evilquest | 6dedac137c487a46b17196dbc51092e6cd8ea6b62eedbe20a33ae3117e6cbcca

Analysis

max time kernel
149s
max time network
148s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
06-04-2024 03:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_ed0a9922174a25bf8da2db3ace0885c4_adload_evilquest
Size

389KB
MD5

ed0a9922174a25bf8da2db3ace0885c4
SHA1

7fb28b3a8e3418033e2aaca30af00647059834f0
SHA256

6dedac137c487a46b17196dbc51092e6cd8ea6b62eedbe20a33ae3117e6cbcca
SHA512

0a6f777ee7314d12cd13593ec3c98ecac77947159bce7a9bfbbd90ba3a1e401126ea79784b0ea909432309c30ff93173be3443e82df861d446f45ccf2361d446
SSDEEP

6144:5SeOQdaZNxtk8cqhSxvHY9xnjCIQwa6QXbYRPuCnfL08Y/ok5XM7mM6QS7MkBh:5LOQdaDxq8cqavHYTWIDaJXcl/nfg801

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

Processes:

resource	yara_rule
behavioral1/files/0x000000030008af3a-0.dat	family_evilquest
behavioral1/files/0x000000030008af3a-3.dat	family_evilquest
behavioral1/files/0x000000030008af3a-10.dat	family_evilquest
behavioral1/files/0x000000030008af3a-19.dat	family_evilquest
behavioral1/files/0x000000030008af3a-27.dat	family_evilquest
behavioral1/files/0x000000030008af3a-68.dat	family_evilquest
behavioral1/files/0x000000030008af3a-74.dat	family_evilquest
behavioral1/files/0x000000030008af3a-81.dat	family_evilquest
behavioral1/files/0x000000030008af3a-88.dat	family_evilquest
behavioral1/files/0x000000030008af3a-95.dat	family_evilquest
behavioral1/files/0x000000030008af3a-102.dat	family_evilquest
behavioral1/files/0x000000030008af3a-109.dat	family_evilquest
behavioral1/files/0x000000030008af3a-116.dat	family_evilquest
behavioral1/files/0x000000030008af3a-123.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 49 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"

Launchctl 1 TTPs 64 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

Processes:

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-06_ed0a9922174a25bf8da2db3ace0885c4_adload_evilquest\""
1⤵
PID:534

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-06_ed0a9922174a25bf8da2db3ace0885c4_adload_evilquest\""
1⤵
PID:534

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-06_ed0a9922174a25bf8da2db3ace0885c4_adload_evilquest
1⤵
PID:534
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-06_ed0a9922174a25bf8da2db3ace0885c4_adload_evilquest
  2⤵
  PID:535
- /Users/run/2024-04-06_ed0a9922174a25bf8da2db3ace0885c4_adload_evilquest
  /Users/run/2024-04-06_ed0a9922174a25bf8da2db3ace0885c4_adload_evilquest
  2⤵
  PID:535

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:536

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:536

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:536

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:540

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:540

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:541

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:541

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:541

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:542

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:542

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:543

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:543

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:543

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:544

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:544
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:547

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:545

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:545

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:545

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:546

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:546

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:546

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:548

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:548

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:548

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:570

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:570

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:570

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:571

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:571

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:571

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:572

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:572

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:572

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:573

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:573

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:574

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:574

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:575

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:575
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:576

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:577

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:577

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:578

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:586

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:586

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:587

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:587
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:588

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:589

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:589

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:589

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:590

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:590

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:591

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:591

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:593

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:593

/usr/libexec/xpcproxy
xpcproxy com.apple.nehelper
1⤵
PID:595

/usr/libexec/nehelper
/usr/libexec/nehelper
1⤵
PID:595

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:600

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:600
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:601

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:602

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:602

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:603

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:604

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:604

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:606

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:606
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:607

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:608

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:608

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:609

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:609

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:609

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:610

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:610

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:610

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:611

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:611

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:611

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:612

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:612

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:612

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:613

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:613

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:613

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:614

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:614

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:614

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:615

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:615

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:615

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:616

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:616

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:616

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:617

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:620

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:620
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:621

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:622

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:622

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:623

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:623
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:624

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:625

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:625

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:625

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:626

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:626

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:626

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:627

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:627

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:627

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:628

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:628

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:628

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:629

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:629

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:629

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:630

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:630
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:631

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:632

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:633

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:633

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:633

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:634

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:634

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:634

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:635

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:635

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:635

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:636

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:636

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:636

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:637

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:637
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:638

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:639

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:639

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:640

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:640
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:641

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:642

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:642

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:643

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:643

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:643

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:644

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:644

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:644

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:645

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:645

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:645

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:646

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:646

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:646

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:650

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:650
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:651

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:652

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:652

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:653

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:654

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:654
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:655

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:656

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:656

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:657

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:657

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:657

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:658

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:658

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:658

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:659

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:659

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:660

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:660

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:660

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:661

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:661

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:662

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:662

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:663

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:663

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:663

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:664

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:664

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:664

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:665

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:665
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:666

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:667

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:668

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:668

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:668

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:669

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:669

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:669

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:670

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:670

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:670

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:671

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:671

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:671

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:673

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:673
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:674

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:675

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:675

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:672

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:676

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:676

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:676

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:677

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:677

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:677

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:678

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:678

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:679

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:679

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:680

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:680
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:681

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:682

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:682

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:682

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
f4a3974db870b249a28b7d9d4ad7e0f4

SHA1
6d5611fc02f9efc88d769b376245ebe7e7fec91c

SHA256
3b745ba0e18977e4c82f6ccaa982a7936c2e0b637aa24931d3b1df8f58c515b0

SHA512
02fd358203d5db702598f88fc412c503546b18846661613f08d8c1c72196df6ee957f0682656050a0b5d46faf4460374c2ed8d126f5080d53ddf0df2c40b7d14

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
041a5bea26bbb4c44c21616302b4ee1b

SHA1
bcc609a49c1b8264d39045ac04beabd6e3278091

SHA256
934abb66d7624c0eb8c08e5652a113713faa1c1765f08e39dd5762d5aa471aba

SHA512
0c683c71e3f5a483c0f738873ccab0e6239c56e306363e39529cc45c18f99dd8599a739b69c909fca83fa895450c275abd178c4da9a8bd43b10d7b5e9481d008

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
e2d93025f1d5bd47862d95477c15110b

SHA1
7132b5b137e1a036cc3a04adcb27b82e3149421c

SHA256
327ccf829534226eae6ce763195ddea2baa5f09327f317abb15c6096d39e7504

SHA512
9bd3312f86fd7e7a51d212f6fc713c2f38a6db1f45ef41802f1dcd38f3e6f1e70c479b2e5980cd006456103bb399aa034432eee4052f7100533e725fe0da7ed9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
af46e52073af23f846231603bead9a8f

SHA1
e7e73cf40fccde0960eacfb11b40982c77056772

SHA256
e5c06dffef3e14f5d926544071cbc5cc629447f1212a4d220ff7a15a06c852cb

SHA512
2087a4cc8905585e5d3209d49ba933fe8a1638cba2df380287bd003a093e6370b47083ffc9977251d5fdb81745d4da69141c10a4cb549a165d7cb5b5b978705d

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
69966386ce2ae56663e36df725fe8058

SHA1
ae0f05c8eb044dd2fa7dc8e40182e03e3642ba18

SHA256
ad0c22e382dca435ba68f7c2f7aadc3fd12d829c67e072792c2d727bc5cf6696

SHA512
74eb622aefdcf41c9630d755fa2eb9ddfadf9dc29890370686d35e01387a36503baf2129f8cca0548a47b6451e27976856d0490056d75a3017e25eafa2368cb7

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
3c6af146d307f378ed73040dedcbb2ef

SHA1
b4197ccee977e1052982d88a65f9bfc76d199ba4

SHA256
d44dad7761da16ff1e21f53eaba4db9ccff61ffff39d1b22d0bb4ae43ff250b2

SHA512
be41867ce4aa4d3eb7c8b013b329cf3fffd8d29bd78617c832479d4aa5c2d8429a57016a4c31acdad16cac81e965df382c832b574e7cf44a0f058845ffa2707e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
c4d9fb4f87dd7ccd2a4728ac30f088ec

SHA1
2b1e0ce953b78ae8f75e386e6be49b89e9f5d16d

SHA256
92c4b3833797ed46906ad0515f4e8dade0afdf3aa65d5b18d4416d7a87255266

SHA512
d788d51c639094f25403e4bb41fad3322f690bcb5632236e1efbe7998868da2508a9a494ec8c898b6bda68489aa66c015923c30d2396ee3d50d87826419f2bfc

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
c6112f6c19c4d78e7143be92adffdda2

SHA1
dd71b7113c54e37816aad46a8bd9e37aa421ef27

SHA256
e632cdd9ab2a9d6e654a9621504f984da0b8da8cb9b918213e49fe896cc125da

SHA512
7c338fa990646e53ac09bdd5de57e890317eb5c36266bfb5f78b438881317a21a05a09ec918749f2f65e3e958f44d89cea47ac3a3d9a929b75582dbb52aec907

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
db9847be9a290bff9e163f299bf57360

SHA1
40ec754845960d31b1574cedad914aa49a8bf833

SHA256
0c45a0b775f4046cd899fdd06cc5b9ee10388dc7aa45a57298968de0338effb4

SHA512
e668c5d2b553f0db41b183f0fe19aadd303f3160a8bdf897e3a245f2d1306385f01a172211dc70a9e006a11027979c279aa8bfdca0493ba3d8e73959d3d01971

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
ffeb25cdd1921e138ea93c99e46bc1cb

SHA1
4cdacb8314bb296873e0f2ebd666fc3066dd66d7

SHA256
5a6b0d5de78e87402a82bbd3b4bcd6b65e5d89d545add86a22b039263952990e

SHA512
58b40acfbd815f7633f1b0e65b00068dce326e98168d706717fc4fbf6578579b8feb6cf0bf8b881de5e1ed86a6752386604f287881d1f780c7546fda71e95018

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
9b01952dcfb9f37af7c9ae04c8b7c709

SHA1
7ba07455aa0f7fd77140e67da2717e3c55db1f66

SHA256
6ceeaa0d0bea4ece3334f3aeeceddbd7939d61c2698edcd27354428732b18bf7

SHA512
63aefe07e7f27e2ff8da80c2c1b55a4963c55ce7a3420d7c9c79e79424d2ea0257fdfb7bf90965b3bb0dbeba43828e4c1fbc6851a18c58c01ddba3ec63001f6f

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
1de2deee5975a258bd589c367a865279

SHA1
d3054a7ae73668ccd17c09ccb324462cf2392f4c

SHA256
529fa74e2c39850ed1e8f7561cc959c25909ada2d71b9b716795718c642acc3e

SHA512
1dc2324124cd6b7eaf3bb550206f8e078665b2415605bfe9099dffac5bf588793beea17837e8b42fba95f69664792c0be889984ac5929cd512926cc8b352f677

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
2d2b8ae5c53b2c6acf006f9bac000a51

SHA1
df23cadad56f1e3617a135649c923da1d13c4f52

SHA256
8ac2b5e6500602ac6d617202db0f49d40926f12c9de4af2a3a9f0288dc8a869c

SHA512
e9482ed523ed32b809539749e876f9cf57fc59e45cdc35d62393561669fb598fd51c40d07464933b5997186444d1cc3a495b0e650596a5e12d9621b5e848a835

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
c9d5104bad2f462130b39136b0d4e580

SHA1
0deda2fda3c5d928196831daaf7435b6d65fbd5d

SHA256
5a4c93a58f2c5fb99b0f40f697437354f53777ab9416241c21f6352dcac74ff2

SHA512
1448a22a7a59f93e5c7e5e9b0ec3c7d9092b5a3be32f7c19e580ee6e6f74985b1d4d8864c66fcf736a3bac3675601a78bab54dbebd5cc92f91ca4fb6e71e8eca

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
0a26615b71da7507479dbf9a68bbd283

SHA1
04cb82cdf1ed4494e3daec9eb1cf3e97e11d06aa

SHA256
2de34adf65f0a224c27b7a0714878932b32602d2bf2cd6ed508b64ca3fa9c129

SHA512
893cd036bda13205719f8fc712b538f5ea925d1d3feb0eb086a6fa195cef7569c51b2dcb66e4a1573a3eebb660394be4b1e16bc6d2d776b2a933143af37cb09a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
a9dc78ca3686092fd0d9153443974691

SHA1
ffc2902d8cb13f06084a75608f96a6626e299bbc

SHA256
71e2fb1df9951bf3be502981db26fe9e23bd3a384bf41c641bcfb6f494e0451c

SHA512
870485f23d1c84591cf1d0d9f5003c9be7ee2b7afb84ab59e83f5c9fb19ef26c011f2590a0be69f9fb780578c47553ae814221cfc68f5d656b57fbd668d26415

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
7b2878fd3c60b7cd298d67e29680dedb

SHA1
728f55e4f48a69ec7e2f4a51b36cced10676cea3

SHA256
bc131d851225289ef825a445ba57dd1771ded3eab6451eb5b3de4b161ee11358

SHA512
dbc1159af88d7d8d8553b2051b92c2fb2aaa8878694586bb9623fc15e4df4803d0c3d805f8a4edb89477dd4fb05cd48bcf77019f274b70636d602585d564b8f1

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
21465c6475f7d350f0509b02580465ec

SHA1
c7426407b2e06d37b5363d971366b0caab04836f

SHA256
803e6cdf3c2ee4817fd17a3e783146d66be6c9f7753312b3d9350543ac3f5697

SHA512
402ac6c5f44a8206a3fc49bbae788658eba7d8eda7838dc0ee0888b1f0b2e67ae161b17b91579fec62282c864b8571c7f586098d8e92cfe58f2d21db25f16d2d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
5fae7e4d9b923852ee4a7b2e5ef4e6c9

SHA1
98c14378737e27a6c33f73b53767ab778a3e4234

SHA256
35211d95aef43c3e4445e487295ac5643281b99f9d2b6322fe4f8d62febb45d0

SHA512
09ae73401067287cfb4c1deca9b562a7d6333e244c72cc2491c92fecea7a4de928c367bc72c2e2e2c67bc68034c56ba54b30e818b0bfc138c5f966f99b93f265

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
bd25b66a38f32c5a8d1e91cedb36c58f

SHA1
0dc24eb831578a6bddaf29015da177d30da55c12

SHA256
6f3973d6737728e0d53b12823e3cc4c5e5604b9f496d9e654f262e0ad31d4601

SHA512
f7649c0556c83ca16a9b999e9e39f0088d46c38aa8c57249241fbf27fa3a4c87be66829c8c13301a4eefb3a0408e160d15c2f5eb994028bafb20fabda94ca3d4

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
b7bb948b1e2c1888b6e66a5991df27d3

SHA1
ac3145dc45dbfc1baa1ab4e656b8e93583f6bae1

SHA256
908b235d5ed0a1f62345c4e6f1bb8002982043239ee3a900f72ad8645a469e3a

SHA512
d39dd9f591553086bf7a1d42db36fff785509ae3331e435e258d52e972d642f9045d835e8589c68998c21fa33f6984482f88436e61baab120675167b475f2470

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
2b8ee735da5a86c4e31e583901ce803e

SHA1
53e7c7443d79960ec3b2cc4604cb3fecc70d2bf2

SHA256
7b095ec784fa66786181ad2099d31a04319960ad3298e506e5bbd23174dbc7cc

SHA512
de73830e0c445c27a3812f304b8702e1631ea707cbf3d34a69c5957b8c54b2a1e9532b4ee2d5d0b804cf48be8c7687c949f4c6dc53b3acfa0571f4097537b33b

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
95258c950d819f49582e927933fb83a9

SHA1
b89e35ee69356f61fa419b543b5d9df196299b2e

SHA256
b79657120a8d2e5221d14706716d543b5bd923539770e1ea283e961de8bb436e

SHA512
a7e3f63ad7196b758ec04454f651cc68049b005ddffd1dc4345f080884629513c8d5f328fc529c7693379db80e59a66d61f01103f8cb9df74a92b7549730506a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
da473b74e6d321aeef654308d3b3bbaa

SHA1
5c70223c6419462d969a102d6700ec1151447dca

SHA256
7274c0f1f131aacbe492204766a12948ddb7da6b5f486fb750197e0f9b80bc68

SHA512
9d43b8003548249411ce665278a1ee4e39694cb88c20727e81752189d473b9eaeeff0b7b6365ece92e0271e68c54c4d197d8524e9586a5a1222e060ba07c5de8

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
4900e325b40d981ea60e60f7c542f953

SHA1
9aaaffc2845503b7edb90234df309163f7e88739

SHA256
86cc4e0e86d1f9ceeccb68b5885ee06c9449fa8d08d375d0120408ab0fe8ba19

SHA512
c6d8c8ad7a93aef2d17cd8278c0277e6a25a0dd149693f7cc4444902b1e778a12d96418d426911dea1589aa3a304280dce1a5a1a126e16831e207689becf9c37

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
c8958c205bd3a25ba6dad0e498d4c033

SHA1
5ad885d84f9e981f998b01fe7c5bbdaa63ccb446

SHA256
1bd0eccee797b120347733ca63b08e80886ca20f5ea7ecf113db3f18199c2e7f

SHA512
7b63e907b05254e58537acfae254219550daf5ad68ee50474ccd9d76e50f9ccab783444fa4d22d16b36508c4bf13dcf22b84524249c0fedab2d2597ce9836dfa

Download Submit
/Library/Preferences/com.apple.networkextension.uuidcache.plist

Filesize
355B

MD5
a6ef4856e99c9d8e1d9bb762c5a8503a

SHA1
25d5405ad91791b716ae5a56b37aa2b393854967

SHA256
232441aa129d4f21999860b8bf31db4b8617df9f7d32ef5f25a383edff82d9fa

SHA512
582fa1ea60766a5a4e99b295a8ed98c94f6bab45e42b7e8db61e9ad645f531891082cd457bfd11d660195af86f02c4ed93589e6e6daded683cff2d8319bbc489

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2b4996618ee1b99af9feb150f6210a5e

SHA1
2edfd05e9600febf4b83b9275468b5886f16b094

SHA256
db5586ad59f450e0f6c07137851f7d153270dd60b5386da6532f546ccc5aeee5

SHA512
d03d78cbef9280e5a4bba8b4a4aa4394dfeed14e7e68c4cd098a05d0018131b85252c7ef212712626b418e9fd05a2fe6b8ed6c9d0286b87a686d07670802727a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
45bb52e2a5f9a28bc9aef40fa29fde8e

SHA1
b7cf8040628e9d696c81a3f7aa6abfa3fb3909bf

SHA256
f2368f7b8c31b2b3ccef6a9b1295b8b385be33b9fe2c95ae558abf425728ec88

SHA512
13f6ac53eb984db220c286d99532bd1a364459b9615844686a58aa5a5faaa3371e1da2b772aa8d21b018ff174bbc49adad2bfdc70ccf4fdf9766db4c4a741ea0

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b5e9df6591d15c99983395c5dd9072e3

SHA1
d825b8fcb68e36f7e8c4ab7f6a08914c960a67c9

SHA256
1f51f29c9bf305c959a3a269f9599522ddd178998c61a20315edbaeaca74a532

SHA512
d860614c385283c27c3ff7575d660bd83f926df619ebeef6732a04d0bf030fd3eb78c4306a0287ea0e659f9197c4f855b8b489b4ddb8199d95266513190ba7ac

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
7127c6d1a8aab118eeb83609c80a9c09

SHA1
2a2fb38c2d7d1ec89aee6358deebcf9e5db22374

SHA256
d4ec73bb28c364ea1a1a382bda05f1dbb5d8fd6c63efdf877b29e9b1fac65e54

SHA512
5386185c02dca0f990148f0975d8ae2f6a1ff1cd4e8d9a8e127c7a6847d6ca4727d9a64f8a15e388d4c7065081c3ce05b7e3824f6b6d73f66611a7d0b51305ff

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e9c5783ff96cfdfa364d395e4f5f4bdf

SHA1
a20d56237379d31673d436cf512128ee1f3ea589

SHA256
b2f9fdc51a2f4c14d682bd6a0068b36abe85d2427b799f3c3b2701eca10aeebf

SHA512
be83c79d92dabb7d54a9d0713060818ad670f70bbabe7c4a335a3ce49be4c5d1da73484f3e956a3a103ccd351aa4cf760817727712386ce6aef888c068ee549e

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fdbb856f8002b375aa72a14702d116ca

SHA1
8ebdfa15d4cbcb3df4c9b5b970e040074dcb58b2

SHA256
6325f24f0bacb28b11e3c04de78b103a3283a19c60d1a6670a27cc1e3c4cd64b

SHA512
ebf3f768fa5bd70047b2cbe9921c75eaa28692d3f31002a1db6a9b6a8ba80a61c5e5ca47b60fffebfafbb5146561362f3b74b61cbe9d0a34d4fcacb4be8bba0e

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
d88334c592ea2ea1d2c9acf24a78cc6a

SHA1
cc6d7c7f534db9a72d7cf6e8e302583243a91966

SHA256
3513cc4def4b28c712f184ca4295f9b2df89eb7b1b1dafb8ea85072c075ad319

SHA512
bf33be2706227626bc8e2a24d2b593e21fd04ffc11b5ff9a704bc44d8ecd0cec9a703e62bfd5c98cbc7accf6b4f438bdd0a3b291ff050aeb606b90ab87981fb2

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
00a40a13fac67c385d2c9221a20d3f33

SHA1
18dd31ed7e4dbb57f7010105800e3013f8a28e10

SHA256
6786fdd6fdb2c450a89bd883c2abb2c9e6101dfdc20ae5fb548b7516b82a6d9b

SHA512
72b714d2639a1931462771d7f1bffb8e497abf334e335d13ee29637f4746e6d1e5d611aae6105701dd585e32b18962f0a78e7b1a3d018b273f2ea9bddf342c8a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
74638677b8842b4983c24bd689d1a2a3

SHA1
cfac525afddf15463c959074d42f4a7429bdd20c

SHA256
3eeb3cc8ebe3fe591737e55d731305a5526ff4e5c799317915fb67047d4665db

SHA512
0f643978075657c731acc06244c5ef5ff94b7ba235d31b55cc03b913a0780842fa8fce4a82c771cc4287b16f8a148aaf83ca434f2eef2049e9cebe1fd5274272

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
e9abd936baffb27f2b868d6ce1df60e6

SHA1
2047854bfe164c340056b1b1cce2624ec756500b

SHA256
ae6dbd4bb9d63a392fa81065e1d6089d64efa3f8821263364b0a8d9790245e45

SHA512
71204b06acf61a682b15c40b15fef5e88cbc81ba0f794dad1f43c239f4ab0e473d21bd6c212a62200e9bb0001aafe00683a00ea67942b6d59045b23d307d0cf8

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
95ec6f83e3eec3eabd1637a07808fe99

SHA1
4b1c01944ceb616d0d29feb31966f955fdb89acd

SHA256
131aafad60bea374564692a97a98a869beda36ab0fc7de47d741faf8a96244f0

SHA512
ad498fdfb89a0746a0bb689117dfb4e7899c568f1e60c4132a3b2938f5301be0f524499f4fd8556600bc8e2ae8aa6d27d6d4be282bd3b930add29c1db53ee4a0

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
5de5b7a407d0e94085bdc0056921c2df

SHA1
63f19bd6a8831b413cb18de76ee8f01cd79dc6ab

SHA256
e2854ff5c008a8a815087c8b7211434cd33fcc7c30a603b5c807199f1c8acbe1

SHA512
01236e8bc73bb311b8e01faf6e16c76a1192fd55d1277762ec9d5e2ab0d7fa0205104fb6ff61d621bb790bae11e3ca79ba2df0f87ed305aff2ff4a3efba87f85

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2acd02b426e9ca921ae7661bc5d07470

SHA1
5e12ed8d0e32115f91c672a0d2e193815320a2ec

SHA256
a0b60acac7cca6afbf36276b55916ec79f6ca0e01f23b7e7e4733195f8bff0a3

SHA512
26271575856e05786efc33ebdac2273494fdf21c078e22318e15f2abbe004a48180b8e3deea8e364ff56f0f58e271bdb234bbdbaad1d0692deb5b9b3f89ef34c

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
cac4f2c9ce49ffc0ed96732cece706e0

SHA1
5d6277f514fb6fa1d2003804d08f435567399e56

SHA256
b9c523c2a1c0d36ad71bd0fde4ee648d75bed27996d009bb03984f7557cab758

SHA512
0ff416ad85eb1c5458118e540fdf16fa1d0c62277ceaf93ff861f4c6739ba788734a32a2ef4f4597a1d2e8c68352daed2edfaf0ab7ba546d9dddb475dad5601f

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
183b90c451a2910b2ae6552c9b808ff3

SHA1
4b0d2b33b0d70516975556ae6b9cdaae40e683e9

SHA256
95ab3432fe40d70ded635f11dd73bf4bbf7cdf6df8f06f5237c00756ac204c0c

SHA512
6f5070a293f5c1c4e39bef30bf2790106a84f44b63f036959ebc1d7441a9d4ffc43bf26a3ed2a2c4ca8b36fd0af612a14bed3a0e92b25b177a0ef09805e63da0

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1261.xml

Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/root/Library/LaunchAgents/com.apple.afsvcpd.plist

Filesize
429B

MD5
b29145cf94cd1ef0d81552c333c3603a

SHA1
4095a7b7b982b8875a6256919b7d80c50b0a2799

SHA256
2cac13ffabc18f7010fffce9f31aaacc06e0c5ae898c3faa79d747567ce1e2fc

SHA512
fd0ccb56cb0c5084950ad4d04363ae9919a0bfa76c45554df8a7fe0eb0f8a7ed2525af3b4f64982eedac0f9aaec28b7985b4ce5ec80434fc3cf426cb96b1def0

Download Submit