ff65ee911729cd90479ecf16278a09232e34941e21ce4b255acc64f1c518820408d21addf0bccc8f6378

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit