evilquest | a39f80c93b646d9e94ad659142475ff307a4509e6f9d0d67441d188c58c4b14b

Analysis

max time kernel
150s
max time network
144s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
31-03-2024 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-31_204151930f024dbf555c643c639c4f64_adload_evilquest
Size

389KB
MD5

204151930f024dbf555c643c639c4f64
SHA1

f69c7d28132deb9b471d6dddb5f1591e8da0a2d6
SHA256

a39f80c93b646d9e94ad659142475ff307a4509e6f9d0d67441d188c58c4b14b
SHA512

318794bb4c8cff70ab608e8bfd8ab2131d2d83d7bb9cc2b9923b3c2f57197e3c922ff56e8a418717c18649b55d7ac6e2a0686bcc3414ba94aa7fbf18992ef63e
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY9BnjCIQwa6QXbYRPuCnfL08Y/ok5XM7mM6QS7MkBh:5LOQdaDxq8cqavHYjWIDaJXcl/nfg801

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

Processes:

resource	yara_rule
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest
/Library/osxmobiledata/com.apple.afsvcpd	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 53 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	process
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:571

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:571

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-31_204151930f024dbf555c643c639c4f64_adload_evilquest\""
1⤵
PID:572

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-03-31_204151930f024dbf555c643c639c4f64_adload_evilquest\""
1⤵
PID:572

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-03-31_204151930f024dbf555c643c639c4f64_adload_evilquest
1⤵
PID:572

/bin/zsh
/bin/zsh -c /Users/run/2024-03-31_204151930f024dbf555c643c639c4f64_adload_evilquest
2⤵
PID:573

/Users/run/2024-03-31_204151930f024dbf555c643c639c4f64_adload_evilquest
/Users/run/2024-03-31_204151930f024dbf555c643c639c4f64_adload_evilquest
2⤵
PID:573

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:577

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:577

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:597

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:597

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:598

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:598

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:599

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:599

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:605

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:601

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:602

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:603

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:603

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:603

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2481EFE7/OneDrive.app
1⤵
PID:604

/bin/sh
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:607

/bin/bash
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:607

/usr/bin/osascript
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
1⤵
PID:607

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:608

/bin/sh
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:609

/bin/bash
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:609

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd
1⤵
PID:609

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd
2⤵
PID:610

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:611

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:613

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:614

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:614

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:615

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:615

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:615

/bin/sh
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:617

/bin/bash
/bin/sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:617

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:618

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:618

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:621

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:621

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:622

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:624

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:624

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:624

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:630

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:630

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:630

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:631

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:631

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:631

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:632

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:632

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:632

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:633

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:633

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:633

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:634

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:634

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:634

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:636

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:636

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:636

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:637

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:637

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:637

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:639

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:639

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:640

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:640

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:641

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:642

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:642

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:644

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:647

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:647

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:650

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:651

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:651

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:653

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:653

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:656

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:658

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:658

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:665

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:670

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:671

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:671

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:672

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:673

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:673

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:675

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:675

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:676

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:676

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:677

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:677

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:677

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:678

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:678

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:678

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:679

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:679

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:679

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:680

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:680

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:680

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:681

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:681

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:681

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:682

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:682

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:682

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:683

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:683

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:683

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:684

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:684

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:684

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:685

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:685

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:686

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:686

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:687

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:690

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:690

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:690

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:691

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:691

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:692

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:692

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:692

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:693

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:693

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:693

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:694

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:694

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:694

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:695

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:695

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:696

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:699

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:699

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:699

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:700

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:700

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:701

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:702

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:702

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:702

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:703

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:703

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:703

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:704

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:704

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:704

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:705

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:705

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:705

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:706

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:706

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:706

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:707

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:707

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:708

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:709

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:709

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:709

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:710

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:713

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:713

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:714

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:715

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:715

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:715

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:716

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:716

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:716

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:717

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:717

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:717

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:718

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:718

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:718

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:719

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:719

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:719

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:720

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:720

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:721

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:721

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:722

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:723

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:723

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:723

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:724

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:724

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:725

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:726

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:726

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:726

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:727

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:727

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:727

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:728

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:728

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:728

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:729

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:729

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:729

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:730

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:730

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:730

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:731

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:731

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:731

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:732

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:732

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:732

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:733

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:733

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:733

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:734

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:734

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:734

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:735

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:735

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:736

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:737

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:737

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:737

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:738

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:738

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:738

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:739

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:739

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:739

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:740

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:740

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:740

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:741

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:741

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:741

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:747

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:747

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:748

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:752

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:752

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:752

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:753

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:754

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:754

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:755

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:756

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:756

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:756

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:757

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:758

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:758

/Library/osxmobiledata/com.apple.afsvcpd
/Library/osxmobiledata/com.apple.afsvcpd --silent
2⤵
PID:759

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
ae0474880782b132fcb5420d3e9b5e6f

SHA1
3819c085bd83ca6701b415baebe960bc4b099f13

SHA256
3524a912bb794f2a9f07c5cebd28d6a9a747e1592fc8f4551efd6a8a574a2479

SHA512
7e0be60a5fa73a0d60ea3e71eb537f0481967a8f90a2a18314568900b75eee9def059a9277583901b506b671962593a6aa7d8f8b7efad2aa9cdb7574746a803e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
158B

MD5
c71449125bcc18d0fabb10723eefc532

SHA1
dc3dde9cb49c111428e94a33e62531e667407486

SHA256
b784d8640f60e97f42d3a975381f8cc7c8bbb817a83cfb357e253324a6eb515d

SHA512
26d9b997dabd5d41a1a05d82305b6d2bc344e601798ea5b916385d7c59bd2934109c90703516408c986a49aa52e35d150610a9174870e94b2240704e856bfa8c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
57fe9f2ca47df1912fb8f93eb25f7740

SHA1
5c1b014400196f3a2b537b62744da989577f5762

SHA256
758b50f07eb6dda2fbc512295618e1581bbe00046bd080a91393d2eafe968582

SHA512
7cfe67e7834af087eb473ee1926507e846047dad92913221cacf73685242a34b5cb64964dfef208a2072ba85e563013ca6ea050d0fb650e60bd77965b4c58c2c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
690f1e340c126e8538b576fc60a8367c

SHA1
387bfb62cd2088fef091227cab7b3bc13d2e2bc5

SHA256
2a9fb3f233dd92ccd8080f0c71a0eddcc32d346f6b158def898a47932b0cc709

SHA512
de603663d3d494a9106fefaa3a889f02cf7c4357c55248da165eb16d8a17b62d780dba0d281a95d77306bab5bd0030a015fab0d39db76e7b775f4ed0877f9422

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
106d47402715980399bd6517a9d5d483

SHA1
c616f9fcd7b91dde268d0957f7d373e60740476a

SHA256
f2811f59d211a529f1c5c10ff76e3b709d214bc37259cc8eeef8f1590729de53

SHA512
e9c375e8dd41a511d609a3a668db2b7390849781c45df8ba5f830a513ad17359bf403230eb10e356720ed4d2c517ffa2683f6d0514fee8f639092df6c911c51d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
629853ef709423f5a43795328eecbe34

SHA1
20e9805a3a2aa980bd70256ab92f69da6b55a45e

SHA256
3aac7974b3be611f3048d81659c9508b1c1ee057a3fe08d6ea90e63920ae02c7

SHA512
a52967a9647348a01d1b19faa605c97748e2f469de8c4075f01ae1996fedf196874ac754728a707562427c7fd15e43206aa3fa342657559751997134e558c0ad

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
e455268fe6c479f75e7218ef26c013df

SHA1
9ad8983fa95ebfc4ffc9dba55fdbccdf23489f7c

SHA256
08b9e32c38be2af87ae2e80d15a297e809d5ac41b8e0b238ee36d1160de1043e

SHA512
5e2cbdbec47c28652f9f0ef53984e5cb706a4b296076617984559ae11c45eea827c8b38b06e220f9d749de9c4d996a096c26adb2be4e389902bf442964b4b309

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
aa0283e245d5319927c2456a08f5dcb1

SHA1
14356f36510a82f3aa8d7ae0cbe307b351434d3e

SHA256
433e8fd2f313e1875ce1c21662efcdf956fe81f0450484e63e686cef5284a23c

SHA512
2dc337cf9eb66f597f2295f7ead58bb505d7956d1e250e8e5dafa07d58132fef6ca846b605b713a77e46ee27dd8b3a135242f2d120a976aa1ed26d16c74190c7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
af58c58d39f233ab0577cf318ea62bc2

SHA1
c0c9eb59a0bfa4267458e0d403098c5a76c69f66

SHA256
e83f50d9286b361f563db765dd899924e3afa016811e7927028d10efd873ef49

SHA512
1f8e5b794bafef840c89b3f22165e1f0242f5aed70309f0455581b13b642b25a151ecec6a5fd37050d9a62be018d460528d9ba46b3f7acd7f792e5de977995c4

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
76a6bf3bc93e49c787baffde49eb7306

SHA1
2de58adc0e5046d39484c0010d5e83bf3f90019b

SHA256
a42dd70992749836e291eb099080bb1e6b2a7dc615e99928b739c51ab7f261cc

SHA512
d188f223c2868b514bd8c025875fce109eb41e99d6b8877665895544dc115e2bfc7c82bc5289bc83ebd4d7ea433c55aaf3a95234bad45dd5be8bf726ff8539ff

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
f67c010ffb9cffa1864380ee0fc5fcc2

SHA1
d2674f06bf5ebbef384ab2e6387325e421324260

SHA256
dc7a396e5207c035039662f66be01fc3335274eb2c9601a75598e39a87b12b93

SHA512
35b7df5bd29aedaa6fc5e893da6f5bed8db0afc02a3349ee63468a682602f5507628114b90e39d0f84761fb27c9b0e5dfd148c45b2880e94e51b4cb0ca2ec5e9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
22bc6fd5ed623ad8f996f47c47c70b8f

SHA1
5e13d0d8258282f93c3e767d476699ab49894b02

SHA256
d7f092997183a5643de8fe93e6bfbfb98b3741ad9160a9dd3cc728e87c79b719

SHA512
5a994bc02baf7bcacf6f9f8bf3a41b88cc6adc5ccffb2f0389a66d4a3a4a944411f705712d16363d1e210a1ba07cca7758915896b3336a1137cb32c70ba0154a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
70945288c2b3e7ec2064013de48fc962

SHA1
86b1e4930b62abdd2fed40eb0fa8652e7392f4fc

SHA256
cba1f6b4a0f601d7f8ffd509679b3c40a261702e556a733e682303f63dbb0ef2

SHA512
725a3c6022f2ea9576890abab2c3be4427438a39b14f6b4e138f5f744146fb69b12fe9fa1f204eb50f47746d92aa3691f04bc69070b65b1c62e11d025bd32eef

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
ebe436e9f64a062e50f17ce645c19ace

SHA1
2f1fc35eab5dde06258a9e00537b9edb6821118d

SHA256
0a729f0c6f4d3736548a7db2da2b0fd4fb2b4d2634a27c41cce34c2dc379ad51

SHA512
a21a0bdfeb4adb09d7d9b6d6f6429d20a6859ae63bbc4d03961a8ad430c534cdda985eae1e859c78bf61860f70e9f09dfa5efa05fb61fccfddb4af059662e2e7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
156B

MD5
ac577c70222216202a8cde93d2a86782

SHA1
3a8c4437a50aea9df6b2b1958c5d5e6d0fd007d7

SHA256
e71db021da59e36705d83bfcf874e6c9d3527b61da0b3ee00f6d3f0f8124ec96

SHA512
b7794a6b6ac1bc92043bf8aa8f47f5ba7efa26d074415a1cfbdc461d023ba2fed92522e186a6a7eac3d564d7b5559cd3b85525b62ff79b5c07a163f6abee4c07

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
cfa137089ebe06527f4ce733622ef02c

SHA1
350c2f3ecef4264e50447c555245a4c2b8c053be

SHA256
6838895a425c54bf36b68fa1ca6a172dbd7ae88076822dcc21e62e293e02fc61

SHA512
9ecef8b83937fdfb71ea796ede93ddb75c42765de581edf11d88d501fab9e8fcc2b35bcf2b007c2a37af87e2b26b88a300ac18ea402940b70ecef1bc3c5ecfe2

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
5b1088debe57241897831da759dd2c17

SHA1
d25c3f993162eeea4c34ee3eefb1a5acca653604

SHA256
4bc99da490d032379341a3ebb7757c6109a6990cf8ba0e5aa8b74bfc61176680

SHA512
dc762cbbb0b42ac2b9bf24fe3a66f621cdb4e1701e8faa727be4d08324d970f8df2a7d68db94d8ed2d9aafea01e0388bbefe0a76a3b899c358e9172311d900bf

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
090471b8f55317db407d437a381e02ea

SHA1
137d9774da383bfc990909207cbb9949275eabef

SHA256
996fdf49ac7c9c99c47685c429776f9d7903d72c0832f7faf64384e26208fb4d

SHA512
c5efc78182a47cfa8b9adf0ae6b48f9f6c40a345d29fe6b12bc2f77ac3d7fbf20a31ed1e1c72e9acf23a8e5bd9f9fa1dda7bae82c1a7596923f9774fd2eac4ec

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
145B

MD5
d6a31bcfed3553e76c86c0c05de40aa4

SHA1
a3bad0f112e0dcaaa3cad6e1f74ecc85f1d20408

SHA256
e977659553eef6bf0d3edec55ff20ee067bb8d16587165604f40f5d2a78158c9

SHA512
e9c9b0f5e74f3b3fc7d104178deb991fd59a14e9c51aa48061b66724b16180bedaab1baad6c7e2502e90f8ffbf82dbf5f4c6c225a23f6d1ff2b066ca3828860d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
9dfaeea619bb602bd7482fdd396f9f41

SHA1
16b1fefa1b3f6b08ed7a3a1a7ec62f3436b3968f

SHA256
32bf6628e3b15e6b6ac6b417f247c51790a326aab04a20c1b23cb2c2144dac78

SHA512
15555be8efbf778af76d7ae01f99a420f3d76ec0a9911e6e0f3d168c7e8247fa0c48bc366beb04d541996ef544eb367b5f48cad696d8b9577baa9cd708c6b074

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
d66a59f3032ecea8869a8b5d56d10c17

SHA1
f58478354a24ee36060d2d821e819999b4492006

SHA256
b28abdd59429e15bfc2fa5673746a07b3865a594812e8518d70c307fdce1410a

SHA512
ce98a95e70ef79925882c4b8fd5f4331a7e07cb85935be34c5bfb9f4bb60ada03d6debb4a57b080c00dae68e045894eb261ad6aa944534eca32bd7680b64987c

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
750ac7173f55080455b08702be5f4f37

SHA1
e6ad733afc98d63164770a991b81b3cfe2813a1f

SHA256
169b5ca3ebba24db0ad92b2beabb7c75a0afacac1f70f99b0ddf4db5e6e0953d

SHA512
a81e67db20f36a6f849deb3d824efb1c226c7ecacceca58086eec66fe7aabeafe3d284a5d3155b63566d9e20eee142e3e2bf4aa0224d3d10318309008447157d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
ba94e1d224af2c73e7e2ca608e0db1aa

SHA1
e327e471ba60dbba58d55e776c80f09764e24e19

SHA256
641d39f0d430f735473ef12273b05da338afb4289385ad0b2247d40890acf9dd

SHA512
ef67857ddca302cc199eb9088e39fc9697080e99ef34ba22fc4630e4a6b362f96270398643c6f6b8e8f693df2b7082a9e50162258ead03227acb391b48ca81a8

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
52931062b6215e551efa930b012ffd51

SHA1
49c482cdf651575c19f4757b5cd404272573770c

SHA256
901c53ee25d8988f4e1ce0c6d1348174f4638206e15597f6e191a7132711e9cf

SHA512
57c1bc7039c21be19e3059d0c2a23b4f42d95ee0a9c39894d4d5993e121a7e37d72179891b4a1418b1f9a4e8ea0059919b8a6dd827b24beab0c9793d14f1c73e

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
37340c26f13532191ee9b7cef72b1517

SHA1
9ac1071dc1617b57fa31721ae69b078c5bf5e49e

SHA256
c4d787719511a1d19c93c2b3e3bce724772ee4ae6fd6e968381d1925ccaf426a

SHA512
e59afff6137418b8526bf2e6c343698bc69067a137877264e6defc369fb9f70c4c373c915ced8e71ec71646060ffddb8ec6430db22cef2b2e9bb08b74697bec5

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
8cd18f0268f215c17c74ed7b48e55deb

SHA1
135065af03d7a27f1100606e7e703ecc8c4a2689

SHA256
0531612243dfe6e7a0d683bb61b336d58418e5076efacc025ce2a52d34d774ef

SHA512
8acb796f8f175e7a238e78846b9eb3e789d7bbc4496ae34e7c6d047da17794a9904ed7bb14af0e2720f4be91ecdf7489566578352ed5186ddf6a74004bba808f

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
a1b035cc27310aa8f0de25e1d286ba77

SHA1
2bd99d5ce8602ec8832166b1b05683e1486b85a1

SHA256
8d8c48e181040985350c803e0c23468ec6eca7765a4f66c3ddc462517234187c

SHA512
8b680aa341290f8c1d7984a1bc21493e636f05097600a755634f498055b96aad0b431203efe62de403c8113fac782735b823d17307279a06bbff48aa8bec1c87

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
ed9e4a808034cc8c0db04dbcde1341a7

SHA1
6c75a2f4b044fc7e09bb73a1ed9de55e431bf9c0

SHA256
bec260e9c8e89a4cce195bc3a4315789008e18b7489ac7df52f76b548461fdec

SHA512
c6a0982825ed8c0abed2b82f382d7913d72c148a621def6d0e3ac767a3e150e26a2b70fe845eb9420a84cae9fad8ce0d36ae2f94016afd8270bd5cf15ad3de24

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist
Filesize
143B

MD5
707f0a20f9b9f689b1218b5b29f5ba90

SHA1
95e351959d274e5a09fd289f0b4b7e64146639ea

SHA256
145fc21493f406fbfdcf3d01463b80e463781853d7756a9d25a5f1794119e284

SHA512
3f720b5b4bf8d077ac449baf7e42db62d24f0472267730be58521066f1be4443615ca116fa5f395742801dac4aafbab99bb8e553e926d2cabc8309ad9a515414

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-03-31-113210_tests-iMac.crash
Filesize
8KB

MD5
44050af4f407a74c9e9c9596944b8f3d

SHA1
9d8e80df993638c0aed5a4ca56e9db81b2d8cc5e

SHA256
080de5b8c4cff94f06ec50362cc2efe7f760616b072e8cbf5b76fd80f7395ae4

SHA512
464af83a5ee1ba351f62c97a1e8570215b7cc4745594f7e5b5728d8c00a3e7d5d8060a55364075721f6cf927287a11f149c815ba45f6eb79628eee5a950c6b4c

Download Submit
/Library/Logs/DiagnosticReports/sudo_2024-03-31-113210_tests-iMac.crash
Filesize
47KB

MD5
a00fc00e9febc5d4ba27ed25cf211296

SHA1
002ef530b15e8b6d67328fd7390c816a99edde75

SHA256
6fe33b7e974f59349cb271225338edab2986b363b7cbe2ed3ff20f7de4ad6592

SHA512
40d54106f45c3204d21a0f46c1232c8782e16088bbce903d81f41ed3f42df842e31469535f48f3f61553e52b37d20c328a06c8d9372704314b06d03dce075ff6

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
535e8fed20a0374f4e46870cdd7bc63a

SHA1
794caffe98653f3dce53b95688a0e83f4bec0c62

SHA256
245bab45c7ed2a09bbd2144c653663ebc2c1d38a1cbccdc22d2e3aca357d36d0

SHA512
a4456d514397994ffd3043004b35a84f7af10a4cd6d043d56e6a644549409cc58a0f32b424dc2ec104b543c6e844fc5743036951268bd10955f1871336fd876f

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
64940b87028aa5381ed4eabcf4198620

SHA1
c34ac72432faef4d195d2ccdb14f11992300251d

SHA256
b36cbc8eb37db9d7cd485ccad9db63f52b024634d1789272d411de7ba6ed8e68

SHA512
f06cf0544e950b6d23aa35d0a419bb19b5a7630347e95df8efb65190ba150bc3a618cbb5ee1edf49eab6e95281b219ebbaea9714ef4fa267c247b54004cc97b1

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
295630e18a2c6fdbcaf7860615ae6cdd

SHA1
81c8fdab6489e4faff43af100bdd107ca3b8b709

SHA256
70c6b62d76a3e781c565a414bbd728833029e32802264d4dc8403e81201c229e

SHA512
a80a19fd527142643c6f3b1fd9a25e8c152bbc74e431a1b0b9696640a01329f70f806739630636b455d016eabf45516d1999f23dd3997e0a5464f099aa3a673a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
e71f9e8ca28dcd9951a2425a7a4a3c1c

SHA1
37d92bdf61c382e131a244ed15a69622cedf5deb

SHA256
41195593df8ba58b884881bb70bdf07dc4e92029c7b72cf144cc1ec9e94da94b

SHA512
d4f2f92fa1ff3739dcad2a4248ceb67fd2d4caed7d2db5a24a7faf1035c3c9f20aeed6538633bae7e7458d524a1ac9f5c52abb4f300de1a4fab7b58a057964aa

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
4aeff81087ae0a095e5eb7429d3ac4ca

SHA1
484710481118652c88abcb661274071107681fa6

SHA256
bf3d6db48a4a08c26675afbf82282643f773c44fe1a2c7c577ad3adf9ad01eb7

SHA512
bbc79aeda4ba68cb353a314e9f0ed0f79c266b374567e0f982bdaee92a063afad020734978deed8204e98548b59e521f15fd9002cf1c3f3ac6a23e6e70b42d70

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
47abed34fde1c3bcf6f3fe01487cae8f

SHA1
6646bc81f881ef1cdd0c9d05f2de0a4ee58359ae

SHA256
1c1dec7ddca9514e75254fc61cb285cb6d3880461e436a877f2f1accf95d3110

SHA512
c4dd99b25ed4e944d2d67d73af6468166ae7a03ea01a42ffd074c0e9c22659bd0b8ecd58221003b5f9856d924fab7c4226a9ef1ac6ecb8f0d391d05d46586b6f

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
cde660610a16d30f4a36bd5b13161f84

SHA1
11f63bd11462eb1a960195d835d64bbb19a68a5b

SHA256
f2134ed803687651b7dbd91687fbab230346616d7963b420b1fc6251a486cc6e

SHA512
303f826a0ee28505bc15e86d6735918623f83954442a5396a7cbcaf3ac8ec77db169aec50a29a7c978a78e700cf0946113e7a062822d4a554bc752ed0a648e5a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
e4d79c92d945941170d7dbab98e421bf

SHA1
7f9527185457774e794e1b64c6bea355dd0ac4e7

SHA256
1fb23b754aafbc32c5fe3773716148b1b0a246e02faf9abb71498d1c6285f6af

SHA512
8344a4dd377b3b122173ba97946c7eed0b55cb04483036b0197d71bf430f8eb73362624d8bb36a8c89f24054fd5a0d14164047b03dfd6e021738274e61add4d5

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
fd1311c45d641a72043cf4b0b72696f0

SHA1
34bd7f950fdb48ce668771dfd678cc951e05b8cc

SHA256
76f856ed7506e85c332295cda8bc3e008a5e3b20b3eccdefb140044e2586500f

SHA512
2f343f1e06960db9e010afb283eb24b3d19741a045c5c1d5704b893aee5fec1a306145ecd41dac13725176701849f1c732c84c4466cf969145d5951cffc0b8f1

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
2171a09cb80c2b97aa444d0a42f372c1

SHA1
1866ee73f72375e5e8d10c287487581eb1cbc5db

SHA256
8bc199b65445892b8c0aa8ca41317c762ef584c659ebf1e3ed1ccb0e23cd667a

SHA512
3f6246069011886fbcd0c458c7cbaa44bbbc02b1cf027bad66848910b7b8369102a9c2ba5c309bf10e4ed99b88120478b0633e4d605a34671ce19f22323ae7a7

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
1c2aba841290fe3c22bc5daeb9e4f2c4

SHA1
a3b47c29f0c9de0ea7e9cb208b0358bfe72bc5a1

SHA256
426baba685b9f73aeca1fda83694c51b74e3554559fb5be65acefa327dbb10d3

SHA512
38d8645f88367123b2141e9b8290044fdd7f92caede31c39962ce9a6624662f188522cab80870306d635e55770b3cc221e5da7e0a52cfce12e4fb9f404845c26

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
e4e3a06562d8104723fe2967453f7f02

SHA1
aa9ba830bdbcd28f2f57466f8458714a6059f7dc

SHA256
0e02639ba7cbda150101743bd335cc803041795c39430ae452fa0b13f2b8ed9a

SHA512
968da854f4eea923a5ee087408107bd0dc466e11bf0e2de51337fbee6bc3ae8b433ca23cb3602828dcbf708eeb3b787ddd16f3c0a924088d05765ef76b048d4d

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
ac7ab2992338707b1b4074933e010749

SHA1
6cc3ce2cafdfb1793799b59b4d6572b54acc066c

SHA256
22616e5990ebd23b27a574e101122d1c0a534d88d3832f9837d9feb260e8099a

SHA512
5592d95cbe27113b14207caa964a9f505e40ddf76dc86b032d0da460af19885b72efe8e10c6ba0d11e53b23395891183186d3a107ede234d1665988196a1e661

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd
Filesize
168KB

MD5
ae4c095743c51d59cd996f68943bb0fd

SHA1
b51fd7d1b4e40873b6f8a9af591748388e73fcf3

SHA256
da492688b3a3ad9f0f5d2256cb42070e57d631b6ce9bd83ac2aa87fd15c27b8c

SHA512
9ba086f2218d8a855284ee7209464ddaf670eae6d6337c41ebbfeed0f51a47b322be22c3e88c26154bdcff5d3b697f20c5b8b8c8b59a8e13febadc5199e65762

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd
Filesize
124KB

MD5
ac62a2bfa07f8d9dea273b66468f0c8e

SHA1
4e6062219547c84858d3f740973987b258c2ed7d

SHA256
19083561632a805d203ec50f606ddda32f185715e99040dc3e2a9133930dfa5a

SHA512
dacede28ba6a9abd80e2832fe4cc2f6e19b1fa79e9b4d38629c0d2a4733d95a5f93f88c3fa96b0406db5fcd471d3d68ed013e387f55b46dad95271a6c979c916

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1261.xml
Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db
Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db
Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit