evilquest | 55cea8395941bb631c1bf80a7dd0db288ee35a148ed938ed1bb5f1ed4e18ae0f

Analysis

max time kernel
150s
max time network
147s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
06-04-2024 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_451f4ff7c10be4c36268e42d8beff525_adload_evilquest
Size

177KB
MD5

451f4ff7c10be4c36268e42d8beff525
SHA1

536764093f44db65334db240805bf41eec33ab5b
SHA256

55cea8395941bb631c1bf80a7dd0db288ee35a148ed938ed1bb5f1ed4e18ae0f
SHA512

e7513a30c7f331d7d59a6c2fe5fcf3591f424bad2ae98dc90a0eed21eaaf2548a5396a0d38006978e352f7fc6cf47ff9664f4db1ef21729f9accd4ea4d79fd3a
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq9207:5SeOQdaZNxtk8cqhSxvHY9h

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008b134-0.dat	family_evilquest
behavioral1/files/0x000000030008b134-12.dat	family_evilquest
behavioral1/files/0x000000030008b134-24.dat	family_evilquest
behavioral1/files/0x000000030008b134-32.dat	family_evilquest
behavioral1/files/0x000000030008b134-43.dat	family_evilquest
behavioral1/files/0x000000030008b134-50.dat	family_evilquest
behavioral1/files/0x000000030008b134-57.dat	family_evilquest
behavioral1/files/0x000000030008b134-64.dat	family_evilquest
behavioral1/files/0x000000030008b134-71.dat	family_evilquest
behavioral1/files/0x000000030008b134-78.dat	family_evilquest
behavioral1/files/0x000000030008b134-85.dat	family_evilquest
behavioral1/files/0x000000030008b134-92.dat	family_evilquest
behavioral1/files/0x000000030008b134-99.dat	family_evilquest
behavioral1/files/0x000000030008b134-106.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 56 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:571

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:571

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-06_451f4ff7c10be4c36268e42d8beff525_adload_evilquest\""
1⤵
PID:572

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-06_451f4ff7c10be4c36268e42d8beff525_adload_evilquest\""
1⤵
PID:572

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-06_451f4ff7c10be4c36268e42d8beff525_adload_evilquest
1⤵
PID:572
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-06_451f4ff7c10be4c36268e42d8beff525_adload_evilquest
  2⤵
  PID:573
- /Users/run/2024-04-06_451f4ff7c10be4c36268e42d8beff525_adload_evilquest
  /Users/run/2024-04-06_451f4ff7c10be4c36268e42d8beff525_adload_evilquest
  2⤵
  PID:573

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:574

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:579

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:579

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:600

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:600

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:600

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:601

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:601

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:602

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:603

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:603
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:608

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:604

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:604

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:604

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:605

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:605

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:605

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:606

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2481EFE7/OneDrive.app
1⤵
PID:607

/bin/sh
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:610

/bin/bash
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:610

/usr/bin/osascript
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
1⤵
PID:610

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/bin/sh
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:612

/bin/bash
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:612

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:611

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd
1⤵
PID:612
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd
  2⤵
  PID:613

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:611

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:614

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:614

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:618

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:619

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:619

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:619

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:620

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:620

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:620

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:622

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:622

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:622

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:618

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:624

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:624

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:624

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:625

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:625

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:625

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:626

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:626

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:626

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:628

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:628
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:629

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:630

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:630

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:630

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:631

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:631

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:634

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:634

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:635

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:635

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:635

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:637

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:637

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:638

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:638

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:639

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:639

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:640

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:640

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:640

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:641

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:641

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:642

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:642

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:643

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:643

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:643

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:644

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:645

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:645

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:648

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:648

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:650

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:650

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:651

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:651
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:652

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:655

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:655

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:657

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:657

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:658

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:658

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:659

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:661

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:661

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:661

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:662

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:662

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:662

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:663

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:663

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:663

/usr/libexec/xpcproxy
xpcproxy com.apple.assistantd
1⤵
PID:665

/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
/System/Library/PrivateFrameworks/AssistantServices.framework/Versions/A/Support/assistantd
1⤵
PID:665

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:666

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:666

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:670

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:670

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:672

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:673

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:673
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:674

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:675

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:678

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:679

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:680

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:680

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:681

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:681

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:681

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:688

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:688

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:689

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:689
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:690

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:691

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:691

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:691

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:693

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:694

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:694
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:695

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:698

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:698

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:698

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:699

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:700

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:700
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:701

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:702

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:702

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:702

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:703

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:704

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:704

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:705

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:705
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:706

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:707

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:707

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:707

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:708

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:711

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:711
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:712

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:713

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:713

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:713

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:714

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:714

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:714

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:715

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:715

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:715

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:716

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:716

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:716

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:717

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:717

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:717

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:718

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:718

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:718

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:719

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:719

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:719

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:720

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:720

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:720

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:721

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:721

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:721

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:722

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:722
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:723

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:724

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:724

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:724

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:725

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:725

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:725

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:726

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:726

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:726

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:727

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:727

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:727

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:728

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:728

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:728

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:729

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:729
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:730

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:731

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:731

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:731

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:732

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:732

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:732

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:733

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:733

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:733

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:734

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:734

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:734

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:735

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:735

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:735

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:736

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:736

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:736

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:737

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:737

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:737

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:738

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:738

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:739

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:739
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:740

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:741

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:741

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:741

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:742

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:742
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:743

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:744

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:744

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:744

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:745

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:745

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:745

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:746

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:746

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:746

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:747

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:747

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:747

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:748

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:748

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:748

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:749

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:749
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:752

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:753

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:753

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:753

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:755

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:755

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:755

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:756

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:756

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:756

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:757

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:757

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:757

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:758

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:758

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:758

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:759

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:759
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:760

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:761

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:761

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:761

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
218dce8fe7c6ffa5b9f7e8866d1d292c

SHA1
2bd8d7c963bb11c25dc9a6e449fb47e44d96f18a

SHA256
57754cde1910c8fbf053137ac79f4e750374ea8ce5905321d15a90cf78387ba9

SHA512
cc90df0c1255842cefcf20e3cfa9c48bc9ce4a459f9defe8f157c806db037d1d371b296c7628c14f36ccec88d8f5f3232a07abc15a1a557297f29fc537813129

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
ea371021be3df7d12c9c7a9e28d1920d

SHA1
c6fd6aa2543c6df67d81d04540d3ad356cb4bbf7

SHA256
836f75bd8dea5c5d45b4a7acfd79a7871632207d57ac2fa8032737722daa513f

SHA512
98a4be50333353719b7bf570d1d678eae1ea5f2a2a77b498ca5851f864b62c8bb33cf5c912349b7e4f86e6a3bff0717b957e861d652ce2df634fc0eb5fcded3f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
158B

MD5
577fba35c4628c64f2deef42476f3e0c

SHA1
afec9f764c7991fc5f0507e206ad1b6211b77e26

SHA256
2b789aede57ffc8298d717b3be371b14d3cbe5fad187cdedcc825a32aa62820f

SHA512
4c07787a136892fb31eb91082474e1646e52671990c44d802f0b7b9ab390d8d8ba9d763dbf493ae1582525f556d1f963557f03464bdfb74ada63fa5e07481799

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
9ed5785c5bb27918d17e2f2457e40560

SHA1
014c075f6a62b5dc97e7c5ee9a12dce672aeba10

SHA256
c1af5d8ed77c932518c9d37b8f02b16a80b6a53eae383706d6b34d9e3672649f

SHA512
1f554e489298d1275b661b5a1f99f7c2f67781d8d044df7c9bc2ae9a4a1ddb2a9d8d21bf88a25feef7a66bb6ed80399935576bedec5e22386457ed2e188bcc11

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
8dd8088fb1dee606fc412eff9673f301

SHA1
36b5d47d6539f9a9cce271396aa059abe426930d

SHA256
f11f7a2e3da6cc60a783e5896e4c1f0d5ac61571cca1bd2f4277111ea612e8c2

SHA512
26f0a7ac524c8b260850b4d504e768e2da28677b841cac375747f85875e0095a8891d14baa46d1cecca8c74effb9ed835a5d18a3fdf7560e3e8bd70dd4576cd7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
b652b457fb1187420a9716b6909df433

SHA1
94b221cbfb2d2b776cea81de0cf623665766056c

SHA256
659596aca69472f5f5c1e7b11306bcecc23c606b974b78f0fa15e49c17a1144c

SHA512
b8d5b68533af73bb4a7fffeb9fa9c81b372b5a9f31f581a4d1f7545c9b29d1998d190e7547ea4272eeb69cac57458096eafbe4b666bb34d69889d4f960e46c64

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
c7d8d29d5928fcb9656c80424c9426ab

SHA1
bd74f7b3509cbd60b0961d6dd4fad74c240478b4

SHA256
e4b0472bb64372b5b3d5ab8b06c36194b83e1e639ffb3f2852355380c18861e3

SHA512
54d9c8e95c8ec42d849ab47d8687f60eb3639e52442d5cd3dd6ab1a84efb044b0859c0823c4385e66f7448209a067bd9edf937b59dbe72125cc9ae9621fc1d6a

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
45b5a6c535c74d77d9b3a543ef693069

SHA1
4b692813b55974a3a1b837d932db9e453fb5d68a

SHA256
a6e1af51acb1d1aa783e0fce9e3fd9edd07b8136efd8a211e34a2af4a90fba97

SHA512
e3bbd51e584cf29aa9d96ceaa8a2297b51d2f318f8ff005dfdb9b64afb0caac708ed6435cb7b20640ba43fe2a4bdbc5218e5b5b25a6a3978241d051e048251e7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
5b9bb2d22c8f90c0a6c5d3c9f6d20606

SHA1
70f6e18969cf41ffe4954a234f579292761296a4

SHA256
0a60c7a4aff1fe5c1f87b86de5cfda49d2209bfd31c74b8d94ad66ed8922128c

SHA512
4f8fbbe49949fe84ddc99f19a571f3b4eed270973725eefc5ee668ea389400ee23b37a1adfc9d201f771a9bf0f2d0262939e474e79e83b0224f886524d0581f5

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
e32bcbb000d9b764996e17f14eef134d

SHA1
1760b500481da738c23e6ea63d9bd5252c46c1e6

SHA256
2b5fb23ac7f2a842d9083c9706414a8da7f1e85322a86b295e1335ddd7903abe

SHA512
93f8033069a39c946f690c4202618da7e1368d377a150017e8ada90eeab197b52eab3769957e8b62a564a53783266fc1496428f5646bab5111923272df1e1411

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
bcaf829b8795eb64dc776754d5857c28

SHA1
c50d011e7c186468279163892b258c8767b9f1c5

SHA256
6249b49907b385604e65e1236a82a0ad9e6b1a119994d2633098d1b911d4d364

SHA512
93396988d9348adab9bce0dcbb0ff51d79cd426d9421384d73df343c8b75aacac30e05730f9bec0423a98f07dc7beef9c3991b1a3b7f5fdaf6066c0c34a63bc3

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
00c5366b859e7fb5905d6a5c3a60db13

SHA1
a9640f85098349118b59875dc32daff2e3949548

SHA256
1ec530b1c9f2bfe3b7c6af7a2d5e2e461ef7440f8cc190ddccf4e69e2074ba37

SHA512
7310631d58bb2ee7302aa2f9d5f451a3c4ef4dcb70f96487539ea1cf89f443c29137d745fd1eb47e60d183f71cbb2b9d794dfff47e75fc779e68598c81320a1c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
40449c369b12c4679f431c90e41f6898

SHA1
684cfb11de43621b0fa94116f60043ccabc277dc

SHA256
7d626b01f8cee76a03ab5c07d90884f7334d3aab6658a147147103d76505b635

SHA512
371123850a6dce01145efa61ac3fc7b26a971e8d2611e8e7cbfe4739d59a4406e2e35080aba2131b0ea567e6fc370361a32a72649d85a28d56808f2cfdb1926c

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
9edd1047a65452504119e5be9829ba90

SHA1
b90c4fe7aa7559641a3d6e9ee92ee25b7820013c

SHA256
4d330d6f42dc829681807339c6865da316cc4d86a8f3bd8f1b5b2f88dafc555a

SHA512
8e39389962809e6c61c749022cd4931135295f74d381e060fbc380aaf2668ba1fa3d2c07d303ad0116620d77cce7e8e2c2d277ce69c366d2cbf122129e8471fa

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
8a36c9cbf490ff78a6957ebcbd3d1cce

SHA1
caa858cfc311eda77b423632a3f25c9636274417

SHA256
66c2e432ca2ac403a5c29243d74927c23abaf8d03e921d7ccb7eeea48fed0111

SHA512
4826c1644bb7732a6c2ce50ca57739d86620d4d8818adb266be1de73597c1be1447254c48d04b4dfcdc69b3e94ab6dbf28decc13f7acbaf660e844b6c79b120d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
6a499de096566402ddb537bf99658ebb

SHA1
68057bc83e3d2456eefde36b8a419df7e87ebe39

SHA256
76e42dd5ee9f06b307d7b22998f93f9ae8ffec55888a7c39b15473222694b237

SHA512
f341df8cc0984db7e3dbc3c9687774b4ad234f1ad70fa5b43bba3a52ccecc03740ec8c0c8dbbc059e8dd4d063869f2544f395c3bc227894a1a5530122cb3e06d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
c4cbceab41a254621dc476ae7406b158

SHA1
4d21b6d6090aa5e826c82810c9a6993b0f567d51

SHA256
c49eba17ca5ac6f36ed506412c77bf0bd1203415f6a74343c68dc5efb61b2072

SHA512
9698437d91085599c163fd2230b6a8b86933610dee7f67b4522239686128b15a344b9b43a669318e3c7e4177859ed58ec02f5549bffe3f4e692b19409eb02c2e

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
631f7c2798ddb7aa6a03d096c349a486

SHA1
220c6a8038cc014061db1411ec0a71431ea9623e

SHA256
0bd79bff3a6330d44781dd6cd34d0bc670400e2043e8bda9e35d7b5b83530e86

SHA512
4b23ee73f9bf33ab05a861c70213e536bfeb4f91929aceade3e33cf0bc93140609a0ce97504f543c8c0f4708af9c58f060a7497feece70173981d25ddcee0bc1

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
145B

MD5
0c4bece26cf2db29559251065890e153

SHA1
99b4e5beacff7c67ec93466713689854d8dd0595

SHA256
76c1a9e80359e9182a3f31c70ff8acf060ab0aa18a075e290d0a5602eb5e6bbb

SHA512
44b6e6f7b1fcb80fafae2387963e7b9fc63c7490176833b8964732d89b34a01038aa7f052d890cfbeceae224c0cb357c071c50ee33ab6d144a7a2d7309a75474

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
1150bc23304de0233392385a981f77c3

SHA1
3448ca253ca96e72247b6cca4a4bcfe656e131bf

SHA256
607b376cd933cf4d5c95ca40f9f0c49b8cdfddc182b027200e52d3478c71cb37

SHA512
1fdb1ba887871607380f7a64b48089cfbc84ccd4fd59b350f804b0482874da8c4dab6b94e034c771aa1609543fa0f696a69c79b815ea7834e646fc7db8ab3039

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
c5d4d70e04d986758fe9b4d5b8bfc967

SHA1
d0116e477fd65899eadcf96b987893ed1be7fd47

SHA256
b9126628c2a209ebb8d47b8f68652aca005b97dfabdebca86a0d17c6e5609bd4

SHA512
f3696c91c410a1ac46757d3ed3f64800aea78e65db60f274cb821edb28c1312b251e7b9a9703f39e83b332acb77271b85f648d55d571eadd7788a73ea9d11f3d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
8899cebdc171a42fe9483fa01bacef3c

SHA1
344e661595dbf9655d4c7468ba014ea462b6214f

SHA256
fa1c2207a2f4c9c871151cedfbd6d582bb827c1cfef0e69e790167d4b70fc035

SHA512
6e4ac62d37a274c7519c96c1eee6cc45f6467a9ba6424b56623e425ad67a1ec49e0c50010ab402b72310e887dd36e9f1a726ba36fb3d12de2b0f0f9069443cfe

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
a6a3c84d6f7de9d8272cf192fbf24830

SHA1
f3991bcf790367e38f6ebf1a93b61b6563024810

SHA256
7244d40aa39f2cba300e4a33c036d74a45de84c9439608c8231f2b99ac34cd68

SHA512
ff5a10666d5d7a58336a26854d5586751a35dbcd87b1f86a253dc7a23883ab7e5167de2613eff0bee83541d340cd61f58f5a8c3948f3433881ee92d579ca1a0f

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
a70b3c0315428be1c333a02801a824bc

SHA1
283b365a858b77f4e566b59b8a7655f1ab943a49

SHA256
b2c4f6211a66e9eade84935cc822fd3385624e9db46f9bd20d89b2c47e2a523d

SHA512
981e3bde5f127250caa67579b8c0629f040e5aa0b2f259628a72e44c7c3e60b16da7a4b9a0246fa30a62ae5bcaefc3a9a60762c28c5846b86d0f48ef242d75a1

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
b6f692db329e2c321a81ebc5c070c969

SHA1
bdddb0468c27d1238922c8f7810b23814b92bf93

SHA256
dc0ccd8e306d0561654631a2d7f1e0d2c0e99a83ba8bdd3d3557028e937dbf0e

SHA512
14ec4f7bf11019fb9dfd4fdcc484f3eccf423571c9bd0ac0c3a305de71df5bee1f0d3891fb53cd1af1c0b2b3efd55278098e0e0e975d52bf0a99f4bf14f5a6cc

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
5cad30e9900490c2139cc170a48ecc6d

SHA1
f31931dd4a4bf2786cfef4ec2e454753f7d2eaa3

SHA256
aa6e87c5dbacac7fd772cac72cbf0a87e1e790545814bd2bfac0140d6771dfa8

SHA512
695bcc984cceb6e195679d96309397f665c74544d3a363a81dc720d66e8a772f7bae51cc41561b1a6d91a11c00e2aacceb051c0137773145443925a0c99dc18d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
1d1f25ec9549b88dbdc45df49ccd782f

SHA1
016dd053ced8c1e2389708af904a0e617598a36c

SHA256
905ac360248b19ca222adf8bdc5bf37edca3a90784bbdc3fc2336d5d69f15d7a

SHA512
957725100b5c1d883ad74eec071911e14cfde01491273643cd4593f39f03791e329fc26b74852374097143e88b2a38589002cbca45e6ff1177b8215d9556b289

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
ece7a16372047d24825cc5ffc8517209

SHA1
748157f6872d5216639a7168b68beebc762ad538

SHA256
2e050b646bfdc5bc2b1819f33097ee41bc7621b760e87772eb5b804e2fa9328f

SHA512
18556a7dc42be249e1c4d1616dd9fd2af81d8fb2caa76a8b1e1cf0a70fd002ec071de8be3da36ee0c9bf791c81700e40ea9c8ce74a923621493a80a503c16b8c

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
4ecd084b653b4fdeebc2cbee940fb12c

SHA1
26a5a4d7aba6466935cebd8ca7b4912c4e1b9d4e

SHA256
c71db92d6e03ccf3412067b0737d8126ccef5f386e677128ffe7c5133a54929d

SHA512
29b000064233b5212fb5d2a848371c524e4214e80560d8f7e9b1ed3e3260ca0dc859635d119f647cac8ed9bbb6676ea4fac464db3149d858b0ff853b616c4995

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-04-06-023311_tests-iMac.crash

Filesize
40KB

MD5
d3ce2679080dcb9f1fff090cc5e39eec

SHA1
e7b805b9c9c64f95bbe5d8ec4437b15e61b60346

SHA256
0c7fe53f33763e31788c5be767f2b556b9ce2057030fc0e3afcb0af578f3701e

SHA512
37bd8c7690b233eea838e464b00da6b991eb49218afd53bd32ef386f737aa918fce6afe2655c5a73d8d73c7c13d94ef09946ad36c7c6f40224c12bd49275a89e

Download Submit
/Library/Logs/DiagnosticReports/sudo_2024-04-06-023311_tests-iMac.crash

Filesize
47KB

MD5
8551a58e9ec7424dda4d11656f9d6103

SHA1
8e6abdb39de49670078629537ab09418948626e8

SHA256
3f5be9dec072a4d2dda79e34c9c5e8686a03438c338eec303ae51fc94462e641

SHA512
4f6eb3850ef189f22435b881693822b785e2038ecebf798fd7f228b3845057d7d4ea0aa71aa44bdc6cbab979b1f328fe91f8ad1f4a4904ec72ad76b91a4f1d18

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
9a39ad88fe3b559b84f07c1be9bc037f

SHA1
20e5d5de384e78e667fcd7dc55f18ca2fc8c4e5d

SHA256
76123171ef2e86ae446ac0aaa59169fba55bcbf8ca7c6c1260e9b0451d8e03d8

SHA512
96c7e82fdd7aa2b4702237631f5b49c79cfefd5704ca4c2dc546de3b9dbb9dcd67e7da49044f9f195e21f3d85f5ca0f99899667e09ccc5b7d9e6e408ce89bc8f

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
039967b3d2550103cb9912f78ae5c7ae

SHA1
56cbd331a531706c22326829a737218f1f1b3826

SHA256
d3cefe5524e44e2f0c2754a9654e9fef77ab462136fb27cbbfc68d6c6881cdad

SHA512
06645efad4d46a7c54946901d77017eb0a0bdc3c04de2863aeb614e4e28ea1faeb1f0a20bdbc25d95e8b09f0d601a1b06a96de5511146efedfa76e8a1580b149

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e991b6c8a79e008fa591a8184a913bbf

SHA1
f53524deac3b6a01e03979a3adb5b416120da701

SHA256
a946dc1e85bd8c0e408159c5e7ab95282577c1d35504b7789116e1eedb6288c2

SHA512
a58467c6fb774c7f85d435917405319f2232e4476e33699e32dec4b9d2fefb4bc2748c929cdd9326952869a3eed75cb1718382a617b5f91250a4697b7c259fa6

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
91026d908100d515b12b7f9699c00f06

SHA1
ac309291cdf5e1ebee63239908602787ac1b8bcf

SHA256
6b6382a37c4a8330ae30e3a35429fc3baa7a55ab3c1bc3473cb87f151cbbf595

SHA512
fa92817aeed30be0bb470e9f0a94aef591bf61488e25acb12b8ba7785237aa487adbe8436142629ad7d6542872b90edfbad630aa3ed72f3b3cfece69a5592c14

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
320aa0649bce33779cabd3f89a2d5b6f

SHA1
8e0b6f66f1cf56219951c26445016e55eac773cb

SHA256
02716cfa546bcf16c0010d9e4c9dd8e8530c8f47e0f9ffd0eca2b891400c3890

SHA512
847eb8dd9ff5c2b1b56b5c841c384d87d502cab83d940dab1ef9fa5b96b07776df60bddd6d9e6a69c08f81ba2c1ea8a76e6fc9f2c72169f497a02917315de0e6

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
77ce2182ea10126ab3532c33c97c110f

SHA1
79738916ca466b600a58f1270fb4a02b5bbdd859

SHA256
704083da3f87aeb0c26a236bc2e3a156ee752a87e3ee7e0af451c43048843650

SHA512
fcde659b187212a015e065ef0f9bcc3bb5c7fd4e45327d98e968ec4ae2b6762eae314749e9f7031a2e3a0c74aafe630fda81e5542ba46ec0f5f14497170ff892

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
47def305f28725e2e4742cc8aefbacfa

SHA1
e5ca57caa010cf5f2b409a36700b90aae9f60545

SHA256
b81da81fd6de52319c4c44ffd16b050421ef324f64ed6a09eceb861a68893a0f

SHA512
d443aeac25549f1415edc3a1209af281ee57592c81c00e5dfbb1864f975b3241e16b019d779236de40355f4dd658b73da53e89ab69dcc83daf05564f3abd2a04

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3a472497cb212d46bbf3b14bdeb6a6ab

SHA1
f74b9d68c4c80c757541f0fa3ab73a165cc1a45b

SHA256
ee32ea87c54a03b113005936834a2bf7a109759b9d859a57cbf08288897329d9

SHA512
5ce4315ef92588bbc320d4b019fe001dcd1078397781b42b45d4a3298a6f44ca9e805e5c667f537956cd29704a2c180bd35968b03deb26392a6cf1265454779b

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
00e7f7f4bec034a4a06f3859921a0498

SHA1
ded63a04b0b5786180a73d6afac93c527d4d6ddc

SHA256
fcd5c31599c15aa0bd64c865175e52829717b0f18a81e86456d5d41694a364f3

SHA512
5860230b983b69dc68fcf2d31dc2eff1d72129f5ab464e1b720554c43f2584a0181529330221b585c9809571cf405bc7ff4bf940c48d46e2ed77c3f447ddccd6

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
240f301388b3078c2409526a76c0e5f9

SHA1
46cbacaf033317e80b253de7d6377828043865c2

SHA256
09015d13f1c871a801b6cc635f2de280407eef864ae32f967cc466bb926ead5a

SHA512
96514e8f6652471d8bc5906056f34540794f4139248ea7c770622fb10f7130ea5c457954d2e27efef61be222922e72300974ccbc2566b80d6fb5825a2b78fb3b

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b4dc89ab9092e2729eb3c8f081df2a88

SHA1
131887eec9144ecbbb614880497c550017d11e5a

SHA256
65570027d4f6d6620b19512eb750268f3ecc74c2e4f6526b9c9abfc8ce88d655

SHA512
9576d13a35ae50cf58cc7c89ee91a365e5a9819e395a11f8322e1d883771381f11128b6f4e1d386dcf9e3da6c8a2b024eb3cbd3538aa8c61619ebddc5d3eac80

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
afaed705bb86ef35f069ad1067eb52fa

SHA1
22fd340747b7134fd69524f44173d6afb874f17b

SHA256
6ab6aa13fb5b2be3485e35adf7a73e808310dbcd0bfacc8c9f1f40883feb4f1a

SHA512
f053f3f5482c2216f065b018330293b3b624cf882430f5d6a3f9c3151a7eb5d871faf1df10cf5cc83c680d6f2b20d092c6cc4a1ae94193158e666b2be7b7c28f

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
ea4eb31fa14e78d48701c355596e71b3

SHA1
e00e5c19495a8022b022eecc4ebad4d7fd0c64b5

SHA256
db6649746a9049dd63c516c7a9e44082a072ffc387ec84f505972a879ddac4b4

SHA512
3f32465377b88355d84644517616d3aa0f6c1d14c635a0717c6de25bfc399b19c042b6f0b8ce10150e546064c25930cfbfd3162704535707cde533c28426ff4a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
485f97ea3b469a8d3410363e67c085d4

SHA1
914d227c3f2eefe5cdf29840e079f641c23b9cfc

SHA256
a29fe916675bcfeac3415f6e95be6af7938b9d30a31243f37bf623b0616aaf92

SHA512
0a5a914a3cd5b5a36bc594902ce9a658b6765716b6a4977611372c4f2a6e939d58c8ee98cbc91a8405d5bc8ed6345688039e05fbfa90287c01df5fd34f553c57

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
d5b7ab0f4d77d02bb52bc3318abdb14c

SHA1
206f4887f08a6aeb06401a811d133b5e331528e5

SHA256
87331516cd3a016124de6e89a8a48b7f01cfbbabb7bb6d6814b8a26277c2349f

SHA512
a695328cee85a3267571bbbc3369eb2321152b695e89d5f33e4354819ae2da1d89c720b4a5f5e2e9097dcce52dc0a41e59bb97b922b33b5a1701e2ed89e30a9c

Download Submit
/Users/run/Library/Caches/GeoServices/Experiments.pbd

Filesize
137B

MD5
b7bbf654f1a1356e3cb5a4f805fbeab7

SHA1
7b136427364c18a6b3bb9d7f21ca5ee6b0facb40

SHA256
779bea79a8fdcf82f959db1d3078362f3f6c07278d4efbb30781098f1392a167

SHA512
44be4846e523a7db3b2da7812db705db5488d3531ef60259a22f448b991f98f8e1867df8c624e1c199b60577e3cada7a6773702d3bff75ee4216c342b955cc88

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1261.xml

Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit