evilquest | 22b3a889cd5dc176a62f69bd68a2db340e19b7675637db62477a1b3899da989d

Analysis

max time kernel
152s
max time network
154s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
29-03-2024 21:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest
Size

190KB
MD5

f495b998d1e8f03b4d4354cd213f0e0a
SHA1

8e4cf3aab1cf0c9652e8fa1bf69f86c4a8b4062a
SHA256

22b3a889cd5dc176a62f69bd68a2db340e19b7675637db62477a1b3899da989d
SHA512

a52be2df8b4de794d845f6078db3c0085a0b035e4dc0df186cdb9f9cdd715c77f293f3f180a254a8c11cf4a8c39d7dd8845ef1f2e8e83d5fdd547e2bd375c0a4
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9Zd20p2Dn5km:5SeOQdaZNxtk8cqhSxvHY9T2Dn5km

Score

10^/10

evilquest backdoor evasion execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 10 IoCs

Processes:

resource	yara_rule
/Users/run/2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 50 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Resource Forking 1 TTPs 2 IoCs

Adversaries may abuse resource forks to hide malicious code or executables to evade detection and bypass security applications. A resource fork provides applications a structured way to store resources such as thumbnail images, menu definitions, icons, dialog boxes, and code.

evasion

Resource Forking

T1564.009

Processes:

ioc	process
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	process
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start afsvcpd
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""

/usr/libexec/xpcproxy
xpcproxy com.apple.loginwindow.LWWeeklyMessageTracer
1⤵
PID:521

/usr/libexec/xpcproxy
xpcproxy com.oracle.java.Java-Updater
1⤵
PID:522

/usr/libexec/xpcproxy
xpcproxy com.apple.DiagnosticReportCleanup.plist
1⤵
PID:523

/usr/libexec/xpcproxy
xpcproxy com.apple.appleseed.seedusaged
1⤵
PID:525

/usr/libexec/xpcproxy
xpcproxy com.apple.speech.speechdatainstallerd
1⤵
PID:526

/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
/System/Library/PrivateFrameworks/SpeechObjects.framework/Versions/A/SpeechDataInstallerd.app/Contents/MacOS/SpeechDataInstallerd
1⤵
PID:526

/usr/libexec/xpcproxy
xpcproxy com.apple.ScreenTimeAgent
1⤵
PID:527

/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
/System/Library/PrivateFrameworks/ScreenTimeCore.framework/Versions/A/ScreenTimeAgent
1⤵
PID:527

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:528

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:528

/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged
"/System/Library/CoreServices/Applications/Feedback Assistant.app/Contents/Library/LaunchServices/seedusaged"
1⤵
PID:525

/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
/System/Library/CoreServices/loginwindow.app/Contents/Resources/LWWeeklyMessageTracer
1⤵
PID:521

/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater
"/Library/Internet Plug-Ins/JavaAppletPlugin.plugin/Contents/Resources/Java Updater.app/Contents/MacOS/Java Updater" -bgcheck
1⤵
PID:522

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest\""
1⤵
PID:532

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest\""
1⤵
PID:532

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest
1⤵
PID:532

/bin/zsh
/bin/zsh -c /Users/run/2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest
2⤵
PID:533

/Users/run/2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest
/Users/run/2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest
2⤵
PID:533

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:534

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:534

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:534

/usr/libexec/xpcproxy
xpcproxy com.apple.secd
1⤵
PID:554

/usr/libexec/secd
/usr/libexec/secd
1⤵
PID:554

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:561

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:561

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:562

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:562

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:563

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:563

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:563

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:564

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:564

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:565

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:565

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:565

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:566

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:566

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:569

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:567

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:567

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:567

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:568

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:568

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:568

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash
1⤵
PID:571

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:572

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:572

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:572

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:573

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:573

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:573

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash agent
1⤵
PID:571

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:574

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:574

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:576

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:576

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:579

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:579

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:583

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:583

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:584

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:585

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:585

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:585

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:586

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:586

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:586

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:587

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:587

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:587

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:588

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:588

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:589

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:589

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:591

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:591

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:593

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:593

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:594

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:595

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:595

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:596

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:597

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:596

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:598

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:598

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:598

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:599

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:600

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:600

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:600

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:601

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /Applications/OneDrive.app
1⤵
PID:602

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:603

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:603

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:604

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:605

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:605

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:605

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:609

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:609

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:609

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:610

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:610

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:612

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:612

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:613

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:613

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:615

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:615

/usr/libexec/xpcproxy
xpcproxy com.apple.pbs
1⤵
PID:622

/System/Library/CoreServices/pbs
/System/Library/CoreServices/pbs
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:623

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:623

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:624

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:625

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:625

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:625

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:626

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:626

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:626

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:627

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:627

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:627

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:628

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:628

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:628

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:629

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:629

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:631

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:632

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:633

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:633

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:634

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:635

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:636

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:636

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:641

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:641

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:642

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:643

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:643

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:648

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:648

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:648

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:649

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:649

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:649

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:650

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:650

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:650

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:651

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:651

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:651

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:652

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:652

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:652

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:653

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:653

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:653

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:654

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:654

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:654

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:655

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:655

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:656

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:656

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:657

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:658

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:658

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:659

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:660

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:660

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:660

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:661

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:662

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveUpdaterDaemon
1⤵
PID:663

/bin/launchctl
/bin/launchctl kill SIGTERM system/com.microsoft.OneDriveStandaloneUpdaterDaemon
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:665

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:665

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:666

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:667

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:668

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:668

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:668

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:669

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:669

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:669

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:670

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:670

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:670

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:671

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:671

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:671

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:672

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:672

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:673

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:674

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:674

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:675

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:676

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:676

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:677

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:678

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:678

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:678

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:679

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:679

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:679

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:680

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:680

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:680

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:681

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:681

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:681

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:682

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:682

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:682

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:683

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:683

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:683

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:684

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:684

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:684

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:685

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:685

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:685

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:686

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:686

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:686

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:687

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:688

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:688

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:689

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:690

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:690

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:690

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:699

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:699

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:700

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:701

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:701

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:701

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:702

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:702

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:703

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:703

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Hide Artifacts

T1564

Resource Forking

T1564.009

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
bc3408dc60e95f1a86881551e63baf6a

SHA1
6d271891e4a69cf7d19ee90966bd536c4732bc15

SHA256
9ffa385b80a3355e6575710b6894d6b4d901393934122d937da72e93a35cd0ac

SHA512
c022d05e1aadc85ac5c3a0dcda8c566f2e27743c5dec0b77e3d4961fb5dee693b602176c5925bd78404fd63f7cdedf5c8ca26c6877126d0a1ac00c516715c4a8

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
9ee4ae9a7560699c46b18b6b08853b00

SHA1
4601d5418fbbe65cda0a7ee49107b8e70312c2cb

SHA256
67e256c304595e745c208364eb2fc50071a76f90d4de05d9eff58541ed3c8788

SHA512
879d43d01f4c22c078251a2c8c96684ccaa938bcc85d829d7766b33714cfea1b66422ee13cbcd26b64b0fb067b31a22abc54dee1010afe8fdc81956299189173

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
e1921873635d004dab3b429cdc3458fd

SHA1
754689dbae7a2e7ecf8b6ea80afadd6748147146

SHA256
671dde728069b021bff7fe8d1c12aed939bea7ff6e903469dec10c2bc4e97bde

SHA512
1b4ca4a6396f115d6701604fea7ef9322826f742f94ddfbde9c95392fd413df1ddbafa73e86d188d86512422e92c619a9d9004f5f2340df75f00ede89b616a04

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
158B

MD5
d85f4212034b628e63ec78b72fba6ba1

SHA1
5eaaba6012fc0a4a222a511439dba47ff1c3db43

SHA256
18c6bbe9d185dd4cbd3b170ca0056b806cfec725e3673e6160911f61e1dfca4c

SHA512
d507f74c2eb5d5eb55c356262d122f46285aa93d2e570a46d7a4cddc2833981a1dffc492e1ba21ed7defe7134a1dac85c7a7f911bc580a1581501b0697b04b7b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
9a4a92cfbc952b7c2a46aada4da83668

SHA1
8f3abebea2c1e98321a8a9b3a3b80313f877f8b7

SHA256
b2d9e19ab870673a8c86a148332ef7a4c84d4a2db9c43403464c5e8eeba56163

SHA512
866e5053357e006a4824278c5a8220576a677437628b7071d831e7f5634d6f53b7b338ea3587c2c9cab230b0dba7be03e3f900520f76f21f727582ed259f7f1f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
d5f435002fb49c121c65e513f4963004

SHA1
334a83112b37b787f4f293e724aa197730a4db65

SHA256
eb8fd61fb6bb609b354ae43e32764bb43e801b43643ca40a589600cea88d23cd

SHA512
23849c579dca39aed59ed58fa7f6f959cbc0e13b9225fffd0c3171c4a24822d25539709a747b469a9de9017ae32897839877f6889520908c0109ea43231bf065

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
9d446de54d1be3a1db2da832d0857b8d

SHA1
e30833765e6e9d2aba4eaa48820b00f4a995f483

SHA256
91a646b59cca006d1a2d9ce3c0c7f88e2426ce573fad2a6cc0d8ba062b9ab39c

SHA512
2971b206df4209784c199793a9d782e9bc92af19626943a028a16562577a79173d03cd3309058b9f7c22a3f520b5b79e0340dac0f209040455477084e25cb6e4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
ecda53b032a7c891fc94ca4b8748e98d

SHA1
82db9da9a6352a16a689b9d6632392a74440c450

SHA256
3db659ad40737104c073f96ae4d63a775f9aa6db5aefad4116e06e80a6047135

SHA512
3e28f23439c4c793b09643040ae394c04422a1be710e16546ba5a807ee1cae3344cab331ae9c9713f8c59b5be2ee94afa55416d93838a710477440ca1c8b5735

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
234121e22477559ce02b73cd23b69342

SHA1
fe78516eda013764ca57e5d2ff67ce524c4204fc

SHA256
77e9103d44254b6c6f21e81f41b4bccd5092bb94622f568c2ba70f6ff3e1d834

SHA512
d0ca214d27c63680dc46b027e2a3ac64e91107631fa0ecc9defe044ca8b386356e54cfcdf82edc1c217fc0661035b012354f8437129271f2b237d29b6ecca488

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
158B

MD5
171de779b144a366604bab66e22e9744

SHA1
7bdd95e913220f97dd72da458000f60efff2c8e3

SHA256
ae34efc16a22f997c1942dbcba82ccffad9da34f6c17064cf17f700e0b546f2c

SHA512
a087ba2fe7adfaf6a09c28e46850b8044efecff828d4a1742e8f8b03a1bf3515991caf5ffd605774ada16c3550719cf255981d286c733a31ea8b21c87184dff6

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
27aef45bbf1ecc455235170d8d108fde

SHA1
1bbfa0668ffc95b5e7e203f17e6b1588d7f5e5c0

SHA256
4993d24b6ec3e160acad46d882bd150668142fb16b85e23b3afb372e0c932e57

SHA512
06bfd465b09081b32c17b46e1fa9d36be5684cb852cb570a4b8480143ff55f753f4f4681cac35229a5604fc00e99ba32bf925a33d99b0d4a29e2770c9b5c2457

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
764fd6a1150520e4c6be184aa414621e

SHA1
5f35ab4ca2e59416f0897103d0858268b791bff7

SHA256
38bbfc04906fcf49e24b09e1b0e343bf17f4d1b8ffd5ea6b03e2ee6548b44df3

SHA512
2206040445230e4932353eab0966935859827554159356efdbb7070dc5189f5ea40c6234b47bb6d8dcc54dea5971ba273ef13243e8b639ebfe244ca39262ab12

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
47f4d45eb4dc487bd9bab2f01d77a5af

SHA1
c7a7098d3ef07993f4f3d18083f456c1a9b06925

SHA256
c81f64e80ad970013aae242f91184521da6695889b368ecfd1c6830998d3c7b3

SHA512
c4f8f69af931836a04284b1b80f21e328bdc155faf22804a66a2a4e81e4170062d17668bc783059b3cd514ddd72ad2d91298d3ee181de6c722c543b400c4625c

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
52099311ebfeb05a879afd2ab271cb47

SHA1
d72a088052719068867af3b5c4227b5e76708297

SHA256
06c35827d1ab1f3d40e06e9798faeab225b543538f74790c0fe35ac72310a6f6

SHA512
730db0aab0c143b39b6f957e2eafd1bf2a561e1f310db4f3eb1501e5f7f9b1fa899a02777596a2df9658ddd22a38098fc396b7dbf84535e4358d947b7f67eab8

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
e6ed937f713b3c892332d696b5a7c272

SHA1
03c737da053297d1cc0c0f09b960cde6f869a60c

SHA256
7d64a2db1331493715beebd04f0f618a01734607ecc403a1b6b5f5eaee3728c7

SHA512
5906665c811a0d90bdac687ae89886804741dbab934681c80d2f708a5ebe80b006ef6c0004db1f893062c14103f0b8c777b96866a509baf069ce20ac03cfcb12

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
234181b0b98087393007f667ae6500f9

SHA1
593e5473cdec23d306ae7d5ac554336b99d2228a

SHA256
dabeb12e30609ee3a2fed49f88c7604b2daad30544f5339e168b52159c1acda9

SHA512
fa1ac15677152ab3f4d6153dc96bbd6152fbf2599205629e402b20645a094debd5219196931369b897c141270aee9ccb4d732a024e962dc0823ade7da1ea1f87

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
519463854a05520ac2db9d94b0f17ac6

SHA1
e027e73522c2386a4bf08f9e6c6676ed41954fee

SHA256
a34e51d9b1d42f4b0f8a9acef18f90ac73af84cc901f45c90d391e7c6b3f7c2a

SHA512
a3de599b62cc443d0946784997060f2a1137bbb6b2b7163f7c483463b3ed6f377190ff0eaaf179b68907221c4976c88639cca74de16dd431ef67b4a773cdaa6e

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
2e275ce0c16c93df73438cbf7b62ffb0

SHA1
e83303dcdf4713b3734c94a0ebea4ad0ea9358d8

SHA256
8f5ef47150dc6778723b9c7b0bc70e1e2906d7c170b23662e032172ca4b058df

SHA512
a82f7aed8c419596a988b471ee3fc2716f7712fec95e16c5064df53f7380b597c8983d18da365556b5046fb012d38948706f4a843f954bfee3e11c77c8b2c169

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
798ceda709c8fde1f3b586e2fdd57232

SHA1
0174241fe73767c13c0c194a14d065e40e926615

SHA256
c94fbbb2d20eac0c75ca33fefd40732e053605d92c1d2c151a9b888f2f4c5130

SHA512
1202e39df7ec7172696e8b255f98bc59c11c14044e1739f02fed2819cfbdb7d5d0c2ad01d3ac2ce6acfdc787de3035cdf05d6becc7fa0f9473165b844770e7f3

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
8cf0c92dd9b6273d7f52dcb0a114733e

SHA1
efde2b7f5e243f081ee13179b26d4b477c01afa1

SHA256
2be97a75df28b886351e83a35c52b6db368f7c5b71114227754f29f3d9b4b7e4

SHA512
0d3ad443766cf5931f2b9608dd09fb43814a162f0c7a93effc4ff1f3e0827ec6bc09b70710188e12e916a2f2e343945a2e710ce26a502733d9912f2c598d4ffd

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-29-232211_tests-iMac.crash
Filesize
40KB

MD5
6d7ef286bbb2891892c8b0ee51169cb2

SHA1
73b499a0b0e6080a38138031cbe0afb8e52ce74e

SHA256
50c0218ddd891742e563546885338887dcb042a1d3d8e20ae6367c02dd708784

SHA512
92bc9a40a6a6be2bc0efe180dcb10a6008e5aff9bd616540316623d1f58b58a8b5056094341d1fd507a6936809a5d7efcf3c98657ed752eadfb1fbd51e476679

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-29-232248_tests-iMac.crash
Filesize
40KB

MD5
94d753522966dc435d3296b31a6e0d7a

SHA1
c2ac8101ad318178cf8d0f6fe1eb68ea3a193118

SHA256
f5eec7277920fd247998db7d98c6e7201223b6efbd5009351415ac2c50fe616c

SHA512
530cd237fae7b0d2e54e91115db73de6d793cf9d25bba807f01ca8a64308e1ca297b7c5afdf1227b679060bfcdd922716fe3fc37f27ff8141e0012fb87dcc607

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
439B

MD5
c05b619361d2cac0288befbdef519546

SHA1
634e507971e2bd2697df0cdbbe8772e6fbec276e

SHA256
1b2c817978649cad70d67be41215a663790d97707b7512cfc156b488438cbec8

SHA512
86308ab30375670ff5eb886d50e3b5be5f3b7d60e0de53458e0372c0c67cbfd1c58450acb201c7d21a5f351c2b0e796d1777dbaa1e2b83ef7f69a83dac26ba20

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
487B

MD5
e251c94fc14a772dbd695b0919d4f53a

SHA1
63c2eaa2aae3f097a6ad8952064d4764fe8295e0

SHA256
2e8a5e8288abdb773269792173899a3261c3a04c2a4d07c119988542d1978b49

SHA512
92222001d9e6f4bebf5abfc02f4a0b379b33c4f7dc4e9b27170e8b2d43f7c7e017632f893619d04f01eeaa48cfd79f77c7b910cc47d74d5b81f69ea83bd69a5d

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
42B

MD5
ce7f5b3d4bfc7b4b0da6a06dccc515f2

SHA1
ce657a52a052a3aaf534ecfbf7cbdde4ee334c10

SHA256
9261ecceda608ef174256e5fdc774c1e6e3dcf533409c1bc393d490d01c713f1

SHA512
db9de6afa0e14c347aa0988a985b8a453ef133a2413c03bae0fab48bda34d4f9a488db104837a386bb65c393e8f11b1ed4856b211c1c186423649c147d6aabfb

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
81B

MD5
520bb9b65b89f03050030e5a985b9cd1

SHA1
91defba6d4540d4c8ede177730d104d747e8f57b

SHA256
6bb23965fd46b9ffe67a1cdb2144943543894e063c05db3a4de54e94b84968a0

SHA512
81eebb3eda761a9ecc94aa9564deab4d476522d94025ec19e002e91b12b7fbf2bffda23e7c393c09cb91b6ecd953ec1bf39ef5f787058b70289a5a5d777f0cf6

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist
Filesize
122B

MD5
16a15c7222b5f487f9e47219bec96c9e

SHA1
47bb4748ff46c6365fb2bf5b22ca60387b4f42bb

SHA256
9ae1d6f1888fc41b8d9c6315df10394ef187eb1f57ac0abe48c5606b3277463c

SHA512
41595eb4b33c09cf1d087977c2a49c14a2894083a4d73dc88a0c9532e6c6b546f872c7cec14a16f674ebd0137c04e690124b777e197677cb964eb9336745d919

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
74c085c45cf59daffabcc508654a2ed0

SHA1
55d61520e42e4efd983381d7ceeb3f5e376af32b

SHA256
7edef6a88011667e0f6cdac695cb42800d2e8d9a09a9e956a9aeda1929457122

SHA512
090226d92401a9bb2c7eb33d1264387e9466af8a67b8f8c2dbb36c9cae80dabb88b5d8aac5bd32e926d3a2444a592f097882c3d5451a174ea9fda4f94cf227dd

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
02fede4d83c3bcbfff9476c3a541ca88

SHA1
b7aeaadf816fc1d776c7dff40c5625182bea6413

SHA256
8677d0dc96cfd63de12623863dcfd405f797020b32be551e19bf3f095a9eacf1

SHA512
1a0963e529cb7b37e433ef655503926fa72a97a75c459d02d3b8f9fd334629866e14e30edcaf2965e09ab78afc9f7733aaa65d83e168318647e857674fb760ab

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
82128744f5569ee5081b8ed285cc5f1e

SHA1
46d8633c7a63b62cda0b292f1de2a1821a9b013c

SHA256
6b3fc7730253a58bd27ff707c288bf0dffa1f716b0138177cc604513b7f21ff9

SHA512
6a4b667cf12c213ede4150297c25294ebf2f08a22a0579749da34adc81a47071ba724f86ac5c88ed4821c819241ca10f49f7f63e66ebbc4664bf25b00251e49d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
c6486ca1b919436a4da339efdbf70bfa

SHA1
6f57b5fa969cb05c7513cbcff41bf2caa7b5dc87

SHA256
8d246d83f34c58591aa8588874dd664026cb4b7db6899bbecd1ab0bd7e59c737

SHA512
f3f1534c86e1bda1233597339018bbb93e2dbcb79f9229626ba7030c4a299126f008ffc1467c1ab311710708fbf384d1efe4f7ad43b42529c478453add5b679c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
b065e942681a3d9ccda86af931730470

SHA1
f31d80eee66da5b95e09ee88fadf648251f7c464

SHA256
87df6743eeb70f1e2659e5dd2209e880dfc21f3ed8a432b033e767cbe20da23b

SHA512
e99c4e50f60c1aeeb901fe62c96ed95322248bbf934e3892cc3b0c1afc2c8f944802aa1e073d0b5e1ebdea11738168cd90ae928cdaedf56f8467c5c93784cfc2

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
bad58fed7685315b081c662c16764846

SHA1
16a60a386a2bf7234536d603300fc2d966ca6889

SHA256
2c35a8c66ab536731e7cfd38ea10c9225869f87c03f4137df7f78e5f32d08088

SHA512
2531cf81be53cb3c8d47f2fde4b6973462ed509784736bf7e59d69c1a190d5c2409692a96cefb4efadd182d7a0d3e85005040ab6650aa79a3b6440db238edc61

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
41be274c3fc1dc98079b8972f245bba6

SHA1
c76680f5f59eaa35dd539049b885b7df16f307c4

SHA256
f1c3eee07ef4ae9874f4abd7946576eff16c2b5c6f8171a139177a1bbb7ee3fb

SHA512
3ae274503f9f01fab5771864f200f3841671cc7b9a8e8abdd6e08e4e3680e7a3360da191c8f5e0de66b1f9664584e3dd8c9d2d9943a99b99f2d9087c15cf807f

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
91ff4fcec327a470c22d6d97428957ed

SHA1
39ac0c8265f76e6022c98c2a8e0b8d0543af8d50

SHA256
6d3e5b93ef71bab00a67ef28b5ed08352ef5c06009ad73b06513366e77de739f

SHA512
2181477816944b36a16f975a9de9d857543945b681f849d7934133d36d78bb0873264fda28480e5839fded6f54d572e2778b64bd52c5d956b8243f7d202bd372

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
177f586353c32ee3acfc24685d78533b

SHA1
8e438980f9199e24ec07131ba9db8c5f43ef4c4a

SHA256
293d8d0287b90ed6e8d9d06ee0dfb989f8044b881bbdb37a090b794f8bda920d

SHA512
119a91d290c3d200884b3d10648172fa8fdcecbbd79f507589d56153a5c555decfe78fee25bb08d9802c61492e578fbded9d3b0725cff142fd73a654f8c5deb3

Download Submit
/Users/run/2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest
Filesize
190KB

MD5
7667b9e49ad314d89a576c550dd3b2b8

SHA1
21ab0767dc5a692df034613fda3971cd9c713885

SHA256
d0a437a173d805cacef2b2ddb88248682fb45cb8fea6f222f10e118f3bc4beb6

SHA512
cc88979b74b61b6b4347726ad5d2bbff3139d87ce173bd458b008d22b130977c666d1c223f0028cd91fc64cdc62b3608e50181526b6f48e088d1d5ca7d084fc1

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Filesize
124KB

MD5
e8b4d979d66c27f246fc44754d538658

SHA1
aa35190335c618b506e0373f93459b039a5d1ec5

SHA256
45d53243e70991d9bb16c98602e3fe3c95f0b094eba171f2041d8e7fa5012ea7

SHA512
0cea5869df59d1a3c9cb3aa63d1d0f5ab7e0506cf6c758563644030ad80357b52c7ad07e2000238ed208d0a3c547cb7c170b65b1406f5543b4447b789380fd21

Download Submit
/Users/run/Library/Logs/DiagnosticReports/2024-03-29_f495b998d1e8f03b4d4354cd213f0e0a_adload_evilquest_2024-03-29-232153_tests-iMac.crash
Filesize
4KB

MD5
416274eeb874eafdac573a297e5e26c4

SHA1
08a3dc14f451dd9a7b52cdbf8d4ca1b89ddd457e

SHA256
7681e5eae95cba9afcbb058a1cd13b464579045489c7a01dbefe38eee3ae4dc8

SHA512
1ccf73e068a268d043880690e150529f616e83817f06325746b55b24ce6b6fe371cfeb0e0a9378cf86b37c7c1e7875452c8ddb76c706de75fea192abff0dbe68

Download Submit
/var/db/locationd/Library/Caches/GeoServices/Resources/altitude-1249.xml
Filesize
160KB

MD5
c0b8e6fb70a16991ed49a487448cd106

SHA1
71f21321168dc466e7f64eb2c2516cecb1a931c3

SHA256
9320e397ccc5577acc65da1f4cbafea31c1d802014ec4b4459c628b449414fdc

SHA512
ae0c5fb1b29d7f80511a846f8c3db54d018aba7b9314792e63d6844ded948610aed6aeac4388dfbfd8530dbaaeae4cf479c10f52746bab866509d71217111ba1

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/C//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit
/var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
Filesize
429B

MD5
b29145cf94cd1ef0d81552c333c3603a

SHA1
4095a7b7b982b8875a6256919b7d80c50b0a2799

SHA256
2cac13ffabc18f7010fffce9f31aaacc06e0c5ae898c3faa79d747567ce1e2fc

SHA512
fd0ccb56cb0c5084950ad4d04363ae9919a0bfa76c45554df8a7fe0eb0f8a7ed2525af3b4f64982eedac0f9aaec28b7985b4ce5ec80434fc3cf426cb96b1def0

Download Submit