evilquest | 625bca21a04e624b4e907e55a80b67ea735406ae3b9ccd90ec74178110ec9a4f

Analysis

max time kernel
150s
max time network
146s
platform
macos-10.15_amd64
resource
macos-20240214-en
resource tags

arch:amd64arch:i386image:macos-20240214-enkernel:19b77alocale:en-usos:macos-10.15-amd64system
submitted
06-04-2024 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-04-06_de0e67da6b4a3f8c4c47121aef3baf41_adload_evilquest
Size

190KB
MD5

de0e67da6b4a3f8c4c47121aef3baf41
SHA1

04a5eaa2e2da9f8ac472afb402d064e32dcfc16b
SHA256

625bca21a04e624b4e907e55a80b67ea735406ae3b9ccd90ec74178110ec9a4f
SHA512

bc3fe58e2b536075074a449034cc1f7a40366c1148c8e32dbf585b3c59a0f3788463670e3899802d8254339e0b45e755f586d36a763504e1a8676f87baa00efd
SSDEEP

3072:cx6SZwEgOQtbap1jZNFnYo6w68cqhS2iJvHLzxq920p2Dn5km:5SeOQdaZNxtk8cqhSxvHY9j2Dn5km

Score

10^/10

evilquest backdoor execution persistence

Malware Config

Signatures

EvilQuest
EvilQuest family.
backdoor evilquest

EvilQuest payload 14 IoCs

resource	yara_rule
behavioral1/files/0x000000030008b138-0.dat	family_evilquest
behavioral1/files/0x000000030008b138-11.dat	family_evilquest
behavioral1/files/0x000000030008b138-23.dat	family_evilquest
behavioral1/files/0x000000030008b138-31.dat	family_evilquest
behavioral1/files/0x000000030008b138-38.dat	family_evilquest
behavioral1/files/0x000000030008b138-45.dat	family_evilquest
behavioral1/files/0x000000030008b138-52.dat	family_evilquest
behavioral1/files/0x000000030008b138-59.dat	family_evilquest
behavioral1/files/0x000000030008b138-66.dat	family_evilquest
behavioral1/files/0x000000030008b138-73.dat	family_evilquest
behavioral1/files/0x000000030008b138-80.dat	family_evilquest
behavioral1/files/0x000000030008b138-87.dat	family_evilquest
behavioral1/files/0x000000030008b138-94.dat	family_evilquest
behavioral1/files/0x000000030008b138-101.dat	family_evilquest

Launch Agent 1 TTPs
Adversaries may create or modify launch agents to repeatedly execute malicious payloads as part of persistence.
persistence

Launch Agent
T1543.001
Launch Daemon 1 TTPs
Adversaries may create or modify Launch Daemons to execute malicious payloads as part of persistence. Launch Daemons are plist files used to interact with Launchd, the service management framework used by macOS.
persistence

Launch Daemon
T1543.004

AppleScript 1 TTPs 33 IoCs

AppleScript is a macOS scripting language designed to control applications and parts of the OS via inter-application messages called AppleEvents.

execution

AppleScript

T1059.002

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

Launchctl 1 TTPs 59 IoCs

Adversaries may abuse launchctl to execute commands or programs. Launchctl supports taking subcommands on the command-line, interactively, or even redirected from standard input.

execution

Launchctl

T1569.001

ioc	Process
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start afsvcpd	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"	Process not Found
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "launchctl start afsvcpd"	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""	Process not Found
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist	Process not Found
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"	Process not Found

/usr/libexec/xpcproxy
xpcproxy com.apple.pluginkit.pkd
1⤵
PID:568

/usr/libexec/pkd
/usr/libexec/pkd
1⤵
PID:568

/bin/sh
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-06_de0e67da6b4a3f8c4c47121aef3baf41_adload_evilquest\""
1⤵
PID:571

/bin/bash
sh -c "sudo /bin/zsh -c \"/Users/run/2024-04-06_de0e67da6b4a3f8c4c47121aef3baf41_adload_evilquest\""
1⤵
PID:571

/usr/bin/sudo
sudo /bin/zsh -c /Users/run/2024-04-06_de0e67da6b4a3f8c4c47121aef3baf41_adload_evilquest
1⤵
PID:571
- /bin/zsh
  /bin/zsh -c /Users/run/2024-04-06_de0e67da6b4a3f8c4c47121aef3baf41_adload_evilquest
  2⤵
  PID:572
- /Users/run/2024-04-06_de0e67da6b4a3f8c4c47121aef3baf41_adload_evilquest
  /Users/run/2024-04-06_de0e67da6b4a3f8c4c47121aef3baf41_adload_evilquest
  2⤵
  PID:572
- - /Users/run/.2024-04-06_de0e67da6b4a3f8c4c47121aef3baf41_adload_evilquest1
    /Users/run/.2024-04-06_de0e67da6b4a3f8c4c47121aef3baf41_adload_evilquest1
    3⤵
    PID:596

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:573

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:573

/usr/libexec/xpcproxy
xpcproxy com.apple.sysmond
1⤵
PID:577

/usr/libexec/sysmond
/usr/libexec/sysmond
1⤵
PID:577

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:580

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:580

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:580

/usr/libexec/xpcproxy
xpcproxy com.apple.security.authtrampoline
1⤵
PID:581

/System/Library/Frameworks/Security.framework/authtrampoline
/System/Library/Frameworks/Security.framework/authtrampoline
1⤵
PID:581

/bin/sh
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:582

/bin/bash
/bin/sh -c "launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:582

/bin/launchctl
launchctl load -w /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:582

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:583

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:583
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:591

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:584

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:584

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:584

/bin/sh
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:585

/bin/bash
/bin/sh -c "launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist"
1⤵
PID:585

/bin/launchctl
launchctl start /Library/LaunchDaemons/com.apple.afsvcpd.plist
1⤵
PID:585

/bin/sh
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:587

/bin/bash
sh -c "osascript -e \"do shell script \\\"sudo /Library/osxmobiledata/com.apple.afsvcpd\\\" with administrator privileges\""
1⤵
PID:587

/usr/bin/osascript
osascript -e "do shell script \"sudo /Library/osxmobiledata/com.apple.afsvcpd\" with administrator privileges"
1⤵
PID:587

/bin/sh
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:588

/bin/bash
/bin/sh -c "sudo /Library/osxmobiledata/com.apple.afsvcpd"
1⤵
PID:588

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd
1⤵
PID:588
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd
  2⤵
  PID:589

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:590

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:590

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:592

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:592

/usr/libexec/xpcproxy
xpcproxy com.apple.ReportCrash.Root
1⤵
PID:593

/bin/sh
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/bash
sh -c "launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:594

/bin/launchctl
launchctl load -w /Users/run/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:594

/bin/sh
sh -c "launchctl start afsvcpd"
1⤵
PID:595

/bin/bash
sh -c "launchctl start afsvcpd"
1⤵
PID:595

/bin/launchctl
launchctl start afsvcpd
1⤵
PID:595

/System/Library/CoreServices/ReportCrash
/System/Library/CoreServices/ReportCrash daemon
1⤵
PID:593

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:599

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:599

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:600

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:600

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:600

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:601

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:601

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:602

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:602

/usr/bin/pluginkit
/usr/bin/pluginkit -e ignore -i com.microsoft.OneDrive.FinderSync
1⤵
PID:622

/usr/sbin/spctl
/usr/sbin/spctl --assess --type execute /var/folders/pq/yy2b5ptn4cz739jgclj4m1wm0000gp/T/OneDriveUpdater2481EFE7/OneDrive.app
1⤵
PID:623

/usr/libexec/xpcproxy
xpcproxy com.apple.icloud.findmydeviced
1⤵
PID:625

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:626

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:626
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:628

/usr/libexec/findmydeviced
/usr/libexec/findmydeviced
1⤵
PID:625

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:632

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:632

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:633

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:633

/usr/libexec/xpcproxy
xpcproxy com.apple.geod
1⤵
PID:634

/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
/System/Library/PrivateFrameworks/GeoServices.framework/Versions/A/XPCServices/com.apple.geod.xpc/Contents/MacOS/com.apple.geod
1⤵
PID:634

/usr/libexec/xpcproxy
xpcproxy com.apple.secinitd
1⤵
PID:635

/usr/libexec/secinitd
/usr/libexec/secinitd
1⤵
PID:635

/usr/libexec/xpcproxy
xpcproxy com.apple.cfprefsd.xpc.agent
1⤵
PID:636

/usr/sbin/cfprefsd
/usr/sbin/cfprefsd agent
1⤵
PID:636

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:638

/usr/libexec/xpcproxy
xpcproxy com.apple.AddressBook.ContactsAccountsService
1⤵
PID:641

/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
/System/Library/Frameworks/AddressBook.framework/Executables/ContactsAccountsService
1⤵
PID:641

/usr/libexec/xpcproxy
xpcproxy com.apple.suggestd
1⤵
PID:643

/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
/System/Library/PrivateFrameworks/CoreSuggestions.framework/Versions/A/Support/suggestd
1⤵
PID:643

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:645

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:645
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:646

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:647

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:647

/usr/libexec/xpcproxy
xpcproxy com.apple.knowledge-agent
1⤵
PID:649

/usr/libexec/knowledge-agent
/usr/libexec/knowledge-agent
1⤵
PID:649

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:651

/usr/libexec/xpcproxy
xpcproxy com.apple.routined
1⤵
PID:652

/usr/libexec/routined
/usr/libexec/routined LAUNCHED_BY_LAUNCHD
1⤵
PID:652

/usr/libexec/xpcproxy
xpcproxy com.apple.Maps.mapspushd
1⤵
PID:654

/System/Library/CoreServices/mapspushd
/System/Library/CoreServices/mapspushd
1⤵
PID:654

/usr/libexec/xpcproxy
xpcproxy com.apple.siri.context.service
1⤵
PID:659

/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
/System/Library/PrivateFrameworks/ContextKit.framework/Versions/A/XPCServices/ContextService.xpc/Contents/MacOS/ContextService
1⤵
PID:659

/usr/libexec/xpcproxy
xpcproxy com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
1⤵
PID:660

/usr/libexec/neagent
/usr/libexec/neagent
1⤵
PID:660

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:663

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:663
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:664

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:667

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:667

/usr/libexec/xpcproxy
xpcproxy com.apple.tailspind
1⤵
PID:672

/usr/libexec/tailspind
/usr/libexec/tailspind
1⤵
PID:672

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:674

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:674
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:675

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:676

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:676

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:677

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:678

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:678
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:679

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:682

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:682

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:682

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:683

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:683

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:683

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:684

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:684

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:684

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:685

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:685

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:685

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:686

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:686

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:686

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:689

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:689
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:690

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:691

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:691

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:691

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:692

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:692

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:692

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:693

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:693

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:693

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:694

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:694

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:694

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:695

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:695

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:695

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:696

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:696
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:697

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:698

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:698

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:698

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:699

/usr/libexec/xpcproxy
xpcproxy com.apple.corespotlightservice.725FD30A-6064-6C02-CC51-5DDB8891B57E
1⤵
PID:700

/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
/System/Library/Frameworks/CoreSpotlight.framework/CoreSpotlightService
1⤵
PID:700

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:703

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:703
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:704

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:705

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:705

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:705

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:706

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:706

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:706

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:707

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:707

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:707

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:708

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:708

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:708

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:709

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:709

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:709

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:710

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:710
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:711

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:712

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:712

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:712

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:713

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:713

/usr/bin/osascript
osascript -e "do shell script \"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:713

/bin/sh
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:714

/bin/bash
/bin/sh -c "launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:714

/bin/launchctl
launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:714

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:715

/bin/bash
sh -c "osascript -e \"do shell script \\\"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:715

/usr/bin/osascript
osascript -e "do shell script \"launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\" with administrator privileges"
1⤵
PID:715

/bin/sh
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:716

/bin/bash
/bin/sh -c "launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist"
1⤵
PID:716

/bin/launchctl
launchctl start /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist
1⤵
PID:716

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:717

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:717
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:718

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:719

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:719

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:719

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:720

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:721

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:721
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:722

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:723

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:723

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:723

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:724

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:725

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:725
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:726

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:727

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:727

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:727

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:728

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:728
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:729

/bin/sh
sh -c "sysctl -n hw.ncpu"
1⤵
PID:730

/bin/bash
sh -c "sysctl -n hw.ncpu"
1⤵
PID:730

/usr/sbin/sysctl
sysctl -n hw.ncpu
1⤵
PID:730

/bin/sh
sh -c "osascript -e \"do shell script \\\"launchctl load -w /var/root/Library/LaunchAgents/com.apple.afsvcpd.plist\\\" with administrator privileges\""
1⤵
PID:731

/usr/libexec/xpcproxy
xpcproxy afsvcpd
1⤵
PID:739

/usr/bin/sudo
sudo /Library/osxmobiledata/com.apple.afsvcpd --silent
1⤵
PID:739
- /Library/osxmobiledata/com.apple.afsvcpd
  /Library/osxmobiledata/com.apple.afsvcpd --silent
  2⤵
  PID:740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

AppleScript

T1059.002

System Services

T1569

Launchctl

T1569.001

Persistence

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Privilege Escalation

Create or Modify System Process

T1543

Launch Agent

T1543.001

Launch Daemon

T1543.004

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
35f17f47d7cfb5ba87ad9f9953fce2df

SHA1
ca61b0959022cb09e8a3e85369ef824acc328a47

SHA256
85ef10fc5048a6d28590fb3d3df7f3ccf806b850e99961f16aac712ff6866b36

SHA512
c6d9eca9adaaad84975aa1285548cf3aacf1079dde968aa4a6092b48f57c4a491ffe3546f009fed51d96f5bcac9b7e8dde7310609ef913022029027ee396aa31

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
baa47aefe76b5089d011e37fb3b468f7

SHA1
5e2925b725b710f152cd1d3583883c827ec8784a

SHA256
58769d9e20c50c5a105b9fa0a8296cda61a3ac83e3a243cf06197981ed9a367e

SHA512
5397c77255a13aa8f07ee918185454f19997c90e18ee94b63885f2dbf47176c66d07ffd600a56a87f2346f5a4311a12d8dcab20d929b41bae8c36e7c191f5329

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
a4c955ee6b55cef04ddecdddc721e7e3

SHA1
f09459b39b1559361464967e5f00dbcc3a9e44ce

SHA256
d38b0ea698edce4dd496f38a1dc14779dd85d306fc969175454a0181dd7c1c57

SHA512
8f97c52a4ad7a31a8d96a388b6afbe555d0455ffb458b516c0805a544adfbdb217274d63ea16e752163f120953f17582163d39d53842a2e6c3a0c1f7f4bc544b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
27e57e16e84569dc7b529725833e1167

SHA1
3839aa716c71b2f5df5bd8b43555408a35249eee

SHA256
6441f42213dace8fdcbd7698756542ea65179bfe81296d8fffad6ae2450bdf34

SHA512
3aadcfa23a301e4a66123709c5d793aab7fc306edf205ba7b29e108e5f4d6414ab5c8f715ccd3bdc42185e5a5e3bd8619c1dc2fcd756e622c6082e7584c07e31

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
2f7ec4acd5744b12867b8921344b8f3e

SHA1
7b9f51af34a2da4f3871959412589a636077a4b7

SHA256
982a7f8ba73f46cce7cf2c1c05ccbfeff55e2e6cee11582ed326a33602833a4a

SHA512
745a5bbcec79ac325e6ac9d4d5a424fe4cec10b836e47b4098f40c31e73380d27da59978ffcdf2cbfdc0390fa0e0ea99af0c6e61cc8263d0fda4b575de8959e9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
5e333dc85a6e0435e4a4e234928834d8

SHA1
e560fd76e79acf00db424174efab07c9db4798e2

SHA256
9cff6b244ac2b3247fd90c07a9c343c277d20a00afe3d2a0a2c905429440b94b

SHA512
790a6c96f13e5ab67b15f032ee5b557d8edb4cceba68521385d55bfea682730818b27d3cc7c3edc7493cf4dbe2cc21e66d3883063831247b037073b55200a326

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
2a2efc77089d8d7449039efbac177ffc

SHA1
b7b2778f02d64273ab82348b32ae99ef8bfb5070

SHA256
02880eb1223b0192060beb880aaa5a2fec676a6267158ba055ac904af0d4d632

SHA512
4e89a506a7349d551500bb1446c94e95364135978ba66f2bc413744ce9f44bed576b9e4c7272ddc7f1a8118a85b1499ee43586c72f348e2d535efc0e622826e9

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
cf01686a008a5d4c32a581f20379fa30

SHA1
42a90cd3e9c0b0228f0ea4c048aa151b40c2f528

SHA256
5861848b0d27f0653a4cd1f3112acad43cb7441108c60c0a4bbbb7d0a97d30b3

SHA512
71923301733d7254b9176a245ea24b8f71ca47fbdd1fae8ed753e12f10961f21111668ec855f76fbdeeedbd15f2cab261be0e53e082e912de95cd966f6d61739

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
fb22ffff87de29448e03091ab5fa3428

SHA1
41cc4d353df2fbc48a7d0fa2e240e344607068f7

SHA256
34e9d453f4ef42bb36b0743e05737c38801b2e3c3234970718e72fe3ea9b337c

SHA512
0b8b6b34897ce3a2b78f4ea42b38e0fed08613729a7df3e0f14e473c75a2c9b036084d859ff7977dee4889eb243c22aa640de6a9bd4e949abca609933fab36f2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
635a41a9fca7331ca56703a05513f8d8

SHA1
95ea043539cda6a32b5b21bc74a3c6118181dad9

SHA256
2dfcd817fda69247ea1b8d4180faf35a09294682ce47601ee829e597b05eaa11

SHA512
fb03a35a111d993dd596b24131892ae58b42782f8b58f4ac8578df5be0e403c1050bf7973354de015ebcfe4f733330fa04dc810d9f4312b329fbcba6d85dfc92

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
7be50f1ee74b8bdf65376ba86ef0833b

SHA1
9bbe69be245a1640d70113a9bdc38c116b89855e

SHA256
b77e5dafaab372ff75060a2a92ab49095edc1ac1bd62e4fe6300b30a41f72b74

SHA512
94ad9db303e5117d586c83686c59d0a0378d880b51a1c66a817bcf9f6ace7a30159a9610859b0a8fc50e14c52a37f546ac1ec42c57c8bc2dcd83f2ecb4f8915b

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
7e74578220641719c4b8ea8753d49023

SHA1
64ec7841d41fbb8b0c7a225f22acd046f7cddb76

SHA256
5548c80a944596915afb4bce35091ee92d54a2a6433f5afc132840204591ab2c

SHA512
2c75ddbea75bbcef3249bed4cbcf87d92228609c14f81a59c1e125c25cdbade047d9743637161e81e46eb9e86c62c81e7e7f971cd966279c7a739015f85f31d2

Download Submit
/Library/Application Support/CrashReporter/com.apple.afsvcpd_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
156B

MD5
75f4d6b14d216ad1fdf5b0690ccc4b7b

SHA1
617343e9fa849dcc41f07c9a103899fdac8d17b9

SHA256
05d693f334a9a5a23a0f139cfb651d737d61170d32b2506896cf50f62cee16cc

SHA512
02890ff70275f5ff49556fcc9f2461ca4e0eb7319a2c30c4a3ab137f35707e0bc2644a87acfe40b1f1e59fad189022f8406942ed5c9b34d0b64fa1ff7f7e1638

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
4dcb0f2cf8785e19c983f6eed0433fff

SHA1
e3636360889aa993298a45abfc8f137e9b3f1549

SHA256
77f9eb15a3d39ab7607182793cbc4bf291660ac4d7b79b52033082adb288d3e9

SHA512
c77be8ec3d6bbe4333f44bffb1ba400a15c1e5efcba656590a43c660526a853cc79c92b9b3f7f2b5f5cf66a0ab75482b13a5893f4fa78df7f10b813c76a4438a

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
41c076c88c21bd7c9db06d78fb456182

SHA1
a1ea2394ec6be90231b8bb71526ac74dae28c0a2

SHA256
063b3b27a5cfa70fae5fddb78873af54816a6f6cea7385da8e97b460b67b3ced

SHA512
2e04946fecd478089c230cdcb8d06f7164635923fcac3ef5c75a570921d6d4e4a3e8eafe0b7254847806f9bfc9fd007eea5394b4becf96fa579b15a4e572a3ad

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
e3affcf2080c07632e73a326f22bdea6

SHA1
1686ecabbc268c5e4f4c97a9e6f54ac658b4a33c

SHA256
0ab611c395e9de49bd6d108c80dc031383889bbd41785d513dcb8ec259d5860a

SHA512
531aac99518270dc3a91cb6a03152bfa7362b7affa72f8f67c44a5eee3688866efb81ab215c81a18c1699b2884d59251fe41d53364eae0416b84a9c096740373

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
4c1487c78a775300122ccdf0777476e9

SHA1
9a185a66a33bee56a195a50016be929ecdcf1c68

SHA256
aec1386c32808a9702195ae86f05d3f2dd7141573574440fb68dd33a31f71de4

SHA512
b393ef0de723c020f389899e6ee70a3d31eb552a66a937f4dae99aaf1b6a92ec2901c68c253ed912300605a8762cdff746833e5ef4da6eb5ac75d148e36a1621

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
98db0b657d0aded25992873a3dd6d346

SHA1
87b63ad95c7a16d3ccd40ddc479f980906193e61

SHA256
a96b4dd89f5461a500f65c010b615a6c0da29e7eeecdbd3199bf091a9d5fa3de

SHA512
e1ce4ade335cf534917b7a6bb70aed7763050a9167bf9b6490256825051f2b4845661a962a7ea6de2e14b220512334cca380638c6ddddaab90fd47b1a006c3d5

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
353d56265b024feb15921a31d3c6e5b0

SHA1
72d4cb425a3ea7ab919f25d8df1fb567e564151f

SHA256
ff9e7d611bc7624a39ff99809af83b5f720655d8b78b4f7d701bdc33558e42e7

SHA512
eed02deae05be6d3c09d9ffc0a3a20ceeea3f96564cf54dad5b4817aa26eca333d04a4d3621bd2272ac73f0aa8cdefc8d2cd108ea622cd514ca32d58a794dac7

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
fe7cd5aaad777b2767df5b01fae88c4c

SHA1
1bffd9eca76102f5afd3e2d9f31ccdee2ae00f82

SHA256
5e9096e6c32c18891c4a2e00039b0d235e7c6f2ca6cf7d9614322e374560d55c

SHA512
3f044a95790893fe35cad7b23e6e827e35778c56f88846a69698de836a8b51475fd98ad8c2b9471655fcfe3251383e36b8bd1b141306e979713c164dbb2e20fc

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
acba0fa3605df8f9cfdd6414e1fa1434

SHA1
a305e9e25217b18057b669e580ca4ae959778c6f

SHA256
33848b45385435b291b9ecf331544d8688c85f1ac6645ee8fc27c724ecd46f3a

SHA512
e1551fcbadcbc6dd0cf8ff0bff64fc47e2bb5b35659ff7da1cba402fe655fd6fa3a344393f2f927eb65d3f6e92a2296b450f582865818fa79d4aeb29c17a045d

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
0e8a7216d8db549eb0a0a2720b7f2d14

SHA1
3704c166bfdebdbeabc502c65881c015c13006c7

SHA256
146b711bec49d4e24df5e252cc054d8530aae832deebdc692fa2956e7f71552a

SHA512
c3b07dc06eebf14cf4c4c712c51e9e0b25cdf7c0b8f382327353e003fe857d13c720300e792ae83c639856c3face48e8e8448492a58829309738760ec8ed6672

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
9f040c7d4c9aac8762106b78b778bafd

SHA1
c443f8f8b7b91295521986ba90eeacfcfe0e2582

SHA256
4c5d80dbef62c50246c7d198060a46f3886c16544111d57c2503c867481b38cd

SHA512
f3f38b9749ebbf62189b3f5ec2d4c609ecf37b9e6628e3f7feb3da764ac4ab08c121c764c7d443374277d825dd0c5fcba5867dad6233b9e6572a4481d6ed9da5

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
26bed6bc714bc775a1da0d648a14838c

SHA1
8d1bc82b4b6d403a457e3ceee3a1f9a49f99148f

SHA256
8cc5bc1b3242db72aeae195b0b17cabbfda8a00124ba4d445d07f31b2233fa8e

SHA512
4e697ff5a01d1df904abfdc347d3ef523dca943f03111ffbfe56dcd72ecaa29cd8e46ead48873357aa14904811385c17d35004954112d9d2daf321939a480f95

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
5ab4634ba398f22f740750f5dfe87b16

SHA1
81b73ea18cc995adc2296d931d53c8d725a80861

SHA256
acc4222e8dde66b8f11cef11e6483411a33bf2d874b97fb1df532a0f5e806676

SHA512
500bea77a70caf4574fc8d918697f1933280f35cbecea47cead5f8606b76db6d10ef15f05f9fed5943af1c1cd24612ff3a522ecf60aa1aa82d3087c1ab708689

Download Submit
/Library/Application Support/CrashReporter/sudo_C589348B-0863-5695-96A0-3DAE1B1C0B90.plist

Filesize
143B

MD5
ba0bd4e86eeb08e0976f422c062d3f49

SHA1
898c480f50fe42ed6ed6df0d5c3f95534b952a6f

SHA256
76a71005c16f6d4961cbb86f13028422e8f14cf1f7d1843916bb6779d44970ec

SHA512
b954b7e7b4847cd071a6b2c689386b500113a1f64e8811f5ae577b1486ea7a748071e89795b2ffa3cd5a8be6657ca72bffb49ed78501f31cb30a91d505b9a3d8

Download Submit
/Library/Logs/DiagnosticReports/com.apple.afsvcpd_2024-04-06-042315_tests-iMac.crash

Filesize
40KB

MD5
0cde2510a69cb891db0ab3d967b04405

SHA1
4d94c692ab0e45beca883ea9edf2b018499c99d0

SHA256
bd9f81c5ff25b78629e1169cb812649c0637ad8b8f8fd408cc6c9e3950e4ba45

SHA512
b10a3483982c83dac534ca80a67128eaed093faa7edd8c94c8eb09e91f7b54adf0dc030f312c43b77a9b0157a1917dc919e04c200018bef18f0992c4eaf94cf8

Download Submit
/Library/Logs/DiagnosticReports/sudo_2024-04-06-042315_tests-iMac.crash

Filesize
47KB

MD5
7972ff20facf16637a983a61567bfebd

SHA1
c5c758884ba2a1d0ec6c18543ebaaa9436a86e9c

SHA256
53c1d263aa01910e466b12956cb1789ed99808b174287cb9a168dc786a13a3b7

SHA512
88b313a713a69d2b43ee8fcb17b14d9dcb7f7605ea023d8f42cc0540d3162435c5be3754d1155a848399342a63aab3060ac8dd843e0e094cccba379da620f447

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
b0268849111fa203b1e067c00ce5942c

SHA1
242249dad3aa6957f5f5435250e700315e8d07db

SHA256
106f55d52c17d6bafa8d125ffc68396027fce15cfc73c0f8523d13e5048b057e

SHA512
806a62190491fdc43323253428d7164ecfe0719750ac10a2d9c3c33b2a3d868359407bd7b9c6f670f8115b6fcdaaf642c4ef3e559e8a1f85eed6e280f9f48965

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
61a13140f079b1aff6712fac334f30df

SHA1
7df76e62c1535688b0d3e24417cd03ad5327bcd3

SHA256
02435ddee1e7e4de4060122c60fc7671bc6e81c64ae476faaee73be8942dec72

SHA512
41757ceefa405478b5c0fcd91edd59482963245fbcb49d4765ea5b1451846ba01fec94cf248ad85bdd5c516588703313ef811f81e93c227ead381ec8ff8d7bf7

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
1efebb7c0b616bfc2110b90108da3c60

SHA1
883af1b41b232c6a3479f3d4d68b217554f9b640

SHA256
1f86759e4650dfa0323cba19edba7cf7a130a6a394b0365d3f4b466505474403

SHA512
1d9224d5f3a69edda699c5f86926e667796b937b227a2ea26759cfca356cc8a8fec96510befaaa3aac7df6606abc64f966ef96a6077bdacfaf5ce5c18dd5d655

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
c2e5fd5a10e1265952f1166c460c7e19

SHA1
232c5bab29ae6e431e6d68b82ff66bea2f330a4e

SHA256
b19395c69feaa3f63bd9d5d5487bb43e89cd4c609638426eb2d0e59c05c452c5

SHA512
8b4c675d886f4e6c4e52bf77dfc881df227c26352a9c638e03a3bfda1f8885015721e86ceb3f4cd5528e4d7fef1c73c80e05d1b9ad8e87166cffc53e1ea9af37

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
fd59bce0edafe7cd45e7a2f0e7d769ef

SHA1
4f5f5fc6e4019f4d367e378cc9f225e720ec196b

SHA256
825b04f10fdbe00b02b761b382ede9f14b0f396662492c72dfb5babb40ffe1e5

SHA512
780dff16df160b9ba09fe51bf89bf9cb1612193e6eb8688cc89349ce26f98f495d6499386672e06ded7eecdc8a05b76e84e6ee0079cf91c5e603d07d53b18f44

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
65aae342517259e4672ecb31d569a2a6

SHA1
6a849e299b1ba6705f8ec89e3139e4736201346a

SHA256
f459536576d080d51fe5bba0015c07b3fc58e512ccfa77b5c6246c80a5b619f0

SHA512
a7929b2b8be27b92f033fd5899c444aa695e08d6fc8626a4922f719272ba0249a15716e6a2b13e931bad75bf7826fec8f43bbe3ef7ec83b3855769aa0cc57f98

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
41bd9b025789ed00bbdc0319f390a675

SHA1
bb14fe15216a73f6bd2545e9da116140e5e51325

SHA256
05c04c9d89e6d157b1f8e7651419fbd6ff72d986c17342f30601942530ca8030

SHA512
bfd220e3147641650cccae36cba9ee8222b10ccc96a05837f3e3912910e3d0a6002209cbd16d4b1e74178c96310df574172623a616424482da3bf97979622378

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
3b5ede23dd38bb3b81b3af25c030bfad

SHA1
058667b8a717f0fbb9f00d018169e6e1c6edbae8

SHA256
d9539221b74e14c69c8317ea74ea544a6dc5fddbdfeeca17d98711d74a093c00

SHA512
697e93e0172f54ce0362903be8ba13a7c6d2ba7099a558b5fa6f503b02866d3973e6fecf46aeb2a81c8aa9913998cc557174ae4f033ef4687d28e9749f03fc9a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
698a7347aed593bc4540c2c3cc5a6594

SHA1
4098e6f11f8d86ea0a609dac15f854f3071c5e11

SHA256
b7077968314c17c26b4003fa3dea7d85134248ceb799e7c0feae5417f3b17d9c

SHA512
cfeac7de1a40e731cd2e1e8279e2dbd0704dca1c6705e11f4a0680e5403f18e50dc9a78ca1739d901c0675a249138f8c7bd3e7144226bf58425bca4ed2399f68

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
10679cf67915b37f109d345465c8fda1

SHA1
73c212c4bbbaa6a7838ddb6b690d7f27933bc8b9

SHA256
834e98506887d5a82393351657fba4b985feb19e7ee209099069fdd7756b93d2

SHA512
fa2590d80eabd641c109a52905eaef8fbb1e32b0f4419d702f81b9fd30a2738c03802f8f25f0a8c75b97f1ade44f8a1987672656c5e97ac6e910b9227594619a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
98b343f0babc969a9fa80198f4c85972

SHA1
12d7604ec283449750871f380ffaaa92dd61f512

SHA256
ff0c1899d1988a25eaa14c5a6189823cf066748929d45df3691b5b21a474f5f4

SHA512
68ca109808fcd5a50693d762be982a66cd8716a9253f434410e3da429a2420cbc6481c5db7a02abed55c282396b3a0a4baa711364eff6bb8ea7f5a1d3befef82

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
8c64150f8692f53013657d184b9624cf

SHA1
2344f48a7255d3f86e0b1e47d32f5575816b45a2

SHA256
4e8af12dd7bc370b38bf1e3935e5f6696615a388278d8b2afd8c178dbe8f660d

SHA512
1fb071251a0ac28c981634db997c2dff6201201c15b23a74e6200912adef98ea9fe4b63235e12c57a4520f5312a7c5a61f4cbd0dd8bd59d03b4e5759ad0eae6a

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
a46015b3a7a22d59fee0f82348cdd8ef

SHA1
b90f664011f56fee863363e5a10a4e0a05bc831b

SHA256
892b59f79d1254b1171766640d75064eec6018eed05a5ffef3eb2c679bb089f3

SHA512
c525162bf5c7feedba1fecd951c478e37329f19132368e3b1ee2d3d9eacaad04b4d78acbf735961553c8b3dae3dc032b026678d292b4146065c1ffe9f367eb32

Download Submit
/Library/osxmobiledata/com.apple.afsvcpd

Filesize
168KB

MD5
2a3ac4b5d4fea59b152bbd9664f92011

SHA1
b9ddc05591d15bb0c229b32a8a09f7578beb3c85

SHA256
e1d33c5314a15e32d4ffba812b810ed063e057a4a17b3c915432a2099afc4b58

SHA512
d5ff817a2b226cee3572471ab7997d0ecd175fc8a2700b4e5e204d2fe389766c09a51a543f2d2dd3e0dd9d59e2024e2d7024ba0b452f8e980079162d60432dae

Download Submit
/Users/run/Library/Caches/GeoServices/ActiveTileGroup.pbd

Filesize
124KB

MD5
6df56e0a501d3458a36a05a1ce44d271

SHA1
63264826f4702f7f1bf02f731f26cd51d7554cc8

SHA256
71a0f0ad8de6579113ca7f93a7ac6720bdc7037b50a8b69e47c53a6ad300b87c

SHA512
50f3ee561ca6c7bfc217c496a1a4c5b16af5010da0bee8b52d68e93cfd163c6dff1ce42ccccd39d2640cd5377676635d524d49976df36557e29709e87c5c8bc6

Download Submit
/Users/run/Library/Caches/GeoServices/Resources/altitude-1261.xml

Filesize
162KB

MD5
461dcb8e6914ac8c3efadaa2ab3bfe82

SHA1
bfb82d565114a505c0dc45a7b88c64fe24c2a96f

SHA256
267aae1978c73f986ab32623d3edd0415e24888226d266bb42943765fbf12904

SHA512
b6e500d7c269c1fa7fe796ded05d3489d2c773f1e02ddc87b99a777cb89f5837b527bfcf4a1ec01a155ed8c07bc4fe9b8ff8c7d3672bc9ee89be09c71bac13d2

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsDirectory.db

Filesize
47KB

MD5
0e4a0d1ceb2af6f0f8d0167ce77be2d3

SHA1
414ba4c1dc5fc8bf53d550e296fd6f5ad669918c

SHA256
cca093bcfc65e25dd77c849866e110df72526dffbe29d76e11e29c7d888a4030

SHA512
1dc5282d27c49a4b6f921ba5dfc88b8c1d32289df00dd866f9ac6669a5a8d99afeda614bffc7cf61a44375ae73e09cd52606b443b63636977c9cd2ef4fa68a20

Download Submit
/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C//mds/mdsObject.db

Filesize
4KB

MD5
d3a1859e6ec593505cc882e6def48fc8

SHA1
f8e6728e3e9de477a75706faa95cead9ce13cb32

SHA256
3ebafa97782204a4a1d75cfec22e15fcdeab45b65bab3b3e65508707e034a16c

SHA512
ea2a749b105759ea33408186b417359deffb4a3a5ed0533cb26b459c16bb3524d67ede5c9cf0d5098921c0c0a9313fb9c2672f1e5ba48810eda548fa3209e818

Download Submit