evilquest | f05d9df0145f193c2dc00c475311438853872c1d9c03821fb1be7b1ee1836204

Analysis

max time kernel
151s
max time network
153s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-03-2024 21:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquest
Size

177KB
MD5

f3244d2c6c2101018393cff17585ace5
SHA1

febccd9656495e33cd2cc421d10113619b0efcdc
SHA256

f05d9df0145f193c2dc00c475311438853872c1d9c03821fb1be7b1ee1836204
SHA512

c8dc9f5bc2315fcbcf24e345647a944c7d1fc195ab8a91110fcb61002df18f803b86da4ae65742716c893c3110fcdda21789a8249154960b6ad964f1ea8ef6cb
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Zd20t:5SeOQdaZNxtk8cqhSxvHY9n

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 8 IoCs

Processes:

resource	yara_rule
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 54 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenTimeAgent
1⤵
PID:523

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:522

/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.oracle.java.Java-Updater
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:526

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.DiagnosticReportCleanup.plist
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.appleseed.seedusaged
1⤵
PID:528

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:524

/usr/libexec/xpcproxy
xpcproxy com.apple.speech.speechdatainstallerd
1⤵
PID:529

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:528

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:529

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquest\""
1⤵
PID:534

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquest\""
1⤵
PID:534

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquest
1⤵
PID:534

/bin/zsh
/bin/zsh -c /Users/run/2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquest
2⤵
PID:535

/Users/run/2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquest
/Users/run/2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquest
2⤵
PID:535

/Users/run/.2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquestest
/Users/run/.2024-03-29_f3244d2c6c2101018393cff17585ace5_adload_evilquestest
3⤵
PID:595

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:536

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:536

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.secd
1⤵
PID:539

/usr/libexec/secd
/usr/libexec/secd
1⤵
PID:539

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:542

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:542

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:546

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:546

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:546

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:547

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:547

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:548

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:548

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:549

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:549

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:552

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:550

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:550

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:550

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:551

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:551

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:551

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:553

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:553

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:553

/bin/sh
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:556

/bin/bash
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:556

/usr/bin/osascript
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
1⤵
PID:556

/bin/sh
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:558

/bin/bash
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:558

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd
1⤵
PID:558

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd
2⤵
PID:559

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:560

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:560

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:560

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:574

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:574

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:575

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:575

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:575

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:576

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:576

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:576

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:577

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:577

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:577

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:578

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:578

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:578

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:579

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:579

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:579

/bin/sh
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:580

/bin/bash
/bin/sh -c "launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:580

/bin/launchctl
launchctl start /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:580

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:581

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:581

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:581

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:583

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:584

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:584

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:585

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:584

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:585

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:586

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:587

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:587

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:588

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:589

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:589

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:590

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:590

/bin/sh
sh -c "ileges\""
1⤵
PID:591

/bin/bash
sh -c "ileges\""
1⤵
PID:591

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:592

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:592

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:592

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:593

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:593

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:594

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:594

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:594

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:596

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:597

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:597

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:597

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:583

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:598

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:596

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:602

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:602

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:603

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:604

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:604

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:606

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:611

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:613

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:613

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:614

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:616

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:616

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:622

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:622

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:622

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:623

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:623

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:623

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:624

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:624

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:624

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:625

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:625

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:627

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:627

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:629

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:630

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:630

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:631

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:633

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:635

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:635

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:637

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:637

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:637

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:640

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:640

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:643

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:643

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:645

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:648

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:649

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:649

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:650

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:650

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:651

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:651

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:651

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:652

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:652

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:652

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:653

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:653

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:653

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:654

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:654

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:657

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:657

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:658

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:659

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:659

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:661

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:661

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:662

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:663

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:663

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:665

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:665

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:666

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:667

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:668

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:669

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:669

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:670

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:670

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:670

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:671

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:671

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:671

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:672

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:672

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:672

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:673

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:673

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:673

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:674

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:674

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:675

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:676

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:678

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:679

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:680

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:681

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:681

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:681

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:682

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:682

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:682

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:683

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:683

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:683

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:684

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:684

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:684

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:685

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:685

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:685

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:686

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:686

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:687

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:688

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:688

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:688

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:689

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:689

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:689

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:690

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:690

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:690

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:691

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:692

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:692

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:692

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:693

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:693

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:694

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:695

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:695

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:695

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:696

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:697

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:697

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:698

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:699

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:699

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:699

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:700

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:700

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:700

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:701

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:701

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:701

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:702

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:702

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:702

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:703

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:703

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:703

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
55dd8be65b558330f131afc5f945a6db

SHA1
5dc0f187d334a611247f67694bf755a6b9e24ecf

SHA256
a475310d64c57d17074008b1bc261225b65aeefdc50ac6ec24fc1c940cfc3192

SHA512
4ba5a01a342cdd4e2b36d4cc7d6d5e0189a8ac649882ffcc1d3964190762da830595621dac76b6792dabcda20c486d2a77727075fde815d0c489e3a3f322759b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
158B

MD5
9006f5d2ad92ba764be6a989dc2d28e9

SHA1
6f68e25c9c1a265e91acab0b3c0175ad3da77793

SHA256
9b384d51b4676a18ab121b2ca2cecc76885848c2ee7e284a384e8d1d1fcffcc8

SHA512
04431e1c00a21106e75e76edc7d1811c72acb7a738e329156bee2fa423eac75bf1b559d507ee3d448708b0639269cfdc86673f85c2c01a9b259304dea385e8b1

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
f808ce99857786ce25bed9a80608c44f

SHA1
7ee43c630bf6b0828f9c20240b5190768b1190d8

SHA256
3d91c920fc3ad94ff4d595217882873013359123f9ef7e18e843952288db1834

SHA512
4e5d6c09194f384577d7b957c36313f80fe9279d973adf5bb1ab4d7d999aa5e68fe206de1554d763ebd2c2eab159b6cd4900180db807ae90870e6115980cdfd8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
158B

MD5
5e17bed1a08feb1456992eb0b4e4573f

SHA1
19da8112bf36778ebee135aeca4c09c4b40d63f9

SHA256
3cb85b65565e6ff75ce1985d4917b20aa4ef62097d0c5336b6b3dc87b14a11a1

SHA512
4a3d58f6822bae9d7c22af746f15c0a9bd093cf8a358f10d6130a26c20155b832f6f23d6fa3e7359e2a693c74e274bcb20100693995b994d6a589db845b7d405

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
232951babaf6257a98a2260cadc55ce8

SHA1
b3bca2e8a06e670037c512d7b6ce63e5bfe36b68

SHA256
4e5511f1ac2d415208cc5920ee2c5422c3369cdedd9e5424f3be6e7a079d19be

SHA512
83f6cf3fb47b2363738208f6929fbedd239077ff0d8f2e1c80693e10f7607c5de9afbe3304902cc30b6fba9edfb920ebbfd84029851e911ee50466de02974cd3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
fd3f8ea277a515b5be94baa02ca3bf15

SHA1
976882d49b623f3c0e8daf1199aeb104fa70a28a

SHA256
dec8520fa32fbc9d5758bd59e89daa59f11fc7e8aacd21e00bd740378897857e

SHA512
428b21ff508d460513035a0df43478fbde87d4a2b25569348eef07730e7357748cbf34793303576e773d60e1a389f4566e24eb40ef63646e090f3b63fd8d2894

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
af419e5f0422a3815d0737429e926faf

SHA1
9ea7217bf853b76bcc441b4719704667c93a25c3

SHA256
8ced6a0afbc6ee79f2bf20447d7033c61784d9301a91f09fba6905d842ced192

SHA512
d92fba3daaeb33ddb82fc1ebc5b4276968a7ab043b754a09dcde262145c1539ba8540a4693015c5b10a1feb9a98531286c714cdbe478161e3c94052b199b88a0

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
993340229bdef4297260f17ab14b0dbb

SHA1
b5bd67e97566aa58999976900ee28f6c969c2ecb

SHA256
1c5b2cc791925661e862c6dcab8ed3438449369a9d48833cec0600bd5de73455

SHA512
89c9e618b03c059cfea4cbff76f8889d83dc2447ca4845dbf89d6ad18c06797d8a163f69f3daf488a5f470d78f68a8b6a4688b686f92f93e0343a298d66b6829

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
e0df6a7b8f5cd933abd1038addc5dad2

SHA1
18235e1090a05d6102a2ad63d0d20b650d0d1316

SHA256
2a865a777eeb378e42c6910a8d9672935ec70b9a0fd016efe48a44fa92ebd1fe

SHA512
be6656871b8e3b30250358711d63d065b90843dce62c95e934ea29f695d3c88a2bdbe2e7f2088488d50362e5ecaac268a99f2974b90175655ac521400cf298b2

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
909d73d00820fc9ec345bc87bcb87cba

SHA1
a4ecf155ed89eec637bc72a5f9769330bf77fc0d

SHA256
2e62a1bbbdf176171a857a324b8d7633a1e77568eb9caa56924a0b77fb743429

SHA512
142d10554d4f9efee16d29fb5eac052f64cef101e23383cb6c57d22d82df1076a90fe29be146cfda3b8874170f253c3a9ffd8409877b0a48ac514f98058a83fe

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
145B

MD5
627b5aac6df498a280094a4059987f4e

SHA1
e2c23e6e58a5fe7368805cfa0d25a720b7e480e3

SHA256
bb36d3ceaf0b2579f98ed9e17a443693ce5d2e6f1c5cc368a604651cd4e783cb

SHA512
d94dc0833c8a8d65cc72ec756533e727bf9f2e900877755205ceb8bf183adc043db79035424addd5687da4a14e812e5aae7670876a255b5c6f1655cd87db2a39

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
0f35feb8886eec93b2c6345ab6195bb6

SHA1
5c38f12a28c623688d9851df290317e3a8f4cfd3

SHA256
50878ed1cd482055415ddbfe820676eac60c09f51513bd81822e685005681722

SHA512
ce054715878e61c52c1f3232804a8b958e98861392c021f6b07e319531747382fd29ee1a2d223b52cb5b6f15b41a6b34cb4cfc55046222865523f1030dc8f4ee

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
965180a935472ebcc5bb8293dfcea410

SHA1
8228fb2cc93101f0c8cfa190166eaac56c8f603a

SHA256
958002834bff7eb7ad7b655102af5c8b723f035b77a33973e72d120074af0d75

SHA512
ff8063a3ad325f707a897f12cf2e47ab9a4b3912134a1fc4b06b66fcb1a5c7a77f8441af40d96d0ea3fee56d833fdae7bfe7e49220d6a7bb7175f1e80eade2d5

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
2970cc6ab22d3435e92888f8b7f78e09

SHA1
ec5808838b2943d9f74a8ff68a04d6a9e1453b02

SHA256
6f0e601f3a7f5a5484c4d6309e5eea27414f691a090b821103529442a78a62ae

SHA512
a547252d0bef25f0f6262c0eeffaabb3ad04fd67f10539a733bfeb67d822ac29f4e1b99a6dba473b905abb64d8d6fa2f7e67bd1b4a0175494f878157171defac

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
acc418fc7c07caec1582a079a8f95c4d

SHA1
e02dcd286dadfa845fa636924df0e324e5c44de1

SHA256
97c417b2353eba7d3289319ff9ec33e29cf378364e3d96508733f782c32f072e

SHA512
322bab7028682577bd3c090d1bea3cbd75e70e4cbfefb39772eca7fa36d13a5d4e495ad62e4356a900e8558de71339ff4ad39ff376a6b9a62a2bb91656c6f802

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
6e78237597e0ad5f36eb95d377193cc8

SHA1
3db2f16f3a1a5bf6d5ff47dab7d404f40054f8fe

SHA256
3a0df67a1ea9ea362c2b7a7bc01eccbea7dd865f137feba851417c98b1a4728c

SHA512
2507c6faef85eb1012ba0ec19eecf57532e941e576c9cf714bc6d7c45f4e699aa1ab2ec8f84933675854a2617b4a3011043106d15c3c231b067c39374bee530c

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
a05171625d184d2796dd7f612ef74336

SHA1
acd36067ba2e8acb70347268310a1476608914b7

SHA256
bc580217ee105611d7338f93fefa8d21cbdd9ec9c93f6f3a7c92a9dd17e8b708

SHA512
303c52e1faf6aaab3783905c7bfd85f8cac67cc25eaa48f28b045f5594a9ee4adcd474c4aeeda223bcb94487040fafe714a15459a20043f9b2cfdc49c28fc736

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-29-231721-1_tests-iMac.crash
Filesize
40KB

MD5
3aecade965f40ff11ec6b0410e522a37

SHA1
6b3213ada3a89c91eb5750756aacbd1b4a3fae76

SHA256
f400cec1d595e6ff53f3971c2a70db3ac9b24065bc2570aba0b192a6fcc1bce6

SHA512
f463a3923dd5c16bcb6e592f7da426acb30ea7da2796fd1aad95b2540da810923f58dcbe41737fa45832c9018c61646e6d79d5136e985d6290abf53840008973

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-29-231721_tests-iMac.crash
Filesize
40KB

MD5
4608f69cb7fd92f75a5453ace56720d3

SHA1
c6fefb1dc26dcee021924a9f31cf60ad8854c096

SHA256
e6e25ad664a29a30d33c62beb43e21d1586dfcff1822c5a89fdefb9fb56a9001

SHA512
b25f8662126d47dd6f7b0fccb83fd185bb099d6d8316ff0cfb925c5200feafbc4914fbd9f6a5b37ad5cbee4eb8440268133f78482763f1b31a60aa7fe6f033f8

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-29-231738-1_tests-iMac.crash
Filesize
40KB

MD5
26b9ee4dd00053493865cbcd89f2bc4f

SHA1
426a3a801a26d545684218f63f5f2a3293181e66

SHA256
b7b3f17ebbd9704e5d80560ff2f58f0b4113d863fa6fee67ab5a6091d743836f

SHA512
eceb9db32a4cd5ffa0a5b335feed93789a1a827eb97071dcc16b2f312cf235e262dca48d1a2e991dd7d33f58876959a74225b679f7f697ddb0f506bc4f85c6d5

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-29-231738_tests-iMac.crash
Filesize
28KB

MD5
79dde009f31d77dd3237592357329a70

SHA1
a63570a21e79b99bc020d51baa7dc849d24cb1f3

SHA256
5c0d1295186236323d3bdf7b9f35a8b88e20ee522ddb6c80657a1ea8837500e5

SHA512
c3e1ec7de671e60d5e84813f76c297427d4b7a63103a11f75df820929b0fc296448cde6c0bee35f4940c3bd148943594bf122d4f747426de46fa9d951696da72

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-29-231738_tests-iMac.crash
Filesize
40KB

MD5
96319dfcc32349e844f1d4f78edf95dc

SHA1
36464b2757baf8f47c3b42f19ac4267753595a27

SHA256
2bd988577d954601abccaf910bb380c4f337ea880e935d7edc2d901cc37cf35e

SHA512
602082fc5481929904af182d7451e15d8f0ab204653fba15abf12809e030b502eb9c8c6e7b7d2703d01682d15f9c4304f3ac36f974885615748210c45b6b5a05

Download Submit
/Library/Logs/DiagnosticReports/sudo_2024-03-29-231721_tests-iMac.crash
Filesize
47KB

MD5
1f357d3f50df0a268aa8c9b886c14386

SHA1
60cceca165b439d0973045cb856f88311cd1a3ec

SHA256
f816f41e0888e86a1c0a453f950a54f094799548c42dc0830a5978cd4f3b9b90

SHA512
b609db60b989e1ad603e4fb52321c649ca7c6567e8ed20cb1f0d3d318a08c623ea9aa0e5e0ab2fb28e527148eb6ca53106290725b9cbe954b33d9760b0439ff4

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
439B

MD5
c05b619361d2cac0288befbdef519546

SHA1
634e507971e2bd2697df0cdbbe8772e6fbec276e

SHA256
1b2c817978649cad70d67be41215a663790d97707b7512cfc156b488438cbec8

SHA512
86308ab30375670ff5eb886d50e3b5be5f3b7d60e0de53458e0372c0c67cbfd1c58450acb201c7d21a5f351c2b0e796d1777dbaa1e2b83ef7f69a83dac26ba20

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
487B

MD5
e251c94fc14a772dbd695b0919d4f53a

SHA1
63c2eaa2aae3f097a6ad8952064d4764fe8295e0

SHA256
2e8a5e8288abdb773269792173899a3261c3a04c2a4d07c119988542d1978b49

SHA512
92222001d9e6f4bebf5abfc02f4a0b379b33c4f7dc4e9b27170e8b2d43f7c7e017632f893619d04f01eeaa48cfd79f77c7b910cc47d74d5b81f69ea83bd69a5d

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
81B

MD5
520bb9b65b89f03050030e5a985b9cd1

SHA1
91defba6d4540d4c8ede177730d104d747e8f57b

SHA256
6bb23965fd46b9ffe67a1cdb2144943543894e063c05db3a4de54e94b84968a0

SHA512
81eebb3eda761a9ecc94aa9564deab4d476522d94025ec19e002e91b12b7fbf2bffda23e7c393c09cb91b6ecd953ec1bf39ef5f787058b70289a5a5d777f0cf6

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
122B

MD5
16a15c7222b5f487f9e47219bec96c9e

SHA1
47bb4748ff46c6365fb2bf5b22ca60387b4f42bb

SHA256
9ae1d6f1888fc41b8d9c6315df10394ef187eb1f57ac0abe48c5606b3277463c

SHA512
41595eb4b33c09cf1d087977c2a49c14a2894083a4d73dc88a0c9532e6c6b546f872c7cec14a16f674ebd0137c04e690124b777e197677cb964eb9336745d919

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
7cb4094442a5f376372381148601eb3c

SHA1
79fcd487b51d231937694257b3ffcf7cf156f5a4

SHA256
8205cd18f3b1bb1f5d2c3256a26ecd5adfda624a327a648441484c1c18a7eb1b

SHA512
aa736f0abde93750ce5ca8a052cadbb600da3289d4fc03fe05361d84c3850d44c04be66a0f433c559ed86ebf064d4fcb3c56553e7e6b1fdd9828655526d6f9b4

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
a9d4ccb6b104d36fa7d91491bb9fef22

SHA1
39b6ad7ce3ab3890be1a8480d716a922fab4a511

SHA256
40fe06d667c3e118aad3fc20f98c71132426342a4f8cdb4810105d3bf8ff7b72

SHA512
4e87a604c8a439b81ad23eb4f93fd276074098b643f1e0bbec3ed43327bf44613f4307912a316ad4dcb7dc4563171d34c3d9289177293af1e2d6733e9662a538

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
5ef207c9a28f6dc5edc0d5a8cbe7ee18

SHA1
70bbff7f8c6114b1db6e69f54d5afd43c05c75ba

SHA256
83a231187ccb912600f043219f49b54fab3b61862eb77a0caf26a8267946212c

SHA512
8993317732de5a15ee7b9a724253dd376b98adda128ddb3d5ebd4cd53e23935d173076d39c6e43372fec140aa5f3ac39aabc1ce4a56279b6b8b512498f7b7e6e

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
155346af5011092ce334b222ad253045

SHA1
823f86c8854cc5cd0e6b857d31b3f5600417640c

SHA256
851fc38413bd07d24070a0aa34dc1d13c9510fec9d4764085c581a87e95f4160

SHA512
83f315fa4cb6985206ccbbfd6d19a9ebaaf57c090137eed0dd03147f98726542ac829f9fb23e7009ba87fe08d6c70e34aac6c896f641367426efb78327850c26

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
092201cab526e3a9f806e2c92d28a413

SHA1
4322802501d3646e61c3797889342d6917e93b1e

SHA256
ad9247457cb400152681d82a5e3e400d427bbec5684cd859721162db500a580a

SHA512
f763f4ad8f2f8d973f485c5e3ab24e163afbe505dea6c4b0d3aaefa85c9151b2a062ce2b312cf335f0f86c67a49b09a249d83392df2a58c5f2dd6565f3aba1f3

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
e1177e1004e5ea8694cf1bda02babb3f

SHA1
54d96134dd02c35cace18403de8bfbc5b44cb75c

SHA256
927c9a50d2385d20de4cef5b29998c5261ed553fe04505507eac3978b096b4ab

SHA512
25385e754593ecbf89404fb5b3b655cd2aae0e1b2d7428cd04796e97cb643b66ecf9213cf835b35cae5453725c6f9c8cb152e4ad85525fee87bd4410453bba87

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
1585bfd1c30304fbfbb55233fecaddea

SHA1
8706c27fb659c5b7a7529d845026f3efff6b98af

SHA256
876f782515c4cf47be8482093b0e1643287a791c6d73c4e953ca8a6621ba086a

SHA512
41f48baa5ac43f6e5edaa9e458e398aecc51d92b7e13428d9808242a79ef483079eb43adad73ab55e5c2f21398598a6e5661f3eb0ea8bb993a763edbf4a14c9e

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
cb9e4dcaa9bcf83fd1cb4fa1f2fdf7e0

SHA1
34b41579a5e11622932205ee7bd0739ef8c4f4c1

SHA256
8ebaa28d00d936938d350892181e60587fe2c38bd5f07e7c1772b82192a27af3

SHA512
453fd4aaf3fe5ebce56ade41cb593164d6f30a04c3b77877a9b8ac3a96eb75f47f1a0f544a2b161533177951f88244801e730b1988aada9696d0c3eb8ba5fa16

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Filesize
124KB

MD5
c8d7d1682b50b402b5eb0c024541faba

SHA1
5d44d162ca06f098ccdad1ca279b96c31a6b229e

SHA256
95cb7ff9cea2dd44c6c3aae9ea75d868effb00df4e87edaad9f636ce657908cf

SHA512
773967552f5e510d5d6452492b330fca2809651958e2376406c4ed8e44ad38fe14d32484e2fb0e876aac46c889f881c0c57aee2bf8ca12322e0f504eb0750927

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1249.xml
Filesize
160KB

MD5
c0b8e6fb70a16991ed49a487448cd106

SHA1
71f21321168dc466e7f64eb2c2516cecb1a931c3

SHA256
9320e397ccc5577acc65da1f4cbafea31c1d802014ec4b4459c628b449414fdc

SHA512
ae0c5fb1b29d7f80511a846f8c3db54d018aba7b9314792e63d6844ded948610aed6aeac4388dfbfd8530dbaaeae4cf479c10f52746bab866509d71217111ba1

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit